📋 Project Overview / Project Overview

Prepared as part of the BGT-Pentest-LAB cybersecurity final project.

Xiaomi HyperOS System Updater bileşeninde bulunan ve uzaktan kod çalıştırmaya (RCE) imkan tanıyan CVE-2024-4309 zafiyetinin derinlemesine analizi, saldırı simülasyonu, tespit motoru ve interaktif web dashboard'u bu depoda yer almaktadır.

💀 Attack Flow / Attack Kill Chain

flowchart TD
    subgraph MITM ["Phase 1: Network Access Compromise (MITM)"]
        A["🌐 1. MITM (ARP Spoofing)"] --> B["🎯 2. DNS Hijack (update.miui.com)"]
    end

    subgraph INJECTION ["Phase 2: Database and Package Manipulation"]
        B --> C["💾 3. Hash Injection (ota_hashes.db)"]
        C --> D["📦 4. Malicious OTA Package Preparation"]
    end

    subgraph BYPASS ["Phase 3: Security Bypass"]
        D --> E["🔓 5. RSA Signature Bypass (Fast Channel)"]
        E --> F["⚡ 6. Hash Verification Bypass (strstr Bug)"]
    end

    subgraph EXPLOIT ["Phase 4: Privilege Escalation & Exfiltration"]
        F --> G["💀 7. RCE & Persistent Root (system.img Flash)"]
    end

    %% Style Definitions
    style MITM fill:#0f172a,stroke:#38bdf8,stroke-width:1px,color:#38bdf8
    style INJECTION fill:#0f172a,stroke:#818cf8,stroke-width:1px,color:#818cf8
    style BYPASS fill:#0f172a,stroke:#f59e0b,stroke-width:1px,color:#f59e0b
    style EXPLOIT fill:#0f172a,stroke:#ef4444,stroke-width:2px,color:#ef4444

    style A fill:#1e293b,stroke:#0284c7,stroke-width:2px,color:#e2e8f0
    style B fill:#1e293b,stroke:#0284c7,stroke-width:2px,color:#e2e8f0
    style C fill:#1e293b,stroke:#4f46e5,stroke-width:2px,color:#e2e8f0
    style D fill:#1e293b,stroke:#4f46e5,stroke-width:2px,color:#e2e8f0
    style E fill:#451a03,stroke:#d97706,stroke-width:2px,color:#fef3c7
    style F fill:#451a03,stroke:#d97706,stroke-width:2px,color:#fef3c7
    style G fill:#4c0519,stroke:#e11d48,stroke-width:3px,color:#ffe4e6

⚙️ Developed Tools / Developed Tools

🖥️ C2 Dashboard app.py Interactive dashboard that visualizes the attack simulation step by step with a premium web panel. Kill chain, risk score, real-time logs.	⚔️ Attack Simulator attack.py MITM attack simulation with a fake OTA server. 4 REST endpoints, malicious ZIP generation, hash injection and Fast Channel bypass.	🔍 Detection Engine detector.py 3-stage OTA security scanner. strstr() detection, Fast Channel analysis, risk score and IoC report.
🔧 Fix Demo fix_demo.py strstr() vs strcmp() interactive comparison and patch demonstration.	📄 Report Generator report_generator.py PDF-ready professional HTML vulnerability analysis report generator.	🧪 Test Suite test_suite.py 27 automated unit tests. Attack + Detector integration tests.

🐛 Root Cause / Root Cause

// NativeVerifier.cpp — BUG!
bool quickHashCheck(const char* hash) {
    for (int i = 0; i < count; i++) {
        if (strstr(whitelist[i], hash))
            return true;  // Substring match ⚠️
    }
    return false;
}

// NativeVerifier.cpp — FIXED
bool quickHashCheck(const char* hash) {
    for (int i = 0; i < count; i++) {
        if (strcmp(whitelist[i], hash) == 0)
            return true;  // Exact match ✅
    }
    return false;
}

🗂 Repository Structure / Repository Structure