bana-io · HackerTrans

5 saat öncediscuss

I've created an issue in GitHub, please see https://github.com/NebuSec/CyberMeowfia/issues/46 (Samsung SM-S948B (S26 Ultra)).

It would be nice to get a `Dockerfile` to build the exploit/POC.

bana-io

10 saat öncediscuss

So I took the risk and ran it on a Samsung S26 Ultra - I will confirm the full details once I have `adb` installed and running.

The exploit/POC (call it what you want) ran or appeared to have executed because:

1. I saw output on the Firefox tab when I navigated to <https://rootme.nebusec.io/b9e3f1a4-7c82-4d6e-9a51-2f8c4b3e0d...>.

2. I saw some output from the execution of the POC.

However, after I went to <https://rootme.nebusec.io/b9e3f1a4-7c82-4d6e-9a51-2f8c4b3e0d...> the phone froze and refused to respond to any input. The only thing that worked was restarting, which I wonder how it works given the, I think, the kernel has hung. Does anyone know how the kernel is able to respond to events whilst the system has hung? The screen remains on with the partial output of the execution of the POC until the screen saver kicks in ...

bana-io

10 saat öncediscuss

Can you please provide a `Dockerfile` to build the POC/exploit?

bana-io

10 saat öncediscuss

What Android devices did you test on exactly?

I take it you did NOT unlock the bootloader?

> Two boot looped, I had to enter recovery and the other just powered off [0].

Absolutely crazy that it is possible to brick someone's phone via an exploit but ... hey.

After the power off what happened? Do things seem normal?

When it entered recovery mode where you able to get the phone in a clean state again? I take it that you did?

I'd really like to run this but I, ideally, do not want to run something random from the internet. It's a shame there is no `Dockerfile` to build this exploit/POC. All I want is LPE to `root` on a Samsung (Snapdragon) phone.

bana-io

evvelsi gündiscuss

What I would have done is tested it with an Android phone. My Samsung S26 Ultra allows me to connect to an external display via a USB C hub. So the test setup would be:

1. Plug the phone into hub.

2. Check that you get display output, the mouse and keyboard are working whilst the screen is not turned off and the phone is not locked.

3. Lock the screen and wait for the screen to turn off, thereby mimicking suspend.

4. Try to make the phone resume by using the attached keyboard and/or mouse.

If all goes well, the monitor should turn on after unlocking the phone or using the keyboard / mouse.

# Other things to try

Again try and reproduce the issue with a Samsung tablet that supports display out via USB C.

Connect the keyboard via Bluetooth and try to make the laptop resume. I found that connecting a Keychron keyboard via bluetooth allowed me to resume a Macbook Pro. I was kinda surprised that this worked.

Does the same issue occur on Linux as well?

I guess you could attach a USB packet type of debugger to ensure that data is being sent to the laptop by attaching the debugger to the cable that connects to the host machine. If you see USB traffic when the monitor goes to sleep and you are pressing keys in the keyboard and the dock still has power that means the dock is working fine so you can rule that out.

bana-io

7 gün öncediscuss

Are you certain this is running OpenWRT? As in, can I get a OpenWRT build and flash it to the router and have it work?

comments