Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
zte-smartlife-app-pwned — ZTE SmartLife security findings leading to account takeover: 100K+ Google Play downloads and CVE-2026-86552 through CVE-2026-86555. | Kitploit
Tools/GitHubGitHub/minanagehsalalma/zte-smartlife-app-pwned
Android SecurityVulnerability AnalysisExploitationReverse EngineeringWeb Application ExploitationCryptographyPenetration TestingMobile SecurityPapers & Research

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
API Security
GitHubminanagehsalalma/zte-smartlife-app-pwned

zte-smartlife-app-pwned

ZTE SmartLife security findings leading to account takeover: 100K+ Google Play downloads and CVE-2026-86552 through CVE-2026-86555.

View RepositoryWebsite
2h 16m agoNot yet reviewed

Proof of Concept (PoC) Suites

This directory contains the minimal, standalone PoC tooling used to validate the ZTE SmartLife backend vulnerabilities (CVE-2026-86552, CVE-2026-86553, CVE-2026-86554, CVE-2026-86555).

All endpoints have been patched and key material rotated by ZTE. The scripts and keys below are published for security research and technical verification.

Cryptographic Key Reference

ParameterValueRole
Bootstrap Decrypt Key (CVE-2026-86555)096760a7a99d99d12de9fecbfca568c0AES-128-GCM key hardcoded in AppMainBackend.setUacSignInfo
Client Symmetric Key (appClientKey)djrom(&)(&)MORJDAES-128-GCM key used for X-Auth-Value signing and payload parameter encryption
Shared Secret (appUacSec)b2cfe28732612cfd81de7a22ace2034317a47eb94683a016a85cc0883597c625Embedded secret incorporated into timestamped X-Auth-Value tokens
Access Key (appUacItp)271950143414fnu4mb3lxxotfj5mi1tpAccess key passed in X-Itp-Value: accessKey=...
App / Client ID (appId)271950143414Client system identifier
Tenant ID (tenantId)10001Cloud tenant identifier

Directory Overview

1. direct-replay/

Contains account-takeover-poc.ps1, an automated PowerShell 7 script demonstrating:

  • Public bootstrap payload decryption (CVE-2026-86555)
  • Account enumeration and accountId disclosure (CVE-2026-86554)
  • Password reset without verification code (CVE-2026-86553)
  • Successful login postcondition with the attacker-set password
  • Arbitrary email identity pre-registration / squatting (CVE-2026-86552)

2. frida/

Contains in-process runtime instrumentation scripts for the official Android client (com.zte.smarthome.abroad):

  • smartlife_dump_uac.js: Hooks client bootstrap decryption and dumps UAC configuration and outbound headers.
  • smartlife_signing_oracle.js: Exposes Frida RPC methods to sign headers and encrypt payloads remotely via the app process.

3. runtime-path-probes/

Contains Invoke-Runtime-AppAuth-AccountProbes.ps1, a standalone probe script verifying the active production backend (https://zxuacde.smart-zte.com) using recovered credentials.

Quick Start

Run Direct Replay PoC (PowerShell 7)

root@kitploit:~
cd direct-replay
pwsh -ExecutionPolicy Bypass -File .\account-takeover-poc.ps1

Run Production Path Probe (PowerShell 7)

root@kitploit:~
cd runtime-path-probes
pwsh -ExecutionPolicy Bypass -File .\Invoke-Runtime-AppAuth-AccountProbes.ps1

Hook Live App with Frida

root@kitploit:~
cd frida
frida -U -f com.zte.smarthome.abroad -l smartlife_dump_uac.js
Download Tool