tc4dy/CVE-2026-0073-PoC-Exploit

GitHubRepository PoCExploit

PoC files

7 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python exploit for CVE-2026-0073, an authentication bypass in Android's ADB Wireless Debugging. It generates an EC or Ed25519 client certificate, establishes a TLS 1.3 connection to the target, performs the ADB authentication handshake, and opens an interactive shell or executes a single command.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and two Python scripts (basic_exploit.py, exploit.py) that implement a proof-of-concept for CVE-2026-0073, an ADB wireless debugging authentication bypass. The code performs TLS connection, certificate generation, ADB protocol handshake, and shell interaction—all consistent with the claimed exploit. No concealed executable behavior, unrelated payloads, credential theft, persistence mechanisms, or operator-directed harm were observed in the reviewed text.

ClassificationExploit
Model confidence98%
AuthenticationNot required
LanguagesPython
Target softwareAndroid ADB daemon
Attack typesauthentication bypassremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code implements a full exploitation chain: it generates a malicious certificate, connects to the target, bypasses ADB authentication, and opens a remote shell. The README explicitly labels it as a 'PoC' and 'Exploit', and the code contains functions to execute commands and provide interactive shell access.

README.md:1-2exploit.py:298-319exploit.py:351-376

Requirements

  • Target device must have Wireless Debugging enabled and be reachable on the network.exploit.py:1
  • Attacker must know or discover the target's Wireless Debugging port.exploit.py:248-260

Observed behavior

  • Generates a self-signed EC P-256 or Ed25519 certificate with CN=adb.exploit.py:137-157
  • Connects to the target via TCP and performs a TLS 1.3 handshake using the generated certificate.exploit.py:273-296
  • Sends an ADB CNXN message and signs the received AUTH token to bypass authentication.exploit.py:298-319
  • Opens an ADB shell stream and either executes a single command or provides an interactive shell.exploit.py:321-376
  • Includes a network scanner to discover Wireless Debugging ports on a subnet.exploit.py:409-434
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
TLS 1.3 connection with self-signed EC P-256 certificate, ADB CNXN/AUTH/OPEN/WRTE/CLSE protocol exchange, shell command execution and interactive shellAll code behavior aligns with the described CVE-2026-0073 authentication bypass exploit; no unrelated or concealed actions detected.exploit.py:273-296exploit.py:298-319exploit.py:321-331exploit.py:333-349exploit.py:351-376
Network Activity
Outbound TCP connections to target IP on discovered or specified port; TLS handshake; ADB protocol messagesNetwork activity is limited to the target ADB service, consistent with the exploit's purpose.exploit.py:276-278exploit.py:288
File System Activity
Temporary PEM file creation and deletion for TLS certificate chain; optional output file write for command resultsTemporary file usage is standard for loading certificates into SSL context; output file write is user-controlled and documented.exploit.py:284-287exploit.py:294-296exploit.py:399-401
Review boundaries

What the analysis did not establish

  • Evidence does not include the binary image file (0073.png) or two other text files omitted from the packet.
  • The artifact's actual effectiveness against patched or unpatched devices is not verified.
  • One non-text media file (0073.png) was flagged as metadata-only and not analyzed for steganographic or embedded payloads.
  • Two unclassified files (totaling 1696 bytes) were present in the repository but not included in the text evidence; their content is unknown.
  • The review is limited to static analysis of the supplied text; no dynamic execution or behavioral analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1