From 064400a722052431235da717b02a182cda5dc7b0 Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Thu, 6 Aug 2026 14:12:30 +0000 Subject: [PATCH] Add content from: Zero-Click File Drop on Xiaomi ShareMe (MiDrop) --- .../android-app-pentesting/README.md | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/src/mobile-pentesting/android-app-pentesting/README.md b/src/mobile-pentesting/android-app-pentesting/README.md index cc0babc94b9..f7b01b867d9 100644 --- a/src/mobile-pentesting/android-app-pentesting/README.md +++ b/src/mobile-pentesting/android-app-pentesting/README.md @@ -36,6 +36,30 @@ Sometimes it is interesting to **modify the application code** to access **hidde - [Android POS payment sockets / ISO 8583 backend abuse](../../network-services-pentesting/pentesting-iso-8583-payment-sockets.md)[[16]](#references) - **Download APKs**: [https://apps.evozi.com/apk-downloader/](https://apps.evozi.com/apk-downloader/), [https://apkpure.com/es/](https://apkpure.com/es/), [https://www.apkmirror.com/](https://www.apkmirror.com), [https://apkcombo.com/es-es/apk-downloader/](https://apkcombo.com/es-es/apk-downloader/), [https://github.com/kiber-io/apkd](https://github.com/kiber-io/apkd) +## Insecure proximity / file-transfer protocols + +Some Android sharing apps stack **BLE discovery/GATT**, **WiFi Direct**, a **control socket**, and a **pull-based HTTP download path**. Audit them as a single trust boundary: if the receiver leaks connection material over BLE or trusts sender-supplied control fields, a normal “Receive” workflow can become a **zero-click arbitrary file delivery** primitive.[[17]](#references)[[18]](#references) + +### What to test + +- **BLE/GATT secret disclosure**: enumerate both custom services and standard characteristics such as **Generic Access / Device Name (`0x2a00`)**. Do not assume these only contain cosmetic names; check for leaked **SSIDs, PSKs, IPs, ports, tokens, or QR-derived metadata**. If the app moved to **BLE extended advertising**, desktop scanners may miss it while Android radios still recover the same bytes.[[17]](#references)[[18]](#references) +- **Optional cryptography / fake key exchange**: treat ECDH/RSA/DES/AES steps as untrusted until proven enforced. Send malformed or dummy key material, then continue with plaintext. If the receiver still returns an ack and accepts later commands, the real security boundary is only **network access**.[[17]](#references)[[18]](#references) +- **Remote consent-policy injection**: grep protocol schemas and deserializers for sender-controlled flags such as `silence`, `silent`, `trusted`, `autoAccept`, `skipPrompt`, `hidden`, or `installer`. Trace every branch that consumes them. If those fields suppress dialogs, UI counters, notifications, or transfer-list entries, the sender can convert a visible transfer into a **silent receive** path.[[18]](#references) +- **Pull-based arbitrary file delivery**: many proximity protocols do not push bytes over the control socket. Instead, the sender supplies **name, size, checksum, and an HTTP URI**, and the receiver connects back to fetch the payload. Exploitation becomes “control-message forgery + matching HTTP response,” so protocol responses like `Accept` / `DownloadFinished` are reliable success indicators even when the victim UI stays empty.[[17]](#references)[[18]](#references) +- **Hidden staging-directory abuse**: once you gain a file-drop primitive, identify where the app stores silent imports and which later workflows consume that directory. Hidden locations with **`.nomedia`** are valuable staging points. In ShareMe/MiDrop, silent transfers landed in `/sdcard/MIUI/ShareMe/.upgrade_package/`, which is later reused by the app’s self-update logic.[[17]](#references)[[18]](#references) +- **Weak APK verification in custom updates**: if the same directory feeds an updater, check whether the app validates only `packageName` / `versionCode` or calls `getPackageArchiveInfo(path, 0)` without requesting signing data. That enables **official-looking update prompts**, forced version changes, or downgrade-to-vulnerable-build attacks whenever platform signature checks are weak, bypassed, or satisfied by a correctly signed older build.[[18]](#references) +- **WebView / FileProvider follow-on pivots**: after file delivery, review `@JavascriptInterface` methods that forward attacker-controlled URLs into `Intent.parseUri(...)` or `startActivity(...)`, and inspect `file_paths.xml` for broad mappings such as `` or `/storage/`. Those patterns extend a file-transfer bug into **exported-intent abuse** or **provider-assisted file disclosure**.[[18]](#references) +- **Legacy fallback credentials**: grep for hardcoded WiFi Direct / hotspot passwords in old compatibility paths. Modern Android may override them, while Android 9/10 or OEM fallback code can still use the embedded default verbatim.[[18]](#references) + +### Fast triage + +Use the decompiled tree and a test device to quickly validate this class of bug:[[17]](#references)[[18]](#references) + +```bash +rg -n 'send_pk|send_files|silence|silent|autoAccept|skipPrompt|trusted|installer|getPackageArchiveInfo|addJavascriptInterface|parseUri|root-path|/data/|/storage/' . +adb shell dumpsys bluetooth_manager | grep name: +``` + ### Automated multi-source APK acquisition (justapk) `pip install justapk` (Python 3.11+). CLI outputs JSON to **stdout** and progress to **stderr** (pipe-friendly). It tries a deterministic fallback chain across **APK20 → F-Droid → APKPure (mobile API) → APKMirror (HTML scrape) → Uptodown (mobile API) → APKCombo (HTML scrape)**. Cloudflare-protected sources use **curl_cffi** with TLS fingerprint impersonation to mimic real clients and reduce bot-detection blocks.[[14]](#references) @@ -960,6 +984,8 @@ AndroL4b is an Android security virtual machine based on ubuntu-mate includes th - [14] [justapk — multi-source APK downloader with Cloudflare bypass](https://github.com/TheQmaks/justapk) - [15] [Jezail rooted Android pentesting toolkit (REST API + Flutter UI)](https://github.com/zahidaz/jezail) - [16] [ISO 8583 Under Fire: Finding Vulnerabilities in a Payment Socket](https://m4kr0.vercel.app/posts/iso-8583-under-fire-finding-vulnerabilities-in-a-payment-socket/) +- [17] [Byterialab mishare-zero-click-file-drop PoC repository](https://github.com/Byterialab/mishare-zero-click-file-drop) +- [18] [Zero-Click File Drop on Xiaomi ShareMe (MiDrop)](https://blog.byterialab.com/zero-click-file-drop-on-xiaomi-shareme-midrop/) {{#include ../../banners/hacktricks-training.md}}