yashsingh1/xdaforums huggingface dataset:
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
come join the in game voice that I have built for developers and gamers alike its a whole stream and all kinds of cool stuff just come view it at twitch.tv/sketchscarz

---------- Post added at 06:53 AM ---------- Previous post was at 06:12 AM ----------

I FOUND THE EXPLOIT

BUSYBOX EXPLOIT

busybox sh

The absolute easiest way to try to get access to a busybox install via command injection is telnetd. Busybox’s telnetd is different: on a normal telnetd install the “-l” flag enables line mode, but on busybox, -l specifies the command to use to challenge the user. That means if you specify the busybox shell, you get a shell without a user/pass prompt:

telnetd -l/bin/sh

That’s the shortest possible string that can land a shell on a busybox system. Of course, here’s where things get tricky. If telnet is already open, this will fail; it will also fail to bind a priveleged port when run as a non-root user. Finally, if the environment does not contain a valid path value, the command will fail.

/bin/busybox telnetd -l/bin/sh -p9999

The command above will bind a telnet shell to port 9999 without a path value and without running as root. Of course, now things get difficult.

Restrictions

Sample exploit conditions are always easy to land and never have anything annoying in the way like character filters or buffer lengths. The real world is different; exploitation often requires circumventing limitations. As far as length goes, the commands above pretty much cover the shortest possible exploit strings. Character set limitations are a different story. Embedded device character set limitations can be pretty heavy duty, enforced by on-screen-keyboards, security character filters, and other methods. A common limitation is space-bounded copy, generated by a tokenizer which clips a supplied argument to everything up to the first instance of whitespace. Here are some ways to work around these limitations:

~ $ echo -e x7cx7cx2e ||. ~ $ printf x7cx2ex0a |.

Busybox supports evaluation of slash-escaped characters both using echo and the shell builtin printf. This can be used to encode a lot of the characters that are often stripped. Different execution methods require different levels of escaping. Here are some combinations that work; note that I have included the command “true” to show where a successful system command would lie in the overall exploit.

true|/bin/busybox telnetd -l/bin/sh -p9999 # Character set required: -/

true|eval $(printf telnetd\\x20\\x2dl\\x2fbin\\x2fsh\\x20\\x2dp9999)

# Character set required: $()\

true|eval `printf telnetd\\\\x20\\\\x2dl\\\\x2fbin\\\\x2fsh\\\\x20\\\\x2dp9999`

# Character set required: `\

If you’re attempting to jailbreak a potential busybox device, and you’re fuzzing a net-facing service, the strings above coupled with a good [&& / || / | / ; / $() / ``] regular expression should get you started; just monitor port 9999. If you manage to land on a device with the methods I’ve listed here, drop me a line and let me know how it went down. If you’re determined to drop a binary on the device a few bytes at a time, this should get you started:
[ZTE ZMAX Guides, News, & Discussion] jcase:
This isn't an exploit, your just running the telnet daemon on port 9999, as shell user. It will also fail on android because /bin/sh is not a valid path to a shell on android. You want /system/bin/sh, even then the daemon is running as shell.

That echoing doesnt do anything, doesnt verify the port or anything. To connect to the daemon you would run telnet localhost:9999 or telnet localhost 9999 something along that lines, depending on busybox's client.
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
This exemplifies a local ip interface:

xdexadxbexefshell@draconis:/ $
[ZTE ZMAX Guides, News, & Discussion] jcase:
it does nothing of value, your only starting a telnet daemon as the shell user, its no more privileged than the shell user itself.
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
Tombstones

Ok i understand was getting excited. I might think twice about utilizing the interface. It seems plausible.

What about the tombstones file?

lrwxrwxrwx root root 1970-01-06 22:11 tombstones -> /data/tombs

tones

---------- Post added at 07:11 AM ---------- Previous post was at 07:11 AM ----------

Thats what i figured since I was still access denied

A compatible exploit from what Ive de-compiled so far?

---------- Post added at 07:15 AM ---------- Previous post was at 07:11 AM ----------

Okay wait since I've gotten into busy box, cant there be some type of way to decrypt the busybox security? I'm tired I'm not sure if I'm thinking straight.

---------- Post added at 07:19 AM ---------- Previous post was at 07:15 AM ----------

lrwxrwxrwx root root 1970-01-06 22:11 usbdrive -> /mnt/usbdrive

To find all SGID files:

find / -xdev -type f -perm +g=s -print

To find all SUID files

find / -xdev -type f -perm +u=s -print

To find all Writable dirs:

find / -xdev -perm +o=w ! \( -type d -perm +o=t \) ! -type l -print
[ZTE ZMAX Guides, News, & Discussion] DroidisLINUX:
I am just glad to see that [MENTION=2376614]jcase[/MENTION] is still a little interested to be checking the thread.
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
[MENTION=2376614]jcase[/MENTION] think you could throw us a bone here sketchskarz and I have been wading through this phone for a while now and could use a little direction.. I'm not looking for a tutorial just a starting point
[ZTE ZMAX Guides, News, & Discussion] monark88:
School time:

Vulnerabilities are flaws discovered in code that allow manipulation (that's a self derived definition)

Exploits are methods that use vulnerabilities to achieve a specific task: eg root exploit, etc.

