[CVE-2013-3685][Root]Multiple LG Android devices, Sprite Software Backup

Search This thread
By:
Advanced…
P

pelrossvannak

Senior Member
Nov 1, 2013
55
0
Phnom Penh
Root

Please explain me how to root LG F200S20e, I am a new android user. Thank you so much.

---------- Post added at 01:55 AM ---------- Previous post was at 01:30 AM ----------

how about LG F200S20e, android 4.1.2, May i use this file to root?
 
Last edited:
Crossvxm

Crossvxm

Senior Member
May 26, 2013
598
144
29
New York
jcase said:
Subject:
Race condition in Sprite Software's backup software, installed by OEM on LG Android devices.

Author:
Justin Case - [email protected]

CVE ID:
CVE-2013-3685

Effect:
Locally exploited vulnerability with minimal device user interaction which results in executing code as the root user. Under specific circumstances, it is possible to exploit this vulnerability without the device user's knowledge

Products:
"Backup"
"spritebud"

Vendors:
Sprite Software
LG Electronics
Potentially other vendors

Affected Versions:
spritebud 1.3.24
backup 2.5.4105
Likely others versions as well

Affected Devices (Subject to firmware configuration):
LG-E971 LG Optimus G
LG-E973 LG Optimus G
LG-E975 LG Optimus G
LG-E975K LG Optimus G
LG-E975T LG Optimus G
LG-E976 LG Optimus G
LG-E977 LG Optimus G
LG-F100K LG Optimus Vu
LG-F100L LG Optimus Vu
LG-F100S LG Optimus Vu
LG-F120K LG Optimus Vu
LG-F120L LG Optimus LTE Tag
LG-F120S LG Optimus LTE Tag
LG-F160K LG Optimus LTE 2
LG-F160L LG Optimus LTE 2
LG-F160LV LG Optimus LTE 2
LG-F160S LG Optimus LTE 2
LG-F180K LG Optimus G
LG-F180L LG Optimus G
LG-F180S LG Optimus G
LG-F200K LG Optimus Vu 2
LG-F200L LG Optimus Vu 2
LG-F200S LG Optimus Vu 2
LG-F240K LG Optimus G Pro
LG-F240L LG Optimus G Pro
LG-F240S LG Optimus G Pro
LG-F260K LG Optimus LTE 3
LG-F260L LG Optimus LTE 3
LG-F260S LG Optimus LTE 3
LG-L21 LG Optimus G
LG-LG870 LG (Unknown)
LG-LS860 LG Mach
LG-LS970 LG Optimus G
LG-P760 LG Optimus L9
LG-P769 LG Optimus L9
LG-P780 LG Optimus L7
LG-P875 LG Optimus F5
LG-P875h LG Optimus F5
LG-P880 LG Optimus 4X HD
LG-P940 LG Prada
LG-SU540 LG Prada 3.0
LG-SU870 LG Optimus 3D Cube
LG-US780 LG Lollipop
Potentially other devices as well.


Product Information:

"Backup" and "spritebud" are a setting and application backup/restore system written by Sprite Software and deployed on LG Android smartphones. "Backup" is the end user front end app, and "spritebud" is the service that preforms the backup and restore functions.


Details:

The "spritebud" daemon is started by the init scripts and runs as the root user. Listening on a unix socket, the daemon accepts instructions from the "Backup" app. Using a crafted backup, we can write to, change permission and change ownership of any file, being that "spritebud" is running under the root user.


