Out-of-bounds write in Android binder_transaction

This repository contains a fully operational local privilege escalation exploit for CVE-2020-0041, targeting the Android binder driver on Google Pixel 3 devices running the February 2020 firmware (QQ1A.200205.002). The exploit is implemented in C and is designed to be built with the Android NDK for the arm64-v8a architecture. The main entry point is 'src/exploit.c', which orchestrates the exploitation process by interacting with the binder device '/dev/hwbinder', manipulating kernel memory structures, and ultimately disabling SELinux enforcement before spawning a root shell ('/system/bin/sh'). The exploit leverages a use-after-free vulnerability in the binder driver, using complex heap manipulation and thread synchronization to achieve arbitrary kernel memory writes. The repository is well-structured, with separate source files for binder interaction, endpoint management, node and pending node handling, and heap reallocation primitives. The Makefile and Android.mk facilitate building and deploying the exploit to a target device via adb. The exploit is hardcoded for a specific firmware version and requires adaptation for other devices or firmware versions. The overall purpose of the repository is to provide a working proof-of-concept for local privilege escalation on vulnerable Android devices, with the end result being a root shell and SELinux disabled.

This repository contains a fully functional local privilege escalation exploit for CVE-2020-0041, targeting Google Pixel 3 and Pixel 3a devices running the February 2020 firmware (QQ1A.200205.002). The exploit is written in C and is structured as a complex multi-threaded program that abuses the Android binder driver via /dev/hwbinder. The main entry point is src/exploit.c, which orchestrates the exploitation process, including kernel memory manipulation, reference count abuse, and controlled reallocation of kernel objects. The exploit disables SELinux enforcement and spawns a root shell (/system/bin/sh) with full privileges. The repository includes a Makefile and Android.mk for building the exploit with the Android NDK, and a detailed README.md explaining the adaptation process for different firmware versions. The codebase is modular, with separate files for binder interaction, endpoint management, node and pending node handling, and kernel memory reallocation. The exploit is operational and requires adaptation of hardcoded kernel offsets for use on other firmware versions.

This repository is a proof-of-concept (POC) exploit targeting the Android Binder subsystem, specifically interacting with the /dev/hwbinder device. The code is written in C and is structured for compilation with the Android NDK for the arm64-v8a architecture (Android 29+). The main entry point is POC/src/poc.c, which sets up memory mappings, pins the process to a CPU core, checks SELinux enforcement, and opens the Binder device. It attempts to become the Binder context manager and enters a loop to handle Binder transactions. Supporting files (binder.c/h, node.c/h) provide abstractions for Binder operations and node management. The Makefile and Android.mk files facilitate building and deploying the binary to an Android device. The exploit does not contain a weaponized payload but demonstrates the necessary steps to interact with the Binder driver, likely as a basis for further exploitation (such as triggering a use-after-free or privilege escalation in the Binder subsystem). The main fingerprintable endpoints are the /dev/hwbinder device and the /sys/fs/selinux/enforce file.

This repository contains a sophisticated local privilege escalation exploit targeting CVE-2020-0041, a use-after-free vulnerability in the Android binder driver. The exploit is specifically tailored for the Google Pixel 3 family running the February 2020 firmware (QQ1A.200205.002), but can be adapted to other devices/firmware by updating kernel offsets. The structure includes multiple C source files implementing the exploit logic, helpers for binder and endpoint manipulation, and Makefiles for building the binary with the Android NDK. The main entry points are 'src/exploit.c' and 'src/exploit_adapt.c'. The exploit works by manipulating binder nodes and endpoints, triggering a use-after-free, and leveraging kernel memory corruption to disable SELinux and escalate privileges. Upon success, it spawns a root shell ('/system/bin/sh') with full privileges. Key fingerprintable endpoints include the device file '/dev/hwbinder', the location where the exploit binary is pushed ('/data/local/tmp/poc'), and the shell binary executed. The exploit is operational, with hardcoded offsets for the target firmware, and requires adaptation for other devices. The README provides detailed build and usage instructions, as well as guidance for adapting the exploit to other firmware versions.

This repository contains a comprehensive exploit toolkit for CVE-2020-0041, a critical Android binder vulnerability. The repository is organized into two main exploit paths: 1. **Local Privilege Escalation (LPE) (lpe/):** - Implements a complex kernel exploit targeting the binder driver on Android (specifically tested on Pixel 3, firmware QQ1A.200205.002). - The exploit disables SELinux and spawns a root shell by leveraging a use-after-free and controlled kernel memory manipulation via binder transactions. - The code is modular, with separate files for binder interaction, endpoint management, node manipulation, and exploitation logic. The main entry point is `lpe/src/exploit.c`. - The exploit must be built with the Android NDK and pushed to the device, then executed locally (e.g., via adb shell). 2. **Chrome Sandbox Escape (sandbox/):** - Provides patches for Chromium 78.0.3904.62 (Android) to demonstrate a browser-based sandbox escape using the same binder vulnerability. - The exploit is triggered via a crafted web page (`sandbox/index.html`) that calls a patched JavaScript function, redirecting execution to native exploit code. - A reverse shell payload is included (`sandbox/reverse_shell/src/reverse_shell.c`), which connects back to 127.0.0.1:5555, and a Python server (`sandbox/serve.py`) serves the payloads to the browser exploit. - The exploit requires building and installing a patched Chromium APK and serving the exploit page and payloads locally. **Key endpoints and artifacts:** - `/dev/hwbinder`: Kernel device used for exploitation. - `/data/local/tmp/poc`: Location where the LPE binary is pushed and executed. - `/system/bin/sh`: Root shell spawned by the LPE exploit. - `127.0.0.1:5555`: Reverse shell target for the browser exploit. - `localhost:6666`: Local server for payload delivery. - `http://localhost:8080/`: Web endpoint to trigger the browser exploit. **Purpose:** The repository demonstrates both local and remote (browser-based) exploitation of CVE-2020-0041, providing full exploit chains for privilege escalation and sandbox escape on Android. The code is operational and includes payloads for root shell access and reverse shell connections. The exploits are not weaponized for mass exploitation but are highly functional and adaptable for research or targeted use.