winslowe/cve-2024-4309-analysisBGT-Pentest-LAB Final Project: Xiaomi HyperOS System Updater OTA Signature Verification Bypass (CVE-2024-4309) Deep Analysis.
⚠️ EDUCATIONAL PURPOSES ONLY — Use on real systems is prohibited.
Prepared as part of the BGT-Pentest-LAB cybersecurity final project.
Xiaomi HyperOS System Updater bileşeninde bulunan ve uzaktan kod çalıştırmaya (RCE) imkan tanıyan CVE-2024-4309 zafiyetinin derinlemesine analizi, saldırı simülasyonu, tespit motoru ve interaktif web dashboard'u bu depoda yer almaktadır.
🔴 Vulnerability Summary
|
🎯 Attack Vector
|
flowchart TD
subgraph MITM ["Phase 1: Network Access Compromise (MITM)"]
A["🌐 1. MITM (ARP Spoofing)"] --> B["🎯 2. DNS Hijack (update.miui.com)"]
end
subgraph INJECTION ["Phase 2: Database and Package Manipulation"]
B --> C["💾 3. Hash Injection (ota_hashes.db)"]
C --> D["📦 4. Malicious OTA Package Preparation"]
end
subgraph BYPASS ["Phase 3: Security Bypass"]
D --> E["🔓 5. RSA Signature Bypass (Fast Channel)"]
E --> F["⚡ 6. Hash Verification Bypass (strstr Bug)"]
end
subgraph EXPLOIT ["Phase 4: Privilege Escalation & Exfiltration"]
F --> G["💀 7. RCE & Persistent Root (system.img Flash)"]
end
%% Style Definitions
style MITM fill:#0f172a,stroke:#38bdf8,stroke-width:1px,color:#38bdf8
style INJECTION fill:#0f172a,stroke:#818cf8,stroke-width:1px,color:#818cf8
style BYPASS fill:#0f172a,stroke:#f59e0b,stroke-width:1px,color:#f59e0b
style EXPLOIT fill:#0f172a,stroke:#ef4444,stroke-width:2px,color:#ef4444
style A fill:#1e293b,stroke:#0284c7,stroke-width:2px,color:#e2e8f0
style B fill:#1e293b,stroke:#0284c7,stroke-width:2px,color:#e2e8f0
style C fill:#1e293b,stroke:#4f46e5,stroke-width:2px,color:#e2e8f0
style D fill:#1e293b,stroke:#4f46e5,stroke-width:2px,color:#e2e8f0
style E fill:#451a03,stroke:#d97706,stroke-width:2px,color:#fef3c7
style F fill:#451a03,stroke:#d97706,stroke-width:2px,color:#fef3c7
style G fill:#4c0519,stroke:#e11d48,stroke-width:3px,color:#ffe4e6| Step | Action | Technical Detail |
|---|---|---|
| 1 | MITM Position | Network traffic is intercepted via ARP Spoofing or a fake Wi-Fi hotspot |
| 2 | DNS Hijack | DNS responses for update.miui.com are redirected to the attacker's server |
| 3 | Hash Injection | A partial malicious hash is injected into the ota_hashes.db database |
| 4 | Malicious OTA Package | A fake update.zip with X-Xiaomi-Fast-Channel: true header is created |
| 5 | RSA Bypass | MiuiRecoveryVerifier sees the Fast Channel header and skips RSA verification |
| 6 | Hash Bypass | quickHashCheck → partial match with strstr() → BYPASS |
| 7 | RCE | Malicious system.img is flashed in recovery mode → Persistent Root |
🖥️ C2 Dashboard app.py
Interactive dashboard that visualizes the attack simulation step by step with a premium web panel. Kill chain, risk score, real-time logs. |
⚔️ Attack Simulator attack.py
MITM attack simulation with a fake OTA server. 4 REST endpoints, malicious ZIP generation, hash injection and Fast Channel bypass. |
🔍 Detection Engine detector.py
3-stage OTA security scanner. strstr() detection, Fast Channel analysis, risk score and IoC report. |
|
🔧 Fix Demo fix_demo.py
strstr() vs strcmp() interactive comparison and patch demonstration. |
📄 Report Generator report_generator.py
PDF-ready professional HTML vulnerability analysis report generator. |
🧪 Test Suite test_suite.py
27 automated unit tests. Attack + Detector integration tests. |
| ❌ Vulnerable Code (strstr) | ✅ Patched Code (strcmp) |
|---|---|
|
|
| 🔴 8 characters sufficient — Brute-force: 2³² | 🟢 64 characters required — Brute-force: 2²⁵⁶ |
📦 CVE-2024-4309-Analysis
├── 📄 README.md # This file
├── 📄 ROADMAP.md # Project roadmap (5 phases)
├── 🐳 Dockerfile # Container configuration
├── 🐳 docker-compose.yml # Service orchestration file
├── 🔑 .env.example # Environment variables template
├── 📄 .gitignore # Git exclusion rules
├── 📄 requirements.txt # Dependency list (zero dependencies)
│
├── 📁 docs/
│ ├── 📁 presentations/ # 🎨 Presentation files (HTML slides, infographic)
│ ├── 📁 research/ # 🔬 Research notes and deep analysis
│ └── 📁 references/ # 📚 Bibliography and references
│
└── 📁 src/
├── 🖥️ app.py # C2 Web Dashboard (Premium UI)
├── ⚔️ attack.py # OTA MITM attack simulator
├── 🔍 detector.py # Multi-stage attack detection engine
├── 🔧 fix_demo.py # strstr() vs strcmp() demo
├── 📄 report_generator.py # PDF-ready HTML report generator
└── 🧪 test_suite.py # 27 automated unit tests
git clone https://github.com/Winslowe/CVE-2024-4309-Analysis.git
cd CVE-2024-4309-Analysis
cp .env.example .env
docker-compose up -d
Dashboard → http://127.0.0.1:5000
# Terminal 1 — C2 Dashboard
python src/app.py
# Terminal 2 — Attack Server
python src/attack.py
# Terminal 3 — Detection Engine
python src/detector.py
python src/test_suite.py
# or
python -m pytest src/test_suite.py -v
| Deliverable | File | Status |
|---|---|---|
| Vulnerability Research and Logs | docs/research/ | ✅ |
| PoC Scripts | src/ (6 files) | ✅ |
| Visual Analysis (Infographic) | docs/presentations/ | ✅ |
| C2 Web Dashboard | src/app.py | ✅ |
| Automated Test Suite | src/test_suite.py (27 tests) | ✅ |
| PDF-Ready Report | report_generator.py | ✅ |
| Docker Support | Dockerfile + docker-compose.yml | ✅ |
| Document | Description |
|---|---|
docs/research/ | 🔬 Deep analysis and research notes |
docs/presentations/ | 🎨 HTML presentation and infographic files |
docs/references/sources.md | 📚 Complete bibliography list |
ROADMAP.md | 🗺️ 5-phase project roadmap |
| Source | Link |
|---|---|
| Xiaomi Security Bulletin | trust.mi.com/misrc/bulletins/advisory |
| QDebugger Research | ota-security.q-debugger.com |
| CWE-347 | cwe.mitre.org/data/definitions/347 |
| Android RecoverySystem API | developer.android.com |
| Xiaomi OTA Research | github.com/nicene-0 |
👨🏫 Instructor / Instructor
|
👤 Student / Student
📚 Course / Course
|