The crafted backup contains restore data for our exploiting application, "com.cunninglogic.lgpwn". The data includes a 50mb dummy file (a) used to increase our exploit window, su binary (b), a script (c) to install su, and a text file (d) containing the path to our script. All files are owned by the application, and are world write/read/execute. All files are restored in alphabetical order. The entire backup, after compress, is approximately 2mb. The structure of this backup is as follows:


drwxrwxrwx u0_a114 u0_a114 2013-05-28 20:13 files


./files:
- -rwxr-xr-x u0_a114 u0_a114 52428800 2013-05-22 20:06 a
- -rwxr-xr-x u0_a114 u0_a114 91992 2013-05-22 20:07 b
- -rwxr-xr-x u0_a114 u0_a114 251 2013-05-22 20:12 c
- -rwxr-xr-x u0_a114 u0_a114 42 2013-05-22 20:07 d


Prior to restoration, our exploit app runs, watches the process and waits. During restoration, the spritebud daemon first creates the files directory, then sets it's permission and owner. Next it decompresses and restores the "a" file, our 50mb dummy files. During the restoration of "a", our exploit application has time to symlink "d", our text file containing the full path to our script (c), to /sys/kernel/uevent_helper. Upon restoration of file "d", our path is written to uevent_helper. When a hotplug even occurs (which occur every few seconds), the path contained in uevent_helper is execute by the kernel and our script (c) is executed and installs the su binary (b).
Click to expand...
Click to collapse

The LG870 is the LG Venice from Boost Mobile. I had that POS, no roms for that POS...
 
R

Rachine35

Member
Jan 16, 2012
5
0
No more bloteware!!!

Thank you. I have been trying for months to get root access to this dam phone. You are awesome!!!





jcase said:
Subject:
Race condition in Sprite Software's backup software, installed by OEM on LG Android devices.

Author:
Justin Case - [email protected]

CVE ID:
CVE-2013-3685

Effect:
Locally exploited vulnerability with minimal device user interaction which results in executing code as the root user. Under specific circumstances, it is possible to exploit this vulnerability without the device user's knowledge

Products:
"Backup"
"spritebud"

Vendors:
Sprite Software
LG Electronics
Potentially other vendors

Affected Versions:
spritebud 1.3.24
backup 2.5.4105
Likely others versions as well

Affected Devices (Subject to firmware configuration):
LG-E971 LG Optimus G
LG-E973 LG Optimus G
LG-E975 LG Optimus G
LG-E975K LG Optimus G
LG-E975T LG Optimus G
LG-E976 LG Optimus G
LG-E977 LG Optimus G
LG-F100K LG Optimus Vu
LG-F100L LG Optimus Vu
LG-F100S LG Optimus Vu
LG-F120K LG Optimus Vu
LG-F120L LG Optimus LTE Tag
LG-F120S LG Optimus LTE Tag
LG-F160K LG Optimus LTE 2
LG-F160L LG Optimus LTE 2
LG-F160LV LG Optimus LTE 2
LG-F160S LG Optimus LTE 2
LG-F180K LG Optimus G
LG-F180L LG Optimus G
LG-F180S LG Optimus G
LG-F200K LG Optimus Vu 2
LG-F200L LG Optimus Vu 2
LG-F200S LG Optimus Vu 2
LG-F240K LG Optimus G Pro
LG-F240L LG Optimus G Pro
LG-F240S LG Optimus G Pro
LG-F260K LG Optimus LTE 3
LG-F260L LG Optimus LTE 3
LG-F260S LG Optimus LTE 3
LG-L21 LG Optimus G
LG-LG870 LG (Unknown)
LG-LS860 LG Mach
LG-LS970 LG Optimus G
LG-P760 LG Optimus L9
LG-P769 LG Optimus L9
LG-P780 LG Optimus L7
LG-P875 LG Optimus F5
LG-P875h LG Optimus F5
LG-P880 LG Optimus 4X HD
LG-P940 LG Prada
LG-SU540 LG Prada 3.0
LG-SU870 LG Optimus 3D Cube
LG-US780 LG Lollipop
Potentially other devices as well.


Product Information:

"Backup" and "spritebud" are a setting and application backup/restore system written by Sprite Software and deployed on LG Android smartphones. "Backup" is the end user front end app, and "spritebud" is the service that preforms the backup and restore functions.


Details:

The "spritebud" daemon is started by the init scripts and runs as the root user. Listening on a unix socket, the daemon accepts instructions from the "Backup" app. Using a crafted backup, we can write to, change permission and change ownership of any file, being that "spritebud" is running under the root user.


