[HTC EVO 3D] dragonfyre13:
Don't know how much time I'll spend on this, since someone smarter than me will come along or (fingers crossed) HTC will decrypt the bootloader.

Just some stuff from poking around that I thought might shake stuff loose for people. I'm still poking around, really only done privilege escalation as part of the infosec portion of my job before, but if I can help...

/system/bin

-rwxr-xr-x root shell 5520 2011-05-23 09:33 3D_calibration
-rwxr-xr-x root shell 69168 2011-05-23 09:33 DMTest
-rwxr-xr-x root shell 10247904 2011-05-13 14:51 DxDrmServerIpc
-rwxr-xr-x root shell 5540 2011-05-23 09:32 PktRspTest
-rwxr-xr-x root shell 191 2011-05-13 14:38 am
-rwxr-xr-x root shell 218182 2011-05-13 14:23 androidvncserver
-rwxr-xr-x root shell 9732 2011-05-23 09:32 aparse
-rwxr-xr-x root shell 5720 2011-05-23 09:33 app_process
-rwxr-xr-x root shell 150628 2011-05-23 09:32 apph
-rwxr-xr-x root shell 49924 2011-05-23 09:32 applypatch
-rwxr-xr-x root shell 39020 2011-05-23 09:33 awb_camera
-rwxr-xr-x root shell 18080 2011-05-23 09:33 badblocks
-rwxr-xr-x root shell 5292 2011-05-23 09:33 bluetoothd
-rwxr-xr-x root shell 9648 2011-05-23 09:33 bma150_usr
-rwxr-xr-x root shell 199 2011-05-13 14:38 bmgr
-rwxr-xr-x root shell 44404 2011-05-23 09:33 bootanimation
-rwxr-xr-x root shell 9716 2011-05-23 09:32 bootcomplete
-rwxr-xr-x root shell 2003092 2011-05-13 14:23 btld
-rwxr-xr-x root shell 5556 2011-05-23 09:32 bugreport
-rwxr-xr-x root shell 5472 2011-05-23 09:33 cam_ins_spmo
lrwxr-xr-x root shell 2011-05-23 09:33 cat -> toolbox
-rwxr-xr-x root shell 9844 2011-05-23 09:33 charging
lrwxr-xr-x root shell 2011-05-23 09:33 chmod -> toolbox
lrwxr-xr-x root shell 2011-05-23 09:33 chown -> toolbox
-rwxr-xr-x root shell 5520 2011-05-23 09:33 chownThp
lrwxr-xr-x root shell 2011-05-23 09:33 chownto -> toolbox
lrwxr-xr-x root shell 2011-05-23 09:33 cmp -> toolbox
-rwxr-xr-x root shell 5520 2011-05-23 09:33 dalvikvm
lrwxr-xr-x root shell 2011-05-23 09:33 date -> toolbox
-rwxr-xr-x root shell 109504 2011-05-23 09:33 dbus-daemon
-rwxr-xr-x root shell 14208 2011-05-23 09:33 dcvs
-rwxr-xr-x root shell 14324 2011-05-23 09:33 dcvsd
lrwxr-xr-x root shell 2011-05-23 09:33 dd -> toolbox
-rwxr-xr-x root shell 9676 2011-05-13 14:51 debug_tool
-rwxr-xr-x root shell 22272 2011-05-23 09:33 debuggerd
-rwxr-xr-x root shell 9796 2011-05-23 09:33 dexopt
lrwxr-xr-x root shell 2011-05-23 09:33 df -> toolbox
-rwxr-xr-x root shell 44596 2011-05-23 09:32 dhcpcd
-rwxr-xr-x root shell 36040 2011-05-13 14:23 dhd
-rwxr-xr-x root shell 5648 2011-05-23 09:32 diag_klog
-rwxr-xr-x root shell 5840 2011-05-23 09:32 diag_mdlog
-rwxr-xr-x root shell 67540 2011-05-23 09:33 dmagent
lrwxr-xr-x root shell 2011-05-23 09:33 dmesg -> toolbox
-rwxr-xr-x root shell 108820 2011-05-23 09:32 dnsmasq
-rwxr-xr-x root shell 34544 2011-05-23 09:32 dumpstate
-rwxr-xr-x root shell 9812 2011-05-23 09:33 dumpsys
-rwxr-xr-x root shell 5548 2011-05-23 09:32 dvz
-rwxr-xr-x root shell 119684 2011-05-23 09:33 e2fsck
-rwxr-xr-x root shell 249836 2011-05-23 09:32 e2fsck_recvy
-rwxr-xr-x root shell 9632 2011-05-23 09:32 fbtool
