CVE-2016-3861 PoC — Android LibUtils 远程代码执行漏洞

Source

https://github.com/kswzzl/CVE-2016-3861

Associated Vulnerability

Title: Android LibUtils 远程代码执行漏洞 (CVE-2016-3861)
Description:LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different encoding widths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted file, aka internal bug 29250543.

Description

my extended take on Mark Brand's CVE 2016-3861 libutils bug

Readme

# CVE-2016-3861

An extended version of Mark Brand's libutils exploit, from the Google Project Zero blog post: https://googleprojectzero.blogspot.com/2016/09/return-to-libstagefright-exploiting.html

Main differences:
* all of the mp4 files used for exploitation are generated in the browser dynamically
* comes with an 'extra_groom' option as certain AOSP builds in the 5-6 version regions require additional heap grooming

Does this actually work?
* yes, but it only gets PC control, and does nothing further
* I've only provided hard-coded addresses for one AOSP build that worked on a spare Nexus 5 I had lying around
* I've attempted this exploit on other phone models (e.g. Samsung), and the heap groom seems to be way different
* code is old, and comments aren't exactly fantastic

This was my first foray into browser exploits, and I really just wanted to see if I could do it. Really this just ended up being an exercise in learning mp4 parsing and some libmedia internals.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →