1

I am working on my school thesis.

I am trying to inject some shellcode into a shared library using Dirty Cow vulnerability on Android x86.

My shellcode is written in asembly and only calls sys_execve with an argument touch /sdcard/FILE.txt. The shellcode should be OK, I am not using any absolute addresses for the string arguments - everything is created on the stack and addressed relatively to the stack pointer. I am trying to inject this shellcode into libc.so (into the function time), which I think succeeds - before this I tried some simpler shellcode that worked perfectly (xor eax, eax; ret).

But right after the attack the program fails: 

01-29 15:56:40.305 3255-3255/com.example.vitek.bakalarka A/libc: Fatal signal 11 (SIGSEGV) at 0x00000000 (code=128), thread 3255 (vitek.bakalarka)

And when I try to communicate with the device via adb, I only get this:

$ adb shell ls -la /sdcard/
CANNOT LINK EXECUTABLE: could not load library "libcutils.so" needed by "/system/bin/touch"; caused by library "libcutils.so" not found

I don't understand why it fails. I thought that the syscall execve creates a subprocess that executes whatever it gets as an argument.

Why does it not load the library libcutils.so?

Can I add something to my shellcode in order for this attack to work? If not, is there any other suitable target that would be easier to attack?

I have seen some Dirty Cow PoC's that were attacking vDSO, but in my case vDSO is not used by the system - I tried to inject that as well, it worked perfectly (I saw that in objdump and hexdump of the vDSO pages that I wrote into a file), but the function I attacked (clock_gettime) seems not to be ever called (either by the system or by me directly).

Thank you for your answers.

Topper Harley
  • 111
  • 2
  • 1
    Which platform do you test? On Nougat, system libcutils.so can not be loaded by user process, same as all other non-public libs. – Alex Cohn Mar 21 '18 at 12:36
  • @AlexCohn I tried many versions (4.4 to 7.0). On Nougat (7.0, 64bit) the way with vDSO worked, but the libc error was all the same with every version. In the end I chose the vDSO way for the thesis. But I would still like to know what exactly caused the libc error. Was it because I tried to execute a binary file from within the libc library, which no other libraries are linked to? – Topper Harley Mar 23 '18 at 18:01

0 Answers0