Android Binder Use-After-Free Privilege Escalation

Repository is a small standalone local privilege-escalation exploit for CVE-2019-2215, containing one main code file (exploit.c) and a README describing the attack. The exploit targets the Android binder use-after-free bug triggered through binder and epoll interaction. Based on the visible code and README, its workflow is: bind execution to CPU 0 for race stability; open /dev/binder; create and link an epoll instance to binder; use crafted iovec/pipe interactions to leak a task_struct pointer; exploit the same primitive to corrupt addr_limit in the current task_struct; use pipe-based arbitrary kernel read/write helpers to access and patch the current process cred structure; set UID/GID and related IDs to 0 and grant full capabilities; derive kernel base from nsproxy using hardcoded symbol offsets; clear selinux_enforcing; then execute /bin/sh as root. The exploit is not remote and contains no network C2 or external callbacks. It is operational rather than a mere PoC because it includes a full post-exploitation path to root shell, but it is highly target-specific due to hardcoded structure and symbol offsets and appears intended for vulnerable ARM64 Android kernels.

This repository is a complete Android root-management application for the Sonim XP3800 (XP3plus), not just a standalone proof-of-concept. Its core exploit is the native file su.c, an ARM32 local privilege-escalation exploit for CVE-2019-2215 (Binder use-after-free) tailored to a specific kernel build (3.18.71-perf) with hardcoded structure offsets and a fixed selinux_enforcing kernel address. The exploit uses /dev/binder plus epoll/iovec/pipe primitives to obtain kernel read/write, overwrite cred fields for uid 0 and full capabilities, disable seccomp, set SELinux permissive, and then execute commands or a shell via nsenter in PID 1's mount namespace. Repository structure: the native exploit lives in su.c; assets/install.sh and assets/uninstall.sh install/remove the root environment; Java sources under src/com/flipphoneguy/root/xp3 implement the Android UI and operational features; AndroidManifest.xml defines activities, boot receiver, and a content provider; docs/ contains detailed technical writeups for CVE-2019-2215 and the ARM32 port; build.sh is a custom APK build pipeline. The Java app copies bundled assets, toggles root installation, maintains a blacklist of apps denied su access, handles APK/XAPK installation using root, checks GitHub Releases for updates, and re-runs install.sh at boot through BootReceiver for persistence across reboots. Main capabilities: one-tap local rooting on-device without PC flashing, persistent re-root on boot, root shell/command execution through /sbin/su, package installation via pm install using root, self-update from GitHub, and access control via whitelist/blacklist files in the app data directory. There is no evidence of remote exploitation or C2 behavior; network use is limited to GitHub API/release download functionality for updates. Overall, this is a real, device-specific operational exploit package wrapping a kernel LPE in a user-friendly Android management app.

This repository is a real local privilege-escalation exploit for CVE-2019-2215 (Bad Binder) targeting an Android 10 x86_64 emulator environment. The main exploit is implemented in exp.cc as a native C++ binary compiled with the Android NDK and deployed to the emulator with adb. The exploit is not part of a larger exploitation framework. Repository structure: exp.cc contains the exploit logic; Makefile builds and optionally pushes/runs the binary; scripts/start-emulator.sh boots an Android AVD with a custom vulnerable Goldfish kernel; scripts/run-exploit.sh waits for boot completion, pushes the binary to /data/local/tmp, and executes it; setup-env.sh configures Android SDK/NDK paths; BUILD.md documents how to build the required vulnerable kernels and run the emulator; kernel/build-configs/* and kernel/patch/* provide supporting kernel build configs and patches. Exploit capability: the code abuses the Binder bug to leak task_struct-related data, derive a kernel base address, obtain arbitrary kernel read/write primitives, overwrite the current process cred structure to set all UID/GID fields to 0 and grant full capabilities, then zero the SELinux enforcing flag. After verifying getuid()==0, it launches /bin/sh, yielding a root shell in the emulator. Targeting and constraints: this is a local attack vector only, not remote. It requires a specifically prepared vulnerable Android 10 x86_64 AVD using a custom Goldfish 4.14.150+ kernel; the stock AVD kernel is noted as patched. The exploit appears tuned to fixed structure offsets and kernel symbols/offsets, so it is highly version-specific and intended for research in an isolated emulator rather than broad real-world deployment. Notable observables/endpoints: target-side file paths include /dev/binder (implied by the Binder exploit), /data/local/tmp/cve-2019-2215-exp for staging/execution, and /bin/sh for post-exploitation shell spawn. The repository also references external build/documentation URLs and local kernel image paths under kernels/.