-rwxr-xr-x root shell 22640 2011-05-23 09:32 fsck_msdos
-rwxr-xr-x root shell 14324 2011-05-23 09:33 fusermount
-rwxr-xr-x root shell 13860 2011-05-23 09:33 getWiMAXPropDaemond
lrwxr-xr-x root shell 2011-05-23 09:33 getevent -> toolbox
lrwxr-xr-x root shell 2011-05-23 09:33 getprop -> toolbox
-rwxr-xr-x root shell 5604 2011-05-23 09:32 gzip
-rwxr-xr-x root shell 23284 2011-05-23 09:33 hciattach
lrwxr-xr-x root shell 2011-05-23 09:33 hd -> toolbox
-rwxr-xr-x root shell 68900 2011-05-23 09:33 hdmid
-rwxr-xr-x root shell 18160 2011-05-23 09:33 htc_ebdlogd
-rwxr-xr-x root shell 68004 2011-05-23 09:32 htcbatt
-rwxr-xr-x root shell 14232 2011-05-23 09:33 htcfs
-rwxr-xr-x root shell 5428 2011-05-13 14:51 htclogkernel
lrwxr-xr-x root shell 2011-05-23 09:33 id -> toolbox
lrwxr-xr-x root shell 2011-05-23 09:33 ifconfig -> toolbox
lrwxr-xr-x root shell 2011-05-23 09:33 iftop -> toolbox
-rwxr-xr-x root shell 194 2011-05-13 14:38 ime
-rwxr-xr-x root shell 201 2011-05-13 14:38 input
lrwxr-xr-x root shell 2011-05-23 09:33 insmod -> toolbox
-rwxr-xr-x root shell 22436 2011-05-23 09:32 installd
lrwxr-xr-x root shell 2011-05-23 09:33 ioctl -> toolbox
lrwxr-xr-x root shell 2011-05-23 09:33 ionice -> toolbox
-rwxr-xr-x root inet 147252 2011-05-23 09:32 ip
-rwxr-xr-x root inet 5588 2011-05-23 09:32 ipd
-rwxr-xr-x root shell 101060 2011-05-23 09:32 iptables
-rwxr-xr-x root shell 5620 2011-05-23 09:32 keypress
-rwxr-xr-x root shell 10112 2011-05-23 09:32 keystore
lrwxr-xr-x root shell 2011-05-23 09:33 kill -> toolbox
-rwxr-xr-x root shell 13812 2011-05-23 09:32 kthp_proxy
-rwxr-xr-x root shell 39448 2011-05-23 09:32 linker
lrwxr-xr-x root shell 2011-05-23 09:33 ln -> toolbox
-rwxr-xr-x root shell 115 2011-05-13 14:23 load-modem.sh
lrwxr-xr-x root shell 2011-05-23 09:33 log -> toolbox
-rwxr-xr-x root shell 13952 2011-05-23 09:32 logcat
-rwxr-xr-x root shell 13984 2011-05-23 09:32 logcat2
-rwxr-xr-x root shell 9760 2011-05-23 09:32 logwrapper
lrwxr-xr-x root shell 2011-05-23 09:33 ls -> toolbox
-rwxr-xr-x root shell 65648 2011-05-23 09:33 lsc_camera
lrwxr-xr-x root shell 2011-05-23 09:33 lsmod -> toolbox
lrwxr-xr-x root shell 2011-05-23 09:33 lsof -> toolbox
-rwxr-xr-x root shell 5504 2011-05-23 09:32 make_ext4fs
-rwxr-xr-x root shell 5564 2011-05-23 09:33 mediaserver
lrwxr-xr-x root shell 2011-05-23 09:33 mkdir -> toolbox
-rwxr-xr-x root shell 34848 2011-05-23 09:33 mke2fs
-rwxr-xr-x root shell 141036 2011-05-23 09:32 mke2fs_recvy
-rwxr-xr-x root shell 9520 2011-05-23 09:33 mm-audio-acdb-test
-rwxr-xr-x root shell 5408 2011-05-23 09:32 mm-audio-alsa-test
-rwxr-xr-x root shell 22260 2011-05-23 09:33 mm-mpo-enc-test
-rwxr-xr-x root shell 10652 2011-05-23 09:32 mm-qcamera-testsuite-client
-rwxr-xr-x root shell 10652 2011-05-23 09:32 mm-qcamera-testsuite-client-awb
-rwxr-xr-x root shell 26492 2011-05-23 09:33 mm-vdec-omx-test
-rwxr-xr-x root shell 63620 2011-05-23 09:33 mm-venc-omx-test
-rwxr-xr-x root shell 30468 2011-05-23 09:33 mm-venc-omx-test720p
-rwxr-xr-x root shell 13760 2011-05-23 09:32 mm-video-driver-test
-rwxr-xr-x root shell 13680 2011-05-23 09:32 mm-video-encdrv-test
