ZergRush.java

package fuzion24.device.vulnerability.vulnerabilities.system;

import android.content.Context;
import android.os.storage.StorageManager;

import java.lang.reflect.Method;
import java.util.ArrayList;
import java.util.List;

import fuzion24.device.vulnerability.util.CPUArch;
import fuzion24.device.vulnerability.vulnerabilities.VulnerabilityTest;
import fuzion24.device.vulnerability.vulnerabilities.helper.SystemUtils;

public class ZergRush implements VulnerabilityTest {
    @Override
    public String getCVEorID() {
        return "CVE-2011-3874";
    }


    @Override
    public List<CPUArch> getSupportedArchitectures() {
        ArrayList<CPUArch> archs = new ArrayList<>();
        archs.add(CPUArch.ALL);
        return archs;
    }


    @Override
    public boolean isVulnerable(Context context) throws Exception {
        int pid = SystemUtils.ProcfindPidFor("/system/bin/vold");
        StorageManager sm = (StorageManager) context.getSystemService(Context.STORAGE_SERVICE);

        Method getObbPath = sm.getClass().getMethod("getMountedObbPath", String.class);
        getObbPath.invoke(sm, "AAAA AAAA AAAA AAAA "
                + "AAAA AAAA AAAA AAAA "
                + "AAAA AAAA AAAA AAAA "
                + "AAAA AAAA AAAA AAAA"
                + "AAAA AAAA AAAA AAAA"
                + "AAAA AAAA AAAA AAAA"
                + "AAAA AAAA AAAA AAAA"
                + "AAAA AAAA AAAA AAAA"
                + "AAAA AAAA AAAA AAAA"
                + "AAAA AAAA AAAA AAAA"
                + "AAAA AAAA AAAA AAAA");

        Thread.sleep(2000);  // give vold some time to crash

        return false;
    }

}