Privilege Escalation via Unverified GMS Loading in Magisk App

This repository contains a working exploit for CVE-2024-48336, a privilege escalation vulnerability in the Magisk app for Android. The exploit is implemented as an Android application that impersonates the Google Mobile Services (GMS) package (applicationId: com.google.android.gms). The exploit leverages Magisk's unsafe dynamic code loading, which fails to verify the authenticity of the GMS app before loading code from it. On devices without GMS preinstalled or with broken signature verification, this allows the exploit app to inject code into the Magisk app process and obtain a root shell without user interaction. The core logic is implemented in three main Java files: - ProviderInstallerImpl.java: Sets up the exploit by injecting a root shell into the Magisk app using IPC via a custom ContentProvider. - MyProvider.java: Implements a ContentProvider that receives file descriptors for the root shell and facilitates command execution. - MainActivity.java: Provides a UI for the attacker to enter arbitrary commands, which are then executed as root via the established shell. The exploit targets Magisk Manager versions v7.0.0 through Canary 27006 on Android devices. It requires the attacker to install the exploit app on a vulnerable device and then interact with the Magisk app to trigger the vulnerability. The exploit provides an interactive root shell, allowing arbitrary command execution as root. The repository is structured as a standard Android Studio project, with all necessary Gradle and resource files included.