yashsingh1/xdaforums huggingface dataset:
[Security Discussion] droidvoider:
I'm definitely not an authority on dirtycow and if I'm wrong on any of this I'm actually here to learn first and teach second. Here's what I think.

dirtycow races the privilege section of the kernel using proc memory in a loop by two methods I've seen which are proc or ptrace. It keeps looping with C at a high speed until it wins, and by wins I mean it gets to write to anything you can see! This includes readonly partitions to readonly root owned files, but only what you can read (hidden or no access is no go). So then you patch run-as allowing you to be "a higher privilege user such as but not limited to root", of course at that point you are still limited by context + selinux as well as any additional watchdog type services.

The main repository on github is fairly simple, although I use Ubuntu daily as a programmer. Ubuntu 16.10 + Android NDK + sudo apt-get install build-essential

Enable usb debugging on device, plug it in and confirm you can adb shell into it. (root not required, adb is the Android SDK) -- Android Studio not required

Download the repo and unzip it: https://github.com/timwr/CVE-2016-5195

(take a long look at your phone, definitely back it up and try to remember what it was like)

drop to a shell and type 'make test'

edit: I fixed a compile error when testing on Android 4.42 and saved it into a forked dirtycow repo, here:

https://github.com/droidvoider/CVE-2016-5195
[Security Discussion] matteogeniaccio:
The linux kernel creates a copy of the files in RAM and programs can only work on copies. If a memory page is marked as "dirty", it means that the original file is obsolete and should not be considered valid anymore. The programs will keep using the modified copy and the kernel will try to save the copy to flash if it is writable.

Dirtycow alone is simply a read-only bypass exploit, but you can do more with it.

1) You can "update" the working memory of an executable while it is running, for example I used it to modify the init process and load a custom selinux policy

2) you can update your /sepolicy file and trigger a reload.

3) you can update a service that can be triggered at will, for example dnsmasq that starts when you enable wifi tethering.
[Security Discussion] droidvoider:
Thanks your wisdom helped me with direction as I am noticing I can't change anything valid and I'm not seeing how the things are being changed back, but I change them for a split second. Trying to get root on my AT&T Note 5 Android 6.01. What you said about updating the memory sounds about as fun as it gets I think I will research how to find the memory of a running app tomorrow. I don't know that I'm smart enough to get elevated privileges enough to remove AT&T apps for those folks seeking other carriers/trapped by bloat. But I am having a lot of fun with this exploit from 4.42 to 6.01 and I finally have root for my firetv stick again, life is good for tinkers right now.
[Security Discussion] matteogeniaccio:
The galaxy note 5 should support the knox sdk.

I used it to create my app, now I can:

- block bloatware app

- block specific component of an app (for example the ads component)

- create a system wide ad blocker

- create a firewall

- customize phone graphics.

If you know how to modify and compile java I can send you my source code.

Also, on your phone you can use "package disabler pro" that allows you to disable system apps (be careful not to remove really needed apps). You can find it on the play store
[Security Discussion] droidvoider:
I downloaded the Samsung SDK but I didn't think it was powerful enough to do what I wanted, I would definitely love to see your version. On another note I'm playing around in /proc/# and figuring my way through this stuff it is fun if not really powerful also. By the way I think most copies of dirtycow.c should have #include <errno.h> but it is largely missed, or I could have looked at the code wrong. It looks like without it we are using glibc or the default c library, tired, names of things running together lol
[Security Discussion] DrZener:
Got a device with no read permission on wpa_supplicant, dhcpd, dnmasq, hostapd and many other ELFs in /system/bin.

Suggestions for candidates (I'm on arm64-v8)?
[Security Discussion] elliwigy:
can you dump the contents of the sepolicy into a text file? then you can easily see what binaries have a context you need to achieve what you want then dirty cow it to spawn a form of root shell.. keep in mind not all contexts will work as you need it but it definitely helps narrow down a list since theres many binaries..

not to mention if its a newer device make sure dirtycow isnt patched or else youre wasting your time. Even if you find the right context and dirtycow isnt patched youll need to find a way around other security measures as well. Especially on MM and above.
[Security Discussion] Paleskin:
Any ideas on editing and saving build prop using this exploit On lollipop 32 bit?
[Security Discussion] DrZener:
Is there an easy way to "unpack" sepolicy into a more readable format to chech which file have the right context to read init?
[Security Discussion] Matt07211:
Assuming you have another rooted phone (or emulator), you can dump it with Chainfires supolicy tool (Not sure if other tools can do this though). Like so:

supolicy --dumpav [infile] >> sepolicy-dump.txt

Infile is the Sepolicy you want to dump, let's say you are using a different phone from the one you want to dump the Sepolicy from you can, on the phone you need the Sepolicy dumped from "adb pull sepolicy" and then on the phone that has Chainfires tool available you can do "adb push sepolicy /data/temp/local/"

