50m-ctf: CTF Writeup - c8889970d9fb722066f31e804e351993

CTF Code: c8889970d9fb722066f31e804e351993 HackerOne $50M CTF Write-Up ============ I came across this tweet announcing the HackerOne CTF for invitations to the HackerOne event in Vegas during DEFCON. I tried searching for a URL for the CTF, but couldn't find anything online, so I assumed that th...

The vulnerability of the user interface in Google Chrome’s WebAPK browser allows a hacker to gain unauthorized access to information.

The vulnerability in the user interface of Google Chrome’s WebAPKs relates to insufficient protection of permissions. Exploiting this vulnerability allows a remote attacker to gain unauthorized access to information through a specially created APK...

50m-ctf: CTF write-up: c8889970d9fb722066f31e804e351993

So the CTF starts with this tweet. F434370 The first image is about the 50 million in bounties but the second one looks related to the CTF. The first thing that comes to mind when relating CTFs and images is "steganography". Using the all purpose steg tool zsteg as our first resort, we discover...

CVE-2019-5767

Insufficient protection of permission UI in WebAPKs in Google Chrome on Android prior to 72.0.3626.81 allowed an attacker who convinced the user to install a malicious application to access privacy/security sensitive web APIs via a crafted APK...

CVE-2019-5767

Insufficient protection of permission UI in WebAPKs in Google Chrome on Android prior to 72.0.3626.81 allowed an attacker who convinced the user to install a malicious application to access privacy/security sensitive web APIs via a crafted APK...

Authorization

Insufficient protection of permission UI in WebAPKs in Google Chrome on Android prior to 72.0.3626.81 allowed an attacker who convinced the user to install a malicious application to access privacy/security sensitive web APIs via a crafted APK...

CVE-2019-5767

Insufficient protection of permission UI in WebAPKs in Google Chrome on Android prior to 72.0.3626.81 allowed an attacker who convinced the user to install a malicious application to access privacy/security sensitive web APIs via a crafted APK...

CVE-2019-5767

Insufficient protection of permission UI in WebAPKs in Google Chrome on Android prior to 72.0.3626.81 allowed an attacker who convinced the user to install a malicious application to access privacy/security sensitive web APIs via a crafted APK...

Keyfinder - A Tool For Finding And Analyzing Private (And Public) Key Files, Including Support For Android APK Files

CERT Keyfinder is a utility for finding and analyzing key files on a filesystem as well as contained within Android APK files. CERT Keyfinder development was sponsored by the United States Department of Homeland Security DHS. Installation requirements: 1. Python 3.x recommended androguard...

CVE-2018-1000849

Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools Alpine Linux' package manager that can result in Remote Code Execution. This attack appear to be exploitable via A specially crafted APK-file can cause apk to write arbitrary data ...

CVE-2018-1000849

Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools Alpine Linux' package manager that can result in Remote Code Execution. This attack appear to be exploitable via A specially crafted APK-file can cause apk to write arbitrary data ...

Remote code execution

Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools Alpine Linux' package manager that can result in Remote Code Execution. This attack appear to be exploitable via A specially crafted APK-file can cause apk to write arbitrary data ...

CVE-2018-1000849

Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools Alpine Linux' package manager that can result in Remote Code Execution. This attack appear to be exploitable via A specially crafted APK-file can cause apk to write arbitrary data ...

CVE-2018-1000849

CVE-2018-1000849 affects Alpine Linux, where the package manager apk-tools prior to versions 2.6.10, 2.7.6, and 2.10.1 contains a vulnerability that can lead to remote code execution. The root cause is described as bugs in handling long link target names and in the extraction of regular files, al...

CVE-2018-1000849

Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools Alpine Linux' package manager that can result in Remote Code Execution. This attack appear to be exploitable via A specially crafted APK-file can cause apk to write arbitrary data ...

PT-2018-9573

Name of the Vulnerable Software and Affected Versions Alpine Linux versions prior to 2.6.10 Alpine Linux versions prior to 2.7.6 Alpine Linux versions prior to 2.10.1 Description The issue is related to a bug in apk-tools, Alpine Linux' package manager, which can result in Remote Code Execution. ...

CVE-2018-1000849: Improper Input Validation

Alpine Linux version Versions prior to 2.6.10, 2.7.6, and 2.10.1 contains a Other/Unknown vulnerability in apk-tools Alpine Linux' package manager that can result in Remote Code Execution. This attack appear to be exploitable via A specially crafted APK-file can cause apk to write arbitrary data ...

CVE-2018-2482

SAP Mobile Secure Android Application, Mobile-secure.apk Android client, before version 6.60.19942.0, allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. Install the Mobile Secure Android client released in Mid-Oct 2018...

CVE-2018-2482

SAP Mobile Secure for Android (Mobile-secure.apk) prior to version 6.60.19942.0 is affected by a Denial of Service condition where an attacker can cause service disruption by crashing or flooding. The issue impacts the Android client component and is mitigated by updating to the released mid-Octo...

Code Execution Vulnerability in Poundland App for Android

The Poundland App is a software that focuses on providing online group buying of goods at low prices. A code execution vulnerability exists in the Android version of Pinduoduo APP. An attacker can exploit the vulnerability to induce users to install a modified APK and execute arbitrary code...