Proof-of-concept exploit for an Android adbd Wireless Debugging TLS auth bypass, using an EC/RSA key type mismatch to obtain an unauthenticated remote shell.
Disclaimer: This Proof of Concept (PoC) is provided strictly for educational and authorized security research purposes. Unauthorized access to computer systems is illegal. Always ensure you have explicit permission before testing against any device or network.
Android devices have a feature called Wireless Debugging, which allows developers to connect to the device over Wi-Fi without a USB cable. To keep this connection secure, the device uses TLS encryption and requires the connecting computer to prove its identity using a cryptographic key.
Where is the flaw?
When a computer connects, the Android daemon (adbd) checks if the computer's key matches any previously authorized keys. It does this using a built-in mathematical function (EVP_PKEY_cmp) that returns one of three numbers:
1 means: "The keys match perfectly."0 means: "The keys do not match."-1 means: "Error: The keys are completely different types (e.g., comparing an RSA key to an EC key)."The Bug:
The programmer wrote a simple check: if (result) { grant_access(); }.
In programming, both 1 and -1 are considered "True". Therefore, if an attacker intentionally sends a completely different type of key (like an Elliptic Curve key instead of the expected RSA key), the function returns -1 (an error). The buggy code sees -1, assumes it means "True", and grants full access anyway.
The Result: An attacker on the same Wi-Fi network can bypass the authentication entirely and gain a remote shell on the device without needing the original pairing keys, and without the user seeing any approval prompt.
For this exploit to work, the target Android device must meet two conditions:
This script requires Python 3 and the cryptography library to generate the ephemeral certificates on the fly.
You can install the required library using either apt (on Debian/Ubuntu/Kali) or pip:
Using apt (Recommended for Linux):
sudo apt update
sudo apt install python3-cryptography
Using pip (Cross-platform):
pip3 install cryptography
Unlike USB debugging, Android assigns a random, high-numbered port for Wireless Debugging every time the device reboots or the Wi-Fi network changes.
If you don't know the current port, you can easily scan for it using nmap. Wireless debugging ports typically fall between 30000 and 50000.
Run the following command, replacing <hostname> with your target device's IP address:
nmap -Pn -p T:30000-50000 <hostname>
How to read the output:
Look for a port that shows as open. For example:
PORT STATE SERVICE
41234/tcp open unknown
In this example, 41234 is the port you will use in the next step.
Once you have the target hostname/IP and the correct port, you can run the exploit.
To open a full interactive remote shell (similar to SSH):
python3 adb_bypass.py <hostname> <port>
Example:
python3 adb_bypass.py 192.168.1.50 41234
Once connected, you will be dropped into a shell user prompt. Press Ctrl+C to exit.
If you just want to run a specific command and see the output without entering an interactive shell, use the --cmd flag:
python3 adb_bypass.py <hostname> <port> --cmd "id"
To see the underlying network traffic and handshake details for debugging or research purposes, append the -v flag:
python3 adb_bypass.py <hostname> <port> -v
CNXN and STLS packets to agree on a TLS upgrade.cryptography library, the script generates an ephemeral EC P-256 private key and a self-signed X.509 certificate in memory.EVP_PKEY_cmp returns -1, the if (cmp) check evaluates to true, and the device marks the connection as authorized.shell: stream using a large delayed_ack window, resulting in an unauthenticated remote shell.