Kernel Privesc with GDB Scripts

1. Kernel Build Configuration

android-kernel-exploitation-lab/android-kernel on  main [!?] 
❯ BUILD_CONFIG=../kernel-build-configs/x86_64_kasan_debug_build.sh build/build.sh

• Purpose: Build the Android kernel with debugging configurations
• Key Points:
  • Uses a predefined build configuration for x86_64 KASAN (Kernel Address Sanitizer) debug build
  • Prepares the kernel with instrumentation for security analysis and debugging

2. Emulator Launch with Kernel Debugging

emulator -show-kernel -no-snapshot -wipe-data -avd CVE-2019-2215 -kernel ~/android-kernel-exploitation-lab/android-kernel/out/relwithdebinfo/dist/bzImage -qemu -s -S

• Emulator Configuration:
  • -show-kernel: Display kernel log messages
  • -no-snapshot: Prevent saving/restoring emulator state
  • -wipe-data: Clear all user data
  • -avd CVE-2019-2215: Use a specific Android Virtual Device
  • -kernel: Specify custom kernel image
  • -qemu -s -S:
    • -s: Enable GDB server on TCP port 1234
    • -S: Pause execution at startup, waiting for debugger

3. GDB Kernel Debugging Connection

gdb -quiet ~/android-kernel-exploitation-lab/android-kernel/out/relwithdebinfo/dist/vmlinux -ex 'target remote :1234'

• Debugging Setup:
  • Load the kernel debug symbol file (vmlinux)
  • Connect to the remote debugging server on localhost:1234
  • Prepare for kernel-level debugging and analysis

4. Process Identification

❯ adb shell
generic_x86_64:/ $ pidof sh
6998
generic_x86_64:/ $

• Objective: Identify the process ID of the shell
• Used for: Targeting specific process for privilege escalation

5. Kernel Privilege Escalation Script

(remote) gef➤ source ~/android-kernel-exploitation-lab/gdb-scripts/kernel_privesc.py

• Script Functionality:
  • Load custom GDB scripts for kernel exploitation
  • Provides utilities like:
    • task-list: List kernel tasks
    • task-by-pid: Find task structure by PID
    • root-by-pid: Elevate privileges for a process

6. Privilege Escalation Execution

(remote) gef➤ root-by-pid 6998

• Exploitation Process:
  • Target a specific process (PID 6998)
  • Patch process credentials
  • Disable SELinux enforcement
  • Gain root privileges

7. Verification of Root Access

❯ adb shell
generic_x86_64:/ $ pidof sh
6998
generic_x86_64:/ $ id
uid=0(root) gid=0(root) groups=0(root),...

• Confirmation:
  • Verify successful privilege escalation
  • User ID and Group ID changed to root
  • Multiple root-level group memberships acquired