CVE-2024-23700 - C2 Server: Command and Control and Data Collection Server

This project illustrates the design and construction of a Command & Control (C2) server used for the experimental exploitation scenario of the privilege escalation vulnerability CVE-2024-23700. This server is responsible for receiving, processing, classifying, and displaying sensitive data stolen from target Android devices.

The documentation and source code in this repository are intended solely for educational purposes, security analysis, and testing within authorized environments. Do not use them on devices, accounts, or data that fall outside the scope of lawful testing.

Project Information

Course: Mobile Device Security

Team: Project carried out by a team of 4 members.

During the research and development of this C2 Server design project, the team undertook the following tasks:

• Built the Backend component using Python (Flask framework) to provide communication APIs, data decryption, and storage.
• Developed an intuitive Frontend admin Dashboard using ReactJS for target monitoring.
• Designed a flat-file database storage system (data.json) to optimize for a fast and lightweight PoC.
• Packaged the entire architecture (Backend and Frontend) into independent containers and operated them via Docker.

Overview

The C2 Server system follows a Client-Server model, where the malicious Android application (PoC) acts as the Client, continuously sending data back. The C2 architecture is divided into two independently processing components to ensure high speed and flexibility.

Main operational flow of the C2 Server:

1. Disguise & Reception (Backend): The root reception endpoint / is designed with a dual-handling mechanism. If accessed via the GET method (browser scanning), the server returns a fake 404 error to evade detection. If it receives a POST method containing JSON format from the malware, the server accepts it and extracts the device identifier.
2. Smart Classification: The server automatically checks the keys inside the packet to label the data (e.g., s_cache, gps_cache).
3. Storage & Packaging: The raw payload is packaged together with the real-time timestamp and device ID, then pushed to the top of the storage list in data.json.
4. Frontend Synchronization: The Dashboard uses a React Hook to send GET requests to /api/data to read the database.
5. Grouping & Display: The Frontend automatically groups packets sharing the same identifier (device_id), deep-scans the structure to extract hardware parameters (RAM, Battery, OS), and visually displays them on the radar.

CVE Information

Vulnerability ID: CVE-2024-23700
Android Severity: Critical
Affected Component: Android Companion Device Manager
Reference Patch: Android Wear Security Bulletin 2024-05-01

This C2 server is designed as part of an experimental network, receiving intelligence data streams from Android devices successfully exploited through the aforementioned vulnerability.

Directory Structure

CVE-2024-23700-C2-Server/
├── backend/
│   ├── app.py - Initializes API Endpoints, handles disguise and JSON classification
│   └── requirements.txt
├── frontend/
│   ├── src/
│   │   ├── pages/
│   │   │   ├── Dashboard.jsx - Device overview radar screen
│   │   │   └── DeviceDetails.jsx - In-depth payload analysis dialog
│   │   ├── App.jsx
│   │   └── App.css
│   ├── package.json
│   └── nginx.conf - Custom Reverse Proxy for frontend
├── data.json - Flat-file database storing records (volume-mounted)
├── docker-compose.yml - Manages containers and internal network
├── .gitignore
└── README.md

Main Components

Data Classification & Interpretation Mechanism

Instead of using cumbersome logic, the server automatically identifies and labels data based on the returned cache blocks, while the Frontend interface integrates a smart dictionary (MODULE_MAP and COLUMN_TRANSLATIONS) to standardize and "localize" the results:

• SMS_INTERCEPT: Data stolen from SMS messages (s_cache).
• CONTACTS_DUMP: Data exported from contacts (c_cache).
• CALENDAR_SPY: Calendar event tracking data (cal_cache).
• NOTIFICATIONS_SPY: Notification eavesdropping data (n_cache).
• LOCATION_TRACKING: Location tracking data (gps_cache).
• GENERAL_TELEMETRY: Default label for general system measurement data.

Additionally, the system automatically converts raw timestamps into readable local time standards and interprets numeric codes into actual states (e.g., Call type 1 = "↙️ Incoming call").

Deployment and Operation

The entire C2 infrastructure is operated using docker compose to ensure consistency and eliminate environmental discrepancies. The structure runs 2 main services:

• c2_backend (Port 5000): Applies Volume Mapping technique to attach the physical data.json file to the /app/data.json location inside the container. This ensures intelligence data is permanently stored even if the container is deleted or restarted. The service applies the restart: always policy.
• c2_frontend (Port 80): Runs on the Nginx web server, acting as a Reverse Proxy. All API requests with the /api/ prefix are automatically forwarded (proxy_pass) to the Backend to enhance security. This container is required to start after the Backend (depends_on) to avoid initial connection loss errors.

Notes

• Ensure the data.json file has appropriate read/write permissions set on the physical server before starting Docker.
• If the data file has not been created, the Backend will automatically return an empty array to prevent the interface from crashing.
• Accessing the server's IP address directly will trigger the HTTP 404 disguise mechanism. Administrators must access the correct path and port configured on Nginx.