I/O Vector Array Overrun in Linux Kernel pipe_read/pipe_write

This repository is a real, device-specific local privilege-escalation kit for HP Slate 7 2800 tablets. It targets CVE-2015-1805 in the Linux kernel pipe/iovec handling and is not a generic Android root tool. The repo contains Bash helper scripts, C exploit sources, a C installer, and a tiny ARM assembly su wrapper. The main exploit path is: scripts/root-device.sh verifies the target via ADB, checks SHA256 hashes, pushes three binaries into /data/local/tmp, and runs the exploit. src/exploit/root-main.c calls iov_main() from src/exploit/expIov/iov_exp_main.c, which implements the race condition using pipes, readv(), mmap/munmap churn, and a loopback UDP sendmmsg-based heap spray. On success, getroot() temporarily overwrites syscall table entry 222 with a naked ARM trampoline that patches addr_limit/current thread context, invokes the syscall, restores the original syscall pointer, and then uses arbitrary kernel read/write helpers to locate and overwrite the current task's cred structure, zeroing UID/GID fields and setting capability bitmaps to all ones. After root is obtained, the exploit execs /data/local/tmp/install-root. The installer remounts /system read-write, copies the uploaded rootsh-armv7 binary to /system/xbin/su, sets ownership to root and mode 06755, syncs, and remounts /system read-only. The installed su wrapper simply sets resgid/resuid to 0 and execves /system/bin/sh, yielding persistent root shell access. Repository structure is clean and purposeful: scripts/ contains build, target-check, and deployment helpers; src/exploit/common contains symbol lookup, syscall-table discovery, and credential modification logic; src/exploit/expIov contains the CVE trigger and race machinery; src/installer contains the persistence installer; src/su contains the minimal su payload. There are no external C2 or remote network targets beyond local loopback UDP used internally by the exploit.

This repository implements a local privilege escalation exploit for Android devices vulnerable to CVE-2015-1805, a kernel vulnerability in the pipe buffer handling code. The exploit is written in C and is intended to be built as a native binary for Android (using the NDK build system). The main entry point is jni/main.c, which orchestrates the exploitation process: it fingerprints the device and kernel version using /system/build.prop and /proc/version, selects the appropriate hardcoded kernel offsets from jni/offsets.c, and then performs a series of heap sprays, memory mappings, and pipe operations to overwrite kernel structures. The exploit ultimately modifies the process's credentials in kernel memory to gain root privileges, disables SELinux enforcement, and spawns a root shell (/system/bin/sh) or executes arbitrary commands as root. The exploit is operational and requires the target device to match one of the supported models and kernel versions. The codebase is well-structured, with separate files for kernel structure definitions, offset management, and the main exploit logic. No network endpoints are targeted; the attack vector is purely local, requiring code execution on the device.

This repository contains a Python script ('androRaT.py') and a README describing an exploit for CVE-2015-1805, a privilege escalation vulnerability affecting older Android devices. The script allows the attacker to build a malicious APK that, when installed on a vulnerable device, provides a remote shell with escalated privileges. The script supports both direct IP/port connections and the use of ngrok for tunneling, making remote exploitation feasible even behind NAT or firewalls. The README provides context about the vulnerability and the exploit's purpose. The repository is operational, providing a working exploit and payload, but is not part of a larger exploitation framework.