derbo904
Keeper of Blinky lights
- Joined
- Dec 2, 2016
- Threads
- 18
- Messages
- 610
- Reaction score
- 330
- Location
- Bay Area, CA
- Vehicle(s)
- 17 FK7 | 11 E90M3
Update on my trials:
Car:
2017 Hatchback EX
Headunit Version:
Build Number 1.F191.02
Hardware:
2015 rMBP 15" with Homebrew ADB/NDK installed
Edit:
I'm going to double check my XML settings again and try a few versions of Waze and different USB sticks.
Edit (4:06pm PDT)
No luck. I tried 2 different USB sticks with different versions of Waze from different sources. The Headunit can definitely see it, but the APK installer doesn't.
Edit: 4:46pm PDT
Maybe I forgot to put the device back into Host mode? Would a reboot reset this?
Edit:
Nope, it resets to host when the car is turned off.
OT EDIT:
I pulled the bootanimation out. We could probably customize the boot animation as well.
System/media/bootanimation.zip
Car:
2017 Hatchback EX
Headunit Version:
Build Number 1.F191.02
Hardware:
2015 rMBP 15" with Homebrew ADB/NDK installed
- Turn on Dev Mode on the Headunit
- Set it to Device Mode
- Plugged in my Macbook, ran ADB Devices to see it listed.
- I successfully ran dirtycow's exploit "make root" in the exploit folder and was able to get root access.
- Ran ADB Shell and run-as to get privileged shell.
- Moved /data/data/whitelist-1.0.xml to /usr/local/tmp/
- chown the file to shell:shell
- I pulled the XML and edited the whitelist with the appropiate waze/spotify/keystores and pushed it back to the headunit /usr/local/tmp
- cp /usr/local/tmp/whitelist-1.0.xml to /data/data
- exit the shell, ran adb reboot
- Headunit reboots
- I plugged in my 8GB MBR FAT32 USB stick in the USB port under cupholders (USBDRIVE2) with Waze 4.25.02 APK in root folder.
- APK installer file list DOES NOT see the apk.
- I threw a wallpaper on the USB and the gallery does see it.
Code:
IT-DNG-rMBP:CVE-2016-5195-master dng$ make root
ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk APP_ABI=armeabi-v7a APP_PLATFORM=android-17
make[1]: Entering directory `/Users/dng/Downloads/Civic ADB/CVE-2016-5195-master'
[armeabi-v7a] Compile thumb : dirtycow <= dirtycow.c
[armeabi-v7a] Compile thumb : dirtycow <= dcow.c
[armeabi-v7a] Executable : dirtycow
[armeabi-v7a] Install : dirtycow => libs/armeabi-v7a/dirtycow
[armeabi-v7a] Compile thumb : run-as <= dirtycow.c
[armeabi-v7a] Compile thumb : run-as <= run-as.c
[armeabi-v7a] Executable : run-as
[armeabi-v7a] Install : run-as => libs/armeabi-v7a/run-as
make[1]: Leaving directory `/Users/dng/Downloads/Civic ADB/CVE-2016-5195-master'
adb push libs/armeabi-v7a/dirtycow /data/local/tmp/dcow
libs/armeabi-v7a/dirtycow: 1 file pushed. 0.9 MB/s (17880 bytes in 0.019s)
adb shell 'chmod 777 /data/local/tmp/dcow'
adb shell 'chmod 777 /data/local/tmp/dcow'
adb push libs/armeabi-v7a/run-as /data/local/tmp/run-as
libs/armeabi-v7a/run-as: 1 file pushed. 0.8 MB/s (5544 bytes in 0.007s)
adb shell '/data/local/tmp/dcow /data/local/tmp/run-as /system/bin/run-as'
dcow /data/local/tmp/run-as /system/bin/run-as
warning: new file size (5544) and destination file size (9464) differ
[*] size 9464
[*] mmap 0x401f2000
[*] currently 0x401f2000=464c457f
[*] using ptrace method
[*] madvise = 0x401f2000 9464
[*] ptrace 0 4
[*] exploited 7052 0x401f2000=464c457f
IT-DNG-rMBP:CVE-2016-5195-master dng$
^[015c026ed634160a device
IT-DNG-rMBP:CVE-2016-5195-master dng$ adb shell
shell@android:/ $ run-as
uid run-as 2000
uid 0
no selinux?
shell@android:/ #
Edit:
I'm going to double check my XML settings again and try a few versions of Waze and different USB sticks.
Edit (4:06pm PDT)
No luck. I tried 2 different USB sticks with different versions of Waze from different sources. The Headunit can definitely see it, but the APK installer doesn't.
Code:
IT-DNG-rMBP:~ dng$ adb shell
shell@android:/ $ run-as
uid run-as 2000
uid 0
no selinux?
shell@android:/ # cd /usbdrive2 && ls -l
d---rwxr-x system media_rw 2017-06-24 16:02 PK
d---rwxr-x system media_rw 2017-06-24 14:53 System Volume Information
----rwxr-x system media_rw 27059534 2017-06-24 15:44 com.spotify.music_5.9.0.774-13633811_minAPI15(armeabi-v7a)(nodpi)_apkmirror.com.apk
----rwxr-x system media_rw 54188909 2017-06-24 14:52 com.waze.apk
----rwxr-x system media_rw 40670040 2017-06-24 14:28 com.waze_3.9.8.0.apk
----rwxr-x system media_rw 47040297 2017-06-24 14:27 com.waze_4.1.0.1.apk
----rwxr-x system media_rw 54188909 2017-06-24 14:26 com.waze_4.25.0.2.apk
shell@android:/usbdrive2 #
Edit: 4:46pm PDT
Maybe I forgot to put the device back into Host mode? Would a reboot reset this?
Edit:
Nope, it resets to host when the car is turned off.
OT EDIT:
I pulled the bootanimation out. We could probably customize the boot animation as well.
System/media/bootanimation.zip
Sponsored
Attachments
-
12.4 KB Views: 607
Last edited: