POC详情： 31778a4e7bf3980e6e6dc68534dcd7618d8d47b1

来源
https://github.com/MrW0l05zyn/cve-2024-0044
关联漏洞
标题： Google Android 安全漏洞 (CVE-2024-0044)
描述：Google Android是美国谷歌（Google）公司的一套以Linux为基础的开源操作系统。 Google Android 存在安全漏洞，该漏洞源于 PackageInstallerService.java 文件的 createSessionInternal 方法存在输入验证不当，可能会以任何应用程序的方式运行。
描述
CVE-2024-0044
介绍
![python-static-badge](https://img.shields.io/badge/Python-blue?logo=python&logoColor=white)
![android-static-badge](https://img.shields.io/badge/Android-blue?logo=android&logoColor=white)

# CVE-2024-0044

- [CVE-2024-0044](https://nvd.nist.gov/vuln/detail/CVE-2024-0044) allows a "run-as" attack to be performed, resulting in a local escalation of privileges. This enables an attacker to access private files stored locally by any application on the mobile device, compromising the security guarantees provided by the "Application Sandbox".
- Requires ADB shell access and developer mode enabled on the mobile device.
- Affects Android versions 12, 12L, 13, and 14*.
- Discovered and disclosed by [Meta Red Team X](https://rtx.meta.security/exploitation/2024/03/04/Android-run-as-forgery.html) in March 2024.
- Security patch released by Google in the [Android security bulletin of March 2024](https://source.android.com/docs/security/bulletin/2024-03-01).

# Usage

```
python cve_2024_0044.py -p target.package.name -a any-app.apk
```
![cve-2024-0044](cve-2024-0044.gif)

> [!TIP]
> For the `any-app.apk` file, any mobile application can be used, such as [F-Droid](https://f-droid.org/), for example.
文件快照

 [4.0K]  /data/pocs/31778a4e7bf3980e6e6dc68534dcd7618d8d47b1
├── [380K]  cve-2024-0044.gif
├── [6.7K]  cve_2024_0044.py
└── [1.2K]  README.md

0 directories, 3 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。