This repository is a compact local privilege escalation exploit for CVE-2019-2215 (Bad Binder) on Android. It contains only two files: a README describing the exploit flow and usage, and a single C source file, bad_binder.c, which implements the full exploit. The code is not a scanner or detector; it is a working exploit intended to obtain root on a vulnerable Android device. The exploit targets the Binder driver via /dev/binder and abuses a use-after-free involving binder waitqueue/epoll interactions. Its structure is split into two main phases. First, it creates Binder state, adds the binder fd to an epoll waitqueue, exits the binder thread, and triggers the UAF while a writev call is blocked on a full pipe. This corrupts iovec metadata and leaks a kernel task_struct pointer from pipe output. Second, it repeats the UAF with a recvmsg-based crafted iovec layout over an AF_UNIX socketpair to gain a controlled kernel write primitive. Using that primitive, it overwrites the current task's addr_limit with a near-maximum value, enabling arbitrary kernel memory read/write through pipe-based kmemcpy operations. It then reads the cred pointer from task_struct and overwrites the credential ID block with zeros, effectively setting uid/gid-related fields to root. After successful escalation, the exploit verifies getuid()==0 and executes /bin/sh. The implementation is highly target-specific: it hardcodes kernel structure offsets such as TASK_STRUCT_OFFSET, CRED_OFFSET_IN_TASK, and ID_BLOCK_IN_CRED_OFFSET, and assumes a compatible Android kernel layout. The README states it was tested on the goldfish Android kernel, arm64, version 4.14, with the patch reintroduced. Overall, this is an operational local Android kernel LPE exploit with a built-in root shell payload, not part of a larger exploitation framework.

This repository is a comprehensive proof-of-concept and operational exploit for CVE-2019-2215 (Bad Binder), a use-after-free vulnerability in the Android kernel's Binder IPC subsystem. The project is structured as an Android application with a Kotlin/Jetpack Compose UI and a native C library implementing the exploit logic, accessible via JNI. The exploit can also be built and run as a standalone native binary for direct execution on a vulnerable device or emulator. Key files include: - `app/src/main/cpp/cve-2019-2215.c`: The main exploit logic in C, implementing the steps to leak kernel addresses, overwrite `addr_limit`, gain arbitrary kernel read/write, disable SELinux enforcing, and escalate privileges to root. - `cve-2019-2215/exploit.c`: A standalone version of the exploit for direct execution. - Kotlin files (`MainActivity.kt`, `ExploitViewModel.kt`, `ExploitScreen.kt`): Provide the Android app interface, manage exploit execution, and display logs/results to the user. - Build scripts and configuration files for both the Android app and native code. The exploit targets Android 10 (Q) and earlier devices with unpatched kernels. It requires local code execution (e.g., via an installed APK or shell access). The main fingerprintable endpoint is `/dev/binder`, which is accessed to trigger the vulnerability. The exploit disables SELinux enforcing and attempts to escalate privileges to root, providing a root shell or root access if successful. The repository is well-documented, with a detailed README explaining setup, usage, and the underlying vulnerability. The exploit is operational, with a working payload, but is not weaponized for mass exploitation.

This repository is a comprehensive local privilege escalation exploit for Android devices running Linux kernel 3.18, targeting CVE-2019-2215. The structure includes: - Native C exploits (su98.c, su98-memory-kallsyms.c, poc98.c) that leverage a use-after-free vulnerability in the binder driver to gain arbitrary kernel read/write and escalate privileges to root. - An Android app (Java code in app/src/main/java/mobi/omegacentauri/su98/) that manages installation, uninstallation, and persistence of the su binary, as well as user interface elements for controlling exploit behavior (e.g., install on boot). - Shell scripts (install.sh, uninstall.sh) for installing the su binary to /sbin, setting permissions, and managing symlinks and whitelist/deny files for access control. - The exploit disables SELinux enforcement for full root access and can persist across reboots if configured. - The Makefile and build scripts facilitate cross-compilation for ARM64 Android targets. The exploit is operational and provides a persistent root shell on vulnerable devices. It is not part of a larger exploitation framework but is a standalone, weaponized exploit with both command-line and Android app interfaces. The main attack vector is local, requiring code execution on the target device. Multiple fingerprintable file paths are used for persistence and access control.

