yashsingh1/xdaforums huggingface dataset:
[ZTE ZMAX Guides, News, & Discussion] kardeef:
Ya now its easier and won't piss off people trying to root this thing if you would simply read. It six when you are trying to root the ZMAX ,then every hour instead of working on root your repeating yourself for people who are so dam lazy to read. I have read evey post on this board and the one that was closed before this one. While I am trying ideas posted here it seems like I am notified every 30 mine with a post asking were are we or do we have root. I have to stop what I am doing to see that for the ninth time its not some add helpful info but its like a nightmare from 20 years ago that my kids asking why is the sky blue for the millionth time, I don't personally blame jcaae for keeping for himself. He probably got a 100 messages a day asking him is the phone rooted. I am about to give up trying simply from the 5 year olds to lazy to read asking every other post..we are we..is it rooted..when will it be rooted. Sheesh
[ZTE ZMAX Guides, News, & Discussion] mingolianbeef:
Okay so I'm not even going to pretend I'm active here like I was in the last one. I just want to say how awesome it is to watch (I do keep up with the thread and all its posts). Thank you to all dedicated to this!

To those bantering back and forth, justified or not, you are this close to root, let's not ruffle feathers. A pissing contest is not the way for everyone to get what they want.

To the OP, if I could suggest something, put the status of root in the thread title and at the top of the first post, as such

"Blah blah title name [ROOT STATUS: PENDING]" or something. That way, if people keep asking, instead entertaining the back and forth, one good Samaritan can say "read the thread title" and boom, argument avoided!

Hope this was a contribution and not an issue for anyone! In no way was I taking shots ?
[ZTE ZMAX Guides, News, & Discussion] kardeef:
Sorry bout my first rant..its late err early now..frustrated.. Tired.. Need sleep..brain fried ..need break.. Might step back a few days.. Good luck. I'll catch up on post and get back to trying to root this uncooperative ZMAX in a few days :)
[ZTE ZMAX Guides, News, & Discussion] BigDaddyE40:
Can someone clean the past few pages......I've been getting notifications expecting progress and I get bs instead
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
Amen to that I'm at work currently and will be back on this when I get home.....

Its so damn annoying to be working through terminal on my laptop then turning to my phone only to see bickering and childish behavior when your expecting feedback.... Root will happen eventually have patience..
[ZTE ZMAX Guides, News, & Discussion] skinlab:
Turn notifications off. I seriously wouldn't do any complaining.. These guys have been kicking azz for hours on end to give us bottom feeders root. The last thing they need is someone else with petty demands. Not trying to be a tool bro but, the devs are getting aggravated with all the questions that have been asked many times.
[ZTE ZMAX Guides, News, & Discussion] ghet2rockuu:
im saying bunch of pre Madonnas in here you ask to many questions , you off topic , oh he butt hurt me , oh to many notifications blah blah
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
Your reading him wrong..... He's not complaining about the time for root he's complaining about the same thing I am.. Working through terminal and in my case metasploit is tedious especially when you get a notification expecting feedback from someone else working on the issues only to come back here and find out it's another person begging for answers is annoying.. Why would I turn off my only connection to the other people working on root with me??

I don't mind questions as long as they are constructive and educated I'm not trying to come off as being rude but saying "I did read everything that was posted but I have bad reading comprehension so where are at with this" is pointless and it clogs up the source of communication for the devs and other people working toward a solution.
[ZTE ZMAX Guides, News, & Discussion] thegrim11:
Everyone just needs to get off their high horse. We as a COMMUNITY are further than we were a week ago. If you keep getting upset cause you're not getting the feedback you wanted, oh well. We all have lives outside of XDA. Sketchscarz works at dell. I go to school full time and play lacrosse. We can't make sacrifices from our daily lives. So stop with the asking about root. Stop complaining because someone didn't answer your post. Thing is, in the time that it takes to type up a post and wait for someone to respond... You can just have read through the post and chances are that your question will be answered that way. Everyone complaining about the actions of others are just clogging up the thread from useful information.
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
OK so after some serious reading and looking I've stumbled across some pretty decent stuff.. I won't be able to try this for a few hours but I think it may work.. I'm going to try to use metasploit to gain a full shell access from my Kali machine and run a few exploits through meterpreter.. This will stream line the process a little for me because I won't need to tunnel anything through adb everything I need will be from my laptop and dropped to run right against the Os on the phone.. I'll check in later with an update..