The crafted backup contains restore data for our exploiting application, "com.cunninglogic.lgpwn". The data includes a 50mb dummy file (a) used to increase our exploit window, su binary (b), a script (c) to install su, and a text file (d) containing the path to our script. All files are owned by the application, and are world write/read/execute. All files are restored in alphabetical order. The entire backup, after compress, is approximately 2mb. The structure of this backup is as follows:


drwxrwxrwx u0_a114 u0_a114 2013-05-28 20:13 files


./files:
- -rwxr-xr-x u0_a114 u0_a114 52428800 2013-05-22 20:06 a
- -rwxr-xr-x u0_a114 u0_a114 91992 2013-05-22 20:07 b
- -rwxr-xr-x u0_a114 u0_a114 251 2013-05-22 20:12 c
- -rwxr-xr-x u0_a114 u0_a114 42 2013-05-22 20:07 d


Prior to restoration, our exploit app runs, watches the process and waits. During restoration, the spritebud daemon first creates the files directory, then sets it's permission and owner. Next it decompresses and restores the "a" file, our 50mb dummy files. During the restoration of "a", our exploit application has time to symlink "d", our text file containing the full path to our script (c), to /sys/kernel/uevent_helper. Upon restoration of file "d", our path is written to uevent_helper. When a hotplug even occurs (which occur every few seconds), the path contained in uevent_helper is execute by the kernel and our script (c) is executed and installs the su binary (b).
Click to expand...
Click to collapse
 
P

pelrossvannak

Senior Member
Nov 1, 2013
55
0
Phnom Penh
o131313o said:
Great work jcase !! :good: I successfully rooted T-mobile USA p769 20d version.. Tried to see if I had spritebud with terminal emulator which got no file found. Downloaded the pwn apk and decided to try anyways. Followed the backup / recovery steps. Phone rebooted by itself. Downloaded root checker with successful root result .. Props !!!
Click to expand...
Click to collapse

Which option we have to tick to back up?
 
J

jhempelayo

Member
Apr 20, 2013
29
2
im sorry if im getting messy here

i got LG F260S from korea (gave as a gift)
im living here in the philippines
im looking for a custom rom for my LGF260S (hopefully with a process o how to do it)

thanks in advance
 
T

techcaptain

Senior Member
Feb 8, 2014
149
14
Incheon
Hi, my friend has a F200K and needs to root. Since I don't know LG stuff, what do I do to root? Just install the apk? (Also is there any custom roms+themes for the f200k too?) thanks.

--
Sent from my awesome rooted, themed (S5 theme) SM-N900L using XDA Premium 4 mobile app
 
0

0utcast

Member
Jul 21, 2013
20
2
if you get /system/xbin/spritebud does not exist (I don't have the file at that location)

what is the issue. (running version 4.4.2) - LG-F260S LG Optimus LTE 3

  • i've installed the .apk.
  • enable debugger mode
  • enable debugger mode on the application
  • turned phone off and back on
  • did a backup
  • did a restore
  • ran again same error


i'm a noob, go gently with the sandpaper to the arse.
 
jcase

jcase

Retired Forum Mod / Senior Recognized Developer
Feb 20, 2010
6,307
15,757
Sequim WA
0utcast said:
if you get /system/xbin/spritebud does not exist (I don't have the file at that location)

what is the issue. (running version 4.4.2) - LG-F260S LG Optimus LTE 3

  • i've installed the .apk.
  • enable debugger mode
  • enable debugger mode on the application
  • turned phone off and back on
  • did a backup
  • did a restore
  • ran again same error


i'm a noob, go gently with the sandpaper to the arse.
Click to expand...
Click to collapse

Means your phone is not compatible

Sent from my HTC One_M8 using XDA Premium 4 mobile app
 
  • Like
Reactions: 0utcast
D

Donmali

New member
Dec 30, 2012
4
0
unable to root lg f200l

please... admin, is there a simplified method to successfully root lg f200l on android kitkat 4.4.2?
 