This repository contains a proof-of-concept (POC) local privilege escalation exploit for CVE-2019-2215, targeting Android devices with kernels patched before October 2019. The exploit is specifically ported for the SHARP AQUOS sense 2 (SH-M08) device running Android 8.1.0, but can be adapted to other devices by extracting the necessary kernel symbol offsets from the device's vmlinux image. The repository consists of a README.md with detailed build, usage, and porting instructions, and a single C source file (poc.c) implementing the exploit logic. The exploit works by abusing a vulnerability in the Binder driver to gain arbitrary kernel read/write access, then escalates the current process to root, disables SELinux enforcement and SECCOMP, and spawns a root shell. The exploit must be run locally on the device (e.g., via adb shell), and is not a remote exploit. The main fingerprintable endpoints are the location where the binary is pushed (/data/local/tmp/poc) and the use of /system/bin/sh to spawn a shell. The exploit is a POC and requires adaptation for different devices and kernel versions.

This repository is a comprehensive Android kernel exploitation lab focused on CVE-2019-2215, a critical use-after-free vulnerability in the Android binder driver. The structure includes documentation for environment setup, kernel building, fuzzing (with AFL++ and Syzkaller), and GDB-based kernel debugging. The core exploit code is in 'exploit-code/binder_cve_2019_2215_exploit.cpp', which implements a full local privilege escalation chain: it manipulates binder and epoll file descriptors to trigger a use-after-free, leaks kernel memory, achieves arbitrary kernel read/write, patches the current process's credentials to root, disables SELinux, and spawns a root shell. A minimal proof-of-concept (PoC) is provided in 'exploit-code/binder_cve_2019_2215_poc.c'. The Makefile and CMakeLists.txt automate building and deploying the exploit and PoC to an Android device or emulator. Fuzzers and GDB scripts are included for advanced analysis and debugging. The exploit targets Android 8.x, 9.0, and early 10 on x86_64 and ARM64 platforms, requiring local access (e.g., via ADB). Key fingerprintable endpoints include the '/dev/binder' device node and the location of deployed binaries in '/data/local/tmp/'. The repository is operational and provides a working exploit chain for research and educational purposes.

This repository contains a single Metasploit module (modules/exploits/android/local/binder_uaf.rb) that exploits CVE-2019-2215, a use-after-free vulnerability in the Android kernel's Binder driver. The exploit is a local privilege escalation, allowing an attacker with code execution on a vulnerable Android device (AARCH64 architecture) to gain root privileges. The module uploads a precompiled exploit binary and a payload (default: Meterpreter reverse shell) to the target device, executes the exploit to escalate privileges, and then runs the payload as root. The module is weaponized, supporting customizable payloads via Metasploit, and is intended for post-exploitation scenarios where the attacker already has a session on the device. No network endpoints are hardcoded; the attack is purely local, with file paths for the exploit and payload binaries being dynamically generated and cleaned up after execution. The module references several public advisories and proof-of-concept resources for further information.

This repository provides a local privilege escalation exploit for Huawei P20 Pro (CLT-AL00) devices running a hardened kernel vulnerable to CVE-2019-2215. The exploit is specifically tailored for a device with build fingerprint 'HUAWEI/CLT-AL00/HWCLT:8.1.0/HUAWEICLT-AL00/176(C00):user/release-keys'. The repository contains C source files for the main exploit logic (common.c, patch_system.c, poc.c), a modified 'su' daemon (in the 'sud' directory), and supporting bash scripts for automating the exploitation and root access setup. The exploitation process involves first running 'patch_system' to disable SELinux protections, then running 'poc' to escalate privileges and spawn a root shell. Optionally, a 'su' daemon can be installed to provide persistent root access to other applications. The scripts automate remounting filesystems, copying binaries, and setting up the environment for root access. The exploit interacts with several kernel and system endpoints, including '/dev/binder', '/dev/ptmx', various cgroup control files, and SELinux context files. The code is operational and provides a working local root exploit for the specified device and configuration.

This repository is a weaponized Android malware project that combines a custom ransomware, data exfiltration, and a local privilege escalation exploit (CVE-2019-2215) to achieve root and establish a reverse shell. The main codebase is an Android app disguised as a 2048 game (Java/Kotlin), which, upon installation and execution, encrypts all files in /sdcard/Pictures using AES, stores per-file keys in /sdcard/keys.json, and retrieves a master key and victim ID from a C2 server (http://192.168.157.73:8080). The app exfiltrates contacts, emails, and account information to the C2 via HTTP POST. It downloads and executes a root exploit payload (shells.zip) containing a compiled CVE-2019-2215 exploit and a reverse shell binary, achieving root and connecting back to the attacker's server. The dropper server (Python Flask) provides endpoints for payload delivery, key management, and data exfiltration. The repository also includes the native C exploit code and server-side scripts. This is a full operational proof-of-concept for Android ransomware with root exploit and C2 integration.

