POC-CVE-2026-0073

ADB Authentication Bypass — Proof of Concept

_{Security Research PoC by naheeju}

Security Notice: CVE-2026-0073 has been patched as of 2026-05-01. This PoC is provided strictly for security research, vulnerability analysis, and authorized testing of affected systems.

Table of Contents

• Disclaimer
• Overview
• What This PoC Demonstrates
• Safety Boundary
• Requirements
• Repository Structure
• Usage
• Building
• Example Output
• Failed Verification
• Technical Details
• Certificate Handling
• Security Considerations
• Responsible Disclosure
• Research Philosophy
• Author

⚠️ Disclaimer

This repository contains a Proof of Concept (PoC) created for security research, vulnerability analysis, authorized penetration testing, and educational purposes.

Only test systems and devices that you own or have explicit permission to assess.

This public PoC intentionally stops after reproducing the authentication condition. It does not:

• Open an ADB shell
• Execute arbitrary commands
• Provide an interactive shell
• Modify files on the target
• Upload or download files
• Establish persistence

The purpose of this repository is to demonstrate the vulnerability condition in a controlled and non-destructive manner.

Overview

POC-CVE-2026-0073 is a Go-based Proof of Concept that tests the ADB authentication flow associated with the vulnerability. The PoC communicates directly with the ADB service and observes the CNXN → STLS → TLS authentication sequence.

Verification Flow

   ADB Target
       │
       │ TCP
       ▼
  CNXN Request
       │
       ▼
 tls_auth detected
       │
       ▼
  STLS Request
       │
       ▼
 TLS Authentication Test
       │
       ▼
 Vulnerability Condition Reproduced
       │
       ▼
 EXPLOITATION SUCCESSFUL
       │
       ▼
      STOP

The PoC terminates at this point and does not continue to post-authentication shell access.

What This PoC Demonstrates

1. Connects to the specified ADB TCP service.
2. Sends an ADB CNXN message.
3. Checks whether the server advertises tls_auth.
4. Waits for the STLS request.
5. Confirms the TLS upgrade.
6. Generates an in-memory test certificate.
7. Performs the TLS handshake.
8. Reports the authentication condition when the expected state is reached.
9. Terminates safely.

The certificate is generated in memory and is not intentionally written to disk.

Safety Boundary

The public implementation deliberately stops after successful authentication verification. There is no post-authentication service opening in this PoC.

In particular, the PoC does not open shell: and does not accept a command argument. This keeps the public repository focused on vulnerability verification rather than providing a general-purpose remote shell implementation.

Requirements

Before running the PoC, make sure the target device meets the following conditions:

• Go 1.XX or newer
• Network connectivity to the authorized test device
• An ADB service reachable over TCP
• The target device must have been paired with an ADB client previously
• A valid previous ADB pairing/authentication history must exist on the target
• A controlled testing environment

Check your Go installation:

go version

Repository Structure

POC-CVE-2026-0073/
├── cmd/
│   └── main.go
├── go.mod
├── go.sum
└── README.md

cmd/main.go contains the public vulnerability verification PoC.

Usage

Clone

git clone https://github.com/naheeju/POC-CVE-2026-0073.git
cd POC-CVE-2026-0073

Download Dependencies

go mod download

Run

go run ./cmd <IP> [PORT] [KEY_TYPE]

Examples

# Default EC certificate
go run ./cmd 192.168.1.2 5555 ec

# Ed25519
go run ./cmd 192.168.1.2 5555 ed25519

# Custom port
go run ./cmd 192.168.1.2 35495 ec

Replace the IP address and port with those of your authorized laboratory target.

Building

go build -o netra ./cmd
./netra 192.168.1.2 5555 ec

The compiled netra binary is a local build artifact and should not be committed to the public repository.

Example: Successful Verification

============================================================
      ADB AUTHENTICATION BYPASS - PoC
============================================================
                    By: naheeju
============================================================
 Security Research / Authorized Testing Only
 This PoC intentionally stops before shell execution.
============================================================

[*] Target    : 192.168.1.2:35495
[*] Key type  : ec
[*] Mode      : Authentication verification

[*] Generating ec test certificate in memory...
[+] Test certificate generated.

[*] Connecting to ADB service...
[*] Sending CNXN...
[+] STLS requested (TLS version: 0x1000000)

[*] Confirming TLS upgrade...
[*] Testing TLS authentication validation...

[+] TLS handshake accepted.
    Protocol : TLSv1.3
    Cipher   : 0x1301

============================================================
                 EXPLOITATION SUCCESSFUL
============================================================
[+] Authentication condition reproduced.
[+] TLS authentication was accepted.
[+] Vulnerability condition confirmed.

[*] Safety boundary reached.
[*] No ADB shell was opened.
[*] No command was executed.
[*] PoC terminated safely.
============================================================

What does EXPLOITATION SUCCESSFUL mean?

In this repository, the message means that the PoC successfully reproduced the authentication condition being tested. It does not mean that:

• a shell was opened;
• a command was executed;
• files were modified; or
• persistent access was established.

The PoC intentionally terminates immediately after the verification stage.

Failed Verification

If the target rejects the authentication test, the PoC reports an authentication failure and terminates:

[-] Authentication was rejected.

Possible causes include:

• The target is patched.
• The target does not match the vulnerable authentication state.
• The ADB implementation differs from the expected implementation.
• tls_auth is not advertised.
• The selected certificate type is not accepted.

A failed result should not be interpreted as proof that a device is secure in every respect. It only indicates that this particular PoC did not reproduce the tested condition.

Technical Details

The PoC implements the relevant ADB protocol messages directly rather than relying on the normal adb command-line client.

Client                         ADB Service
  │                                │
  │────── CNXN ───────────────────>│
  │<───── CNXN ────────────────────│
  │<───── STLS ────────────────────│
  │────── STLS ───────────────────>│
  │<═══════ TLS Handshake ═════════>│
  │                                │
  │        Authentication Test     │
  │        Verification Result     │
  │                                │
  X────── PoC Terminates ──────────

The public PoC does not continue into the ADB shell/service layer.

Certificate Handling

The PoC can generate two test certificate types: ec and ed25519.

The generated certificate and private key are held in memory for the test and are not stored as persistent key files by the PoC.

Security Considerations

For responsible testing, use an isolated environment whenever possible:

┌─────────────────────┐
│   Research Machine  │
│       Go PoC        │
└──────────┬──────────┘
           │ Isolated LAN
           ▼
┌─────────────────────┐
│    Test Android     │
│    ADB Service      │
└─────────────────────┘

Do not expose vulnerable test infrastructure to the public Internet.

Responsible Disclosure

If this research identifies a vulnerability affecting software or devices that you do not own, follow the appropriate vendor security contact and responsible disclosure process.

Do not use this project to access systems without authorization.

Research Philosophy

This repository intentionally separates:

Vulnerability Research → Reproduction → Verification → Documentation

from post-authentication exploitation. The objective of the public PoC is to make the vulnerability observable, reproducible, and understandable while maintaining a clear safety boundary.

Author

naheeju — Security Researcher