yashsingh1/xdaforums huggingface dataset:
[Security Discussion] RenaKunisaki:
Don't know yet.

I got my LG G4 back from being repaired for boot loop issue (took 2 months!) and now it's on Marshmallow. Haven't tried the old dd method yet but played with this dirtycow exploit. It seems like it can give you usermode code execution in just about every process (including init, which gives you root), but that's not very helpful due to selinux. Bypassing that I think won't be easy, but maybe there's another way? Can we talk to TrustZone from here and exploit that?

By modifying VIKIROOT a bit I was able to inject shellcode into init and create files under /data/local/tmp (and crash the phone a lot), but that's about it. Even though it's running as root, things like connecting to a socket or opening /dev/pts/n fail with EACCES. Very little you can actually do here...

timwr's version (if I understand it correctly) works differently, using the exploit to overwrite read-only files in memory, which allows things like executing run-as to get a "root" shell, but again selinux prevents doing much of anything there.

I was able to copy /sepolicy and /system/build.prop to SD card but I don't really know what to do with those. :p Probably best bet is if we can inject into a different SE context and find a weakness there, or clobber files to make some service behave differently.

One thing you can do from a restricted-root shell is launch any activity. So you can open part of LG's "hidden menu" which seems to normally be hidden even within the menu:

am start com.lge.hiddenmenu/.updt.ADBShellAppActivity

Without root, that fails with a permission error. But it doesn't appear to be very useful, anyway. (You can also do

am start com.lge.hiddenmenu/.HiddenMenu

to get the main menu, but that's already accessible by typing codes on the dialer.)

Also I still do have a full eMMC image from the device before I sent it in, when it was on 5.x and rooted. Still looking into things on it...
[Security Discussion] RenaKunisaki:
So if I'm understanding correctly, with this exploit we can map any file into memory (only read permission is needed), bypass the copy-on-write mechanism, and modify the underlying shared memory? So we can inject code into other processes by hot-patching system libraries, and even calls like read() will return our modified version, allowing soft-patching any file?

Someone mentioned there's a setprop command to reload sepolicy, so could we not just call that after soft-patching /sepolicy file to be more lenient?
[Security Discussion] Ricky Divjakovski:
i was able to patch the run-as binary with dirtycow, just cant set uid0 for some reason?

selinux is permissive.
[Security Discussion] hydroman202:
Can this dirty cow change files without a root shell, (#) that thing?
[Security Discussion] RenaKunisaki:
In theory it can. Making those changes stick can be trouble due to selinux, bootloader filesystem verification, etc...
[Security Discussion] elliwigy:
i have read some places that it has been done but it has to be done very carefully as its very easy to make it crash while reloading the sepolicy.. this also doesnt necessarily mean the changes remain after a reboot but could mean some form of temp root
[Security Discussion] RenaKunisaki:
Even a temporary root with selinux disabled should let us modify the system partition, though? Or does doing that cause boot failures?
[Security Discussion] rohitSehgal:
I would like to go through that video. As i am interested in building such exploit app. Can you please share with me that link?
[Security Discussion] elliwigy:
i believe it wouldnt have a failure but on newer OS it will roll back the changes when it reboots.. most likely need temp root without a crash then attack the BL or somehow have it load the modified sepolicy into ram at each boot somehow
[Security Discussion] n1sh1:
I have tried this on Android 5.1.1 with non-rooted phone and SElinux disabled also. I am able to alter dnsmasq binary but whenever I start wifi tethering, I am not able to see open port 11112 in "netstat" command, also "dnsmasq" process is running under "nobody" not under "root" when i checked using "ps" command. Is there anything am I missed or what?
[Security Discussion] matteogeniaccio:
On some mobile phones dnsmasq is running as nobody so it is useless.

You could use the process that performs the initial check and mount of the sdcard, it can be triggered by unmounting and remounting the external sd from the system settings.

