CVE Research and PoC Laboratory — Android Security Analysis

👨‍🏫 Advisor Information

👤 Student Information

📚 Course Information

🚀 Project Summary and Scope

This project was developed as the final assignment for the Penetration Testing (BGT006) course of the Information Security Technology program at İstinye University. Within the scope of the project, 3 different current vulnerabilities affecting the Android ecosystem (CVE-2024-0044, CVE-2024-43093, CVE-2024-23706) were examined in depth, an isolated lab environment was set up, and analyzed using a cyber detective methodology.

🎯 Problem Solved and Project Objective

Traditional Android security analyses usually consist only of theoretical documentation or static images. This project solves the following fundamental problems by combining the attack and defense cycle with working code:

• Live Analysis of Vulnerabilities: Captures live traces of critical privilege escalation (LPE) vulnerabilities such as CVE-2024-0044 in the Android log layer (logcat).
• Red Team & Blue Team Correlation: Presents a complete attack-defense PoC (Proof of Concept) by connecting the red team exploitation tool (exploit_sim.py) end-to-end with the blue team log monitoring detector (detector.py).
• Productized Security Outputs: Converts detected alarms into real-time JSON/CSV reports compliant with SIEM standards and feeds them into a centralized dashboard.

⚡ Single-Command PoC (Attack-Detection Simulation)

Single-command PoC launchers (run_poc.bat / run_poc.sh) have been added so that a user who clones the project can run it and see the output within seconds. These scripts simulate the red team's exploitation steps and cause the blue team detector to generate alarms and write to the reports/detection_results.json file. For detailed execution steps, please refer to the Installation and Execution section.

📊 Summary Table of Analyzed Vulnerabilities

🔌 Midterm Module (NetVanguard) Integration

The endpoint log analysis agent src/detector.py developed within the project scope has been integrated into the NetVanguard central anomaly monitoring and alarm panel implemented as the midterm project. Critical vulnerability signatures generated on the emulator are transmitted over the network to the NetVanguard backend engine, simulating a centralized monitoring (SIEM) architecture.

🕵️ Log Analysis Agent (src/detector.py) Working Architecture

The vulnerability detection agent (src/detector.py) is a lightweight endpoint log monitoring engine designed to detect exploitation activities performed on an Android device.

Core Features and Operating Modes:

1. Flexible Log Input (3 Different Modes):
   • Live ADB Logcat Stream: Connects directly to the emulator with the adb connect command to monitor device logs live.
   • Pipeline / Stdin Mode: Can be piped with other CLI tools via the adb logcat | python src/detector.py architecture.
   • File Tail (Tail -f): Dynamically monitors previously saved log files (.log) line by line.
   • Fallback (Manual Input): If ADB or log file is not installed on the system, filters manually entered log lines for testing purposes (Live simulation module).
2. Rule-Based Signature Matching:
   • Fed from the DETECTION_KEYWORDS variable in the .env file.
   • Generates [DANGER - ALARM] instantly on the terminal and in logs when it captures critical exploitation signatures such as Android Runtime crashes (SIGSEGV), package installation errors (SIGABRT), and crashing security applications (Process has died).

🛠️ Technologies Used

📂 Project Directory Structure

Android-rce-analizi/
├── .github/
│   └── workflows/
│       └── detector_test.yml  # GitHub Actions (CI/CD) Automatic Test Configuration
├── .gitattributes             # GitHub language statistics and file attributes configuration
├── README.md                  # Main project document
├── ROADMAP.md                 # Project roadmap (Phase 0-5)
├── start_dashboard.bat        # Windows Web Dashboard launcher
├── start_dashboard.sh         # macOS/Linux Web Dashboard launcher
├── run_poc.bat                # Windows one-click PoC simulator
├── run_poc.sh                 # macOS/Linux one-click PoC simulator
├── .gitignore                 # Git untracked files
├── .env.example               # Environment variables template
├── Dockerfile                 # Docker configuration
├── docker-compose.yml         # Multi-container configuration
├── LICENSE                    # License file
├── mitigation/                # Vulnerability mitigation and patch files
│   ├── cve_2024_0044_patch.diff
│   ├── cve_2024_23706_mitigation.md
│   └── cve_2024_43093_mitigation.md
├── src/                       # Source codes
│   ├── detector.py            # Endpoint log analysis agent (Real-time detection engine)
│   ├── exploit_sim.py         # Red Team vulnerability exploitation simulator
│   └── test_detector.py       # Automated unit tests written for the agent
├── reports/                   # Simulated scan and detection reports
│   ├── nessus_scan.csv        # Simulated Nessus vulnerability scan output
│   └── detection_results.json # Real-time log outputs recorded by the detection engine
├── web/                       # Web Dashboard interface
│   ├── index.html             # Main dashboard HTML file
│   ├── css/style.css          # Interface styles
│   └── js/main.js             # Interface dynamics and terminal simulator
├── docs/                      # Documentation
│   ├── assets/                # Images and media files (including Demo GIF)
│   ├── modules/               # Module documents
│   ├── references/            # Reference sources
│   └── research/              # In-depth research documents
│       ├── 01_zafiyet_analizi.md
│       ├── 02_teknik_mekanizma.md
│       ├── 03_saldirgan_perspektifi.md
│       ├── cve_2024_23706.md
│       ├── cve_2024_43093.md
│       ├── detector_test_output.md  # Test report output
│       └── final_rapor.md           # Course submission final report
└── honeypot/                  # Honeypot environment files (Emulator setup guide)

