Privilege Escalation in Android mediaserver (CVE-2014-7920)

This repository contains a full exploit for CVE-2014-7920 and CVE-2014-7921, targeting the mediaserver process on Android versions up to 5.1. The exploit is implemented in C++ and leverages vulnerabilities in the AudioPolicyService and AudioFlinger Binder services to achieve arbitrary code execution in the mediaserver context. The main exploit logic is in 'main.cpp', which orchestrates a series of memory manipulations and function pointer overwrites using custom ROP gadgets defined in 'gadgets.h'. The exploit writes the path to an attacker-controlled binary ('/data/local/tmp/a') into mediaserver memory and redirects execution flow to system(), effectively running arbitrary code as mediaserver. Supporting files implement memory manipulation primitives, memory mapping, and gadget management. The build process is managed by 'build.sh' and 'Android.mk'. The exploit requires local access and sufficient privileges to interact with Android's audio services. No network endpoints are involved; all actions are performed locally via Binder IPC and direct memory manipulation. The code is operational and provides a working exploit chain, but payload customization would require modifying the path or parameters in the source code.

This repository contains a full exploit for CVE-2014-7920 and CVE-2014-7921, which are code execution vulnerabilities in the Android mediaserver component (affecting versions 4.3 up to 5.1). The exploit is implemented in C++ and is structured as a standalone binary (built via Android.mk and build.sh). The main logic is in main.cpp, which orchestrates the attack by interacting with the audio services (AudioPolicyService and AudioFlinger) via Binder IPC. The exploit manipulates function pointers in the mediaserver's memory by leveraging gadgets in system libraries, ultimately redirecting execution to a system() call with an attacker-controlled path (e.g., /data/local/tmp/a). Supporting files (primitives.cpp/h, memory_map.cpp/h, write32.cpp/h, gadgets.h, defs.h) provide low-level primitives for memory manipulation, gadget addresses, and service interaction. The exploit requires local code execution on the device and is not a remote exploit. It is operational and can be adapted to different Android versions by adjusting symbol offsets. No network endpoints are present; all interaction is via local Binder IPC and direct memory manipulation.