PS. also check which process is started when you enable wifi tethering, it could be a good pivot point too
[Security Discussion] Paleskin:
is there a way to gain write access into system folder using dirty cow exploit ?
[Security Discussion] elliwigy:
thats a very broad question lol answer is yes however.. but certain contexts might have access to certain files/folders but another context might be able to access everything else for example
[Security Discussion] carlos1984:
whats you youtube username

i searched for what you said but there are more now, can you give me ur yt username so i know im watching the correct one.
[Security Discussion] n1sh1:
Can you elaborate your answer little bit? so that it can help me in some way. It would be a great help.. !
[Security Discussion] elliwigy:
to be honest if you dont know what it means then youve got a lot of learning to do lol.. and im not trying to be rude but i myself dont compile code just have a very basic understanding since i was involved in the v20 root methods..

so lets say you use a run as context.. you can access certain files with but other system files will still be denied so in as example:

1) say run as is dirty cowed but we do not have access to aboot or boot or recovery with run as but it has access to other binaries.

2) use run as to dirty cow atd which has access to the bloxks we need.

3) use atd to dirtycow the aboot with a debug aboot

4) debug aboot has fastboot enabled and is already unlocked so we can now fastboot flash...

this is just a random example that probably doesnt work lol.. but essentially you need to daisy chain dirtycow until you get read access to what you need and then you can write over it..

certain contexts can still be limited but each context you dirty cow should get you closer and closer until you gain read access to what you need..

the v20 was only possible due to having debug firmware.. without it secureboot would have reverted any changes on a reboot.. so on newer devices you need to keep that in mi d since dirtycowing certain files such as init or other items can crash system.. you essentially need to dirtycow something to work in your favor and somehow patch or reload it into memory without crashing and thats only part of the battle
[Security Discussion] trjv:
Oh wow yeah that was like the first day haha. My YouTube channel is GhostlyHaks.
[Security Discussion] Paleskin:
I got me, a haier a16c3h android phone, which is a tough nut to crack, it got locked bootloader, locked usb debug, and background process which reboot the phone in 30 seconds after a temporal root using dirty cow method succeeded

So far I only got temporal root and usb debugging on, but the system folder still in read only mode
[Security Discussion] Matt07211:
File Context in relation to this comments is about selinux. Gentoo wiki has a good write up about it, o suggest you read it.

Basically a file is given a context (E.g. system), that context is only given certain permission to do certain things, thus limiting the ability of files/binarys to do tasks they aren't supposed to.

I suggest you dump the contents of the swpolicy into a text file and look through all the different contexts available until you find one that has the necessary permissions you need.
[Security Discussion] carlos1984:
Thanks man

I actually watched your video, But I am trying it on a Sony Xperia X, I can not get it to work. Model is F5121 running Android 7, I made the mistake of using PC companion to restore it and now it is asking for an email, the guy I bought it from will not reply to me and since I used KIJIJI to buy it, I cannot even see the email of the person I was messaging because Kijiji masks the email address.

I am trying to downgrade it using the androyxe Flashtool but it keeps giving error code.

any help would be greatly appreciated.

---------- Post added at 04:04 PM ---------- Previous post was at 03:13 PM ----------

Hey man , this has nothing to do with android, but I noticed your user name is KennonK, is you name Kennon? Reason I ask is because my son is named Kennon and I have never seen anyone else with that name before?
[Security Discussion] kennonk:
Yep, and I am supposedly named after someone my mom grew up with in San Francisco so there must be a few of us around. I've seen it a lot as a last name but never the first name either. Good call on the name, it has served me well ;)
[Security Discussion] carlos1984:
My step son was named after his bio dad, Ken, apparently his mom thought she was being original, which up until I seen your name I thought it was since I have never seen someone with that name before. Thanks for the reply.
[Security Discussion] matteogeniaccio:
OK,

I achieved root with selinux bypass on a galaxy note 4, marshmallow, arm 32 bit.

Writing the shellcode was a pain.

Tomorrow if you want I'll post the full details, I'm too tired now.

Matteo
[Security Discussion] Zacharee1:
Which variant?
[Security Discussion] matteogeniaccio:
no brand, N910F europe, italy

build: xxu1dpi1

patch: september 2016
[Security Discussion] Root-Maniac:
Unlocked bootloader variant if my memory serves me correctly...
[Security Discussion] matteogeniaccio:
Yes, unlocked variant.

