WithSecureLabs/drozer

`app.service.send` does not include intent extras when binding a service

Yogehi opened this issue · 1 comments

example: run app.service.send <package> <component> --extra string yay yaystringyay --msg 1 2 3 --extra integer yay 1234

when hooking into <component>.onBind(Intent), the Intent object does not have any extras

this was not the case on drozer2. everything worked find on drozer2

it looks like app.service.send:

  • creates a android.os.Message object and uses Message.setData(Bundle) to set the extras
  • the Message object eventually gets sent to /src/drozer/modules/common/ServiceBinder.java`
  • confirmed that Message.getData() does contain the bundled extras

still trying to troubleshoot what exactly happens after that

for now, i can get everything working again by forcebly putting extras:

public class ServiceBinder {
...
    public boolean execute(Context context, String package_name, String class_name, Message message, int timeout) {
        HandlerThread thread = new HandlerThread("drozerHandler", Process.THREAD_PRIORITY_BACKGROUND);
        thread.start();
        Looper serviceLooper = thread.getLooper();

        serviceConnection = new HgServiceConnection(serviceLooper, this);

        ComponentName c = new ComponentName(package_name, class_name);

        in = message;
        
        if(c == null)
            return false;

        // yaydebugyay
        Intent i = new Intent();
        i.setComponent(c);

        for(String key : message.getData().keySet()){
    		Log.i("drozerServiceBinder", "Key: " + key + " : " + message.getData().get(key));

                // yaydebugyay
                // this doesn't actually work, but its similar to what i have working and this is just to take notes anyway
                // this won't compile because `message.getData().get(key)` is an object and needs to be casted to whatever type `message.getData().get(key)` is
                // the point is that shit isn't attaching to intents
                i.putExtra(key, message.getData().get(key));
    	}
...
  1. looking through my notes from last year....apparently this wasn't working last year either lol

  2. added code that always adds intent extras to the intent used for bind()

legit don't know if this breaks binded services in the future? we'll see lol

#455