T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- shell.sh:15
- Finding
- Unnecessary and Incorrect Invocation of an Interactive Root Shell## Vulnerability Details **File Location**: `shell.sh:15-17` **Vulnerability Type**: Excessive privilege acquisition and unsafe interactive root shell **Risk Level**: High ```bash # 切换到root权限 log "切换到root权限" su ``` ### Technical Analysis The script invokes `su` globally before dispatching every supported operation. This violates least-privilege principles because operations such as listing packages, tapping coordinates, entering text, and taking screenshots do not universally require unrestricted root access. Invoking `su` without a command normally starts an interactive child shell. It does not elevate the parent script or automatically cause the subsequent `case` statement to run as root. Consequently, the script exposes an unrestricted interactive root-command channel and then resumes its remaining commands after that shell exits, potentially under the original privileges. The behavior also conflicts with the documented claim that the script automatically switches to root before executing subsequent commands. Root access is therefore both excessive and incorrectly implemented. ### Attack Path 1. A user or automation agent invokes `shell.sh` for an otherwise routine Android operation. 2. The script executes the standalone `su` command. 3. If root authorization is granted, an interactive root shell is opened. 4. Any party capable of supplying input to that shell can execute arbitrary Android or Linux commands as root. 5. The attacker can read or modify protected data, alter system configuration, remove applications or files, or install additional software. 6. After the interactive shell exits, the script continues, making the privileged interaction less apparent to the caller. ### Impact Assessment Successful exploitation provides unrestricted root-level command execution on the Android device. The affected scope can include protected application data, system settings, installed packages, credentials accessible ...[truncated 174 chars]
- Remediation
- ## Remediation Suggestions - Remove the unconditional standalone `su` invocation. - Run all operations without root unless a specific command demonstrably requires elevated privileges. - For operations that require elevation, invoke a fixed and validated command explicitly through a non-interactive mechanism such as `su -c`, rather than opening an unrestricted shell. - Validate all command arguments before constructing any privileged operation. - Maintain an allowlist of privileged operations and reject unexpected commands or options. - Require explicit user confirmation before destructive privileged actions such as clearing application data, installing packages, or uninstalling packages. - Check command exit statuses and report whether privilege acquisition and the requested operation actually succeeded. - Document the minimum permission requirements for each supported operation.