E

ekoms420

Member
Sep 17, 2010
36
2
LG spree k120

has anyone tried the Lg Spree K120 from cricket. cant seam to root it. anyhelp would be awesome.
thanks
 
You must log in or register to reply here.

Similar threads

L
Honda Connect Android System
Replies
4K
Views
2M
B
borba0
NiTrOwow
Xiaomi firmware has multiple backdoors
Replies
69
Views
63K
pulser_g2
pulser_g2
jcase
[CVE-2013-3741] LGInstallServices Silent Install + Privilege escalation XDA:DevCon
Replies
5
Views
29K
jcase
jcase
C
[SECURITY] Multiple Android Superuser vulnerabilities
Replies
10
Views
36K
D
diabolicalprophecy
S
Motorola Moto G4 Plus Android 7.0(Nougat) , FRP Solution Please
Replies
35
Views
89K
L
Lucifer4014

Top Liked Posts

24 Hours All time
  • There are no posts matching your filters.
  • 44
    jcase
    jcase
    Subject:
    Race condition in Sprite Software's backup software, installed by OEM on LG Android devices.

    Author:
    Justin Case - [email protected]

    CVE ID:
    CVE-2013-3685

    Effect:
    Locally exploited vulnerability with minimal device user interaction which results in executing code as the root user. Under specific circumstances, it is possible to exploit this vulnerability without the device user's knowledge

    Products:
    "Backup"
    "spritebud"

    Vendors:
    Sprite Software
    LG Electronics
    Potentially other vendors

    Affected Versions:
    spritebud 1.3.24
    backup 2.5.4105
    Likely others versions as well

    Affected Devices (Subject to firmware configuration):
    LG-E971 LG Optimus G
    LG-E973 LG Optimus G
    LG-E975 LG Optimus G
    LG-E975K LG Optimus G
    LG-E975T LG Optimus G
    LG-E976 LG Optimus G
    LG-E977 LG Optimus G
    LG-F100K LG Optimus Vu
    LG-F100L LG Optimus Vu
    LG-F100S LG Optimus Vu
    LG-F120K LG Optimus Vu
    LG-F120L LG Optimus LTE Tag
    LG-F120S LG Optimus LTE Tag
    LG-F160K LG Optimus LTE 2
    LG-F160L LG Optimus LTE 2
    LG-F160LV LG Optimus LTE 2
    LG-F160S LG Optimus LTE 2
    LG-F180K LG Optimus G
    LG-F180L LG Optimus G
    LG-F180S LG Optimus G
    LG-F200K LG Optimus Vu 2
    LG-F200L LG Optimus Vu 2
    LG-F200S LG Optimus Vu 2
    LG-F240K LG Optimus G Pro
    LG-F240L LG Optimus G Pro
    LG-F240S LG Optimus G Pro
    LG-F260K LG Optimus LTE 3
    LG-F260L LG Optimus LTE 3
    LG-F260S LG Optimus LTE 3
    LG-L21 LG Optimus G
    LG-LG870 LG (Unknown)
    LG-LS860 LG Mach
    LG-LS970 LG Optimus G
    LG-P760 LG Optimus L9
    LG-P769 LG Optimus L9
    LG-P780 LG Optimus L7
    LG-P875 LG Optimus F5
    LG-P875h LG Optimus F5
    LG-P880 LG Optimus 4X HD
    LG-P940 LG Prada
    LG-SU540 LG Prada 3.0
    LG-SU870 LG Optimus 3D Cube
    LG-US780 LG Lollipop
    Potentially other devices as well.


    Product Information:

    "Backup" and "spritebud" are a setting and application backup/restore system written by Sprite Software and deployed on LG Android smartphones. "Backup" is the end user front end app, and "spritebud" is the service that preforms the backup and restore functions.


    Details:

    The "spritebud" daemon is started by the init scripts and runs as the root user. Listening on a unix socket, the daemon accepts instructions from the "Backup" app. Using a crafted backup, we can write to, change permission and change ownership of any file, being that "spritebud" is running under the root user.


    The crafted backup contains restore data for our exploiting application, "com.cunninglogic.lgpwn". The data includes a 50mb dummy file (a) used to increase our exploit window, su binary (b), a script (c) to install su, and a text file (d) containing the path to our script. All files are owned by the application, and are world write/read/execute. All files are restored in alphabetical order. The entire backup, after compress, is approximately 2mb. The structure of this backup is as follows:


    drwxrwxrwx u0_a114 u0_a114 2013-05-28 20:13 files


    ./files:
    - -rwxr-xr-x u0_a114 u0_a114 52428800 2013-05-22 20:06 a
    - -rwxr-xr-x u0_a114 u0_a114 91992 2013-05-22 20:07 b
    - -rwxr-xr-x u0_a114 u0_a114 251 2013-05-22 20:12 c
    - -rwxr-xr-x u0_a114 u0_a114 42 2013-05-22 20:07 d


    Prior to restoration, our exploit app runs, watches the process and waits. During restoration, the spritebud daemon first creates the files directory, then sets it's permission and owner. Next it decompresses and restores the "a" file, our 50mb dummy files. During the restoration of "a", our exploit application has time to symlink "d", our text file containing the full path to our script (c), to /sys/kernel/uevent_helper. Upon restoration of file "d", our path is written to uevent_helper. When a hotplug even occurs (which occur every few seconds), the path contained in uevent_helper is execute by the kernel and our script (c) is executed and installs the su binary (b).
    View
    1
    jcase
    jcase
    TheCoutures said:
    Neither is the work, donation made, enjoy a beer or a cheap American six pack on me, ha.

    Sent from my LG-P769 using Tapatalk 2
    Click to expand...
    Click to collapse

    Thanks, will end up being pizza or ice cream for the kids
    View
    1
    jcase
    jcase
    reikred said:
    Enclosed. I grep'ed the logcat file for lgpwn, here is what came of it:

    I/ActivityManager( 350): START {act=android.intent.action.MAIN cat=[android.intent.category.LAUNCHER] flg=0x10200000 cmp=com.cunninglogic.lgpwn/.MainActivity u=0} from pid 638
    I/ActivityManager( 350): Start proc com.cunninglogic.lgpwn for activity com.cunninglogic.lgpwn/.MainActivity: pid=2527 uid=10120 gids={1015, 1028}
    D/SurfaceFlinger( 142): createSurface for (1 x 1), name=Starting com.cunninglogic.lgpwn
    W/ActivityThread( 2527): Application com.cunninglogic.lgpwn is waiting for the debugger on port 8100...
    W/ActivityManager( 350): Activity idle timeout for ActivityRecord{418e27f8 com.cunninglogic.lgpwn/.MainActivity}
    Click to expand...
    Click to collapse

    In developer settings, do you have an app marked to be debugged?
    View
    1
    O
    osashi555
    jcase said:
    Subject:
    Race condition in Sprite Software's backup software, installed by OEM on LG Android devices.

    Author:
    Justin Case - [email protected]

    CVE ID:
    CVE-2013-3685

    Effect:
    Locally exploited vulnerability with minimal device user interaction which results in executing code as the root user. Under specific circumstances, it is possible to exploit this vulnerability without the device user's knowledge

    Products:
    "Backup"
    "spritebud"

    Vendors:
    Sprite Software
    LG Electronics
    Potentially other vendors

    Affected Versions:
    spritebud 1.3.24
    backup 2.5.4105
    Likely others versions as well