This repository contains a full operational local privilege escalation exploit for CVE-2019-2215 (the 'bad binder' vulnerability) specifically ported to the Huawei P20lite running Android 8.0.0 (kernel 4.4.23). The exploit is implemented in C and is designed to be built with the Android NDK for ARM64. The main exploit logic resides in 'exploit/cve_2019_2215.c', which leverages a use-after-free in the binder driver ('/dev/binder') to achieve arbitrary kernel read/write. The exploit then escalates privileges to root by overwriting the process's credentials, disables seccomp, and manipulates SELinux policies to make all types permissive, effectively disabling SELinux enforcement. The exploit also grants all Linux capabilities to the process. The payload is a root shell spawned on the device. The repository includes supporting code for kernel read/write primitives, SELinux policy manipulation, and seccomp disabling. The Makefile and Android.mk files automate building and deploying the exploit binary to the target device. The exploit is not a detection script or a PoC; it is a fully operational exploit with a hardcoded payload (root shell).

This repository contains a local privilege escalation exploit for Android devices vulnerable to CVE-2019-2215, a use-after-free in the Binder driver. The main exploit logic is implemented in two C files: 'poc.c' and 'su98.c'. 'poc.c' targets general vulnerable kernels, while 'su98.c' is tailored for Android 3.18 kernels with specific offsets. Both files implement the exploit chain to gain arbitrary kernel read/write, escalate privileges, disable SELinux enforcing, and join the init mount and network namespaces. The payload spawns a root shell, providing full control over the device. The Makefile and Android.mk facilitate building and deploying the exploit binary to the target device via ADB. The exploit is operational and provides a working root shell on affected devices. No network endpoints are targeted; the attack vector is local, requiring code execution on the device (e.g., via ADB or a malicious app).

This repository contains a proof-of-concept (PoC) exploit for CVE-2019-2215, a privilege escalation vulnerability in the Android kernel. The exploit targets Google Pixel 2 and Pixel 2 XL devices running the September 2019 QP1A.190711.020 image with kernel version 4.4.177-g83bee1dc48e8. The main file, 'cve-2019-2215.c', is a C program that, when compiled for arm64 and executed on a vulnerable device, exploits a kernel memory read/write vulnerability to escalate privileges and spawn a temporary root shell. The exploit also includes a debug console for advanced kernel memory manipulation. The Makefile provides build instructions for cross-compiling the exploit using the Android NDK. The README.md details usage instructions, device requirements, and credits. The exploit is local-only and does not expose any network endpoints; it requires physical or ADB access to the device. The overall structure is typical for a PoC: a single C source file, a Makefile for building, and documentation.

This repository contains a local privilege escalation exploit for CVE-2019-2215 (Bad Binder), a vulnerability in the Android Binder driver. The main exploit logic is implemented in 'exp.cc', a C++ file that manipulates kernel structures to escalate privileges to root. The Makefile provides build and deployment instructions, targeting Android devices via the Android NDK toolchain. The exploit works by leaking kernel addresses, overriding process credentials, disabling SELinux enforcement, and finally spawning a root shell by executing '/bin/sh'. The exploit must be compiled for the target device's architecture and pushed to '/data/local/tmp/cve-2019-2215-exp' for execution. The repository is operational and provides a working local privilege escalation payload, but is not part of a larger exploit framework.

This repository is a weaponized Android malware project combining ransomware, privilege escalation, and data exfiltration. The main component is a modified 2048 Android game (Java/Kotlin) that, upon installation and execution, requests extensive permissions. Once granted, it encrypts all files in /sdcard/Pictures using AES, storing per-file keys in /sdcard/keys.json. It communicates with a C2 server (default: 192.168.157.73:8080) to retrieve a master key and victim ID, which are used to further encrypt the keys file and identify the victim. The malware downloads a ZIP archive containing a root exploit (CVE-2019-2215) and a reverse shell payload, extracts and executes them to gain root and establish a reverse shell to the attacker's server. Additionally, it exfiltrates contacts, emails, and account information via HTTP POST to the C2. The dropper_server.py script implements the C2 endpoints for payload delivery, key management, and data collection. The repository also includes the C source code for the CVE-2019-2215 exploit and supporting scripts for payload deployment. The project is a full-featured, operational Android malware suite, not a simple proof-of-concept.