The exploit is reusable and gives a temporary unrestricted root without tripping knox
[Security Discussion] carlos1984:
are you posting here?
[Security Discussion] erfanoabdi:
Oh god thanks

Are you ported Trident ? Right?

Could you please tell me how did you generate init_offset?

more details would be so helpful :D
[Security Discussion] matteogeniaccio:
I used the same approach as trident.

Finding the offset was really difficult. I had to follow init code and match each cpp code line with the assembly.

Ida pro is your friend.

To debug the first shellcode I wrote a little patch that forks Init and executes the shellcode in a child process.
[Security Discussion] erfanoabdi:
Thanks a lot, I really hate reverse engineering and disassemble :(

This looks really hard work, but I'm trying to root Verizon Moto z

Thanks for sharing this :good:

Do you want to make your amazing work (also that little patch) open source?
[Security Discussion] matteogeniaccio:
I'll publish everything when I'm back home.

If you send me your init file I can find the function for you.

You still have to be able to compile the shellcode and put it in place via dirtycow. Right now the process is not automated.
[Security Discussion] erfanoabdi:
Oh god really appreciate it

What function do you want to patch your shell code ?

Selinux policy loading? Or selinux policy warning function?

I guess I have to use Trident shellcode, cause it's arm64 and msm8996 like galaxy s7active in Trident, right?

Here's my init : https://mega.nz/#!KAJxUDRI!s0MWpX0xEuy8KVu0k2USgwVlTNQfX0Mt5IswmXhq5Zc
[Security Discussion] matteogeniaccio:
You can directly use trident.

The function is bootchart_sample(),

I'll try to analyze your init file as soon as possible
[Security Discussion] erfanoabdi:
But I think this function offset of my init device is different

Let me find it, thanks for helping

May I ask you for not spamming this thread, PM you? :laugh:
[Security Discussion] matteogeniaccio:
That's why I asked for your init file,

I can find the offset for you because I already did it on my own.

Once you have the offset and any working shellcode it's trivial to use them
[Security Discussion] matteogeniaccio:
My code is public at the address:

https://github.com/matteoserva/dirtycow-arm32
[Security Discussion] Fobos531:
Is this useful on phones with locked bootloaders?
[Security Discussion] Dzion:
So, I have been playing with this on my galaxy s7 edge snapdragon. Managed to get root and have permission to do pretty much everything except mount as rw. When I do that the phone reboots. My question would be how to go about disabling dm-verity next? Rather... would it be possible without the engboot?
[Security Discussion] hydroman202:
I wish I could figure this root method out, but finding offsets and what not are definitely not my strong points. Is there a chance this could be automated in the near future?
[Security Discussion] elliwigy:
no.. every device is different so itd be pretty difficult to make an automation unless its something you can find that is the same on every device
[Security Discussion] matteogeniaccio:
I don't know but I wouldn't mess with critical files if the bootloader is locked.

I was experimenting with a softer approach: a tmpfs mounted over the main filesystem but right now I'm obtaining only crashes
[Security Discussion] pvineeth97:
Hi! I am able to spawn a temporary root shell using dirtycow but with SELinux Enforced.

Init File: https://drive.google.com/file/d/0B9ZHDklJCY7DM28ySGktb1FnT0E/view?usp=sharing

I am trying to follow the instructions in your github project page. I am unable to find "bootchart_sample()". But I found a similar looking code in the file.

Its kinda not clear. Where should I copy?
[Security Discussion] kenosis:
What is the next step after we got rootshell@ ?
[Security Discussion] Dzion:
For me it's disabling dm-verity on a locked bootloader heh
[Security Discussion] matteogeniaccio:
Hello. Sorry if it was not clear.

The function name was added by me, you should really look only at the function shape or its instructions.

When you open the compiled shellcode with a hex editor, it will show you the AAAA strings. Copy the code between them

I uploaded my compiled files so you can compare yours with mine.
[Security Discussion] pvineeth97:
Thanks buddy.
[Security Discussion] pvineeth97:
I installed "gcc-arm-linux-androideabi" in ubuntu using terminal command "apt-get install gcc-arm-linux-androideabi".

gcc: arm-linux-androideabi-as shellcode.s gives me command not found error.