    Affected Devices (Subject to firmware configuration):
    LG-E971 LG Optimus G
    LG-E973 LG Optimus G
    LG-E975 LG Optimus G
    LG-E975K LG Optimus G
    LG-E975T LG Optimus G
    LG-E976 LG Optimus G
    LG-E977 LG Optimus G
    LG-F100K LG Optimus Vu
    LG-F100L LG Optimus Vu
    LG-F100S LG Optimus Vu
    LG-F120K LG Optimus Vu
    LG-F120L LG Optimus LTE Tag
    LG-F120S LG Optimus LTE Tag
    LG-F160K LG Optimus LTE 2
    LG-F160L LG Optimus LTE 2
    LG-F160LV LG Optimus LTE 2
    LG-F160S LG Optimus LTE 2
    LG-F180K LG Optimus G
    LG-F180L LG Optimus G
    LG-F180S LG Optimus G
    LG-F200K LG Optimus Vu 2
    LG-F200L LG Optimus Vu 2
    LG-F200S LG Optimus Vu 2
    LG-F240K LG Optimus G Pro
    LG-F240L LG Optimus G Pro
    LG-F240S LG Optimus G Pro
    LG-F260K LG Optimus LTE 3
    LG-F260L LG Optimus LTE 3
    LG-F260S LG Optimus LTE 3
    LG-L21 LG Optimus G
    LG-LG870 LG (Unknown)
    LG-LS860 LG Mach
    LG-LS970 LG Optimus G
    LG-P760 LG Optimus L9
    LG-P769 LG Optimus L9
    LG-P780 LG Optimus L7
    LG-P875 LG Optimus F5
    LG-P875h LG Optimus F5
    LG-P880 LG Optimus 4X HD
    LG-P940 LG Prada
    LG-SU540 LG Prada 3.0
    LG-SU870 LG Optimus 3D Cube
    LG-US780 LG Lollipop
    Potentially other devices as well.


    Product Information:

    "Backup" and "spritebud" are a setting and application backup/restore system written by Sprite Software and deployed on LG Android smartphones. "Backup" is the end user front end app, and "spritebud" is the service that preforms the backup and restore functions.


    Details:

    The "spritebud" daemon is started by the init scripts and runs as the root user. Listening on a unix socket, the daemon accepts instructions from the "Backup" app. Using a crafted backup, we can write to, change permission and change ownership of any file, being that "spritebud" is running under the root user.


    The crafted backup contains restore data for our exploiting application, "com.cunninglogic.lgpwn". The data includes a 50mb dummy file (a) used to increase our exploit window, su binary (b), a script (c) to install su, and a text file (d) containing the path to our script. All files are owned by the application, and are world write/read/execute. All files are restored in alphabetical order. The entire backup, after compress, is approximately 2mb. The structure of this backup is as follows:


    drwxrwxrwx u0_a114 u0_a114 2013-05-28 20:13 files


    ./files:
    - -rwxr-xr-x u0_a114 u0_a114 52428800 2013-05-22 20:06 a
    - -rwxr-xr-x u0_a114 u0_a114 91992 2013-05-22 20:07 b
    - -rwxr-xr-x u0_a114 u0_a114 251 2013-05-22 20:12 c
    - -rwxr-xr-x u0_a114 u0_a114 42 2013-05-22 20:07 d


    Prior to restoration, our exploit app runs, watches the process and waits. During restoration, the spritebud daemon first creates the files directory, then sets it's permission and owner. Next it decompresses and restores the "a" file, our 50mb dummy files. During the restoration of "a", our exploit application has time to symlink "d", our text file containing the full path to our script (c), to /sys/kernel/uevent_helper. Upon restoration of file "d", our path is written to uevent_helper. When a hotplug even occurs (which occur every few seconds), the path contained in uevent_helper is execute by the kernel and our script (c) is executed and installs the su binary (b).
    Click to expand...
    Click to collapse

    omg omg thank you man, you rock, finally managed to root my lg l9, props to you man, i didnt know how to check on spritebud and other stuff, but i said meh lets try it, i used root checker, it said im rooted,
    View
    1
    M
    Mactech.chris
    hot plug trick

    chadteck said:
    It initially appeared that the exploit had been patched in P769 V20h, but I was able to get it to work.

    What I did was restore the backup and prior to clicking the button to restart, plugged the phone into my computer. I was prompted with a SuperSU confirmation dialog and I granted access.

    This hotplug wasn't necessary with previous ROM versions, but maybe something changed. I read that was how the exploit worked, so I thought I'd give it a try.
    Click to expand...
    Click to collapse


    Thanks! The hot plug trick worked for me on P76920h
    View

New posts