This repository contains a local privilege escalation exploit for CVE-2019-2215, targeting Sony Bravia TVs running Android 8 (PKG6.0724) with kernel version 4.9.51. The exploit is implemented in C (poc-bravia.c) and leverages a use-after-free vulnerability in the Android Binder IPC subsystem to gain arbitrary kernel memory read/write. It then patches the current process's credentials to root, disables SELinux enforcement, and spawns a root shell, providing temporary root access. The README.md provides detailed compilation and usage instructions, including pushing the binary to the device and executing it via ADB shell. The exploit is operational and may be adapted to other affected devices by adjusting kernel offsets. The main attack vector is local, requiring code execution on the target device (e.g., via ADB). The only fingerprintable endpoint is the file path where the exploit binary is placed and executed.

This repository contains a working exploit for CVE-2019-2215, a use-after-free vulnerability in the Android kernel's binder driver. The exploit is implemented in C++ across two main files: 'exploit.cpp' (the main exploit logic) and 'trigger.cpp' (a minimal PoC to trigger the kernel crash). The exploit works by manipulating the binder driver via /dev/binder, creating a use-after-free condition, and leveraging it to gain arbitrary kernel read/write. It then escalates privileges by patching the current process's credentials to root, disables SELinux enforcing, and spawns a root shell. The included 'crash_report.txt' provides a KASan report confirming the use-after-free bug. The exploit targets unpatched Android devices running vulnerable kernels, and is operational, providing a real privilege escalation payload. No network endpoints are involved; the attack vector is local, requiring execution on the target device.

This repository contains a proof-of-concept (PoC) exploit for CVE-2019-2215, a use-after-free vulnerability in the Android Binder driver that allows local privilege escalation. The main exploit logic is implemented in 'PoC.cpp', which demonstrates how to leak the kernel task_struct address and modify the addr_limit field by manipulating epoll and iovec structures and exploiting the Binder driver's UAF condition. The exploit does not provide a shell or direct privilege escalation, but serves as a learning tool for kernel exploitation techniques. The Makefile is provided to build the PoC for Android (cross-compilation). The only fingerprintable endpoint is the '/dev/binder' device file, which is the target of the exploit. The repository is structured as a typical PoC: a single C++ source file, a Makefile for building, a README with context and references, and a license file. The exploit requires local code execution on a vulnerable Android device and does not target remote or network attack vectors.

This repository contains a local privilege escalation exploit for the Android kernel vulnerability CVE-2019-2215, also known as 'Bad Binder'. The exploit is implemented in C (exploit.c) and targets the binder driver by abusing a use-after-free (UAF) vulnerability. The exploit achieves arbitrary address read (AAR) and arbitrary address write (AAW) primitives, which are then used to leak kernel addresses and overwrite the addr_limit field. This allows the attacker to modify the cred_struct in kernel memory, effectively escalating privileges to root. The exploit interacts directly with the /dev/binder device and uses various Linux system calls (epoll, mmap, pipe, writev, etc.) to manipulate kernel memory. The README.md provides background and references but no code. The exploit is operational and requires local access to a vulnerable Android device with the binder driver exposed.

This repository contains a working local privilege escalation exploit for CVE-2019-2215, targeting Google Pixel 2 and Pixel 2 XL devices running the September 2019 QP1A.190711.020 image with kernel version 4.4.177-g83bee1dc48e8. The main exploit is implemented in a single C file ('cve-2019-2215.c'), which, when compiled and executed on a vulnerable device, leverages a kernel vulnerability to gain arbitrary kernel memory read/write access, patches the current process credentials to root, and spawns a root shell. The exploit also sets SELinux to permissive mode. Optionally, a debug console can be invoked to allow direct kernel memory manipulation and inspection. The Makefile facilitates cross-compilation for AArch64 using the Android NDK. The README provides detailed usage instructions, including compilation, deployment, and example outputs. The exploit is operational and provides a real privilege escalation path on affected devices, but is not weaponized for mass exploitation. No network endpoints are involved; the attack vector is strictly local, requiring code execution on the target device.

This repository contains a local privilege escalation exploit for CVE-2019-2215, a use-after-free vulnerability in the Android binder driver. The main file, 'exploit.c', is a C program that manipulates binder objects to gain arbitrary kernel read/write, disables SELinux enforcement, sets the current process's UID and GID to 0 (root), and spawns a root shell. The Makefile provides build and deployment instructions for Android (aarch64). The README references the original Project Zero bug. The exploit targets Android devices with a vulnerable binder driver and requires local code execution. Key fingerprintable endpoints include the '/dev/binder' device and the use of '/bin/sh' to spawn a shell. The exploit is operational, providing a working local privilege escalation payload.