3

I got Sony m4 aqua with locked bootloader, android 6.01 and july 1 2016 security patch, no DM verity...
I would like to freeze few factory apps via adb's pm disable command (or any other way possible).
I've tried to run "su pm disable package.name" but the su command is not recognized for some reason. I am Linux noob but I got android studio with SDK and NDK installed on lubuntu machine (got it also on win7 machine).
Can someone explain me the steps to take in order to gain root shell access with DirtyCow exploit (or any other way) to be able to freeze apps?

  • Did you root your device? You can't call su when your device is not rooted. Besides, you can disable any package instead of uninstalling with pm hide package_name and it doesn't require root. – esQmo_ Jan 17 '17 at 19:02
  • No, my device is not rooted. I need root shell in order to install superSu apk. I am trying to get to root shell using dirtyCow exploit, but I am not sure how to do it (I'm not so good with Linux). – Markonionini Jan 17 '17 at 19:26
  • There is a thread on XDA-Developers about rooting Sony M4 Aqua: forum.xda-developers.com/m4-aqua/general/root-t3421932 – esQmo_ Jan 17 '17 at 19:31
  • I saw it, its only for devices with unlocked boot loader. Mine is locked, so I can not flash any recovery or replace bootloader. – Markonionini Jan 17 '17 at 19:35
  • 1
    This seems to be an XY problem. Isn't your real question how to root your device? Wouldn't you accept other methods, if available? – Izzy Jan 17 '17 at 19:53
3

The reason the command isn't working for you is because "su" is a binary that gets installed by rooting your device. Without a proper root you have no "su" command.

In order to use the dirtycow exploit you have to compile the binary for your device's architecture.

  • Head over to https://github.com/timwr/CVE-2016-5195 and download or git clone the files.
  • (Optional) If you do not know your device architecture then on the phone install the "Droid Hardware Info" app from Play Store, open it, and swipe left to get to the System tab. Next to the label "Instruction Sets" will be your supported architecture.
  • On your computer open a terminal and navigate to where the dirtycow files are (extract if needed). Then simply type "make (insert architecture here)" without the quotes. This will create two binaries inside the folder at libs/(your_architecture)/ called dirtycow & run-as. Alternatively, if you have USB Debugging enabled then simply attach the device and type "make root" and it will push the binaries into your device at /data/local/tmp, then automate a few ADB commands to exploit and grant you a limited root shell.
  • If you don't see the terminal user icon as # and instead see a $ then the exploit didn't work at some point. Since the files are still on the device I would suggest to then try and manually patch run-as by using adb shell and typing the following...

chmod 777 /data/local/tmp/*

dirtycow /data/local/tmp/run-as /system/bin/run-as

/system/bin/run-as

If this doesn't prompt you as root user (#) then the exploit won't work for your device in this fashion and you'll need to do some digging why not. If this happens try opening an Issue on the Github repo, it's still pretty active so you should have an answer before long.

  • I managed to get LIMITED root shell, but it can not execute any command I type in, it just shows #root... Do you know how can I use this root shell to freeze or delete system apps, and also do you know what is the purpose of having this limited root shell on android? – Markonionini May 6 '17 at 14:58
  • 1
    I'm not really the guy to be asking... I just know how to use it somewhat. BUT the fact that you have got it working enough to get the limited root shell means that your device is exploitable. At this point you don't need to use the shell to remove system apps. Watch my video on using dirtycow to bypass FRP lock and you'll see a perfect example of how to remove system apps with dirtycow youtu.be/iSsjeI7DV-k – therealjayvi May 13 '17 at 9:09
0

@therealjayvi

You forgot to say that compiling and using CVE-2016-5195 from timwr REQUIRES adb installed and NDK to be installed as well, prior to make [architecture] and make root, and that this must be done from a Linux environment.

All was either assumed that the pre-requisites where obtained before doing this, pre-requisites may have been added after comment, or little to nothing was known about exploit CVE-2016-5195 from the person who made the comment.

Anyways, this can all be done through: First being in linux (ubuntu, debian, mint, ext.) And i am assuming that adb is in your list of repositorys for apt, as it usually is be default, but not all the time. If sudo isn't present, use su.

sudo apt-get install adb

Get latest linux download from here, then extract and run:

export PATH=$PATH:/root/directory/of/ndk/

You may need to re-run export if you close the current terminal, as i cannot find a solution that stays.

Once all that is done then you can follow @therealjayvi 's way of going about this! Your welcome for the clarification on some people's parts.

-1

For all readers that are struggling with sony m4 'low storage' problem, and come accross to this page, hoping that dirtycow can help them. Just to note that it CAN NOT.

Dirtycow on marshmallow can not do anything because of selinux restrictions. And on lollipop there are already so much successfull exploits already.

No need to waste your time on android ndk compiling, except for knowledge-test.

Above accepted answer is good explantation of 'how to compile dcow proof of concept'. But it can not even ls current folder where it's run. And word limited inside 'limited root' should be bold to 100px font or renamed to "dummy root", so that kali-linux-hacker-wanna-be-s can not keep the air of misleading mystery around it.

/data/local/tmp$ run-as
/data/local/tmp# ls
opendir failed, permission denied
  • dirtycow works on any android phone that has a security version patch of October 5, 2016 and older. Android version (LP, MM, nougat, etc) none of that matters at all for dirtycow. but no, probably not in the way you're looking to use it. dirtycow enables the ability to write over "read-only" files. So as long as your firmware is vulnerable, and you can "see" a file with ls, then you can write over that file with any other file, binary, apk, anything at all and it will behave as if it is the original if you call the original by command/name. – therealjayvi Apr 7 '18 at 21:49
  • @therealjayvi I think for Android 6 and above, if you use dirty-cow exploit directly to get root access and modify the /system partition or any other partition like boot which's signature is verified by 'Android verified boot', the device won't boot up when you reboot since verified boot will fail when partition's root hash is altered. That's what @MetNP tried to convey by his statement I guess. – Gokul NC Sep 30 '18 at 13:12
  • @GokulNC You're definitely right about the boot chain, though what's cool about dcow is that it only changes the files in memory. This is why there's such a challenge with rooting a device with it, because any changes are removed upon reboot without utilizing other built-in features to do so. LG V20 has an example of using built-in features, as well as my video provided above. MetNP nobody said you'd be able to use the shell to read areas you are restricted from regardless. do ur homework yo ;) – therealjayvi Oct 8 '18 at 2:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.