源代码即将推出™
基于 cve-2023-33107 的 Pico 4 设备开源内核漏洞利用程序
Usage: picohaxx [options] [-- <final command>]
GENERAL OPTIONS:
-help Show this help menu
-v Print build timestamp and exit
-unroot unroot adbd
-nobash once adb root is unlocked, the default is
to pivot to a more capable embedded bash shell
with init and persistent history
-nadbd dont patch adbd
-nftpd disable internal root ftpd daemon
DEBUG/TEST:
-dbg verbose debug output, use twice for even more
-force run the exploit again, even though you're already root
-sound/-nosound plays a sound to indicate various events
-dump dump 64MB of memory after PTE spray stage
-ttest test terminal input
-sim simulated dry-run of the final exploit stage
-marathon do extra laps on the task walk for stability testing,
can be used multiple times
CUSTOM POST-EXPLOIT EXEC:
-- <cmd> ... Everything after '--' is the final command to execve into.
picohaxx -- /system/bin/sh -i
The default post exploit behavior (on the first run) is to:
patch adb root, enable persistent tcp 5555 and spawn a root ftp on port 21.
注意:adbd 在应用 root 补丁后需要重启。因此,如果你在 adb shell 内运行该漏洞利用程序, 你的连接将在首次运行后断开。重新连接后,adb shell 将默认以 root 身份运行, 你可以使用 adb unroot/adb root 来切换默认的 shell 模式。
支持的 Pico 4 操作系统版本:中文版 5.2.0 至 5.11.0,或全球版 5.9.9。 截至撰写本文时,任何更新的版本都可以通过 edl 降级。