Edit: Solved! Use "arm-linux-androideabi-as shellcode.s" (without quotes).
[Security Discussion] matteogeniaccio:
Now be careful. The shellcode doesn't include the code to return to caller. You have to add it manually
[Security Discussion] pvineeth97:
How to add the code to return to caller sir?

I patched the init according to your instructions, I got only 4 NOP's against your patched init which has 5 NOP's. I started adding the shellcode in HEXVIEW just after the line "PUSH.W {R4-R11, LR}" or shall I start adding the shell code from the line just after "loc_91B0"?

My patched init: https://drive.google.com/open?id=0B9ZHDklJCY7DQlE1dWpYbmNWWFk
[Security Discussion] matteogeniaccio:
hello, after the two nops add the "POPEQ.W {R4-R11,PC}" instruction.

you can copy it from offset .text:00009526,

put a nop after that instruction then you are done.

Congrats

Update:

Run adb logcat|grep audit or equivalent on your pc, you should now see messages stating that the new policy has been loaded
[Security Discussion] pvineeth97:
Sir I have 4 NOP's but you mentioned 2 NOP's. Which 2 NOP's?
[Security Discussion] matteogeniaccio:
The shellcode terminates with an "add sp, sp, 0x80" and two nops. You have to end it with the pop instruction. Look at the very end of the listing I published on github in the ida directory.
[Security Discussion] pvineeth97:
POPEQ.W {R4-R11,PC}; NOP conversion fails on armconverter.com.

Edit: Just added this "BDE8F08F00BF"
[Security Discussion] matteogeniaccio:
Just select it in ida pro, then go to hex view. It will highlight it for you
[Security Discussion] pvineeth97:
When I try to load it in the root folder of the Android it says "init" is only a read only file system. Where should I copy the modified "init" file? Into /data/local/tmp?
[Security Discussion] matteogeniaccio:
I usually copy it in /storage/emulated/0 (the sdcard), then dirtycow it over /init

Update: don't worry, you have to do all this only the first time, then I'll show you how to automate it from the phone
[Security Discussion] pvineeth97:
I used your dirtycow script. Compiled it. Ran "./dirtycow init init". The first init argument is the init already present in the Android system. The second init argument is the init I patched. So does the script replace the patched init with the default init present in Android system?

What's your method to dirtycow over /init?

(The init file which you see in the image is the patched one)

Can you also elaborate a bit on how you compiled libsepol and sepolicy-inject? When I type "make" it starts but shows errors and stops.
[Security Discussion] matteogeniaccio:
Compile dirtycow with arm-linux-androideabi-gcc.

Move the compiled file in your phone.

If your compiled file is called a.out:

Run

"./a.out /init ./initpatched"

And it will replace the device init with the patched one.

You need read permissions to /init to use dirtycow.

If your shell account does, then you can move all your files in /data/local/tmp and run from here.
[Security Discussion] pvineeth97:
I compiled sh.c using "gcc sh.c -o sh".

I moved all the files into /sdcard. Was trying to execute the compiled file "./sh". It says "Permission Denied" in Android Terminal Emulator.

Even ./a.out /init ./initpatched gives me permission denied.
[Security Discussion] matteogeniaccio:
You have to make it executable.

From adb run this on your device:

"chmod 755 ./a.out"
[Security Discussion] pvineeth97:
I executed it. Now I get this one:
[Security Discussion] matteogeniaccio:
you have to recompile dirtycow with:

"arm-linux-androideabi-gcc -pie ./dirtycow.c"

remember that you have to recompile sh too.
[Security Discussion] pvineeth97:
I compiled it as you said. It ran but with a warning and an error:

I now understand that I need to first spawn the root shell and then attempt replacing the init file. I switched on "Wifi Tethering".Running ./sh gives me a warning like above and gives me a blinking cursor.
[Security Discussion] pvineeth97:
-del-
[Security Discussion] Paleskin:
is there a way to edit build.prop while temp rooted ?
[Security Discussion] Zacharee1:
If you could, it wouldn't have to be a temp root.
[Security Discussion] WeButterTheBread:
Using system apps against the system

