CVE-2019-2205 PoC — Android System组件资源管理错误漏洞

Source

Associated Vulnerability

Title:Android System组件资源管理错误漏洞 (CVE-2019-2205)
Description:In ProxyResolverV8::SetPacScript of proxy_resolver_v8.cc, there is a possible memory corruption due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-139806216

Description

A local PoC exploit for CVE-2019-2205

Readme

# PACPoC: A local PoC exploit for CVE-2019-2205

To try out this exploit install the "malicious" app PacTest.apk and make `exploit.pac` available over http with, for example `python -m SimpleHTTPServer`. Then go to proxy settings on an Android device, select proxy autoconfig, and enter the URL to `exploit.pac`.

File Snapshot


 [4.0K]  /data/pocs/aef0f075491c3977b5d1317ff69e6e15acc28121
├── [1.2K]  exploit.pac
├── [4.0K]  PacTest
│   ├── [4.0K]  app
│   │   ├── [ 949]  build.gradle
│   │   ├── [ 751]  proguard-rules.pro
│   │   └── [4.0K]  src
│   │       ├── [4.0K]  androidTest
│   │       │   └── [4.0K]  java
│   │       │       └── [4.0K]  com
│   │       │           └── [4.0K]  nowsecure
│   │       │               └── [4.0K]  PacTest
│   │       │                   └── [ 713]  ExampleInstrumentedTest.java
│   │       ├── [4.0K]  main
│   │       │   ├── [4.0K]  aidl
│   │       │   │   └── [4.0K]  com
│   │       │   │       └── [4.0K]  android
│   │       │   │           └── [4.0K]  net
│   │       │   │               └── [ 308]  IProxyService.aidl
│   │       │   ├── [ 715]  AndroidManifest.xml
│   │       │   ├── [4.0K]  java
│   │       │   │   └── [4.0K]  com
│   │       │   │       └── [4.0K]  nowsecure
│   │       │   │           └── [4.0K]  PacTest
│   │       │   │               └── [6.4K]  MainActivity.java
│   │       │   └── [4.0K]  res
│   │       │       ├── [4.0K]  drawable
│   │       │       │   └── [5.5K]  ic_launcher_background.xml
│   │       │       ├── [4.0K]  drawable-v24
│   │       │       │   └── [1.8K]  ic_launcher_foreground.xml
│   │       │       ├── [4.0K]  layout
│   │       │       │   └── [1.2K]  activity_main.xml
│   │       │       ├── [4.0K]  mipmap-anydpi-v26
│   │       │       │   ├── [ 272]  ic_launcher_round.xml
│   │       │       │   └── [ 272]  ic_launcher.xml
│   │       │       ├── [4.0K]  mipmap-hdpi
│   │       │       │   ├── [2.9K]  ic_launcher.png
│   │       │       │   └── [4.8K]  ic_launcher_round.png
│   │       │       ├── [4.0K]  mipmap-mdpi
│   │       │       │   ├── [2.0K]  ic_launcher.png
│   │       │       │   └── [2.7K]  ic_launcher_round.png
│   │       │       ├── [4.0K]  mipmap-xhdpi
│   │       │       │   ├── [4.4K]  ic_launcher.png
│   │       │       │   └── [6.7K]  ic_launcher_round.png
│   │       │       ├── [4.0K]  mipmap-xxhdpi
│   │       │       │   ├── [6.2K]  ic_launcher.png
│   │       │       │   └── [ 10K]  ic_launcher_round.png
│   │       │       ├── [4.0K]  mipmap-xxxhdpi
│   │       │       │   ├── [8.9K]  ic_launcher.png
│   │       │       │   └── [ 15K]  ic_launcher_round.png
│   │       │       └── [4.0K]  values
│   │       │           ├── [ 208]  colors.xml
│   │       │           ├── [  70]  strings.xml
│   │       │           └── [ 383]  styles.xml
│   │       └── [4.0K]  test
│   │           └── [4.0K]  java
│   │               └── [4.0K]  com
│   │                   └── [4.0K]  nowsecure
│   │                       └── [4.0K]  PacTest
│   │                           └── [ 382]  ExampleUnitTest.java
│   ├── [ 558]  build.gradle
│   ├── [4.0K]  gradle
│   │   └── [4.0K]  wrapper
│   │       ├── [ 53K]  gradle-wrapper.jar
│   │       └── [ 232]  gradle-wrapper.properties
│   ├── [1.0K]  gradle.properties
│   ├── [5.2K]  gradlew
│   ├── [2.2K]  gradlew.bat
│   └── [  15]  settings.gradle
├── [1.6M]  PacTest.apk
├── [ 313]  README.md
└── [110K]  writeup.pdf

35 directories, 36 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!