So the above command you can then substitute /data/local/tmp/sepolicy" as the infile.
[Security Discussion] elliwigy:
long time no talk buddy lol.. so basically he needs to pull his sepolicy then push it to a device that can use chainfires tool and push the sepolicy to the tmp folder to dump it using the dumpav command..

i forgot how we did it since its been a while haha
[Security Discussion] Matt07211:
Yea, been a while. Yep you hit the nail on the head, if he has a rooted device he can really put the file anywhere he wants, I just said tmp cause it's the easiest and creates the less hassle.

Still Using the v20 or have you moved onto an axon7? ( ͡° ͜ʖ ͡°)
[Security Discussion] elliwigy:
haha f axon bro.. v20 here.. im gonna most likely jump to the S8 however lol
[Security Discussion] droidvoider:
If you use this tool or the source please give credit to the author: freddierice

https://xdaforums.com/general/security/farm-root-recovery-image-pulling-t3490089

(See above post for details, I didn't realize he was a member here and I rather keep things on his thread)

edit: I moved my changes and fixes to this thread. Samsung S7, and now Note 5, owners please see proper thread for this tool.
[Security Discussion] zjbggz:
Hi!

I have written a program for my mobile for getting root based in gist.github.com/scumjr/17d91f20f73157c722ba2aea702985d2, but I have modifed for armv7. The program finish succesfully, the 'id' linux command show:

I have read about context=u:r:shell:s0, I think is about SElinux protection, where can I found info about that? how can I bypass that protection?
[Security Discussion] Matt07211:
It's called a file context and that's what your running under. So let's say shell can do a,e and f tasks, where system_server can do a,b,c, init can only do x,y,z. Basically it limits rogue tasks that could be used to negatively impact a system (E.g. privlage escalation).

I suggest you read up on selinux from the Gentoo/arch Linux wikis, I'd also suggest dumping your sepolicy contents to allow you to see what file contexts have what permissions, allowing you to better target the right context needed to evaluate your privlage to a higher level.
[Security Discussion] elliwigy:
so baaically you need shell to dirty cow system server then find another context to dirtycow so you can gain access to init..

this unfortunately is only a small start to the task of gaining full root as you cannot touch init without a system crash.. i am sure there are methods to sort of reload it or just reload a modified sepolicy but its above my pay grade and needs to be done very carefully as it is very finnicky and will crash if not done just right..

but if you could manage to somehow reload the sepolicy thatd be good news for you to an extent lol

once you gain access to init you really need a strong understanding of linux/android code, selinux, boot chain etc. to get anywhere
[Security Discussion] haxy:
I'm still trying to figure out a way to spawn a shell. As a reminder, I cannot access developer settings, cannot install any apks, ADB is disabled, but I do have a built in internet browser. You mentioned I could use "meterpreter or netcat or reverse PHP shells" but can't find a tutorial on how to use these to spawn a shell. Do you have any more suggestions? Getting a shell is literally the only thing left for me to overcome. Is there a way to run exploits through the browser - to maybe enable ADB over wifi without having to access developer settings? Any help would GREATLY be appreciated. I'd also be more than willing to donate to anyone who has an idea. Thanks in advance!
[Security Discussion] trjv:
Hit me up on Skype and I'll help you out @ therealjayvi90
[Security Discussion] miscellaneousmemphian:
ZTE z828tl works perfectly slight freeze but upon navigating back to the CrooWt you will see the root status. i turned bluetooth off after root on the first go around and a reboot occurred a few minutes after but has not occurred again since i did not turn bluetooth off the secound time.
[Security Discussion] tcpcd:
this is temporary root, is there any way to pull boot.img and aboot.img
[Security Discussion] Matt07211:
The Linux dd command
[Security Discussion] tcpcd:
i tried but getting permission denied error

also tried with farm-root and VIKIROOT both not working.
[Security Discussion] Matt07211:
So find a selinux context that has block_read/write access. For example the v20, the file context that had that permission was the ATD context.

Dump the contents of your sepolicy file and Search through the dump till you find what you need. I've post instructions on how to Dump earlier in this thread
[Security Discussion] tcpcd:
can you give me post id where you explained

thanks
[Security Discussion] Matt07211:
https://xdaforums.com/general/security/dirty-cow-t3484879/post71248171

2 pages back
[Security Discussion] tcpcd:
Gettinr error:

shell@CPI:/ # supolicy
sh: supolicy: not found
[Security Discussion] Matt07211:
Do you have Chainfires supolicy tool?

