yashsingh1/xdaforums huggingface dataset:
[Security Discussion] Matt07211:
Their is a write up for compilling dirty cow, backa few pages (believe it's a github readme). As for getting root shells, people are able to, but with the file context and limitations of the file they overwrited, so in a sense people are able to get a root shell, but due to android protections like selinux etc. are unable to do anything meaningful with that root shell. Also another problem is stuff like dm-verity etc. Even if you did manage to modify /system, when you reboot you'll be locked out of the Phone unable to do anything.
[Security Discussion] elliwigy:
i am not trying to modify anything.. just trying to pull a system update i have in the cache/fota folder on my device but get access denied since i dont have a root shell..

so essentially just want to read/pull the file.. not change anything so dont care about a reboot necessarily
[Security Discussion] Matt07211:
DirtyCow expliots in this thread are unable to create/delete files, only overwrite a file. And as I said in the previous post, the file DirtyCow pivots off to run, is then context that the shell takes. So a shell can be UID 0 (root) but it's context can be e.g.untrusted:app etc. So even if you have a "root" shell it will still only have the permissions of the file context you've pivoted off, so unless you find a context with the necessary permissions then you are unable to use that root shell to pull the file onto an sd/computer.
[Security Discussion] Kzawww:
Is it possible to replace file with same name?

I just want to replace some files from system/fonts folder.
[Security Discussion] Matt07211:
Theoretically yes, practically im not a 100% sure, as stuff like dm-verity may get in your way, most people messing around with dirty cow are doing it on a rooted device with that disabled, meaning even though they change system files, they won't be locked out by the security measures.
[Security Discussion] Kzawww:
Thanks for answering, will try it.
[Security Discussion] Matt07211:
Be careful and don't lock your self, see if your phone has dm-verity (and other measures) enabled , if it does then I wouldn't advise you to do it , becuse if the hashsum of the system changes then you'll be locked out of the phone.
[Security Discussion] oF2pks:
Do you believe etc/hosts could be changed (adblocks) on unrooted Intel's tablets, like Yoga tab 3 pro(, without getting error_3 on boot).
[Security Discussion] elliwigy:
dm verity doesnt always mean a lock out.. it could boot in a red state then revert changes so it can boot, that is how my vzw lg v20 is.. but agreed, if this is unknoen he can soft brick and would need a method to restore his device back to a fully stock state for it to boot
[Security Discussion] Matt07211:
True, I was just giving him a warning to look out for stuff like dm-verity (and other measures) as it can cause you to brick the phone if you aren't careful, and unless you have a way to fix it, which I doubt "they" can flash a firmware back as it's probably being performed on a locked phone.
[Security Discussion] elliwigy:
again, that isnt true.. majority of all devices have a legitimate way to reflash official firmware.. samsung odin, lg up etc... also, vzw for example has verizon repair assistant which actually works great for many of their devices..

official firmware typically passes dm verity and other checks and is one if the main reasons they exist

edit: to add, these methods can be done on a "locked" device.

---------- Post added at 01:35 PM ---------- Previous post was at 01:32 PM ----------

i am not saying with 100% certainty in his situation since i dont know what device he has but there typically are methods to "unbrick" devices as well as dm verity doesnt always result in a brick as sometimes it automatically reverts back on reboot (write protection)
[Security Discussion] vampirefo:
Yes, they will revert on reboot though.

---------- Post added at 09:31 AM ---------- Previous post was at 09:24 AM ----------

On an arm device yes, Intel unlikely, none of my Intel's will allow dirtycow to replace files.

On reboot original hosts file will be restored.
[Security Discussion] Matt07211:
Okay, cool, I stand corrected. I accept that ;)
[Security Discussion] LaughingCarrot:
The Sprint LG G4 has ADB disabled. Very few commands are possible, so would this never work for us until we find a way to get ADB?
[Security Discussion] mrmazak:
I might have missed it here, but the method I used(not my method, i just used it) to root is not being talked about. I think it might be able to used on more devices.

It uses the system_server for root shell. I see many using this but not in the same way.

1. You use dirtycow on app-process to get the system-server to fork a shell.

2. Use busybox loaded onto sdcard to "nc localhost "port #""

3. within the root shell cp the boot.img (blk0p#) to sdcard

4. chmod the copied file 7777

5. exit root shell adb pull the boot.img, modify it as needed for "permissive, " "ro.secure=0"

6. as user dirtycow the modified boot over the copied one

7. busybox nc "port?"

