CVE-2024-0039-Exploit

Description

Python script for exploiting CVE-2024-0039: arbitrary code execution on vulnerable Android devices.

WARNING: This code is intended for educational and constructive purposes only, on the side of good, so to speak!

Usage

Run the script with the necessary arguments:

python exploit.py --cb-host <Your IP> --cb-port <Your port> --output exploit.mp4

Project structure

• exploit.py: Main exploit script that creates a malicious MP4 file and logs the execution process.
• logs/: Diary for your educational and constructive villainy.
  • exploit.log:
• utils/: Helpers extracted here for code cleanliness
  • helpers.py
• tests/: Tests (adhering to best practices)
  • exploit.test.py

What this code does:

Function create_malicious_payload

Creates a malicious payload with a ROP chain and reverse shell.

• Create ROP chain: Setting up the ROP chain for arbitrary code execution.
• Create buffer overflow (and fill it with letter 'A'): Filling the buffer with 'A's for overflow.
• Create payload for reverse shell (don't try this at home): Setting up the reverse shell.

Function write_to_file

• Generate goodness into a file

Main part of the code

• Create goodness into a file
• Write to file
• Message about successful file creation

Logging

Logs are saved in logs/exploit.log. Logs script actions such as ROP chain creation, buffer overflow, file writing, and successful exploit execution.

Note

• All addresses and commands in the ROP chain are examples and must be adjusted according to the specific vulnerability and target.
• This code is intended for educational purposes only and should not be used for unauthorized actions.

License

This project is licensed under the MIT License - see the LICENSE file for details. Because even hacking should be legal... well, almost.