Depends on if the tool path is in your terminals emulators PATH.

If you cant find it go

cd /su/bin/

Then run the command, cause that's where the supolicy tool is located if using Chainfires systemless root.
[Security Discussion] tcpcd:
that also not found :crying:

http://pastebin.com/yUVXh6p2
[Security Discussion] Matt07211:
Are you running a device (or emulator) rooted with Chainfires root package?
[Security Discussion] tcpcd:
no my device is not rooted.
[Security Discussion] Matt07211:
If you read the past original post I referred you to it said to copy the sepolicy of the device that you want to Dirty Cow and place it onto a device that is rooted (A physical device or emulator) so you can dump the contents.

Sorry I assumed you where running it on a second device that was rooted due to the fact that you had "#" in one of your replys (# = Usually signifys root).

Gimmie a moment to find you a link for how to do it on an emulator.

Edit:

https://xdaforums.com/apps/supersu/patching-sepolicy-supolicy-tool-modifed-t3462922/

Here the thread that will help with using the supolicy tool with an emulator.

adb push libsupol.so /system/lib/libsupol.so
adb shell chmod 0644 /system/lib/libsupol.so
adb push /system/xbin/supolicy
adb shell chmod 0755 /system/xbin/supolicy
adb push supolicy /data/local/tmp/supolicy
adb shell chmod 0755 /data/local/tmp/supolicy

adb push sepolicy /data/local/tmp/sepolicy
adb shell
cd /data/local/tmp
chmod 0755 supolicy
LD_LIBRARY_PATH=/data/local/tmp:$LD_LIBRARY_PATH ./supolicy <Command Syntax Here>
[Security Discussion] tcpcd:
okay checking

anyway is this possible to obtain root in my device>> https://xdaforums.com/general/rooting-roms/modify-ota-zip-to-gain-root-access-t3572202
[Security Discussion] Matt07211:
Let's move this conversation to your Thread
[Security Discussion] a99888:
can I use Dirtycow to write 0 in /proc/sys/kernel/kptr_restrict?

My phone is not root
[Security Discussion] droidvoider:
Maybe if you hack toolbox.c to wait for something with the correct context + root to come through then fork off a dcow call.
[Security Discussion] billydroid:
I've not been following this thread. And I'm sorry if I'm butting in on actual development of dirty cow as viable exploit.

But is it possible to gain temp root with dirty cow? I have an S8+. Just trying to find a path to full root.
[Security Discussion] elliwigy:
no... lol dirty cow has been patched since i think Dec. or Jan.
[Security Discussion] billydroid:
Lol...well there you go then. Like I said I haven't been paying attention to it at all.
[Security Discussion] vampirefo:
What program is this? I need a free arm disassembler.
[Security Discussion] Fobos531:
That's most probably IDA PRO Disassembler.
[Security Discussion] vampirefo:
Yeah, that's not free though.
[Security Discussion] reas0n:
Works on Xperia Z3, doesn't work on Nexus 6P with latest 7.0 :silly:

Now we should replace for example app_process to root a phone (I actually don't have the knowledge about it)
[Security Discussion] i1135t:
What about compiling a binary of "screen" and have the exploited sh root bin execute screen to create a root shell that you can interface with?
[Security Discussion] matteogeniaccio:
Right now my priority is elevating privileges, then I'll try to maintain them :)

I obtained insmod privileges and tried to load my kernel module.

It failed with the following kernel message:

[ 2699.999247] TIMA: lkmauth--launch the tzapp to check kernel module; module len is 25328
[ 2699.999272] TIMA: lkmauth -- hdr before kreq is : f9bd3000
[ 2699.999293] TIMA: lkmauth--send cmd (tima_lkm) cmdlen(304:320), rsplen(264:320) id 0x00050000, req (0xCFFFE000), rsp(0xCFFFE140), module_start_addr(0xF9BD3000) module_len 25328
[ 2700.003527] scm call by lkmauth
[ 2700.021163] TIMA: lkmauth--verification failed -1
[ 2700.021192] TIMA: MSG=lkm_modified; result (TIMA_RESULT=MSG=lkm_modified;)

If I'm not mistaken, this means that the module needs to be digitally signed.

