MobileHackingLab — Runtime Toad Writeup
Exploiting CVE-2025-59489 in Unity's runtime — local and remote RCE via -xrsdk-pre-init-library intent extras.
// tagged · 13 posts
#android
Unvalidated implicit intent result leaks private files to a world-readable cache
Unvalidated implicit intent data lets a malicious app return an internal file:// URI, which AnkiDroid copies into a world-readable cache directory.
MobileHackingLab — Document Viewer RCE
Chaining path traversal in getLastPathSegment() with unverified native library loading for RCE on MobileHackingLab's Document Viewer.
Nahamcon CTF 2024 — Mobile Writeups
Speedrun of the mobile track at Nahamcon CTF 2024: logcat, strings, Godot script extraction, Flutter instrumentation, and Frida hooking.
OS command injection through an unsanitized path extra in DatabaseViewerActivity
OS command injection via an unsanitized path string extra in DatabaseViewerActivity.java allows arbitrary command execution when root explorer mode is enabled.
TCP1P CTF 2023 — Mobile Writeups
Mobile challenge solutions from TCP1P CTF: exported activity exploitation, implicit intent hijacking, and a WebView/JS interface/content provider chain.
File theft via missing intent validation and over-broad FileProvider paths
Theft of arbitrary files via lack of intent validation and insecure provider paths in TTFViewerActivity.kt.
Attacker-controlled bash scripts execute through the exported BashAssociation activity
Theft of arbitrary files via execution of attacker-controlled bash scripts through the exported BashAssociation activity.
Intent validation gap in TextViewerActivity opens arbitrary private files
Improper validation of intent data in TextViewerActivity allows a malicious app to open arbitrary files from Inure's private storage.
setResult misuse in a third-party welcome screen leaks a non-exported FileProvider
Theft of arbitrary files from a non-exported FileProvider via improper setResult() in a third-party welcome screen library.