Bypassing CVE-2023-21257 Replacing Intune-Managed Android Wo...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://jgnr.ch/sites/android_enterprise.html
• Blog Title: Bypassing CVE-2023-21257: Replacing Intune-Managed Android Work Profile Apps via Finsky and Required-App Auto-Install
• Suggested Section: Mobile Pentesting -> Android Applications Pentesting (new subpage on 'Android Enterprise Work Profile / MDM Bypasses' or under a subsection like 'Android Enterprise & Work Profile Attacks')

🎯 Content Summary

Overview
This blog post shows how to install an arbitrary Android app into an Android Enterprise Work Profile on a BYOD device after Google’s patch for CVE-2023-21257, by abusing Android Studio’s multi-user install behavior, Microsoft Intune’s required/auto-install apps, and the Google Play Store service (Finsky) version resolution logic. The attacker replaces a managed Work Profile app (e.g. Workday) with a malicious app having the same package name and...

🔧 Technical Details

Trick 1 – Leveraging Android multi-user architecture and “install for all users”
Android Enterprise Work Profiles are separate Android users (e.g. user 0 = owner, user 1 = Work Profile). Directly installing into a Work Profile user with commands like adb install --user 1 <apk> fails under typical enterprise restrictions, producing errors such as java.lang.SecurityException: Shell does not have permission to access user 1. However, deploying via Android Studio with the run configuration set to “install for all users” uses the INSTALL_ALL_USERS path in PackageManagerService. Pre-patch, this allowed APKs to be installed for both personal and Work Profile users, effectively sidestepping per-user ADB permission checks. Post-patch, this path is policy-gated but still drives the rest of the exploit chain because it pushes the malicious APK into the system’s install flow (including temp directories) for the Work Pro...

🤖 Agent Actions

Summary:

• Added a dedicated “Android Enterprise & Work Profile Attacks” section that links to the new technique page from the main Android pentesting index.
• Authored a new page detailing how to replace Intune-required Work Profile apps post-CVE-2023-21257 by abusing Android Studio’s INSTALL_ALL_USERS path, Intune compliance refresh, and Finsky’s version resolution logic, including prerequisites, commands, impact, detection ideas, and mitigations with proper references.

Tests: Not run (documentation-only changes).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://jgnr.ch/sites/android_enterprise.html

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting -> Android Applications Pentesting (new subpage on 'Android Enterprise Work Profile / MDM Bypasses' or under a subsection like 'Android Enterprise & Work Profile Attacks')".

Repository Maintenance:

• MD Files Formatting: 914 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge