CVE-2014-7911 PoC — Android 权限许可和访问控制漏洞

Source

https://github.com/GeneBlue/cve-2014-7911-exp

Associated Vulnerability

Title:Android 权限许可和访问控制漏洞 (CVE-2014-7911)
Description:Google Chrome是美国谷歌（Google）公司开发的一款Web浏览器。Android是美国谷歌（Google）公司和开放手持设备联盟（简称OHA）共同开发的一套以Linux为基础的开源操作系统。 Android 5.0.0之前版本的java.io.ObjectInputStream实现中的luni/src/main/java/java/io/ObjectInputStream.java文件存在安全漏洞，该漏洞源于程序没有检查反序列化的对象是否可以序列化。攻击者可借助序列化对象的finalize方

Description

exploit for cve-2014-7911; android; java deserialization ;system privilege;ace;

Readme

# cve-2014-7911-exp
exploit for cve-2014-7911; android; java deserialization ;system privilege;ace;

This exp refers to retme7's [exp](https://github.com/retme7/CVE-2014-7911_poc),but the rop chain is different.

And the most important part is [Chunk Spray](https://github.com/GeneBlue/cve-2014-7911-exp/blob/master/heap_spray_layout.jpg).

Hope it will help.

#environment
device:nexus5

os version:Android4.4.4

File Snapshot


 [4.0K]  /data/pocs/516a900201514db15e09a1d05cab9528b7dbf846
├── [1.0K]  AndroidManifest.xml
├── [4.0K]  assets
│   └── [ 13K]  msmattack
├── [4.0K]  bin
│   ├── [1.0K]  AndroidManifest.xml
│   ├── [4.0K]  classes
│   │   ├── [4.0K]  AAdroid
│   │   │   └── [4.0K]  os
│   │   │       └── [ 460]  BinderProxy.class
│   │   └── [4.0K]  gene
│   │       └── [4.0K]  blue
│   │           └── [4.0K]  cve20147911exp
│   │               ├── [ 357]  BuildConfig.class
│   │               ├── [ 770]  MainActivity$1.class
│   │               ├── [4.3K]  MainActivity$2.class
│   │               ├── [9.5K]  MainActivity.class
│   │               ├── [ 358]  R$attr.class
│   │               ├── [ 479]  R$dimen.class
│   │               ├── [ 425]  R$drawable.class
│   │               ├── [ 475]  R$id.class
│   │               ├── [ 421]  R$layout.class
│   │               ├── [ 406]  R$menu.class
│   │               ├── [ 490]  R$string.class
│   │               ├── [ 449]  R$style.class
│   │               └── [ 733]  R.class
│   ├── [1.3M]  classes.dex
│   ├── [497K]  CVE20147911EXP.apk
│   ├── [4.0K]  dexedLibs
│   │   └── [440K]  android-support-v4-163608780dbd86e59a7e6765fdf2ca70.jar
│   ├── [ 120]  jarlist.cache
│   ├── [4.0K]  res
│   │   └── [4.0K]  crunch
│   │       ├── [4.0K]  drawable-hdpi
│   │       │   └── [5.8K]  ic_launcher.png
│   │       ├── [4.0K]  drawable-mdpi
│   │       │   └── [3.0K]  ic_launcher.png
│   │       ├── [4.0K]  drawable-xhdpi
│   │       │   └── [9.1K]  ic_launcher.png
│   │       └── [4.0K]  drawable-xxhdpi
│   │           └── [ 17K]  ic_launcher.png
│   └── [ 47K]  resources.ap_
├── [4.0K]  gen
│   └── [4.0K]  gene
│       └── [4.0K]  blue
│           └── [4.0K]  cve20147911exp
│               ├── [ 166]  BuildConfig.java
│               └── [2.6K]  R.java
├── [ 52K]  heap_spray_layout.jpg
├── [ 50K]  ic_launcher-web.png
├── [4.0K]  libs
│   └── [1.3M]  android-support-v4.jar
├── [ 781]  proguard-project.txt
├── [ 563]  project.properties
├── [ 413]  README.md
├── [4.0K]  res
│   ├── [4.0K]  drawable-hdpi
│   │   └── [7.5K]  ic_launcher.png
│   ├── [4.0K]  drawable-mdpi
│   │   └── [3.7K]  ic_launcher.png
│   ├── [4.0K]  drawable-xhdpi
│   │   └── [ 12K]  ic_launcher.png
│   ├── [4.0K]  drawable-xxhdpi
│   │   └── [ 24K]  ic_launcher.png
│   ├── [4.0K]  layout
│   │   └── [1.1K]  activity_main.xml
│   ├── [4.0K]  menu
│   │   └── [ 374]  main.xml
│   ├── [4.0K]  values
│   │   ├── [ 220]  dimens.xml
│   │   ├── [ 231]  strings.xml
│   │   └── [ 697]  styles.xml
│   ├── [4.0K]  values-v11
│   │   └── [ 334]  styles.xml
│   ├── [4.0K]  values-v14
│   │   └── [ 391]  styles.xml
│   └── [4.0K]  values-w820dp
│       └── [ 381]  dimens.xml
└── [4.0K]  src
    ├── [4.0K]  AAdroid
    │   └── [4.0K]  os
    │       └── [ 226]  BinderProxy.java
    └── [4.0K]  gene
        └── [4.0K]  blue
            └── [4.0K]  cve20147911exp
                └── [ 13K]  MainActivity.java

37 directories, 48 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!