8. in the root shell dd the now permissive boot back to mmcblk0p?

I hope this idea is not too far off the mark,

the way i used this was to make changes to other partition to allow boot loader unlock. I assume it will do same for the boot partition.
[Security Discussion] elliwigy:
did you do this on a unlocked BL device or with a locked BL?
[Security Discussion] mrmazak:
this was done on locked bootloader. in order to unlock it. I did not do the boot image, .i did the FRP partition, that allowed for bootloader unlock.
[Security Discussion] elliwigy:
i sent you a pm if u got time let me know!
[Security Discussion] vampirefo:
Won't work on boot or recovery partition.
[Security Discussion] elliwigy:
but if it works on frp partition to allow BL unlock or even to set device as permissive, hell for me even to gain a root shell its a start
[Security Discussion] vampirefo:
Only if you have the R1HD phone, won't set device to permission.

Anyway good luck to you.
[Security Discussion] elliwigy:
?? im just trying to get a root shell at this point.. whats special about the R1HD that other devices dont have that would allow it only on that device?
[Security Discussion] vampirefo:
It's the only device I have this method works on, I have 9 androids only R1HD allows it to work.

If it works for you great, for me not so much, my R1HD already has full root, even before dirtycow.

Give it a try and you will know for sure.

http://xdaforums.com/showthread.php?t=3490882
[Security Discussion] itandy:
Just curious. So far I see it's possible to use dirtycow to run a root shell. Is it also possible to run backup TA for Xperia LB devices to backup the DRM key?
[Security Discussion] elliwigy:
is the mod i assume compiled as 32bit? i have 64bit so id need to compile it again from github?
[Security Discussion] raimondomartire:
Can you share your update four .bat script for v20 or explain how mod your original one?

---------- Post added at 06:19 AM ---------- Previous post was at 06:18 AM ----------

Tell me which file I must recompile from github. I have H990ds with lock bootloader but with working fastboot command shell
[Security Discussion] elliwigy:
i havent compiled anything yet lol.. we have us variants, sprint att and vzw..

if you want to work together check out this thread:

http://xdaforums.com/v20/how-to/sprint-att-locked-bootloaders-root-t3491498/page20

we are trying to get root shell but our variants do not have fastboot enabled
[Security Discussion] raimondomartire:
Sure, thanks. For now I published my partition table very different from yours

http://xdaforums.com/v20/how-to/lg-v20-h990ds-partitions-table-t3496650
[Security Discussion] Jaws4God:
can anyone with a Moto Z Play Droid let me know if this will root the Verizon Variant?

Thanks!
[Security Discussion] mrmazak:
[MENTION=1287891]vampir[/MENTION]fo does this just not work with "toybox" or does it also not work with "busybox" as well.

Lots of questions come to mind. Like is it a 32 bit vs 64 bit issue?

Did you happen to have (logcat -s "cow") running while you tried. Maybe a message of what's happening could help.
[Security Discussion] Root-Maniac:
Major progress being made now.. looks like some one cracked selinux... hoping this is good for Samsung users!!
[Security Discussion] A.Fitz:
Sadly selinux still hasn't been cracked.

"chaosmaster commented an hour ago
[MENTION=597777]Peregrine[/MENTION]Z you're just patching the library to think selinux is permissive, the kernel will still enforce it."
[Security Discussion] baselsayeh:
naikel was able to disable it and get temp root by loading a kernel module but that's already fixed on the newer devices

https://android-review.googlesource.com/#/c/138510/2/system_server.te
[Security Discussion] Blade22222:
No go. He was patching it to say permissive but the kernel was still enforceing it.
[Security Discussion] elliwigy:
i know its probably already been tried but just asking if anyone is temporarily able to get permissive and/or root shell before a reboot on 64bit devices?
[Security Discussion] freddierice:
I injected shellcode into init as another member in here had suggested, and it works as a charm. Unfortunately, I couldn't turn off selinux from my init process (galaxy s7 active). However, I do have the ability to load new policies. When I loaded a new policy (by writing the contents of the new policy into /sys/fs/selinux/load), SELinux did not write anything in the audit log, but the domains I made permissive are not actually permissive!