Edit... I realised I wasn't very clear on why this seems like the easier way to go about things and to answer questions before they're asked I'll explain.. Metasploit has allot of the privilege escalation exploits pre-compiled all I need to do is tweak and send cutting the amount of time at the keyboard down.
[ZTE ZMAX Guides, News, & Discussion] skinlab:
Would this be of any help to you?

http://cyberarms.wordpress.com/2014/02/26/android-webview-exploit-tutorial-70-of-devices-vulnerable/
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
Yes and no... What your looking at there would gain me shell access to the phone but that would be better suited against someone else's device that you didn't have access to... That being said all I have to do is run the meterpreter session on my zmax and I will gain shell access... Good find because it means I have fresh eyes on exploits.. Your looking for privilege escalation exploits for android 4.4.2
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
Lollipop coming!!!!

There is a Lollipop update coming for the ZTE Z max soon a least that is what one the reps told me he said they are working on some bug fixes and stuff but as so as there are done they will release it!!!!
[ZTE ZMAX Guides, News, & Discussion] thereal_antiHackmasta:
Do you have any idea if this is for the T-Mobile version or MetroPCS?
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
I think it's for both version I asked about it....
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
Your badass. Get the full shell and try to see the phone
[ZTE ZMAX Guides, News, & Discussion] jamesthegreat88:
I wouldn't use until we find root tbh who knows they may have a mole in here so of course update ruin our method and then we will have to find something else. On the other hand may come unlocked or at least root able from one click root.
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
Getting the shell should be the easy part it's the privilege escalation that's going to be a PITA
[ZTE ZMAX Guides, News, & Discussion] skinlab:
This is some interesting reading.

http://securitystreet.jive-mobile.com/#jive-document?content=/api/core/v2/posts/6955

---------- Post added at 09:36 PM ---------- Previous post was at 08:39 PM ----------

Why couldn't we use retme's root package? I know it's for the nexus but, it's for 4.4.4. He says The exploit may also work on other devices if the offsets of the rop chain are modified.

http://packetstormsecurity.com/files/130112/Android-CVE-2014-7911-CVE-2014-4322-Local-Exploit.html

android-root.zip (1.8 MB)

http://packetstormsecurity.com/files/download/130112/android-root.zip
[ZTE ZMAX Guides, News, & Discussion] DarthJaylen9189:
Hey. Sorry I've not been posting. I thought I would not be of any help. But has anyone noticed that on the last time with jcase achieving root and people trying to start crap.. Its happening again I see. I'm not tru ng to start any thing and I'm not saying anything else. Just that we are so close. I'm excited about the development and am glad to be here

Sent from my Z970
[ZTE ZMAX Guides, News, & Discussion] skinlab:
Everything is pretty chill now brudder.

Still WIP. Moving forward thanks to some awesome people here.
[ZTE ZMAX Guides, News, & Discussion] Lightfeather:
I honestly don't know why everyone seems to be pooping themselves over the new lollipop update. I work in a testing environment and from my experience lollipop has more compatibility issues, battery draining, and laggy loads than kitkat. It feels like a bloated mess in comparison. =/
[ZTE ZMAX Guides, News, & Discussion] DarthJaylen9189:
Yeah. I am glad I was apart of this haha I feel like I accomplished in life for this. Thanks brudder for ur and everyone elses work! ?

Sent from my Z970
[ZTE ZMAX Guides, News, & Discussion] skinlab:
Has anyone looked into this?

www.zdnet.com/article/backdoor-found-in-zte-android-phones/
[ZTE ZMAX Guides, News, & Discussion] DroidisLINUX:
This was the suid I was talking about earlier were they have user with root access, we still need to know the root users name and the password might be different than the one on that site which was

Password is ztex1609523

---------- Post added at 11:44 PM ---------- Previous post was at 11:40 PM ----------

And this was the root exploit that I was referring to earlier also that is our best bet, but still needs to be compiled Into an apk for our phone, this needs some looking Into cause with all our chances this is the one.
[ZTE ZMAX Guides, News, & Discussion] skinlab:
How can we test the backdoor code? That's where I'm lost bro.
[ZTE ZMAX Guides, News, & Discussion] Rusell:
This post is from 2012, Very outdated and very high chances of already being patched.
[ZTE ZMAX Guides, News, & Discussion] skinlab:
Until it's tried, we can't really say it doesn't work.

Trying all possibilities.. Can't hurt huh?
[ZTE ZMAX Guides, News, & Discussion] ghet2rockuu:
stop being so paranoid aint no mole in here lol

---------- Post added at 11:13 PM ---------- Previous post was at 11:09 PM ----------

because people love to keep up with the jones! im fine with kit kat i just want exposed . can care less for lollipoop
[ZTE ZMAX Guides, News, & Discussion] thegrim11:
You can't report an exploit that hasn't been found yet :P and from what tech_yeet said about the update coming soon... I doubt they have patched anything unless jcase reported his exploit. BUT lets focus our heads on the horizon and where we're going.
[ZTE ZMAX Guides, News, & Discussion] skinlab:
Ummmmmm brudder, you are on the largest Android exploit, iOS, site on the Web. If you really think for a second that all carriers and phone manufacturers lame **** spies are not on this wonderful site, you should go back to a beeper.
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
Allright so theres good news on my front i have remote shell access and am pushing exploits through metasploit this is going to take time and as far as suids i can see what i can find out while im prodding the os
[ZTE ZMAX Guides, News, & Discussion] thereal_antiHackmasta:
When you say remote shell access do you mean that you can see the system directories like /system/bin and write to them?
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
Yea that's outdated. 442 is older. About phone will demonstrate the particular version that you have.

