{"id":52,"date":"2025-02-12T14:30:35","date_gmt":"2025-02-12T14:30:35","guid":{"rendered":"https:\/\/jasveermaan.com\/?p=52"},"modified":"2026-03-13T10:07:16","modified_gmt":"2026-03-13T10:07:16","slug":"exploiting-android-exported-activities-for-root-bypass","status":"publish","type":"post","link":"https:\/\/jasveermaan.com\/index.php\/2025\/02\/12\/exploiting-android-exported-activities-for-root-bypass\/","title":{"rendered":"Intentional Exposure: Exploiting Android Exported Activities for Root Detection Bypass"},"content":{"rendered":"\n<p>Hi readers,<\/p>\n\n\n\n<p>it&#8217;s been a while since my last post, particularly after migrating to the new server. This time, I&#8217;d like to share an interesting, yet surprisingly simple, root detection bypass that I recently discovered. The unusual behavior is what truly caught my attention; I hadn&#8217;t encountered anything quite like it before.<\/p>\n\n\n\n<p>Over a weekend, a friend of mine, relatively new to cybersecurity, reached out for assistance. He was struggling to bypass the root detection mechanisms in an Android application.<\/p>\n\n\n\n<p>We quickly jumped on a call, and he shared his screen as he attempted to use Objection and Frida to bypass the detection. However, as shown in the figure below, Objection failed to bypass the root detection:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"3004\" height=\"1802\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2025\/02\/image-1.png\" alt=\"\" class=\"wp-image-54\"\/><\/figure>\n\n\n\n<p>As you can see in the figure above, Objection is running and hasn&#8217;t been terminated. This observation prompted me to reverse engineer the application, where I discovered that Zimperium was being utilized for root detection.<\/p>\n\n\n\n<p>In my experience with Zimperium, applications typically force-close upon detecting a hooking attempt, which would also terminate Objection. However, this wasn&#8217;t the case here, making the behavior quite unusual and worthy of further investigation.<\/p>\n\n\n\n<p>While analyzing the <code>AndroidManifest.xml<\/code> file, I noticed an activity with <code>exported=true<\/code>, as displayed in the figure below:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1868\" height=\"300\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2025\/02\/image.png\" alt=\"\" class=\"wp-image-53\"\/><\/figure>\n\n\n\n<p>So, we launched the mobile application and then executed the following command to launch the exported activity via Objection, in an attempt to bypass the root detection screen:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<pre class=\"wp-block-preformatted\">android intent launch_activity &lt;ACTIVITY_NAME&gt;<\/pre>\n<\/blockquote>\n\n\n\n<p>The figure below shows the command being executed successfully:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1874\" height=\"821\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2025\/02\/image-3.png\" alt=\"\" class=\"wp-image-56\"\/><\/figure>\n\n\n\n<p>The figure below demonstrates the successful bypass. We were able to use the application without any issues related to root detection.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"476\" height=\"929\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2025\/02\/image-4.png\" alt=\"\" class=\"wp-image-57\"\/><\/figure>\n\n\n\n<p>Note: This write-up is being published a couple of months after the discovery. The application is no longer active and requires an update. Additionally, the vulnerability has been patched by the application developers.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hi readers, it&#8217;s been a while since my last post, particularly after migrating to the new server. This time, I&#8217;d like to share an interesting, yet surprisingly simple, root detection bypass that I recently discovered. The unusual behavior is what truly caught my attention; I hadn&#8217;t encountered anything quite like it before. Over a weekend, &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/jasveermaan.com\/index.php\/2025\/02\/12\/exploiting-android-exported-activities-for-root-bypass\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Intentional Exposure: Exploiting Android Exported Activities for Root Detection Bypass&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-52","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/posts\/52","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/comments?post=52"}],"version-history":[{"count":4,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/posts\/52\/revisions"}],"predecessor-version":[{"id":142,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/posts\/52\/revisions\/142"}],"wp:attachment":[{"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/media?parent=52"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/categories?post=52"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/tags?post=52"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}