[Verizon Galaxy S 5 General] cquick97:
We can get it to compile, and run. As someone posted earlier, I believe it fails here:

puts("[+] Doing once-off allocations");

for (i = 0; i < ONEOFF_ALLOCS; ++i)
if (openpty(&temp_fd_1, &temp_fd_2, NULL, NULL, NULL) == -1) {
puts("[-] pty creation failed");
return 1;
}

I'll try to look into strace.

Make sure he knows how much we appreciate any push in the right direction for this!!

Edit: I don't know anything about strace. Does anyone know what this means?

Edit2: Now that I look at it, it seems we don't have permission to create /dev/pts/1.... :(

shell@kltevzw:/data/local/tmp $ ./strace4.8 ./exploit
execve("./exploit", ["./exploit"], [/* 26 vars */]) = 0
uname({sys="Linux", node="localhost", ...}) = 0
brk(0) = 0x67a000
brk(0x67ad04) = 0x67ad04
set_tls(0x67a4c0, 0x99230, 0, 0x67a4c0, 0x9c600) = 0
set_tid_address(0x67a068) = 21405
set_robust_list(0x67a070, 12) = 0
futex(0xbeb2669c, FUTEX_WAKE_PRIVATE, 1) = 0
futex(0xbeb2669c, FUTEX_WAIT_BITSET_PRIVATE|FUTEX_CLOCK_REALTIME, 1, NULL, 67a4c0) = -1 EAGAIN (Resource temporarily unavailable)
rt_sigaction(SIGRTMIN, {0xea50, [], SA_SIGINFO|0x4000000}, NULL, 8) = 0
rt_sigaction(SIGRT_1, {0xe8f8, [], SA_RESTART|SA_SIGINFO|0x4000000}, NULL, 8) = 0
rt_sigprocmask(SIG_UNBLOCK, [RTMIN RT_1], NULL, 8) = 0
getrlimit(RLIMIT_STACK, {rlim_cur=8192*1024, rlim_max=RLIM_INFINITY}) = 0
readlink("/proc/self/exe", "/data/local/tmp/exploit", 4096) = 23
brk(0x69bd04) = 0x69bd04
brk(0x69c000) = 0x69c000
fstat64(1, {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 0), ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb6fa4000
write(1, "[+] Resolving symbols\n", 22[+] Resolving symbols
) = 22
write(1, "[+] Doing once-off allocations\n", 31[+] Doing once-off allocations
) = 31
open("/dev/ptmx", O_RDWR) = 3
statfs("/dev/pts", {f_type="DEVPTS_SUPER_MAGIC", f_bsize=4096, f_blocks=0, f_bfree=0, f_bavail=0, f_files=0, f_ffree=0, f_fsid={0, 0}, f_namelen=255, f_frsize=4096}) = 0
ioctl(3, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(3, TIOCGPTN, [1]) = 0
stat64("/dev/pts/1", {st_mode=S_IFCHR|0600, st_rdev=makedev(136, 1), ...}) = 0
getuid32() = 2000
socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 4
connect(4, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
close(4) = 0
socket(PF_LOCAL, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 4
connect(4, {sa_family=AF_LOCAL, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory)
close(4) = 0
open("/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
open("/vendor/lib/tls/libnss_compat.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat64("/vendor/lib/tls", 0xbeb233e8) = -1 ENOENT (No such file or directory)
open("/vendor/lib/libnss_compat.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat64("/vendor/lib", {st_mode=S_IFDIR|0755, st_size=8192, ...}) = 0
open("/system/lib/tls/libnss_compat.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat64("/system/lib/tls", 0xbeb233e8) = -1 ENOENT (No such file or directory)
open("/system/lib/libnss_compat.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat64("/system/lib", {st_mode=S_IFDIR|0755, st_size=24576, ...}) = 0
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
open("/lib/tls/libnss_compat.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat64("/lib/tls", 0xbeb233e8) = -1 ENOENT (No such file or directory)
open("/lib/libnss_compat.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat64("/lib", 0xbeb233e8) = -1 ENOENT (No such file or directory)
open("/usr/lib/tls/libnss_compat.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat64("/usr/lib/tls", 0xbeb233e8) = -1 ENOENT (No such file or directory)
open("/usr/lib/libnss_compat.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
stat64("/usr/lib", 0xbeb233e8) = -1 ENOENT (No such file or directory)
open("/vendor/lib/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
open("/system/lib/libnss_files.so.2", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
getgid32() = 2000
chmod("/dev/pts/1", 0620) = -1 EACCES (Permission denied)
close(3) = 0
write(1, "[-] pty creation failed\n", 24[-] pty creation failed
) = 24
exit_group(1) = ?
+++ exited with 1 +++
1|shell@kltevzw:/data/local/tmp $

P.S if anyone saw that previous code block, it was wrong because of a bug in it. Patched with latest strace 4.8. New binary here: http://d-h.st/7fo