my extended take on Mark Brand's CVE 2016-3861 libutils bug# CVE-2016-3861
An extended version of Mark Brand's libutils exploit, from the Google Project Zero blog post: https://googleprojectzero.blogspot.com/2016/09/return-to-libstagefright-exploiting.html
Main differences:
* all of the mp4 files used for exploitation are generated in the browser dynamically
* comes with an 'extra_groom' option as certain AOSP builds in the 5-6 version regions require additional heap grooming
Does this actually work?
* yes, but it only gets PC control, and does nothing further
* I've only provided hard-coded addresses for one AOSP build that worked on a spare Nexus 5 I had lying around
* I've attempted this exploit on other phone models (e.g. Samsung), and the heap groom seems to be way different
* code is old, and comments aren't exactly fantastic
This was my first foray into browser exploits, and I really just wanted to see if I could do it. Really this just ended up being an exercise in learning mp4 parsing and some libmedia internals.
[4.0K] /data/pocs/9be6367bb0a03c3a96a286cd147d4f729ba95053
├── [ 912] bn_calc_offsets.py
├── [ 32K] poc.html
└── [ 983] README.md
0 directories, 3 files