That approach is probably a dead end.
[Security Discussion] christianrodher:
1|shell@R1_HD:/ $ /data/local/tmp/busybox nc 127.0.0.1 -p 11111

nc: can't connect to remote host (127.0.0.1): Connection refused

1|shell@R1_HD:/ $ /data/local/tmp/busybox nc localhost -p 11111

nc: bad address 'localhost'

1|shell@R1_HD:/ $

going to compile a standalone nc to try since the BLU R1 HD doesn't have one
[Security Discussion] matteogeniaccio:
I made a stupid mistake.

The file I uploaded listens on port 11112, not 11111.

also, after you enabled the wifi tethering, run a "netstat" so we can see the result
[Security Discussion] a___:
With root privileges through your dnsmasq shell, wouldn't you be able to create a /system/bin/su with setuid permission?
[Security Discussion] matteogeniaccio:
The selinux policy would prevent it from doing its stuff.
[Security Discussion] christianrodher:
shell@R1_HD:/ $ data/local/tmp/busybox nc 127.0.0.1 11112

ciao

shell@R1_HD:/ $

it auto exist instant.
[Security Discussion] matteogeniaccio:
The "ciao" means that the daemon got executed and was listening on that port.

It seems that the execl failed, which is causing the disconnection.

As an alternative I would try patching /system/bin/wpa_supplicant or hostapd

Let me know it works for you.

Another candidate is fsck_msdos, which can be triggered by remounting the sdcard in the android settings. The problem is that it doesn't have the permissions to bind a socket but you can use it to execute something else.
[Security Discussion] christianrodher:
Selinux prevents replacing fsck_msdos or any other with a script.sh to install supersu? Or no one has tried?
[Security Discussion] freddierice:
I just tried. I couldn't remount /system from fsck_msdos's sepolicy.

I'm currently downloading 6.0.1 r3 for the selinux tools. I'm thinking we can use dirtycow to give ourselves a defacto permissive :D.
[Security Discussion] tomtom1265:
I tried on Intel device, doesn't work I only need temp root, so I can pull boot.img from device, from there I can repack and flash modified boot.img to get root.
[Security Discussion] freddierice:
We are all trying to get said temp root. SELinux is getting in the way.
[Security Discussion] tomtom1265:
I though the poster I quoted got shell root, which is temp root, if I could get shell root I could pull boot.img.

Can you get shell root?
[Security Discussion] freddierice:
No, we are stuck in dnsmasq root

uid=0(root) gid=0(root) groups=0(root) context=u:r:dnsmasq:s0
[Security Discussion] acejavelin:
Ran across this today... supposedly it is working exploit to root anything?!?! Untested...

https://github.com/timwr/CVE-2016-5195
[Security Discussion] tomtom1265:
Do you know how to compile it and use it to get root? I see no instructions on how to do that, so my guess it doesn't work.
[Security Discussion] acejavelin:
I don't... Probably won't get to look at until Sunday, but the Readme looks like you just build it, move it to the directory on the device and give it executable permission and run it, whoalla root, according to the poster where I found it on G+... but I could be wrong and I don't necessarily believe it's possible. Note the Readme also says "proof of concept" so take it with a grain of salt.
[Security Discussion] tomtom1265:
I tried to compile it, doesn't compile, that's why I ask if you knew how, as it doesn't do anything the way it is.
[Security Discussion] dlradlt:
Won't work on locked bl

Your boot.img would not be digitally signed properly and if you flash it to your phone it likely won't boot.

The temp root method occurs after boot and only modify's system

:good:

Good work though
[Security Discussion] clothtalklp:
I am rooting an LG V20 and following the thread recowvery unlock your V20/G5 potential now with twrp!

And it's sends me to a GitHub link where after pushing 4 files and a couple commands asked me to exit and enter

adb logcat -s recowvery

I've tried this twice and both times it says

-------begining of system

-------begining of main

And then nothing? I could really use some help
[Security Discussion] elliwigy:
I would think the actual recowverry thread is your best bet to get assistance..... I also assume your v20 is the tmobile variant
[Security Discussion] tcpcd:
okay. can dirtycow able to fetch appsboot.mbn file from rom??
[Security Discussion] jayenashar:
[MENTION=3976779]Scorpius666[/MENTION] Please forgive me if this has already been answered somewhere else. I can see that most partitions are mounted nosuid, except /system, so I assume there are suid files in /system. So could you write to a file in /system (which I know is read-only) by writing to /dev/block/dm-0 ? Yeah it requires you to have code that can traverse ext4, but it seems like you should be able to write to /system via /dev/block/dm-0 (maybe even add a new file instead of writing an existing one). Is there something on boot that checks /dev/block/dm-0 for modification? If yes, then maybe just write it, run stuff as root, then write it back to the original? Would you have to write the whole of /dev/block/dm-0 or does dirtycow let you only write a few blocks? I guess you need to be sure to `sync` before and after your writes in case something is cached by ext4?
[Security Discussion] LLStarks:
There's a new Dirty COW

https://medium.com/bindecy/huge-dirty-cow-cve-2017-1000405-110eca132de0

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000405
[Security Discussion] trjv:
I love you for this
[Security Discussion] ztotherad:
I'd love to see this active on the VZW variant of the Google Pixel. I may have to do some reading/digging and see if this is possible. I'm running the Dev Preview 2 for Oreo 8.1.0 stock rom, so I don't know if that matters since it's patched with the November security update, but hell worth a try right?
[Security Discussion] trjv:
Unfortunately for now I don't think this is able to be used on Android because it requires the use of huge pages in memory, of which Android lacks afaik.

I'm digging into possible options though; it was unfortunate how quickly the original exploit was patched, this was a fun one :/
[Security Discussion] ztotherad:
yeah, I'd love to see this live, cause the lack of root sucks hardcore.
[Security Discussion] acejavelin:
OP says here it is, compiled: https://mega.nz/#!2FInAbTa!3YWaK7PCVb2uaa1uoNorJQ_Zl29i3Z-EY51bJq0eYiA

From this post: https://plus.google.com/+xda/posts/McszQE9YDai
[Security Discussion] tomtom1265:
Thanks but doesn't work.

I tried them all they don't do anything, anyway thanks for trying.

$ adb push ./x86_64/dirtycow /data/local/tmp/dirtycow
230 KB/s (10192 bytes in 0.043s)
$ adb shell chmod 755 /data/local/tmp/dirtycow
$ adb shell /data/local/tmp/dirtycow
/system/bin/sh: /data/local/tmp/dirtycow: No such file or directory
$

---------- Post added at 07:23 PM ---------- Previous post was at 06:32 PM ----------

Ok, I compiled dirtycow myself, for what ever reason no one wants to say how to compile.

../x86/bin/clang -llog -DDEBUG -fPIE -fPIE -pie dirtycow.c -o dirtycow

This binary now runs, but doesn't root anything.

adb shell '/data/local/tmp/dirtycow /system/bin/run-as /data/local/tmp/rw'

/data/local/tmp/dirtycow /system/bin/run-as /data/local/tmp/rw'
warning: new file size (205) and file old size (9568) differ

size 9568

[*] mmap 0xf7493000
[*] exploit (patch)
[*] currently 0xf7493000=464c457f
[*] madvise = 0xf7493000 9568
[*] madvise = 0 1048576
[*] /proc/self/mem -1048576 1048576
[*] exploited 0xf7493000=464c457f

Desktop/arm/CVE-2016-5195-oldcow$ adb shell /system/bin/run-as
run-as: Usage:
run-as <package-name> [--user <uid>] <command> [<args>]

The way this exploit is suppose to work it copies any file from /data/local/tmp to system, in this case /system/bin/run-as'

Replacing /system/bin/run-as with /data/local/tmp/rw while it claims it does, it doesn't, when running /system/bin/run-as after words, it should run the rw script rather run-as
[Security Discussion] Agimax:
The exploit works fine overwriting files**, i ran the command and just wrote a modified sound file for louder audio to my Sprint G5. Woo hoo!

I didn't copy the run-as file to the bin directory. Just use the dirtycow file to write files you want places.

See my screenshot.

** NOTE: Files revert back after reboot
[Security Discussion] refi64:
So then could someone (temporarily) copy over an su binary and then use BootUnlocker to unlock without wipe, or use the TWRP app to get that recovery and flash a permanent root zip through that?

(Sorry if this has already been answered; I just subscribed to this thread.)
[Security Discussion] Scorpius666:
You can't create new files with dirty cow. Only replace existing files. You can't change owner, change attributes, etc. To install a su file you need:

exploit to gain root access in at least the u:r:kernel:s0 SELinux context

ability to remount /system as read/write

create the /system/xbin/su file

So far it has not been easy. We can get root access, but in the wrong SELinux context, so basically it's a root that can't write a file.

I'm not saying it's not possible to gain the right root access but we're still far away from it. At least I am.
[Security Discussion] tomtom1265:
Doesn't work for me as I clearly showed filed claimed to be overwritten but wasn't.

---------- Post added at 09:33 PM ---------- Previous post was at 09:22 PM ----------

I think everyone is, many claims but no root that can be confirmed.