Is this a viable method, or am I missing something?
[Security Discussion] feanor12:
Install supersu from cli

I added a system(argv[1]) call to the run-as example and now I have something like sudo. Can I install SuperSU from the cli? What do you suggest as a next step? I'm working on the Acer E1 V360.
[Security Discussion] baselsayeh:
[MENTION=3812611]elliwigy[/MENTION] [MENTION=7780160]A.Fitz[/MENTION] [MENTION=4894444]Blade22222[/MENTION]

https://github.com/timwr/CVE-2016-5195/issues/9#issuecomment-257078797

https://github.com/timwr/CVE-2016-5195/issues/9#issuecomment-257099346
[Security Discussion] iwannarock:
-cow-root-android/amp/

Saw This today

google.dk/amp/androiding.how/dirty-cow-root-android/amp/
[Security Discussion] elliwigy:
i dont think thats anything new
[Security Discussion] baselsayeh:
it wont work with devices that have selinux (which most of the new devices have it)
[Security Discussion] LLStarks:
naikel seems to be onto something with his latest updates in the github comments
[Security Discussion] Scorpius666:
I only have 32-bit devices that don't have the latest "Android Security" patch.

That means that I can install kernel modules using the u:r:system_server:s0 context. My approach in the github thread was based on that.

Now for the 64 bits devices that can't install kernel modules with the system_server context we haven't found a way to disable SELinux yet...
[Security Discussion] freddierice:
I successfully wrote a 0 to /sys/fs/selinux/enforce. But selinux did not get disabled. On my phone, the kernel was compiled to never disable selinux.

I also cannot transition to the kernel context without causing my phone to reboot.

However, I can load arbitrary sepolicy files, and give arbitrary permissions to contexts. Is that sufficient for root, or do I need to patch the kernel?
[Security Discussion] LLStarks:
Are 64-bit devices on October a lost cause? Kernel dates are usually early October and shouldn't cover Dirty Cow. Unless there's something else that was patched that we really needed.
[Security Discussion] Scorpius666:
Check your dmesg and/or logcat. Pretty much it has a line that says audit: and then says setenforce denied. So you thought you wrote something, but you didn't.
[Security Discussion] freddierice:
I gave the context I was running under (dnsmasq) setenforce privileges, so nothing was logged underlogcat.

It appears as though my kernel was compiled with

DCONFIG_ALWAYS_ENFORCE=true
[Security Discussion] lssong99:
Instead of getting root, does dirty cow allow us to temp root and gain ability to modify /data/data/any.apps.data?

I got a lot of spam SMS everyday and before I had my old, rooted phone, I just use Tasker to sqlite edit the SMS data base to delete all those spam SMS automatically. However my new phone is not root able (yet, hopefully) and I miss this ability greatly...

The data is already there so new file creation limitations doesn't apply, only the content are modified. Also, since it's 8n /data, so should no worry about dm-verity.

Am I right and can we achieve this? This would be the next better thing (and as dangerous if used meticulously) than full brown root.
[Security Discussion] Basti_Schr:
What is wrong whith it?

I can't use the run-as command! Every time i use it, this is the result:

WARNING: linker: run-as: unused DT entry: type 0x6ffffffe arg 0x6f0
WARNING: linker: run-as: unused DT entry: type 0x6fffffff arg 0x1
running as uid 2000
uid 0

It appears only after I 'make root-arm8' because my phone is 64 bit. Can anyone help me?
[Security Discussion] mrmazak:
There are several different Android make files now so it's not easy to answer why you are getting that message, at least not without knowing what build you are trying. But I assume you have some type of strange build results.

Could be from building with "root-arm8". Unless that was just a typo on your post.

I do see that if you are trying to build with only the NDK and SDK to chain and use "timwr" GitHub as source. You can use "make" and if will build all arch's at same time. So no need to include the "root-arm8". You just get the dirtycow and run-as in multiple arch folders.
[Security Discussion] TwinAdk:
We will not see an APK solution:

Source: https://github.com/timwr/CVE-2016-5195/issues/9#issuecomment-260188071

Kind Regards

TwinAdk
[Security Discussion] ecs87:
Instead of copy pasting source code and attempting to get it to work, use the COW(copy on write) exploit to do whatever you want. Someone already gave you all a HUGE clue how to use it. If you're not going to put in the time to learn the C code behind it, you might as well twiddle your thumbs waiting for a one click.
[Security Discussion] elliwigy:
Now what is the next step if one already can obtain a root shell through tcp connection using the app process?
[Security Discussion] ecs87:
Hint. SELinux contexts. Sure uid=0 is root...for a specific context that you've hijacked. True root requires either init or su contexts. Start taking a look at your kernel sources.
[Security Discussion] Aaahh:
That's exactly what should happen

---------- Post added at 08:32 PM ---------- Previous post was at 08:18 PM ----------

If it's in the kernel command line, using setenforce (which writes to that) has no effect, even if you have the proper access. I tested it on my bacon
[Security Discussion] Basti_Schr:
How to use it?

