PoCs

Table of PoCs

Note: if you experience crashes or locks take a look at this fix.

| Link | Usage | Description | Family | |---|---|---|---|---|---|---| | dirtyc0w.c | ./dirtyc0w file content | Read-only write | /proc/self/mem | | cowroot.c | ./cowroot | SUID-based root | /proc/self/mem | | dirtycow-mem.c | ./dirtycow-mem | libc-based root | /proc/self/mem | | pokemon.c | ./d file content | Read-only write | PTRACE_POKEDATA | | dirtycow.cr | dirtycow --target --string --offset | Read-only write | /proc/self/mem | | dirtyc0w.c | ./dirtycow file content | Read-only write (Android) | /proc/self/mem | | dirtycow.rb | use exploit/linux/local/dirtycow and run | SUID-based root | /proc/self/mem | | 0xdeadbeef.c | ./0xdeadbeef | vDSO-based root | PTRACE_POKEDATA | | naughtyc0w.c | ./c0w suid | SUID-based root | /proc/self/mem | | c0w.c | ./c0w | SUID-based root | PTRACE_POKEDATA| | dirty_pass[...].c | ./dirty_passwd_adjust_cow | /etc/passwd based root | /proc/self/mem | | mucow.c | ./mucow destination < payload.exe | Read-only write (multi page) | PTRACE_POKEDATA | | cowpy.c | r2pm -i dirtycow | Read-only write (radare2) | /proc/self/mem | | dirtycow.fasm | ./main | SUID-based root | /proc/self/mem | | dcow.cpp | ./dcow | /etc/passwd based root | /proc/self/mem | | dirtyc0w.go | go run dirtyc0w.go -f=file -c=content | Read-only write | /proc/self/mem | | dirty.c | ./dirty | /etc/passwd based root | PTRACE_POKEDATA | | Dirty COW Tester | make && ./bin/dct | Read-only write | /proc/self/mem | | exploit.c | ./exploit | vDSO-based root (Android) | PTRACE_POKEDATA | | cowcron.c | ./cowcron | /etc/cron.hourly based root (RHEL) | PTRACE_POKEDATA |

List of PoCs

• https://github.com/dirtycow/dirtycow.github.io/blob/master/dirtyc0w.c
  • Allows user to write on files meant to be read only.
• https://gist.github.com/rverton/e9d4ff65d703a9084e85fa9df083c679
  • Gives the user root by overwriting /usr/bin/passwd or a suid binary.
• https://gist.github.com/scumjr/17d91f20f73157c722ba2aea702985d2
  • Gives the user root by patching libc's getuid call and invoking su.
• https://github.com/dirtycow/dirtycow.github.io/blob/master/pokemon.c
  • Allows user to write on files meant to be read only.
• https://github.com/xlucas/dirtycow.cr
  • Allows a user to write on files meant to be read only.
• https://github.com/timwr/CVE-2016-5195
  • Allows user to write on files meant to be read only (android).
• https://github.com/rapid7/metasploit-framework/pull/7476
  • Metasploit module based on the cowroot PoC.
• https://github.com/scumjr/dirtycow-vdso
  • Gives the user root by patching the vDSO escapes containers/SELinux doesn't need suid.
• https://gist.github.com/mak/c36136ccdbebf5ecfefd80c0f2ed6747
  • Gives the user root by injecting shellcode into a SUID file.
• https://gist.github.com/KrE80r/42f8629577db95782d5e4f609f437a54
  • Gives the user root by injecting shellcode into a SUID file using PTRACE_POKEDATA .
• https://gist.github.com/ngaro/05e084ca638340723b309cd304be77b2
  • Gives the user root by replacing /etc/passwd
• https://gist.github.com/chriscz/f1aca56cf15cfb7793db0141c15718cd
  • Allows user to write on files meant to be read only. Supports writing to multiple pages, not just the first
• https://github.com/nowsecure/dirtycow
  • Allows the user to write on files meant to be read only, implemented as a radare2 IO plugin.
• https://github.com/sivizius/dirtycow.fasm
  • Gives the user root by injecting shellcode into a SUID file. implemented for amd64 in flatassembly.
• https://github.com/gbonacini/CVE-2016-5195
  • Gives the user root by replacing /etc/passwd
• https://github.com/mengzhuo/dirty-cow-golang/blob/master/dirtyc0w.go
  • Allows user to write on files meant to be read only. implemented for arm32/x86/amd64 in Golang faster than c implement.
• https://github.com/FireFart/dirtycow/blob/master/dirty.c
  • Generates a new password hash on the fly and modifies /etc/passwd automatically. Just run and pwn.
• https://github.com/sideeffect42/DirtyCOWTester
  • Runs exploit and tells user if his system is vulnerable by writing to a read-only file (usually /tmp/dirtycow_test). Also has a --no-root option that does not require superuser.
• https://github.com/hyln9/VIKIROOT
  • Android M temporal root with SELinux bypass via the vDSO injection approach.
• https://github.com/securifera/cowcron
  • Overwrites comment line in cron.hourly script with user defined script to gain root.