-rwxr-xr-x root shell 53892 2011-05-23 09:33 mmcamera_test
-rwxr-xr-x root shell 205 2011-05-13 14:21 monkey
lrwxr-xr-x root shell 2011-05-23 09:33 mount -> toolbox
-rwxr-xr-x root shell 9984 2011-05-23 09:33 mpdecision
-rwxr-xr-x root shell 18308 2011-05-23 09:32 mtpd
lrwxr-xr-x root shell 2011-05-23 09:33 mv -> toolbox
lrwxr-xr-x root shell 2011-05-23 09:33 nandread -> toolbox
-rwxr-xr-x root shell 5604 2011-05-23 09:32 ndc
-rwxr-s--- root inet 5676 2011-05-23 09:33 netcfg
-rwxr-xr-x root shell 39412 2011-05-23 09:33 netd
-rwxr-xr-x root shell 48420 2011-05-23 09:33 netmgrd
-rwxr-xr-x root shell 13988 2011-05-23 09:33 netsharing
lrwxr-xr-x root shell 2011-05-23 09:33 netstat -> toolbox
lrwxr-xr-x root shell 2011-05-23 09:33 newfs_msdos -> toolbox
-rwxr-xr-x root shell 5520 2011-05-23 09:33 nl_listener
lrwxr-xr-x root shell 2011-05-23 09:33 notify -> toolbox
-rwxr-xr-x root shell 32616 2011-05-23 09:33 omx_tests
-rwxr-xr-x root shell 18692 2011-05-23 09:33 pand
-rwxr-sr-x root net_raw 26720 2011-05-23 09:32 ping
-rwxr-xr-x root shell 191 2011-05-13 14:38 pm
-rwxr-xr-x root shell 139540 2011-05-23 09:32 pppd
lrwxr-xr-x root shell 2011-05-23 09:33 printenv -> toolbox
lrwxr-xr-x root shell 2011-05-23 09:33 ps -> toolbox
-rwxr-xr-x root shell 28772 2011-05-23 09:32 qmuxd
-rwxr-xr-x root shell 142516 2011-05-23 09:32 racoon
-rwxr-xr-x root shell 5424 2011-05-23 09:32 radiooptions
-rwsr-sr-x root shell 5604 2011-05-23 09:32 reboot
lrwxr-xr-x root shell 2011-05-23 09:33 renice -> toolbox
-rwxr-xr-x root shell 26372 2011-05-23 09:33 resize2fs
-rwxr-xr-x root shell 47524 2011-05-23 09:32 resize2fs_recvy
-rwxr-xr-x root shell 9808 2011-05-23 09:33 rild
lrwxr-xr-x root shell 2011-05-23 09:33 rm -> toolbox
lrwxr-xr-x root shell 2011-05-23 09:33 rmdir -> toolbox
lrwxr-xr-x root shell 2011-05-23 09:33 rmmod -> toolbox
-rwxr-xr-x root shell 59412 2011-05-23 09:32 rmt_storage
lrwxr-xr-x root shell 2011-05-23 09:33 route -> toolbox
-rwsr-s--- root shell 59860 2011-05-23 09:32 run-as
-rwxr-xr-x root shell 5392 2011-05-23 09:32 schedtest
lrwxr-xr-x root shell 2011-05-23 09:33 schedtop -> toolbox
-rwxr-xr-x root shell 13936 2011-05-23 09:32 sdcard
-rwxr-xr-x root shell 42404 2011-05-23 09:33 sdptool
lrwxr-xr-x root shell 2011-05-23 09:33 sendevent -> toolbox
-rwxr-xr-x root shell 763396 2011-05-23 09:33 sequansd
-rwxr-xr-x root shell 34692 2011-05-23 09:33 ser2net
-rwxr-xr-x root shell 9860 2011-05-23 09:33 service
-rwxr-xr-x root shell 9956 2011-05-23 09:32 servicemanager
-rwxr-xr-x root shell 17972 2011-05-23 09:33 setWiMAXPropDaemond
lrwxr-xr-x root shell 2011-05-23 09:33 setconsole -> toolbox
lrwxr-xr-x root shell 2011-05-23 09:33 setprop -> toolbox
-rwxr-xr-x root shell 82840 2011-05-23 09:32 sh
-rwxr-xr-x root shell 18164 2011-05-23 09:32 shutdown
lrwxr-xr-x root shell 2011-05-23 09:33 sleep -> toolbox
lrwxr-xr-x root shell 2011-05-23 09:33 smd -> toolbox
-rwxr-xr-x root shell 5408 2011-05-23 09:32 snd
-rwxr-xr-x root shell 9504 2011-05-23 09:32 snd8k
-rwxr-xr-x root shell 18000 2011-05-23 09:32 sound8x60
lrwxr-xr-x root shell 2011-05-23 09:33 start -> toolbox