255|u0_a138@draconis:/data/local/tmp $ busybox chpasswd

chpasswd: permission denied (are you root?)

asswd zte1609523 <

chpasswd: permission denied (are you root?)

asswd zte10138 <

chpasswd: permission denied (are you root?)

ogin 10138 <

sulogin: can't open '10138': No such file or directory

1|u0_a138@draconis:/data/local/tmp $ busybox login su

login: must be suid to work properly

in zte10138 <

login: must be suid to work properly
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
I can see them yes.. but as of yet i havent gained write access.. all im doing with the metasploit framework is running precompiled exploits to try to grab root.. doing things this way saves me a considerable amount of time because all of the exploits run directly against the phone through an essentially stolen shell

Right now i have an exploit that is looking promising but it is experiencing an error,, im in the metasploit irc as we speak trying to figure out what (if anything) im doing wrong in sending the command.... if this doest work though im afraid im going to be fumbling in the dark..
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
Uid is 10138

---------- Post added at 02:29 AM ---------- Previous post was at 02:28 AM ----------

What's the syntax?

---------- Post added at 02:32 AM ---------- Previous post was at 02:29 AM ----------

He could mean wifi adb

---------- Post added at 02:36 AM ---------- Previous post was at 02:32 AM ----------

Im protruding busybox. there is a lot of code to decompile. Have to play with the output and determine what is and isn't permitted n terminal. If you get Operation not permitted within terminal emulator on the phone, then you know the action CAN be performed within psuedo tunnel or root shell.
[ZTE ZMAX Guides, News, & Discussion] thereal_antiHackmasta:
Looks like I have gotten as far as you have. I am also trying to gain write access to the /system directory. I am installing Kali Linux in hopes that it will give the elevated privileges that I need to get full access. Also just a suggestion, have you tried to pivot the directory to essentially change then system directory that has the files pushed to them already. Such as /data/local/tmp
[ZTE ZMAX Guides, News, & Discussion] Rusell:
I got as far as writing in the /data partition, Which isn't all that exiting. All tough the changes did not persist upon reboot :(
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
We are at the same place with different starting points though... you have to remember im stealing access and for all intents and purposes whoami returns me as the root user.... i need to escalate to system level to do what we want to though.. ive made alot of headway in the past couple of minutes the problem is if i get root this way itll never be easy for the end user.... if i was simply running an exploit wed be fine but im not.. ive had to meterpreter myself into the phone to get as far as i am and is a problem. with out decent knowledge of what your doing theres a large chance to brick the device here..... im going to keep hammering away and see if i can gain root.. im trying to find copies of the su binaries does anyone have a link on hand
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
https://plus.google.com/105855773732882713268/posts/eG8haMtSKjo beautiful...
[ZTE ZMAX Guides, News, & Discussion] kardeef:
Iam taking a brake from trying to root this thing for a few days, I am burnt out.

I ran across this for ZTE devices and wanted to share it with ya,it might be a big help or jcase got this exploit to root it closed off.

So why are we posting about it? Because the root method used is, well... interesting.

It was uncovered by our own Justin Case from TeamAndIRC, and while a big part of the process will look very familiar to some of you, there is one step that induces a wait, what? moment.

Before you get started throwing commands at the little guy, though, you need to grab this file. After that, commence command throwing.

adb shell rm -r /data/local/logs (if this command gives you an error, do not worry, it is precautionary)

adb shell mkdir /data/local/logs

adb shell ln -s /data/local.prop /data/local/logs/loglast1.tar.gz

Dial *983*7668# on your phone. This does a few things, it mounts /system as writable on boot, and creates the loglast1.tar.gz.

Wait about 10 seconds, then continue.

adb shell echo 'ro.kernel.qemu=1' > /data/local.prop (Nod to Rosenberg here)

adb reboot

Once the phone reboots, continue

adb push su /system/xbin/su

adb shell chown 0.0 /system/xbin/su

adb shell chmod 06755 /system/xbin/su

adb shell rm -r /data/local/logs

adb shell rm /data/local.prop

adb shell rm /data/property/persist.sys.ztelog.enable

adb shell rm -r /data/local/rwsystag

Head into the Market and grab the Superuser app.

