[AT&T Samsung Galaxy S 5] TheBadgers:
Hey guys, this is my first post on XDA, so I hope I have it in the correct format and place; if not, just politely let me know and I will adjust the post accordingly. This is also just a theory I have on how to achieve root with the OTA 5.0 update, and would like the community's feedback on whether this would work or not.

First, let me start by saying that I don't have much experience with rooting, but I have done a lot of reading and research about how it works and feel like I have a good understanding of how it works. I do however, have a lot of programming and computer security experience, so I like to stay current on active vulnerabilities and such, whether it be on mobile devices or computers.

So I was stupid took the OTA update to 5.0 before checking to see if anyone managed to achieve root, to find out that 5.0 root hasn't been achieved on my model yet so I started to look for a way to do it myself. As I was browsing around for general info on the G900A, the keyboard vulnerability stuck out to me immediately.

To summarize the vuln: "A remote attacker capable of controlling a user’s network traffic can manipulate the keyboard update mechanism on Samsung phones and execute code as a privileged (system) user on the target’s phone. This can be exploited in a manner that requires no user interaction — a user does not have to explicitly choose to download a languagePack update to be exploited." So essentially, if I were to set up my own rogue Wi-Fi access point, I'd be able to execute any code I want in a privileged context.

On NowSecure's website, they go into deep detail on the specific steps of recreating this exploit, but to summarize here are the general steps:

Step 1:

Set a global Wi-Fi proxy and point our device at mitmproxy on our computer

(Essentially creating your own controlled Man-In-The-Middle attack for your phone)

Step 2:

Write a script that feeds the phone a zip containing our payload upon download request from the keyboard

Step 3:

Precompute the SHA1 of our payload and create a custom manifest file containing the SHA1

Add path traversal to the payload and attempt to write to /data/

Now, we have an arbitrary file write as system user. Next, we attempt to turn this file write ability into code execution.

Step 4:

Choose DeviceTest.apk as our target to exploit (this file is owned by a group system and is automatically invoked)

Generate an odex file with code for a BroadcastReceiver named com.sec.factory.entry.FactoryTestBroadcastReceiver

The exploit source will look like this:

➜cat FactoryTestBroadcastReceiver.java | head

package com.sec.factory.entry;
import java.lang.Class;
import java.io.File;
import android.content.BroadcastReceiver;
import android.content.Context;
import android.content.Intent;
import android.util.Log;

public class FactoryTestBroadcastReceiver extends BroadcastReceiver {
//Exploit code here
}

Step 5:

Once the payload is created, we compile it and run it through the DalvikExchange (dx) tool to get a .jar file which includes our dalvik bytecode

Push our jar to our phone and generate the odex using

ANDROID_DATA=/data/local/tmp dalvikvm -cp /data/local/tmp/<payload.jar> com.sec.factory.entry.FactoryTestBroadcastReceiver

This will put our cache file in a directory that is readable by the shell user.

Step 6:

Patch our .odex to contain the CRC32 and modification time from the original APK's zip file so it appears to be generated from the original DeviceTest.apk

Step 7:

Trigger the vulnerability to execute the payload

Here is the fully detailed article .

So my question is: would it be feasible to use this vuln to create a payload that injects root into the system?

To check to see if you're vulnerable to this exploit

Download a terminal emulator on your phone and type:

ls -l /system/app/SamsungIME*

If you see a line that looks like:

-rw-r--r-- root root 7243414 2008-08-01 07:00 SamsungIME.apk

and the date is older than 2015-03-16 you are vulnerable.

UPDATE: As of July 1, 2015, AT&T appears to have rolled out a small OTA update that updates the bootloader from OC4 to OF2 as well as patches the keyboard vulnerability. As long as you don't take the update and the date modified for SamsungIME.apk is earlier than 2015-03-16, this vulnerability could still be of some potential benefit.