initial exploit

2026-08-18 16:00:27 +04:00
parent 7cf025402c
commit 10ff8c2e47
26 changed files with 2973 additions and 0 deletions
@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "$0")/.." && pwd)"
+adb_bin="${ADB_BIN:-adb}"
+serial=""
+assume_yes=0
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --serial)
+            serial="$2"
+            shift 2
+            ;;
+        --yes)
+            assume_yes=1
+            shift
+            ;;
+        *)
+            echo "Usage: $0 [--serial ADB_SERIAL] [--yes]" >&2
+            exit 2
+            ;;
+    esac
+done
+
+adb_args=()
+if [[ -n "$serial" ]]; then
+    adb_args=(-s "$serial")
+fi
+
+"$repo_root/scripts/check-target.sh" "$serial"
+
+if command -v shasum >/dev/null 2>&1; then
+    (cd "$repo_root" && shasum -a 256 -c SHA256SUMS)
+else
+    (cd "$repo_root" && sha256sum -c SHA256SUMS)
+fi
+
+if [[ "$assume_yes" != 1 ]]; then
+    printf 'Type ROOT to run the kernel exploit on this tablet: '
+    read -r confirmation
+    [[ "$confirmation" == ROOT ]] || exit 3
+fi
+
+"$adb_bin" "${adb_args[@]}" push \
+    "$repo_root/bin/hp-slate7-cve-2015-1805-root" \
+    /data/local/tmp/cve-2015-1805-root
+"$adb_bin" "${adb_args[@]}" push \
+    "$repo_root/bin/hp-slate7-install-root" \
+    /data/local/tmp/install-root
+"$adb_bin" "${adb_args[@]}" push \
+    "$repo_root/bin/hp-slate7-su" \
+    /data/local/tmp/rootsh-armv7
+
+"$adb_bin" "${adb_args[@]}" shell \
+    'chmod 755 /data/local/tmp/cve-2015-1805-root /data/local/tmp/install-root /data/local/tmp/rootsh-armv7; sync'
+
+set +e
+"$adb_bin" "${adb_args[@]}" shell \
+    '/data/local/tmp/cve-2015-1805-root; rc=$?; echo DEVICE_RC=$rc; exit $rc'
+exploit_rc=$?
+set -e
+
+if [[ "$exploit_rc" != 0 ]]; then
+    echo "Exploit did not complete cleanly. Reboot before any retry." >&2
+    exit "$exploit_rc"
+fi
+
+"$adb_bin" "${adb_args[@]}" wait-for-device
+root_id="$($adb_bin "${adb_args[@]}" shell '/system/xbin/su -c id' | tr -d '\r')"
+echo "$root_id"
+[[ "$root_id" == uid=0\(* ]] || {
+    echo "Root verification failed." >&2
+    exit 4
+}
+
+echo "Root verified. See README.RU.md for cleanup and reboot verification."