module

Samsung Galaxy KNOX Android Browser RCE

Disclosed	Created
11/12/2014	05/30/2018

Disclosed

11/12/2014

Created

05/30/2018

Description

A vulnerability exists in the KNOX security component of the Samsung Galaxy
firmware that allows a remote webpage to install an APK with arbitrary
permissions by abusing the 'smdm://' protocol handler registered by the KNOX
component.

The vulnerability has been confirmed in the Samsung Galaxy S4, S5, Note 3,
and Ace 4.

Authors

Andre Moulujduck joev

Platform

Android

Architectures

dalvik

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:

    msf > use exploit/android/browser/samsung_knox_smdm_url
    msf /(l) > show actions
        ...actions...
    msf /(l) > set ACTION < action-name >
    msf /(l) > show options
        ...show and set options...
    msf /(l) > run

NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today