[GUIDE] SMT SYSTEM SHELL ACCESS ON SAMSUNG ONEUI 5.1 [March & April Update ]

[Camlin3]

Background:​

It all started back in 2019 by @flanker017 who revealed a major bug in Samsung In-House TTS engine Apk which allows a third-party app to call malicious intent to load library as system shared library which can invoke a shell with user system .against which Samsung patched and issued an updated app.

Original CVE: CVE-2019-16253
Original Github Repo of POC: SMT-CVE-2019-16253
Original Write UP: Flanker017 Blog

Present Time in 2023:​

Another user @K0mraid3 recently in January leveraged a malfunctioned ADB command which allows downgrading any system app to any version as long as Build SDK supports it to reinstall vulnerable version code: 300200002 against which Samsung issued a patch in OneUI 5.1 March Update to mitigate downgrading of system apps by normal users but again it was limited to selected installers which gives error

Failure [-3005: INSTALL_FAILED_ADP_VERSION_LOCKED]

So now , this is something that does not exist in AOSP Code , upon further looking into Samsung Internal Sources , I found out that samsung heavily customises different AOSP APIs according to it's own need so such patch was introduced to mitigate moderately the vulnerability not a concrete solution , it still left some place for itself to rollback system app updates or introducing other updates without any future hassles. that's where comes the another backdoor to introduce downgrading of system apps . Samsung has own Package Installer which goes by package id com.sec.android.preloadinstaller , which invokes system updates and another updates internally of Samsung apps . Samsung was careful or lazy enough to whitelist its own package installer for downgrade of system apps either debuggable or not which also comes under bigger purview of Samsung In-House Security Daemon ASKSMANAGER whitelisted app to perform alleviated restriction free packages installations , and thanks to Android PackageManager , it allows providing installer package id for any app installation.


TLDR; we are going to use a secret installer to downgrade our target app to a vulnerable version on Latest ONEUI 5.1 March/ April Update .

adb install -d -i com.sec.android.preloadinstaller vulnerable_com.samsung.SMT.apk

or

adb shell pm install -d -i com.sec.android.preloadinstaller vulnerable_com.samsung.SMT.apk

Results:​

Epilogue:​

Finally Google stepped in as Knight in shining armour for Samsung and put last nail in the coffin for stopping further fun play with May Android Security Update . Now system apps can no longer be downgraded below factory installed version.
More Details : Google Git ; CVE-2023-21116

adiós, amigo !

 

[Camlin3]

BLuFeNiX , See and Update your tool !​

 

[wr3cckl3ss1]

BLuFeNiX , See and Update your tool !​

Already did it...and since you made the post available now. I'll be forking soon and uploading my version of this...ENJOY the Video

 

[Dante63]

Already did it...and since you made the post available now. I'll be forking soon and uploading my version of this...ENJOY the Video
View attachment 5907003

Does that mean the watch app should be updated as well?
EDIT: will update it soon...

 

[Dante63]

BLuFeNiX , See and Update your tool !​

Using "com.sec.android.preloadinstaller" does not work for samsung watches 1 April 2023... results are yielding downgrade failure

 

[Camlin3]

Using "com.sec.android.preloadinstaller" does not work for samsung watches 1 April 2023... results are yielding downgrade failure

What is exact error message with code ?
Are you sure , it's android security update is 1 April 2023 not 1st May 2023 ? Try these installer

"com.samsung.android.seinstaller"
"PrePackageInstaller"

 

[Dante63]

What is exact error message with code ?
Are you sure , it's android security update is 1 April 2023 not 1st May 2023 ? Try these installer

"com.samsung.android.seinstaller"
"PrePackageInstaller"

Absolutely sure, nothing visible in logs as the app used belongs @BLuFeNiX, mine is a tweaked version to work on the watch, for April patch, the smt and the preloadinstaller both give downgrade failure...

I will try the other two and see...
But it might be the watch gotten its update and patched before the phone ...

Will keep you updated...

 

[Dante63]

What is exact error message with code ?
Are you sure , it's android security update is 1 April 2023 not 1st May 2023 ? Try these installer

"com.samsung.android.seinstaller"
"PrePackageInstaller"

Neither of those work, so I am assuming watch April 2023 security patch has it fixed...

 

[Camlin3]

Absolutely sure, nothing visible in logs as the app used belongs @BLuFeNiX, mine is a tweaked version to work on the watch, for April patch, the smt and the preloadinstaller both give download failure...

I will try the other two and see...
But it might be the watch gotten its update and patched before the phone ...

Will keep you updated...
View attachment 5910269

Neither of those work, so I am assuming watch April 2023 security patch has it fixed...

What is error code ?

 

[Dante63]

What is error code ?

Downgrade failure

 

[King081]

Using this exploit, can I get oem unlocking to show on my phone, for some stupid reason Samsung activated Knox Guard on my A53 and they don't even know why,

 

[wr3cckl3ss1]

Neither of those work, so I am assuming watch April 2023 security patch has it fixed...

Correct. It seems patched.

 

[wr3cckl3ss1]

 

[wr3cckl3ss1]

GitHub - wr3cckl3ss1/system_shell_2: SMT Shell with a twist! Fully updated and upgraded.

SMT Shell with a twist! Fully updated and upgraded. - GitHub - wr3cckl3ss1/system_shell_2: SMT Shell with a twist! Fully updated and upgraded.

github.com

 

[bkdwt]

View attachment 5915361

Doesn't work on S21+ with April or May update. I just get the "failed" error message.

 

[wr3cckl3ss1]

Doesn't work on S21+ with April or May update. I just get the "failed" error message.

A bit overkill with posting on two XDA threads and on GitHub. But could you elaborate more on your firmware?

 

[nguyenlucky]

Hi @wr3cckl3ss1, thank you for your work. I got system shell on my S23U S918B on april update.

Do you know what command I can use to enable the second physical sim slot on my device? It's an Australian version with only one physical SIM slot.

Changing CSC and factory reset makes it recognize the second physical SIM until I finish the setup wizard, where it got disabled again. Hence it must be a software thing.

It has 2 distinct IMEIs and supports DSDS with a physical SIM and eSIM.

 

[wr3cckl3ss1]

Hi @wr3cckl3ss1, thank you for your work. I got system shell on my S23U S918B on april update.

Do you know what command I can use to enable the second physical sim slot on my device? It's an Australian version with only one physical SIM slot.

Changing CSC and factory reset makes it recognize the second physical SIM until I finish the setup wizard, where it got disabled again. Hence it must be a software thing.

It has 2 distinct IMEIs and supports DSDS with a physical SIM and eSIM.

To my knowledge there is not a command to do this. But if your saying it happens right after finishing the setup wizard. Don't finish it or at least get close as possible to almost finishing. Get shell or system shell thru PC and disable or uninstall the package for set-up wizard. Reboot and see if you can see the second sim like you want.

 

[nguyenlucky]

To my knowledge there is not a command to do this. But if your saying it happens right after finishing the setup wizard. Don't finish it or at least get close as possible to almost finishing. Get shell or system shell thru PC and disable or uninstall the package for set-up wizard. Reboot and see if you can see the second sim like you want.

How can I enable adb during the setup wizard?

 

[wr3cckl3ss1]

T

How can I enable adb during the setup wizard?

That's for you to find. I will not disclose that here or in private unfortunately. Info like that would be heaven for thieves. Look around at different sites and in different languages. If i can find it...you could too.