关联漏洞
标题：
Android System(art) 权限许可和访问控制问题漏洞
(CVE-2017-13156)
描述：Android是美国谷歌（Google）公司和开放手持设备联盟（简称OHA）共同开发的一套以Linux为基础的开源操作系统。System（art）是使用在其中的一个ART模式运行环境。 Android中的System(art)存在提权漏洞。远程攻击者可利用该漏洞提升权限。以下版本受到影响：Android 5.1.1版本，6.0版本，6.0.1版本，7.0版本，7.1.1版本，7.1.2版本，8.0版本。
描述
A collection of tools for the Janus exploit [CVE-2017-13156].
介绍
# Janus Toolkit
<!--This is a collection of tools to help you inject custom code in APKs without
changing the APK Signature v1.
This method only works in Android Marshmallow (SDK 23) or below as the exploit
Janus \[CVE-2017-13156\] has been fixed by Google in Android Nougat (SDK 24).-->
This is a collection of tools for the Janus exploit \[CVE-2017-13156\],
affecting AOSP versions 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 as described
[here](https://source.android.com/security/bulletin/2017-12-01#system).
You can read more at the [writeup] from Guardsquare.
## Tools
### Janus [![python3]](#) [![go]](#)
### AndroidManifest extractor [![python3]](#)
#### Usage
1. Extract the `AndroidManifest.xml` from the target APK using [Apktool].
2. Run `manifest_dummy.py` to generate dummy classes to include in your
Android Studio project. (The necessary tags generated by this script are
only needed if you set `shrinkEnabled true` in your `build.gradle`)
### Extract DEX from already injected APK \[WIP\] [![python3]](#)
## TODO
* Complete the guide. Extra instructions in [this][janus_poc] repo.
## Donate
If this repository helped you in any way, feel free to donate [here][donate].
[go]: https://img.shields.io/badge/Language-Go-00acd7 "Go"
[java]: https://img.shields.io/badge/Language-Java-red "Java"
[python3]: https://img.shields.io/badge/Language-Python_3-blue "Python 3"
[donate]: https://paypal.me/hexile0
[apktool]: https://github.com/iBotPeaches/Apktool
[janus_poc]: https://github.com/V-E-O/PoC/tree/8c389899e6c4e16b2ddab9ba6d77c2696577366f/CVE-2017-13156
[writeup]: https://www.guardsquare.com/en/blog/new-android-vulnerability-allows-attackers-modify-apps-without-affecting-their-signatures
[v-e-o]: https://github.com/V-E-O/
文件快照
[4.0K] /data/pocs/80be205018c4e67e29332fa926b35823f4cdf436
├── [4.0K] golang
│ └── [3.4K] main.go
├── [ 11K] LICENSE
├── [4.0K] python3
│ ├── [1.3K] extract_dex.py
│ ├── [3.6K] janus.py
│ ├── [3.6K] manifest_dummy.py
│ └── [4.0K] templates
│ ├── [ 111] application
│ ├── [1.1K] provider
│ ├── [ 253] receiver
│ └── [ 272] service
└── [1.7K] README.md
3 directories, 10 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。