lrwxr-xr-x root shell 2011-05-23 09:33 stop -> toolbox
-rwxr-xr-x root shell 5456 2011-05-23 09:33 surfaceflinger
-rwxr-xr-x root shell 192 2011-05-13 14:38 svc
lrwxr-xr-x root shell 2011-05-23 09:33 sync -> toolbox
-rwxr-xr-x root shell 5480 2011-05-23 09:33 system_server
-rwxr-xr-x root shell 67956 2011-05-23 09:32 tc
-rwxr-xr-x root shell 10084 2011-05-23 09:32 test_diag
-rwxr-xr-x root shell 14164 2011-05-23 09:32 thermald
-rwxr-xr-x root shell 81544 2011-05-23 09:32 toolbox
lrwxr-xr-x root shell 2011-05-23 09:33 top -> toolbox
-rwxr-xr-x root shell 5648 2011-05-23 09:32 touchevent
-rwxr-xr-x root shell 5644 2011-05-23 09:32 touchscreen
-rwxr-xr-x root shell 26564 2011-05-23 09:33 tune2fs
-rwxr-xr-x root shell 141428 2011-05-23 09:32 tune2fs_recvy
-rwxr-xr-x root shell 19504 2011-05-23 09:32 udhcpd
lrwxr-xr-x root shell 2011-05-23 09:33 umount -> toolbox
lrwxr-xr-x root shell 2011-05-23 09:33 uptime -> toolbox
-rwxr-xr-x root shell 408 2011-05-13 14:23 usbnet
-rwxr-xr-x root shell 5552 2011-05-23 09:32 vdc
lrwxr-xr-x root shell 2011-05-23 09:33 vmstat -> toolbox
-rwxr-xr-x root shell 55860 2011-05-23 09:33 vold
lrwxr-xr-x root shell 2011-05-23 09:33 watchprops -> toolbox
-rwxr-xr-x root shell 5504 2011-05-23 09:33 wimaxAddRoute
-rwxr-xr-x root shell 5520 2011-05-23 09:33 wimaxConfigInterface
-rwxr-xr-x root shell 22144 2011-05-23 09:33 wimaxDaemon
-rwxr-xr-x root shell 5520 2011-05-23 09:33 wimaxDhcpRelease
-rwxr-xr-x root shell 5424 2011-05-23 09:33 wimaxDhcpRenew
-rwxr-xr-x root shell 5536 2011-05-23 09:33 wimaxDumpKmsg
-rwxr-xr-x root shell 5536 2011-05-23 09:33 wimaxDumpLastKmsg
-rwxr-xr-x root shell 5536 2011-05-23 09:33 wimaxDumpLogcat
-rwxr-xr-x root shell 30368 2011-05-23 09:33 wimax_mtd
-rwxr-xr-x root shell 5424 2011-05-23 09:33 wimax_uart
lrwxr-xr-x root shell 2011-05-23 09:33 wipe -> toolbox
-rwxr-xr-x root shell 249648 2011-05-13 14:23 wl
-rwxr-xr-x root shell 304228 2011-05-23 09:33 wpa_supplicant

Here's the ones with a suid bit set (nowhere else is the suid bit set):

-rwxr-s--- root inet 5676 2011-05-23 09:33 netcfg
-rwxr-sr-x root net_raw 26720 2011-05-23 09:32 ping
-rwsr-sr-x root shell 5604 2011-05-23 09:32 reboot
-rwsr-s--- root shell 59860 2011-05-23 09:32 run-as

There's a sticky bit here (the only one):

/sys/devices/virtual/graphics/fb1/video_mode --w----r-T root root 4096 2011-06-27 18:07 video_mode

here's current user id output, including groups.

uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1009(mount),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)

run-as seems to be a decent way to get whatever group membership we need, but it won't allow us to escalate to root (it takes an application to run as, not a user), though there may be an exploit there somewhere.

reboot seems to take a "reboot command" of some sort, not sure what that is exactly, playing with that now.

I've got a little python utility I threw together that drives ADB, and does dives into file types, permissions, etc. and allows me to sort and slice the data however I want. If that would be useful for someone, I can throw it up here.