Neura Market
timwr/CVE-2016-5195 logo

timwr/CVE-2016-5195

Free

CVE-2016-5195 (dirtycow/dirtyc0w) proof of concept for Android

FreeFree tier
Type
Open Source
Visit Website GitHub (38 stars)

About timwr/CVE-2016-5195

CVE-2016-5195 (Dirty COW) proof of concept for Android that demonstrates privilege escalation on vulnerable devices via ADB. The repository contains source code (C) and build scripts (Makefile, Android.mk) to compile dirtycow (dcow) and run-as binaries. After pushing the binaries to the device, the exploit overwrites the system's run-as binary with a modified version that grants root access. The tool does not disable SELinux or install superuser, and requires an existing ADB connection. It is primarily intended for security research and testing.

Key Features

Demonstrates the Dirty COW privilege escalation vulnerability on Android
Provides source code (C) and build scripts (Makefile, Android.mk) for cross-compilation
Includes a modified run-as binary to obtain a root shell
Supports multiple architectures: arm, arm64, x86, x86_64, mips, mips64
Lightweight and focused – does not disable SELinux or install superuser

Pros & Cons

Pros
  • Open source and free to use
  • Simple build process with make or ndk-build
  • Works on a wide range of Android architectures
  • Clear, minimal codebase ideal for learning exploit mechanics
  • Does not alter the device beyond the runtime exploit
Cons
  • Only functional on Android devices vulnerable to CVE-2016-5195 (patched in kernel 4.8+)
  • Requires an existing ADB connection and device with debug enabled
  • Does not bypass SELinux constraints (root context limited to shell domain)
  • No persistent root – effect is lost after reboot
  • No graphical interface or automated scanning – manual usage only

Best For

Security researchers testing Android device vulnerability to CVE-2016-5195Penetration testing on Android devices with ADB accessEducational demonstration of privilege escalation exploits on mobile platforms

FAQ

Does this exploit disable SELinux?
No, the exploit does not disable SELinux (see issue #9) or install superuser on the device. The resulting shell runs in the shell context (u:r:shell:s0), not an SELinux permissive domain.
How do I build and run this exploit?
Clone the repository, then run 'make' or 'ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk APP_PLATFORM=android-16'. Push the compiled binaries (dirtycow and run-as) to the device via ADB, execute dirtycow to overwrite /system/bin/run-as, then run the modified run-as binary to gain a root shell.