Command Injection in Metasploit msfvenom APK Template Handling

This repository contains a single Metasploit exploit module targeting a command injection vulnerability (CVE-2020-7384) in the msfvenom payload generator of the Metasploit Framework and Metasploit Pro. The exploit works by generating a specially crafted APK file with a malicious X.509 certificate Common Name field. When this APK is used as a template with msfvenom's -x option, arbitrary shell commands embedded in the certificate are executed on the system running msfvenom. The module is written in Ruby and leverages Metasploit's FILEFORMAT exploit mixin. The only file in the repository is the exploit module itself, which generates the malicious APK file (default name: msf.apk). The attack vector is local, as it targets users who run msfvenom with a crafted file. No network endpoints are involved. The exploit is operational, as it provides a working payload for command execution, but is not weaponized for mass exploitation.