Since Dirty Cow can only change the contents of files, would it possible to copy an app, script, or otherwise to the executable of a bloatware app (say NFL mobile or something that came with the phone as a system app)? Then when that app is supposed to open, it executes our code and writes the su binary (or the modded app reboots the phone with system r+w, user runs the app again, app sees r+w system, app installs su, and then we go from there?)
[Security Discussion] elliwigy:
no. its not that simple or it wouldve been done already you first need to dirty cow something with root permission/read access to priv app and then youd need a system app that has write access to install the binaries.. you cant just replace an entire apk. not to mention on later firmwares youd most likely need to reboot to have the app change take affect at which dm verity/secure boot would kick in..

you need to first somehow set permissive and or modify init etc. to disable dm verity/secure boot..

not as simple as just dirty cowing an app
[Security Discussion] WeButterTheBread:
Ah, thank you. My apologies, it was my understanding that if something was a system app it had system access. I also did indeed forget about SELinux and the like. I'm lucky in the fact that my device (to my knowledge) does not have such factors. As to replacing the apk (mind you I have limited experience in this area), I believed that the apps were stored in apk format on the device, except that perhaps parts were extracted to various areas to speed loading of them. My thinking was that if one could overwrite those files, or maybe if the app ran files from its /data/ directory we could replace those. My apologies for any errors in my reasonings.

However, all this said, seems like dirty cow isn't as big as it's hyped up to be, at least on android. With various media outlets saying things such as "new way found to root ALL android phones", one would believe it's as easy as a button click. However that is nit the case.
[Security Discussion] elliwigy:
dirtycow is great but it alone cant necessarily gain root as most know it.. it can be used to gain temp root very easily.. depends on what type of root ppl think about when they read it but it could be used on any vulnerable device for temp root with ease
[Security Discussion] WeButterTheBread:
So could it be used to delete bloatware apps? Or would that need system r+w?
[Security Discussion] kenosis:
Can I replace system fonts by using dirty cow?
[Security Discussion] elliwigy:
you still need a form of root.. even if you could delete anything on later firmwares it will revert back.. in order to delete youd need to somehow get a full adb root shell with rw access to what you want to remove or temp root to give temp root permission to a root explorer

---------- Post added at 09:14 PM ---------- Previous post was at 09:11 PM ----------

not sure.. in theory maybe but most modifications made dont reload until a reboot is done and newer devices will revert back when system is rebooted..

id say if you dont know how dirty cow works or what it can potentially achieve then theres really nothing for you to except hope a dev makes a compatible method for you if ever..

i dont claim to know dirty cow that well but understand the basics
[Security Discussion] droidvoider:
dirtycow isn't the finished tool guys it's the vessel. Speaking from someone on the AT&T Note 5 with a locked bootloader, Android 6.01 selinux enforcing, you can't write to /data/apps it will reboot. You can change /default.prop but you can't even alter a readonly textfile in data/app that you yourself put there on my note 5, it'll simply reboot with no change to file! Even though I can patch binary files on /system/bin to be executable, and make it say hairy gorrilla in the about screen for baseband, something is watching data/apps and likely priv-apps which needs to be disabled. (not my goal, possible tho)

If someone figures out/shares a method to root an Android 6.01 phone with a locked bootloader many of us will likely follow right along. Currently I am over trying to figure that out for the moment and I am creating custom kernel instead, turns out I can flash any boot.img I want on my phone without a check at all! hmmm, think I will!
[Security Discussion] trjv:
The whole point of using dirtycow is that it works in memory, not the physical storage. The thing about memory is that it clears itself upon every reboot so anything you do with this exploit unless you can use it to interact with some other type of file to allow yourself to specifically make other changes you wouldn't normally be able to then nothing will persist through a reboot. If you go look at the dirtycow github there's a newer version used specifically for Android called Vikiroot and I think it will work exactly for your situation.