A collection of tools for the Janus exploit [CVE-2017-13156].# Janus Toolkit
<!--This is a collection of tools to help you inject custom code in APKs without
changing the APK Signature v1.
This method only works in Android Marshmallow (SDK 23) or below as the exploit
Janus \[CVE-2017-13156\] has been fixed by Google in Android Nougat (SDK 24).-->
This is a collection of tools for the Janus exploit \[CVE-2017-13156\],
affecting AOSP versions 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 as described
[here](https://source.android.com/security/bulletin/2017-12-01#system).
You can read more at the [writeup] from Guardsquare.
## Tools
### Janus [![python3]](#) [![go]](#)
### AndroidManifest extractor [![python3]](#)
#### Usage
1. Extract the `AndroidManifest.xml` from the target APK using [Apktool].
2. Run `manifest_dummy.py` to generate dummy classes to include in your
Android Studio project. (The necessary tags generated by this script are
only needed if you set `shrinkEnabled true` in your `build.gradle`)
### Extract DEX from already injected APK \[WIP\] [![python3]](#)
## TODO
* Complete the guide. Extra instructions in [this][janus_poc] repo.
## Donate
If this repository helped you in any way, feel free to donate [here][donate].
[go]: https://img.shields.io/badge/Language-Go-00acd7 "Go"
[java]: https://img.shields.io/badge/Language-Java-red "Java"
[python3]: https://img.shields.io/badge/Language-Python_3-blue "Python 3"
[donate]: https://paypal.me/hexile0
[apktool]: https://github.com/iBotPeaches/Apktool
[janus_poc]: https://github.com/V-E-O/PoC/tree/8c389899e6c4e16b2ddab9ba6d77c2696577366f/CVE-2017-13156
[writeup]: https://www.guardsquare.com/en/blog/new-android-vulnerability-allows-attackers-modify-apps-without-affecting-their-signatures
[v-e-o]: https://github.com/V-E-O/
[4.0K] /data/pocs/80be205018c4e67e29332fa926b35823f4cdf436
├── [4.0K] golang
│ └── [3.4K] main.go
├── [ 11K] LICENSE
├── [4.0K] python3
│ ├── [1.3K] extract_dex.py
│ ├── [3.6K] janus.py
│ ├── [3.6K] manifest_dummy.py
│ └── [4.0K] templates
│ ├── [ 111] application
│ ├── [1.1K] provider
│ ├── [ 253] receiver
│ └── [ 272] service
└── [1.7K] README.md
3 directories, 10 files