[Droid 2 General] Pyr0ball:
SuperOneClick hug on zerg rush method.

phone's on and phone thinks it's got ADB active, but SOC isnt seeing it.

log dump:

* daemon not running. starting it now on port 5037 *

* daemon started successfully *

export PS1=""

$ export PS1=""

getprop ro.build.version.release > /data/local/tmp/output 2>&1

export TEMPRANDOM=97413

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

2.3.4

END:97413export PS1=""

getprop ro.product.manufacturer > /data/local/tmp/output 2>&1

export TEMPRANDOM=23038

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

motorola

END:23038export PS1=""

getprop ro.product.model > /data/local/tmp/output 2>&1

export TEMPRANDOM=51743

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

DROID2

END:51743export PS1=""

getprop ro.build.version.incremental > /data/local/tmp/output 2>&1

export TEMPRANDOM=84484

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

120117

END:84484export PS1=""

ls -l /system/xbin/su > /data/local/tmp/output 2>&1

export TEMPRANDOM=36720

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

/system/xbin/su: No such file or directory

END:36720export PS1=""

ls -l /system/bin/su > /data/local/tmp/output 2>&1

export TEMPRANDOM=74165

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

/system/bin/su: No such file or directory

END:74165export PS1=""

chmod 755 /data/local/tmp/busybox > /data/local/tmp/output 2>&1

export TEMPRANDOM=25357

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

END:25357export PS1=""

/data/local/tmp/busybox whoami > /data/local/tmp/output 2>&1

export TEMPRANDOM=44793

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

whoami: unknown uid 2000

END:44793export PS1=""

ls -l /data/local/12m > /data/local/tmp/output 2>&1

export TEMPRANDOM=95768

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

drwxrwx--x mot_tcmd shell 2011-09-03 20:52 batch

END:95768export PS1=""

mv /data/local/12m /data/local/12m.bak > /data/local/tmp/output 2>&1

export TEMPRANDOM=76259

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

END:76259export PS1=""

ln -s /data /data/local/12m > /data/local/tmp/output 2>&1

export TEMPRANDOM=21842

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

END:21842export PS1=""

$ export PS1=""

ls -l /data/local/12m > /data/local/tmp/output 2>&1

export TEMPRANDOM=42924

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

lrwxrwxrwx shell shell 2012-05-14 16:47 12m -> /data

END:42924export PS1=""

rm /data/local/12m > /data/local/tmp/output 2>&1

export TEMPRANDOM=51968

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

export TEMPRANDOM=51968

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

END:51968export PS1=""

mv /data/local/12m.bak /data/local/12m > /data/local/tmp/output 2>&1

export TEMPRANDOM=71998

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

END:71998export PS1=""

mv /data/local.prop /data/local.prop.bak > /data/local/tmp/output 2>&1

export TEMPRANDOM=49127

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

failed on '/data/local.prop' - Permission denied

END:49127export PS1=""

rm /data/local/tmp/boomsh > /data/local/tmp/output 2>&1

export TEMPRANDOM=76636

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

rm failed for /data/local/tmp/boomsh, No such file or directory

END:76636export PS1=""

rm /data/local/tmp/sh > /data/local/tmp/output 2>&1

export TEMPRANDOM=60635

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

rm failed for /data/local/tmp/sh, No such file or directory

END:60635export PS1=""

chmod 700 /data/local/tmp/zergRush > /data/local/tmp/output 2>&1

export TEMPRANDOM=94275

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

END:94275export PS1=""

cd /data/local/tmp/ > /data/local/tmp/output 2>&1

export TEMPRANDOM=17284

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

END:17284export PS1=""

export TEMPRANDOM=23415;export PS1=END:$TEMPRANDOM;./zergRush

[**] Zerg rush - Android 2.2/2.3 local root

[**] (C) 2011 Revolutionary. All rights reserved.

[**] Parts of code from Gingerbreak, (C) 2010-2011 The Android Exploid Crew.

[+] Found a GingerBread ! 0x00000118

[*] Scooting ...

[*] Sending 149 zerglings ...

[*] Sending 189 zerglings ...

[-] Hellions with BLUE flames !

END:23415export PS1=""

export PS1=""

/data/local/tmp/busybox mount -o rw,remount /system > /data/local/tmp/output 2>&1

export TEMPRANDOM=84557

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

mount: permission denied (are you root?)

END:84557export PS1=""

/data/local/tmp/busybox mount > /data/local/tmp/output 2>&1

export TEMPRANDOM=86651

export PS1=END:$TEMPRANDOM;cat /data/local/tmp/output

rootfs on / type rootfs (ro,relatime)

tmpfs on /dev type tmpfs (rw,relatime,mode=755)

devpts on /dev/pts type devpts (rw,relatime,mode=600)

proc on /proc type proc (rw,relatime)

sysfs on /sys type sysfs (rw,relatime)

none on /acct type cgroup (rw,relatime,cpuacct)

tmpfs on /mnt/asec type tmpfs (rw,relatime,mode=755,gid=1000)

tmpfs on /mnt/obb type tmpfs (rw,relatime,mode=755,gid=1000)

none on /dev/cpuctl type cgroup (rw,relatime,cpu)

/dev/block/mmcblk1p21 on /system type ext3 (ro,noatime,nodiratime,barrier=1,data=ordered)

/dev/block/userdata on /data type ext3 (rw,nosuid,nodev,noatime,nodiratime,errors=continue,barrier=1,data=ordered)

/dev/block/cache on /cache type ext3 (rw,nosuid,nodev,noatime,nodiratime,errors=continue,barrier=1,data=ordered)

tmpfs on /data/tmp type tmpfs (rw,relatime,size=2048k)

/dev/block/pds on /pds type ext3 (rw,nosuid,nodev,noatime,nodiratime,errors=continue,barrier=1,data=ordered)

/dev/block/preinstall on /preinstall type ext3 (rw,nosuid,nodev,noatime,nodiratime,barrier=1,data=ordered)

/dev/block/vold/179:1 on /mnt/sdcard type vfat (rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro)

/dev/block/vold/179:1 on /mnt/secure/asec type vfat (rw,dirsync,nosuid,nodev,noexec,relatime,uid=1000,gid=1015,fmask=0702,dmask=0702,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro)

tmpfs on /mnt/sdcard/.android_secure type tmpfs (ro,relatime,size=0k,mode=000)

/mnt/sdcard on /mnt/sdcard type ecryptfs (rw,dirsync,nosuid,nodev,noexec,relatime,ecryptfs_sig=9d248994b69b6392,ecryptfs_cipher=aes,ecryptfs_key_bytes=32,ecryptfs_passthrough,no_new_encrypted)

END:86651