But how to use the command to activate the SuperUser rights.

Yes, I used the timwr Makefile and resources.
[Security Discussion] ecs87:
....you're still not listening. It has absolutely nothing to do with the files you used unless you got different errors than the one you posted. You need to learn how the exploit works. The PoC is just that, a proof of concept. Does it "root" the phone for you? Absolutely not. Look at the source code and understand it.
[Security Discussion] Basti_Schr:
Yes, it is written several times! But with this command one may execute an other file to get SU. My question: is there a executable file or package to activate the SU rights forever at the phone to have it rooted?
[Security Discussion] elliwigy:
i think thats the goal for everyone lol. i think ppl have been successful at a root shell but thats only half the battle.. you then have to attack dm verity, selinux, secure boot etc. which is not easy since many changes you can make will fail and fall back after a reboot..

best bet is to use dirty cow to somehow atk the BL to get it unlocked or allow the system to boot with modifications/root.. you cant just execute a file or app to get perm root.. not on newer firmware anyways
[Security Discussion] Saiyajin:
Hey guys,

is there a tutorial or writeup on how to root your own device? I just need temp root to change the GPS.conf on my xperia M4 and to uninstall some bloatware on a toshiba excite pro tablet.
[Security Discussion] ecs87:
Again, this exploit alone will not root your phone. Analyze the source files and read how the exploit actually works. It hijacks memory regions.

Can this eventually lead to a root method? No doubt.

Is it a one click root method right out the box from the poc source code? Hell no.
[Security Discussion] CreeperPVP:
Hi, i can read/write files with full permissions i guess, but when it initializes my shell script from let's say "mediaserver" my phone goes black, notification led pulsates and it shows i'm touching the screen (i have Show Touches on). I don't know if i'm getting anywhere or if i'm failing quite frankly..
[Security Discussion] elliwigy:
so i understand, if theres a way to use dirty cow to overwrite partitions by hijacking something it will fail to boot due to SELinux/secure boot?

what if the files were using are userdebug files with secureboot disabled at the BL (is unlocked) and kernel has adb root shell by default.

does this change things?
[Security Discussion] vampirefo:
If you already have adb root, you have temp root, you don't need dirty cow.
[Security Discussion] elliwigy:
sorry for misunderstanding, we have a debug device we pulled the files from..

we need a way to flash the files to a NON debug device that does not habe adb root or an unlocked BL...

---------- Post added at 08:04 PM ---------- Previous post was at 08:03 PM ----------

meaning, if we can flash the userdebug partitions to a locked non debug phone, would it still fail to boot even though the partitions we flash are signed and have secure boot disabled?
[Security Discussion] Matt07211:
I recommend you have a look at DM-VERITY (https://source.android.com/security/verifiedboot/) as it will be a thorn in your side.

Overview: At each boot, the boot.img generate a hash and generates/compare to check the integrity of block devices.

The ability to modify any of the blocks would be equivalent to breaking the cryptographic hash.

So therefor, if you where to try this, I would recommend grab the boot.img, modifying it to disable dm-verity (and other security features that may stop booting of phone) (Have a look at the SuperSu install script to see how it's done.) Then flash the modifed boot.img back. This is assuming your able to pull/and flash the partition.

You then should be able to mess with the rest of the phone without it getting ducked up.
[Security Discussion] elliwigy:
I am aware of dm verity but essentially we'd want to replace everything involved in the boot process to the debug variants including /system.. but that is our issue lol.. we cannot get rw access to the necessary partitions..

we have used dirty cow successfully but not in the context we need as we are not able to sh

to add, the only shell we can get atm is in a tcp shell which isnt able to run the root sh command where we have the readable zones which is necessary for dirty cow..

to add, we cant flash a recovery because the hash and it will revert on a reboot reverting the changes..

We have an LG V20 and no fastboot and no way to repack the debug firmware within a tot to try that way lol.

