[AT&T Samsung Galaxy Note 4] android-DEP:
I've devoted my last 3 weekends to this stuff, i tried much the same similar tricks as that exploit accomplishes.

but it seems as that exploit run into the same critically terminal issue of requiring system context permissions to launch it for it to execute properly.

Largely with good success I was able to do something like this(i attached a copy of the busybox i used):

*this was from command prompt inside the folder where this file is located so u dont need to enter absolute path*

C:\Users\dep\Downloads\root_files>adb push busybox /data/local/tmp
3185 KB/s (1109128 bytes in 0.340s)

C:\Users\dep\Downloads\root_files>adb shell
shell@trlteatt:/ $ cd /data/local/tmp
cd /data/local/tmp
shell@trlteatt:/data/local/tmp $ chmod 0777 busybox
chmod 0777 busybox
shell@trlteatt:/data/local/tmp $ export PATH=$PATH:/data/local/tmp
export PATH=$PATH:/data/local/tmp
shell@trlteatt:/data/local/tmp $ busybox
busybox
BusyBox v1.21.1 (2013-07-08 10:26:30 CDT) multi-call binary.
BusyBox is copyrighted by many authors between 1998-2012.
Licensed under GPLv2. See source distribution for detailed
copyright notices.

Usage: busybox [function [arguments]...]
or: busybox --list[-full]
or: busybox --install [-s] [DIR]
or: function [arguments]...

BusyBox is a multi-call binary that combines many common Unix
utilities into a single executable. Most people will create a
link to busybox for each function they wish to use and BusyBox
will act like whatever it was invoked as.

Currently defined functions:
[, [[, acpid, add-shell, addgroup, adduser, adjtimex, arp, arping, ash,
awk, base64, basename, beep, blkid, blockdev, bootchartd, brctl,
bunzip2, bzcat, bzip2, cal, cat, catv, chat, chattr, chgrp, chmod,
chown, chpasswd, chpst, chroot, chrt, chvt, cksum, clear, cmp, comm,
conspy, cp, cpio, crond, crontab, cryptpw, cttyhack, cut, date, dc, dd,
deallocvt, delgroup, deluser, depmod, devmem, df, dhcprelay, diff,
dirname, dmesg, dnsd, dnsdomainname, dos2unix, du, dumpkmap,
dumpleases, echo, ed, egrep, eject, env, envdir, envuidgid, ether-wake,
expand, expr, fakeidentd, false, fbset, fbsplash, fdflush, fdformat,
fdisk, fgconsole, fgrep, find, findfs, flock, fold, free, freeramdisk,
fsck, fsck.minix, fsync, ftpd, ftpget, ftpput, fuser, getopt, getty,
grep, groups, gunzip, gzip, halt, hd, hdparm, head, hexdump, hostid,
hostname, httpd, hush, hwclock, id, ifconfig, ifdown, ifenslave,
ifplugd, ifup, inetd, init, insmod, install, ionice, iostat, ip,
ipaddr, ipcalc, ipcrm, ipcs, iplink, iproute, iprule, iptunnel,
kbd_mode, kill, killall, killall5, klogd, last, less, linux32, linux64,
linuxrc, ln, loadfont, loadkmap, logger, login, logname, logread,
losetup, lpd, lpq, lpr, ls, lsattr, lsmod, lsof, lspci, lsusb, lzcat,
lzma, lzop, lzopcat, makedevs, makemime, man, md5sum, mdev, mesg,
microcom, mkdir, mkdosfs, mke2fs, mkfifo, mkfs.ext2, mkfs.minix,
mkfs.vfat, mknod, mkpasswd, mkswap, mktemp, modinfo, modprobe, more,
mount, mountpoint, mpstat, mt, mv, nameif, nanddump, nandwrite,
nbd-client, nc, netstat, nice, nmeter, nohup, nslookup, ntpd, od,
openvt, passwd, patch, pgrep, pidof, ping, ping6, pipe_progress,
pivot_root, pkill, pmap, popmaildir, poweroff, powertop, printenv,
printf, ps, pscan, pstree, pwd, pwdx, raidautorun, rdate, rdev,
readahead, readlink, readprofile, realpath, reboot, reformime,
remove-shell, renice, reset, resize, rev, rm, rmdir, rmmod, route, rpm,
rpm2cpio, rtcwake, run-parts, runlevel, runsv, runsvdir, rx, script,
scriptreplay, sed, sendmail, seq, setarch, setconsole, setfont,
setkeycodes, setlogcons, setserial, setsid, setuidgid, sh, sha1sum,
sha256sum, sha3sum, sha512sum, showkey, slattach, sleep, smemcap,
softlimit, sort, split, start-stop-daemon, stat, strings, stty, su,
sulogin, sum, sv, svlogd, swapoff, swapon, switch_root, sync, sysctl,
syslogd, tac, tail, tar, tcpsvd, tee, telnet, telnetd, test, tftp,
tftpd, time, timeout, top, touch, tr, traceroute, traceroute6, true,
tty, ttysize, tunctl, udhcpc, udhcpd, udpsvd, umount, uname, unexpand,
uniq, unix2dos, unlzma, unlzop, unxz, unzip, uptime, users, usleep,
uudecode, uuencode, vconfig, vi, vlock, volname, wall, watch, watchdog,
wc, wget, which, who, whoami, whois, xargs, xz, xzcat, yes, zcat, zcip

