CVE-2014-7911 PoC — Android 权限许可和访问控制漏洞

Source

https://github.com/ele7enxxh/CVE-2014-7911

Associated Vulnerability

Title:Android 权限许可和访问控制漏洞 (CVE-2014-7911)
Description:luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify that deserialization will result in an object that met the requirements for serialization, which allows attackers to execute arbitrary code via a crafted finalize method for a serialized object in an ArrayMap Parcel within an intent sent to system_service, as demonstrated by the finalize method of android.os.BinderProxy, aka Bug 15874291.

Readme

# CVE-2014-7911
POC for CVE-2014-7911 for Nexus5 Android 4.4.4_r1 based on retme7, use different rop chain

#Info
http://ele7enxxh.com/CVE-2014-7911-Detailed-Analysis-Of-Android-Local-Privilege-Escalation-To-System-Vulnerability.html

# Usage
connect your phone via adb
```
adb push jni/expolit /data/local/tmp
adb logcat | grep auo_
```
lunch this poc, click the “CVE-2014-7911” button, you will see:
```
D/auo_CVE20147911(24892): staticAddr = 0x43a1f000
D/auo_CVE20147911(24892): heap sparying... 0
D/auo_CVE20147911(24892): heap sparying... 100
D/auo_CVE20147911(24892): heap sparying... 200
D/auo_CVE20147911(24892): heap sparying... 300
D/auo_CVE20147911(24892): heap sparying... 400
D/auo_CVE20147911(24892): heap sparying... 500
D/auo_CVE20147911(24892): heap sparying... 600
D/auo_CVE20147911(24892): heap sparying... 700
D/auo_CVE20147911(24892): heap sparying... 800
D/auo_CVE20147911(24892): heap sparying... 900
D/auo_CVE20147911(24892): heap sparying... 1000
D/auo_CVE20147911(24892): heap sparying... 1100
D/auo_CVE20147911(24892): heap sparying... 1200
D/auo_CVE20147911(24892): heap sparying... 1300
D/auo_CVE20147911(24892): heap sparying... 1400
D/auo_CVE20147911(24892): heap sparying... 1500
D/auo_CVE20147911(24892): heap sparying... 1600
D/auo_CVE20147911(24892): heap sparying... 1700
D/auo_CVE20147911(24892): heap sparying... 1800
D/auo_CVE20147911(24892): heap sparying... 1900

```
Then minimize activity several times until the system crashes, if you see:
```
D/auo_exploit(22665): uid=1000(system) gid=1000(system)
```
the exploit has succeeded, if your phone just crashes, your device is vulnerable the exploit may have failed(you should find diffent ROP chains).

File Snapshot


 [4.0K]  /data/pocs/446dcaa4d061ec89f864c177bf757b6c1754719a
├── [4.0K]  app
│   ├── [ 590]  build.gradle
│   ├── [ 652]  proguard-rules.pro
│   └── [4.0K]  src
│       ├── [4.0K]  androidTest
│       │   └── [4.0K]  java
│       │       └── [4.0K]  com
│       │           └── [4.0K]  secauo
│       │               └── [4.0K]  cve_2014_7911
│       │                   └── [ 355]  ApplicationTest.java
│       └── [4.0K]  main
│           ├── [ 690]  AndroidManifest.xml
│           ├── [4.0K]  java
│           │   ├── [4.0K]  AAdroid
│           │   │   └── [4.0K]  os
│           │   │       └── [ 267]  BinderProxy.java
│           │   └── [4.0K]  com
│           │       └── [4.0K]  secauo
│           │           └── [4.0K]  cve_2014_7911
│           │               └── [ 10K]  MainActivity.java
│           └── [4.0K]  res
│               ├── [4.0K]  layout
│               │   └── [ 756]  activity_main.xml
│               ├── [4.0K]  menu
│               │   └── [ 361]  menu_main.xml
│               ├── [4.0K]  mipmap-hdpi
│               │   └── [3.3K]  ic_launcher.png
│               ├── [4.0K]  mipmap-mdpi
│               │   └── [2.2K]  ic_launcher.png
│               ├── [4.0K]  mipmap-xhdpi
│               │   └── [4.7K]  ic_launcher.png
│               ├── [4.0K]  mipmap-xxhdpi
│               │   └── [7.5K]  ic_launcher.png
│               ├── [4.0K]  values
│               │   ├── [ 211]  dimens.xml
│               │   ├── [ 130]  strings.xml
│               │   └── [ 194]  styles.xml
│               └── [4.0K]  values-w820dp
│                   └── [ 358]  dimens.xml
├── [ 436]  build.gradle
├── [4.0K]  gradle
│   └── [4.0K]  wrapper
│       ├── [ 49K]  gradle-wrapper.jar
│       └── [ 232]  gradle-wrapper.properties
├── [ 855]  gradle.properties
├── [5.0K]  gradlew
├── [2.3K]  gradlew.bat
├── [4.0K]  jni
│   ├── [ 765]  Android.mk
│   ├── [9.2K]  exploit
│   └── [ 621]  exploit.c
├── [1.7K]  README.md
└── [  15]  settings.gradle

26 directories, 27 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!