🔬 Analysis and Simulation Methodology

Vulnerability analysis and defense simulations within the project scope were handled through a cybersecurity cycle consisting of 4 basic stages:

graph TD
    A["1. Vulnerability Analysis & Static Review"] --> B["2. Isolated Lab Environment Setup"]
    B --> C["3. Exploitation Simulation & Dynamic Logging"]
    C --> D["4. Correlation & Visual Dashboard"]

1. Static and Theoretical Analysis: AOSP (Android Open Source Project) source codes were examined to identify logical errors in UID mappings, SQLite database access restrictions, and package installation mechanisms.
2. Isolated Lab Environment: The Android emulator (API 33-34) and honeypot configuration were isolated into a penetration test network via Docker containers.
3. Dynamic Logging and Detection: Crash and bypass traces (e.g. SIGSEGV) that appear when vulnerabilities are triggered were captured by filtering them with the src/detector.py vulnerability detection agent.
4. Dashboard Visualization: The collected data was enriched with risk matrices, attack chain graphs, and live terminal simulations understandable by administrators and analysts, and presented in the web/ interface.

Installation and Execution

Prerequisites

• Python 3.8+
• Android SDK (API Level 33-34)
• Docker & Docker Compose
• ADB (Android Debug Bridge)

Step 1: Preparation

# 1. Clone the repository and navigate to the directory
git clone https://github.com/bfurkanyildiz/Android-rce-analizi.git
cd Android-rce-analizi

# 2. Prepare environment variables (default settings are used without .env)
cp .env.example .env

Step 2: Execution Options

🚀 Option A: One-Click PoC Simulation (Fastest Method)

To test the attack and detection mechanism end-to-end without any installation or emulator setup:

• Windows (Double Click or CMD):
  root@kitploit:~

  run_poc.bat
  

• macOS / Linux (Terminal):
  root@kitploit:~

  bash run_poc.sh
  

🕵️ Option B: Manual Live ADB Mode

To capture real-time logcat with your Android Emulator running:

# Start the agent (starts listening for live logs via ADB)
python src/detector.py

# Trigger the attack simulator from a separate terminal
python src/exploit_sim.py

🐳 Option C: Docker Container Mode

To start all dependencies in an isolated Docker container:

docker-compose up -d

Step 3: Running Automated Tests

To test software quality and CI/CD standards:

python -m unittest src/test_detector.py

🖥️ Web Dashboard Interface

Any user who clones the repository (git clone) can easily run the rich web interface containing analysis reports and terminal simulation locally.

Dashboard Preview (Demo)

You can use one of the following methods to view the interface:

1. Automatic Launcher Scripts (Recommended)

To start the local HTTP server in the background and automatically open the interface in your default browser, run the command suitable for your operating system:

• Windows (PowerShell / CMD): You can double-click the start_dashboard.bat file in the project root directory or run it from the terminal with this command:
  root@kitploit:~

  start_dashboard.bat
  

• macOS / Linux (Bash): To start directly from the terminal (without requiring execute permission):
  root@kitploit:~

  bash start_dashboard.sh
  

  or by granting execute permission to the file:
  root@kitploit:~

  chmod +x start_dashboard.sh
  ./start_dashboard.sh
  

2. Offline (Serverless) Execution

To run directly without setting up any local server:

1. Go to the web/ directory.
2. Double-click the index.html file to open it directly in your browser.

3. Manual Server Launch

If you prefer to start the Python server manually:

python -m http.server 8080

Then go to http://localhost:8080/web/index.html in your browser.

🔄 CI/CD and Automated Security/Quality Scans

Our project is managed with software engineering (DevSecOps) principles compliant with cybersecurity standards. For every push or pull request to the repository, GitHub Actions runs the following pipeline:

1. Multi-Operating System Support (Matrix Build): The agent's code is tested on both ubuntu-latest and windows-latest systems to verify cross-platform compatibility.
2. Static Code Analysis (Linter): Python coding standards (PEP 8) are checked using the flake8 tool.
3. Static Security Analysis (Bandit Scan): Critical vulnerability patterns that may occur in the code are automatically scanned using the bandit tool (all false-positive cases are marked with # nosec in cybersecurity standards).
4. Pipeline Integration Test: The exploit_sim.py | detector.py pipe is run to simulate the end-to-end exploitation-detection cycle.
5. Report Output (Artifacts): The detection_results.json generated as a result of a successfully run PoC is uploaded as an automatic zip file to the Actions outputs.

PoC Terminal Output Preview:

⚠️ Legal Disclaimer

This project is for academic and educational purposes only. All tests are performed on isolated virtual machines in a controlled laboratory environment. Any attempt to attack real devices or third-party systems is illegal and outside the scope of this project.

📄 License

This project is licensed under the GNU General Public License v3.0.