[Sprint Samsung Galaxy S III] Edge-Case:
Well I've been working on getting the Kali Linux toolkit to run on Android without a chroot and I did it, just gotta mount all the subfiletree's or whatever to where they belong in Androids root dir ,"/" (NOT "/root") and set up the paths in the enviroment a it seems to be working.

I spent way more time researching and planning out exactly how I was going to exicute this, it still has some kinks as some of the filesystems clash or have files of the same name but with slightly moified content, I guess I gotta dig through all those and patch em up so it all flows together, I just ran on the presumtion that it was all compiled for arm and I think it all runs on the android kernel when you chroot into an img file. I basically just mounted the kali.img file and instead of chrooting into that I went backwords and moved everything into Androids root.

Im working on a script with sanity checks and error collection and all that, I am still learning bash, linux, kernel, android, all like a summer cram session so please forgive me if I dont know or it takes time to share something I think is even slightly worthy for ya'll.

Anyways for those interested here is a bit of the tail end of what all this research has become, I think metasploit uses ruby, so if msf is working I guess that is too... here it is

localhost etc # ls
CHANGELOG-CM.txt gps.conf ppp
CHANGES.txt hosts recovery-resource.dat
NOTICE.html.gz init.d security
apns-conf.xml init.goldfish.sh snd_soc_msm
audio_effects.conf init.qcom.efs.sync.sh ssh
audio_policy.conf init.qcom.mdm_links.sh system_fonts.xml
bash init.qcom.modem_links.sh terminfo
bluetooth init.qcom.post_boot.sh thermald-8064.conf
boot_fixup init.qcom.thermal_conf.sh thermald-8930.conf
build-manifest.xml media_codecs.xml thermald-8960.conf
dbus.conf media_profiles.xml thermald.conf
dhcpcd mkshrc vold.fstab
event-log-tags nano wifi
fallback_fonts.xml nfcee_access.xml
firmware permissions
localhost / # mount --rbind $subset/etc /etc
localhost / # which apt-get
/usr/bin/apt-get
localhost / # which mfsconsole
localhost / # which msfconsole
/usr/bin/msfconsole
localhost / # msfconsole
IIIIII dTb.dTb _.---._
II 4' v 'B .'"".'/|\`.""'.
II 6. .P : .' / | \ `. :
II 'T;. .;P' '.' / | \ `.'
II 'T; ;P' `. / | \ .'
IIIIII 'YvP' `-.__|__.-'

I love shells --egypt

Easy phishing: Set up email templates, landing pages and listeners
in Metasploit Pro's wizard -- type 'go_pro' to launch it now.

=[ metasploit v4.7.0-2013071701 [core:4.7 api:1.0]
+ -- --=[ 1131 exploits - 638 auxiliary - 180 post
+ -- --=[ 309 payloads - 30 encoders - 8 nops

stty: standard input: Bad file number
msf > exit
localhost / # ls
acct init.trace.rc
bin init.usb.rc
cache initlogo.rle
charger lib
config lpm.rc
d media
data mnt
default.prop opt
dev persist
efs proc
etc res
extSdCard root
firmware run
fstab.qcom sbin
init sdcard
init.cm.rc srv
init.goldfish.rc storage
init.qcom.class_core.sh sys
init.qcom.class_main.sh system
init.qcom.early_boot.sh tmp
init.qcom.lpm_boot.sh tombstones
init.qcom.rc ueventd.goldfish.rc
init.qcom.sh ueventd.qcom.rc
init.qcom.syspart_fixup.sh ueventd.rc
init.qcom.usb.rc usbdisk0
init.qcom.usb.sh usr
init.rc var
init.recovery.qcom.rc vendor
init.target.rc
localhost / # exit
exit
shell@android:/ #

EDIT: Please note that to get this working I had to "su -c bash" so that some of the mount commands would work properly, this is why is says "localhost / #" and not "shell@anroid:/ #", its bash and thats the same interpreter the normal chroot throws you into. This is bash from Androids / directory.