Use-After-Free in Linux Kernel ping_unhash (CVE-2015-3636)

This repository contains a local privilege escalation exploit targeting ARM-based Android devices running a vulnerable Linux kernel. The main files are 'poc.c' (the exploit driver) and 'getroot.c' (the kernel credential manipulation logic). The exploit works by abusing kernel structures and socket manipulation to gain arbitrary kernel read/write, then locates and modifies the current process's credentials to escalate privileges to root. Upon success, it spawns a root shell by executing '/system/bin/sh'. The code is written in C and is intended to be compiled as a static binary for execution on the target device. No network endpoints or remote attack vectors are present; the exploit must be run locally on the device. The repository is structured for Android NDK builds, as indicated by the 'Android.mk' file.

This repository contains a local privilege escalation exploit targeting the Linux kernel, specifically for Android devices. The main exploit logic is implemented in 'exploit.c', which manipulates kernel memory via a race condition involving ICMP sockets (pingpong vulnerability). The exploit creates a large number of sockets and uses memory mapping and process forking to trigger the vulnerability, allowing arbitrary kernel memory read and write. The 'pingpong.c' and 'pingpong.h' files provide an interface for reading and writing kernel memory at arbitrary addresses, and for running the exploit with a callback. The build file 'Android.mk' is used to compile the code as a static library for Android. The exploit is operational and can be used to escalate privileges on vulnerable systems, but does not include a weaponized, customizable payload. The attack vector is local, requiring code execution on the target device. The only fingerprintable endpoint is the use of device files and sockets, typical for kernel exploits.

This repository contains a local privilege escalation exploit targeting ARM-based Android devices running vulnerable Linux kernels. The main files are 'poc.c' (the exploit driver) and 'getroot.c' (the kernel credential modification payload). The exploit works by manipulating kernel memory structures associated with process credentials, ultimately setting all user and group IDs to 0 and granting all capabilities. The exploit then spawns a root shell at '/system/bin/sh'. The attack vector is local, requiring code execution on the target device. The Makefile ('Android.mk') is provided for building the exploit as a static binary. No network endpoints or remote attack surfaces are present; the exploit is purely local. The code is operational and provides a working root shell if the target is vulnerable.