shell@trlteatt:/data/local/tmp $

or view the env. variables on the device

system@trlteatt:/data/local/tmp $ export ANDROID_SOCKET_adbd=9
export ANDROID_SOCKET_adbd=9
system@trlteatt:/data/local/tmp $ export UID=1000
export UID=1000
system@trlteatt:/data/local/tmp $ busybox printenv
busybox printenv
_=/data/local/tmp/busybox
PATH=/sbin:/vendor/bin:/system/sbin:/system/bin:/system/xbin:/data/local/tmp
LOOP_MOUNTPOINT=/mnt/obb
ANDROID_ROOT=/system
VIBE_PIPE_PATH=/dev/pipes
SHELL=/system/bin/sh
ANDROID_DATA=/data
KNOX_STORAGE=/data/knox/ext_sdcard
ANDROID_ASSETS=/system/app
TERM=vt100
ANDROID_PROPERTY_WORKSPACE=10,0
ANDROID_BOOTLOGO=1
HOSTNAME=trlteatt
UID=1000
LD_LIBRARY_PATH=/vendor/lib:/system/lib
BOOTCLASSPATH=/system/framework/core.jar:/system/framework/conscrypt.jar:/system/framework/okhttp.jar:/system/framework/core-junit.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/framework2.jar:/system/framework/telephony-common.jar:/system/framework/voip-common.jar:/system/framework/mms-common.jar:/system/framework/android.policy.jar:/system/framework/services.jar:/system/framework/apache-xml.jar:/system/framework/webviewchromium.jar:/system/framework/sec_edm.jar:/system/framework/timakeystore.jar:/system/framework/seccamera.jar:/system/framework/scrollpause.jar:/system/framework/stayrotation.jar:/system/framework/smartfaceservice.jar:/system/framework/commonimsinterface.jar:/system/framework/secocsp.jar:/system/framework/TmoWfcUtils.jar:/system/framework/simageis.jar:/system/framework/qcmediaplayer.jar:/system/framework/oem-services.jar:/system/framework/org.codeaurora.Performance.jar
EMULATED_STORAGE_SOURCE=/mnt/shell/emulated
ANDROID_SOCKET_adbd=9
EMULATED_STORAGE_TARGET=/storage/emulated
ANDROID_STORAGE=/storage
MKSH=/system/bin/sh
MC_AUTH_TOKEN_PATH=/efs
EXTERNAL_STORAGE=/storage/emulated/legacy
RANDOM=14943
ASEC_MOUNTPOINT=/mnt/asec
SECONDARY_STORAGE=/storage/extSdCard
USER=system
HOME=/data
system@trlteatt:/data/local/tmp $

BTW, another alternative workaround to the busybox not being installable, there's a BusyBox Install(No Root)

I only mention this because reading from the post on this Huawei Ascend Mate 7 root utility page, it mentions this

Here's another piece to this exploit's effectiveness

You can see this section inside of ServiceExploitActivity.java, starting from line 32

if(i < amethod.length)
{
label0:
{
if(!amethod[i].getName().equals("checkAndGetTcObjectClass"))
break label0;
flag = false;
}
}
if(flag)
{
super.onCreate(bundle);
(new exploit_CVE_2014_7911()).do_exploit(getBaseContext());
return;
} else
{
super.onCreate(bundle);
setContentView(0x7f030000);
((TextView[FONT="Lucida Sans Unicode"][I][highlight][COLOR="black"][B])findViewById(0x7f060000)).append("Your device seems not vulnerable!");[/B][/COLOR][/highlight][/I][/FONT]
return;
}
i++;
if(true) goto _L2; else goto _L1
_L1:
}
}

So based on that final part, my thoughts are perhaps something else can be injected into L1 section so it instead would broadcast an intent elsewhere rather than doing nothing like it is now?

**Extra details on existing SELinux context policies enforced on the unlucky 4.4.4 Android. It's mainly this exact part of this entire puzzle that's making everything so difficult. In my opinion, the simplest route would be to get anything with system level credentials to execute either "setenforce 0" or "setprop ro.build.selinux 0". I believe that would be the ice breaker if it can be executed somehow, everything else by virtue of policy of how this system works, should be by default in a non-enforcing mode and instead just flood the catlog with policy violations silently. It appears that although everything was set to read-only, /mnt/media_rw was left writable to be accessed by the system or root to perform write functions\tasks\activities to any file that's otherwise labeled as "read-only".

So disarming this selinux I think has to come first before moving further. It virtually removes all ability to perform any real tasks other than what's expected from a 5 year old child's use of this kind of hardware. After selinux is chloroformed from the picture, the rest should be to some degree a big more cooperative to exploit. This list of contexts should be useful at some point.

I included Trace32.exe, it's a singly tool from Microsoft's SCCM Server utilities which associates with .LOG files and let's you view them live as they're being written to. It highlights errors and notification areas so it's easier to spot. Invaluable help after reading some of these logs from system dumps, far better than notepad AND notepad++ as far as just viewing log output goes.