CVE-2017-13156 PoC — Android System(art) 权限许可和访问控制问题漏洞

Source

https://github.com/giacomoferretti/janus-toolkit

Associated Vulnerability

Title:Android System(art) 权限许可和访问控制问题漏洞 (CVE-2017-13156)
Description:Android是美国谷歌（Google）公司和开放手持设备联盟（简称OHA）共同开发的一套以Linux为基础的开源操作系统。System（art）是使用在其中的一个ART模式运行环境。 Android中的System(art)存在提权漏洞。远程攻击者可利用该漏洞提升权限。以下版本受到影响：Android 5.1.1版本，6.0版本，6.0.1版本，7.0版本，7.1.1版本，7.1.2版本，8.0版本。

Description

A collection of tools for the Janus exploit [CVE-2017-13156].

Readme

# Janus Toolkit

<!--This is a collection of tools to help you inject custom code in APKs without
changing the APK Signature v1.

This method only works in Android Marshmallow (SDK 23) or below as the exploit
Janus \[CVE-2017-13156\] has been fixed by Google in Android Nougat (SDK 24).-->

This is a collection of tools for the Janus exploit \[CVE-2017-13156\],
affecting AOSP versions 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 as described
[here](https://source.android.com/security/bulletin/2017-12-01#system).

You can read more at the [writeup] from Guardsquare.

## Tools

### Janus [![python3]](#) [![go]](#)

### AndroidManifest extractor [![python3]](#)

#### Usage

1. Extract the `AndroidManifest.xml` from the target APK using [Apktool].
2. Run `manifest_dummy.py` to generate dummy classes to include in your
   Android Studio project. (The necessary tags generated by this script are 
   only needed if you set `shrinkEnabled true` in your `build.gradle`)

### Extract DEX from already injected APK \[WIP\] [![python3]](#)

## TODO
* Complete the guide. Extra instructions in [this][janus_poc] repo.

## Donate
If this repository helped you in any way, feel free to donate [here][donate].

[go]: https://img.shields.io/badge/Language-Go-00acd7 "Go"
[java]: https://img.shields.io/badge/Language-Java-red "Java"
[python3]: https://img.shields.io/badge/Language-Python_3-blue "Python 3"
[donate]: https://paypal.me/hexile0
[apktool]: https://github.com/iBotPeaches/Apktool
[janus_poc]: https://github.com/V-E-O/PoC/tree/8c389899e6c4e16b2ddab9ba6d77c2696577366f/CVE-2017-13156
[writeup]: https://www.guardsquare.com/en/blog/new-android-vulnerability-allows-attackers-modify-apps-without-affecting-their-signatures
[v-e-o]: https://github.com/V-E-O/

File Snapshot


 [4.0K]  /data/pocs/80be205018c4e67e29332fa926b35823f4cdf436
├── [4.0K]  golang
│   └── [3.4K]  main.go
├── [ 11K]  LICENSE
├── [4.0K]  python3
│   ├── [1.3K]  extract_dex.py
│   ├── [3.6K]  janus.py
│   ├── [3.6K]  manifest_dummy.py
│   └── [4.0K]  templates
│       ├── [ 111]  application
│       ├── [1.1K]  provider
│       ├── [ 253]  receiver
│       └── [ 272]  service
└── [1.7K]  README.md

3 directories, 10 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!