I think we have a way to unlock many v20s with the debug firmware but other than that no way to flash the imgs since we cant get an adb root shell temporarily to do what we need..

i am sure theres a way but its beyond our technical level i feel and experienced devs will not help for valid reasons (not related to our group)

If you or any experienced dirty cow fans want to test their expertise wed be more than happy to invite you to our hangouts group..

we currently still have access to the debug device as well as an octopus box (atm) but they are not supporting 7.x atm so thats a dead end i fear..

we have been able to use send commands and have a root tcp shell but the shell isnt really useful as we still cant read what wed need to overwrite
[Security Discussion] Matt07211:
I haven't been following dirty cow long enough to be able to help you with flashing or the use of sh in the correct. ThTa gonna require testing and reasearch on your part. Sorry that I can't be of any more help.
[Security Discussion] elliwigy:
no problem man, weve been racking our brains for days now haha.. i just added to the previous post.. hopefully some experienced devs see it and will help out.. i just wish i was more advanced myself lol
[Security Discussion] Matt07211:
Good luck, but before I go, did you see the github page (I belive around page 10 or so) that is able to blindly flash a recovery image onto the phone, using the run-as command? I recommended to see how they implemented it, and base your efforts of that.
[Security Discussion] billydroid:
So I'm confused. Has any one even gained tempt root using dirty cow?
[Security Discussion] elliwigy:
yes.. as in adb root shell.. those with ecperienve can do it.. its selinux that is the problem.. any changes made in temp root revert back.. big pita on Android 7.x
[Security Discussion] Matt07211:
http://xdaforums.com/fire-tv/general/guide-rooted-fire-tv-via-dirtycow-t3489922/

Yes, someone succesfully did it, as they lucked out and the selinux was relaxed on the entry point used.
[Security Discussion] CreeperPVP:
That is the same binary i'm using on my AT&T Galaxy S5. So far we can only get system privileges but we can't do much with it.. We can permanently change some binary files such as "run-as" tho.. Thought that was cool, but then i tried a link (i think i turned stupid for a second) and then i broke my phone :P.. We're back tho! IMEI and everything was wiped lol

I love ODIN
[Security Discussion] freddierice:
Dirty cow is sufficient to circumvent SEAndroid.

https://www.redtile.io/security/galaxy

shows how to get temp root on the galaxy s7 active and arbitrarily change sepolicies.
[Security Discussion] serajr:
Just amazing!!! :highfive:

I already have a working temp root (run-as approach, shell context, uid 0). Do you think it is possible to change sepolicies only (based on your code) and be able to at least dd a device partition? Ofc I need to look deeper into your code (and I will).

Btw, I cannot dirtycow on dnsmasq ($ ls -laZ system/bin >>> gives me: lstat 'system/bin/dnsmasq' failed: Permission denied).
[Security Discussion] freddierice:
You should be able to use the same approach. Can you read /init from your root shell?
[Security Discussion] Honestly Annoying:
Fantastic job my sir ;)
[Security Discussion] serajr:
# ls -laZ / >>> lstat '//init' failed: Permission denied

It looks like xperia's won't be part of party! It is a pity!!

Once again I'd like to thank you for amazing us!!
[Security Discussion] NavSad:
[MENTION=7818535]freddierice[/MENTION]

How do we pull the sepolicy from the device?
[Security Discussion] freddierice:
adb pull /sepolicy
[Security Discussion] dev_null:
This is a bit over my head but:

Has anyone tried patching to a binary similar to mount? (As in the actual mount binary)
[Security Discussion] Fobos531:
Excuse my ignorance: what does this mean for us newbs when it comes to these things? Does this mean that other devices such as LG G4, G4c etc. would be able to get temp root on 6.0 and we could do whatever we like until a reboot? eg. delete bloatware and have it still deleted after a reboot despite the root being lost?
[Security Discussion] Skinner62:
Only one question! When?
[Security Discussion] elliwigy:
no. its not that easy.. sepokicy is loaded into memory on a reboot so overwriting it either wont work or will cause a crash/reboot..

you need to overwrite it and find a way to reload it without a crash and even then it only lasts unril a reboot..

once you patch selinux however it should allow more modifications to say the aboot so youd then need to exploit further.. patching sepolicy just opens more doors

---------- Post added at 01:20 PM ---------- Previous post was at 01:19 PM ----------

when what?
[Security Discussion] Skinner62:
When oneclickroot with dirty cow will be available?
[Security Discussion] vampirefo:
Never