> For the complete documentation index, see [llms.txt](https://kero0x1.gitbook.io/general/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kero0x1.gitbook.io/general/mobile-pentest/mobile-hacking-lab/post-board.md).
# Post Board
Hello everyone , In this blog post , I will try to explain my solution steps for Post Board challenge from Mobile Hacking Lab Platform . i hope it will be useful for you
1. After we install The APK then we open it its a message application with an input field
2. Let’s **Examine** **the AndroidManifest.xml** we found that activity `com.mobilehackinglab.postboard.MainActivity` , it’s an exported activity
1. have a data schema with scheme= `postboard` and android:host= `postmessage` with a category `BROWSABLE`
3. let’s analysis this main activity code :
1. First thing we find is `setupView()` that have :
1. `setJavaScriptEnabled(**true**)`
2. path that load the url `file:///android_asset/index.html`
2. the second thing is `handleIntent()`
1. Verifies if the intent’s URI scheme is `postboard` and the host is `postmessage`.
2. Decodes a Base64-encoded path in the URI, escapes certain characters, and passes it to JavaScript via `WebAppInterface.postMarkdownMessage` to display it on the home page.
4. Let’s try to test our input :
1. First payload is `
kero
` ⇒ already success
2. the second payload is `` ⇒ success
5. when we analysis the `WebAppInterface` class we found this Func `postCowsayMessage()`
1. it execute the `cowsay` script located at `CowsayUtil.scriptPath`
2. passing the message arg as `{"bin/sh", "-c", CowsayUtil.scriptPath + ' ' + message}`
1. it use a shell , then call the message + script path
2. may be we can call the `postCowsayMessage` and then pass `whoami` as a `cowsayMessage`
3. then it will be passed to `runCowsay` and then exec it by :
1. my payload is `` let’s encode it and put it with adb
`adb shell am start -n "com.mobilehackinglab.postboard/.MainActivity" -a "android.intent.action.VIEW" -d "postboard://postmessage/`
`PGltZyBzcmM9eCBvbmVycm9yPVdlYkFwcEludGVyZmFjZS5wb3N0Q293c2F5TWVzc2FnZSgiS2VybzB4MV9pc19oZXJlO2lkIik+"`
6. and here we success and already get rce 😉
2. Let’s **Examine** **the AndroidManifest.xml** we found that activity `com.mobilehackinglab.postboard.MainActivity` , it’s an exported activity
1. have a data schema with scheme= `postboard` and android:host= `postmessage` with a category `BROWSABLE`
