my extended take on Mark Brand's CVE 2016-3861 libutils bug# CVE-2016-3861
An extended version of Mark Brand's libutils exploit, from the Google Project Zero blog post: https://googleprojectzero.blogspot.com/2016/09/return-to-libstagefright-exploiting.html
Main differences:
* all of the mp4 files used for exploitation are generated in the browser dynamically
* comes with an 'extra_groom' option as certain AOSP builds in the 5-6 version regions require additional heap grooming
Does this actually work?
* yes, but it only gets PC control, and does nothing further
* I've only provided hard-coded addresses for one AOSP build that worked on a spare Nexus 5 I had lying around
* I've attempted this exploit on other phone models (e.g. Samsung), and the heap groom seems to be way different
* code is old, and comments aren't exactly fantastic
This was my first foray into browser exploits, and I really just wanted to see if I could do it. Really this just ended up being an exercise in learning mp4 parsing and some libmedia internals.
登录后查看神龙缓存的 POC 文件快照
登录查看