chompie1337 / s8_2019_2215_poc Goto Github PK

Hi @chompie1337, thank you for such a great work. It's pretty useful to obtain the root privileges without ticking KNOX.

I want to adapt your poc for Samsung Note 9 (SM-N9600) (Android version 8.1.0, Kernel version 4.9.65-14505206 (gcc version 4.9.x 20150123 (prerelease) (GCC)) Tue Jan 8 16:29:04 KST 2019, Android security patch level January 1, 2019, Baseband version N9600ZCU1ARL3, Build Number: N9600ZHU1ASA5) to modify my build.prop.

I'm not very familiar with the Android kernel, so I'm wondering, how did you find DECISION_AVC_CACHE_OFFSET? It seems that I found every offset except for this.

(There is no N9600ZHU1ASA5 version on opensource.samsung.com so I took N9600ZHU1ARL1 from https://github.com/klabit87/twrp_android_kernel_samsung_crownqltechn)

At this point, my phone reboots while s8_poc is running:

crownqltechn:/sdcard/USER/cve $ cp s8_poc /data/local/tmp/s8_poc
crownqltechn:/sdcard/USER/cve $ cd /data/local/tmp
crownqltechn:/data/local/tmp $ chmod +x s8_poc
crownqltechn:/data/local/tmp $ ./s8_poc -s
[+] options are set, we're ready to go :)
[!] attempting to exploit bad binder...
leak_kernel_memory, i = 0
...
usleep(CHILD_SLEEP);
epoll_ctl(iEpFd, EPOLL_CTL_DEL, iBinderFd, &epoll_ev); WITH ARGUMENTS iEpFd=4, EPOLL_CTL_DEL=2, iBinderFd=3, &epoll_ev

I would be glad if you find some time to help.