Done.

Catch that bold part? Looks like someone at ZTE dropped the ball and left seventy-nine developer codes in the retail version of the device. Oops.

Of course, their mistake is your gain. Hell, there's even a code to disable Carrier IQ: *983*24737#. Enter the code, ???, profit.

While this is definitely an unusual and unique find, it's also quite dangerous. This means that any app can mount the system as writable and, from there, basically control everything. As a result, JCase contacted ZTE to let them know of their oversight.
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
busybox find / -perm +6000 -type f -exec ls -ld {} \;

This will give you the suid binaries
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
Are you telling me this works or are you asking us to try im a tad confused here lol
[ZTE ZMAX Guides, News, & Discussion] Vyrus69:
That was for a different ZTE device the warp I believe. The code doesn't work on our device.

Sent from my Z970
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
I've pulled the binaries for suid. I am in Bourne shell. I am still permission denied however this time it showed me the folders. You guys need to come to twitch.tv/sketchscarz. I can broadcast my phone screen.
[ZTE ZMAX Guides, News, & Discussion] jamesthegreat88:
Pretty sure he is saying you could try this way but beware. And zte has been made aware of the issue.
[ZTE ZMAX Guides, News, & Discussion] thereal_antiHackmasta:
I'll have time on Saturday. [emoji20] I have to work. That's my first day off this week but I would love to collaborate more with you. Thanks for all your efforts thus far.
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
I am broadcasting my phone screen right now utilizing this code that has been input by the community and integrating with my methods.

twitch.tv/sketchscarz

---------- Post added at 04:04 AM ---------- Previous post was at 04:01 AM ----------

I can now see the root directories
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
Here are the root permissions for root shell.

I bow in humbleness
[ZTE ZMAX Guides, News, & Discussion] therealduckie:
No ability to chmod them to 777?
[ZTE ZMAX Guides, News, & Discussion] thereal_antiHackmasta:
I'm on the edge of my seat in excitement!
[ZTE ZMAX Guides, News, & Discussion] skinlab:
Er ma gerd.
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
1|shell@draconis:/ $ busybox find / -xdev -type f -perm +g=s -print

busybox find / -xdev -type f -perm +g=s -print

find: /config: Permission denied

find: /mnt/secure: Permission denied

find: /mnt/media_rw: Permission denied

find: /sbin: Permission denied

find: /root: Permission denied

1|shell@draconis:/ $ busybox find / -xdev -type f -perm +u=s -print

busybox find / -xdev -type f -perm +u=s -print

find: /config: Permission denied

find: /mnt/secure: Permission denied

find: /mnt/media_rw: Permission denied

find: /sbin: Permission denied

find: /root: Permission denied

1|shell@draconis:/ $ busybox find / -xdev -perm +o=w ! \( -type d -perm +o=t \)

! -type l -print

o=w ! \( -type d -perm +o=t \) ! -type l -print < THIS COMMAND MAKES THE FILES PRINT THAT ARE WRITABLE DIRECTORIES.

find: /config: Permission denied

/mnt/usbdrive <-------------------- This is a writable directory and we have execute.

find: /mnt/secure: Permission denied

find: /mnt/media_rw: Permission denied

find: /sbin: Permission denied

find: /root: Permission denied

1|shell@draconis:/ $
[ZTE ZMAX Guides, News, & Discussion] imattmodz:
Just take some deep breaths . This phone had me so mad this weekend that I was about to smash out the screen with the backside of my mouse. That permission denied reply is equivalent to the phone laughing in my face. This is a good community here people. We'll get it cracked open sooner or later. I haven't given up yet, and it's nice to see other folks still working on it as well. Good job XDA Community.
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
busybox pivot_root /system/bin /

pivot_root: Operation not permitted

1|shell@draconis:/ $

This command is potentially successful in a linux distribution.... also chroot which you can change the root directory or pivot it to a new location. Then set the folder permissions
[ZTE ZMAX Guides, News, & Discussion] thereal_antiHackmasta:
Are you trying these commands through the terminal emulator built into android?

---------- Post added 31-03-2015 at 12:00 AM ---------- Previous post was 30-03-2015 at 11:50 PM ----------

Because I believe that the only way to do this is in a Linux shell with elevated privileges after chmod the directory. Please correct me if I am wrong.
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
Yes. and adb. and pushing yall to test different distros.. there are codes and potential root methods to try in linux that ive previously posted in my last couple posts
[ZTE ZMAX Guides, News, & Discussion] thereal_antiHackmasta:
I get you. I really appreciate all the foot work you have been doing I am testing as much as I can. I think we are going to have some good results as soon as I get Kali setup. I'm optimistic! Your efforts are not in vain as I am working along side you.