[Android Software/Hacking General [Developers Only]] kryz:
Hi,

I have developed a tool to exploit the dirtycow vulnerability and get TEMPORAL ROOT

It bypass the selinux in lollipop 32bits system only, we are working now in a 64bits and Marshmallow version and will be soon, have a lot of work to do it universal.

Im bringing 2 tools, one apk (no computer required) and one rar for adb and linux.

With this tool we will access to those partitions and start the attack there, but in the actual state if you have locked your bootloader a good choice is to have root even temporal one.

·APK

Required: SDCARD

The apk exploits this vuln in the vold context so, is necessary to have a sdcard and mount or extract it, when the app requires, one time per session.

This tool has some utilities for flash boot and system partition, also for backup and 2 methods of root:

·Attack init process (lollipop 32 bits only)

·Attack app_process.(all devices, not really good)

·Get root

Uninstall any supersu manager before root.

The way to use this app is first click in check perms(optional) and you will see if you have permissions to /init file.

If you have permisisons and lollipop 32 you can use the first method to get root.

Also in check permissions you will see if you have rights to backup/flash boot and system partition.

The process takes until 2 minutes to finish so wait please and watch the log window.

# ISSUES #

If you get reboot after get root you can:

-Clean init (restore init process sometimes crash the device, but is safe)

-Install selinux permissive (Set permanent the new selinux policy, not tested)

The first option is safe you just can get a reboot.

The second option is just tested in 3 devices(oppo,xperia,Moto E), so test it with a recovery system working, can break some selinux rule..

·ADB

The adb rar contains some utilities to get root via run-as and init and is only working in Lollipop 32bits.

To execute it:

-Pass rar:"nox"

-Extract the rar in /data/local/tmp/

chmod 755 /data/local/tmp/exploit.sh
cd /data/local/tmp/
./exploit.sh

This process take some time 1-2 minutes but you will see the progress in the console, please wait,

After will ask to turn off bluetooth do even sometimes is not required, it can accelerate the process.

It will ask to install selinux permissive, if you don't have reboot problems, don't install it, otherwise be sure you have a recovery system working and a stock rom ready to flash, this feature is stable but need more testing.

if all is ok you will see this:

#Type run-as -s1 to get a shell"
#Type run-as -s2 to execute su daemon"

The run-as -s1 give you a shell with init context but some restrictions because selinux autotransfer domain to run-as

The run-as -s2 will execute su dameon and a su init context with no restrictions.

# ISSUES #

If you get reboot after get root you can:

·mount system partition with flag abort:

mount -o remount,abort /system

You won't able to mount system in write mode.

This app is in BETA BETA state for now, just 7/9 devices passed not bad at all ;)

I'll add more devices in the list soon ;)

List of rooted devices:

Moto G 5.1 lollipop

Xperia 5.1 lollipop

Oppo 5.1 lollipop

Emulator 5.1 lollipop

XT1528 (MOTO E Verizon prepaid) 5.0.2 lollipop(reboot issues)

Asus Zenfone Go ZB452KG Lollipop(5.1.1)

Smartfren Andromax A / Haier a16c3h (Lollipop 5.1 Firmware 12.2)

Version:0.4

Adb:http://www.mediafire.com/file/r3i900n7jb2zfoo/EXPLOIT_ADB.rar

Apk:http://www.mediafire.com/file/38tyscsaxms00sa/croowt%282%29.apk

Implemented selinux pemissive after reboot.(adb,apk)

Enforce mode working.(adb,apk)

Version: 0.3

Fixed bug creating bl instruction.

Version: 0.2

-Fix bug in apk for some devices

Version: 0.1

-More compatible adb with lollipop 32 bits

-Fixed bug in the shellcode.

-64 bits version of run-as-dirtycow.

Todo:

-Working in Marshmallow 32 bits.

-Apk some fix.

Thanks to n0x for his great help debugging the shellcode issue in Moto G