Meterpreter uses known CVEs to gain root access on some devices, mainly geohot's exploit (towelroot). Probably won't ever gain root access through Metasploit or meterpreter, and if you did, it would be months from now (vulnerability must be discovered -> exploit created -> meterpreter team integrates into meterpreter) unless you are a Metasploit boss and brew your own... so we're better off with an ADB shell, but your thinking is certainly outside the box and in the right direction.. Meterpreter is good for remote device access...

Just because we have access to a shell doesn't mean much at all... Not being rude at all, I enjoyed all those "permission denied" outputs you got. I've seen a few of those as well! Good to know someone else is trying, and getting their hands dirty. We're struggling against a write protected system partition here.... ALL modern phones have this protection. The thing is, ZTE has patched all current vulnerabilities to gain root privileges.

You can't patch what you don't know exists yet.

None of the past ZTE exploits, exploits or other non-device specific exploits will work. They've all been patched in the kernel. We need a new vulnerability.

We can't adapt an old exploit to work on this device...

I wouldn't rely on jcase, he's clearly expressed that he's not interested.. we should just keep going.
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
Good definition I can agree with this

See theres where the rub is. you're looking at it in the case of precompiled exploits but the major advantage is scripting and tunneling the exploit in realtime versus writing an apk and pushing it.. the metasploit framework just send and executes so we can script in any language we need to package it and use it

I didn't take you as being rude you are well spoken and made good points.. The main reason I'm using what I am is because I know it better than adb and have some of the save functions.. I've never tried to penetrate an android device so I figured this as good a time to start as any

I'm not relying on him and the way he was talked to and treated I don't blame him for washing his hands with the project.. Was just looking for input.. he knows where to start and all the ins and outs.. I wouldn't have my feelings hurt in the least if he chose not to reply he has my respect because he's a great developer..
[ZTE ZMAX Guides, News, & Discussion] therealduckie:
Now THIS sounds more like the XDA the seasoned users know and love! Mutual respect, sharing information and knowledgeable posts. Bravo.

As for direction... What I understand from the previous thread was that root can be temporarily achieved but upon reboot the read/write issue rears its ugly head and it doesn't stick. Not sure how much that helps to know. Also, my paraphrasing could be slightly off.

Cheers
[ZTE ZMAX Guides, News, & Discussion] skinlab:
I think our best luck would be modifying retme's root package.

Our phones are vulnerable.
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
Yes that's what I'm getting at I have a full understanding of the permission chain... the issue I'm having is understanding the exploit used.. it has to be unlisted or listed after the build date to be relevant.. On top of that the only exploits I found are the futex_requeue and adduser exploit that match for 4.4.2 and the issue with these is I'm not fluent enough in programming to create an apk or exploit for metasploit to push for either this goes for the rop chain editing as well.. And also if I'm not mistaking even if we found an exploit for the os since it's not sticking we also need one for the kernel to keep the system mounted as writable atleast until we get the su to stock
[ZTE ZMAX Guides, News, & Discussion] therealduckie:
Remember, also, that many users are on 4.4.4 so whatever exploit you find in 4.4.2 may not work universally as it may have been patched.
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
I agree when you said that we can't patch what doesn't exist. We either need to look at the developed integrated interface and keep decompiling code, or revisit how to unmount this fuse, which I believe would entail breaking some spectrum of the api.

Hard code. Diligence and understanding what this interface does may bring to the forefront a vulnerability so that we can exploit this said vulnerability.

What I had done last night was prospect a potential exploit because of the dead beef local address interface without root permissions.

This could be an entryway to the developed api.

The fuse needs to be analyzed, and what is delegating the fuse to be mounted?
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
The adduser java exploit is listed for both we already know the futex_requeue won't work as it is a version of the towelroot exploit

But yes I haven't forgot about those of us on the metropcs side of things

Edit there is one other exploit that wasn't patched aosp until 5.0 but I can't remember what it leverages
[ZTE ZMAX Guides, News, & Discussion] skinlab:
This might help: www.cvedetails.com/vulnerability-li...7/version_id-177951/Google-Android-4.4.4.html
[ZTE ZMAX Guides, News, & Discussion] mingolianbeef:
It might not be much but I'm throwing $10 in the beer fund of the guy that is successful, you guys are an inspiration and amazing devs. Love the cooperation and participation!
[ZTE ZMAX Guides, News, & Discussion] skinlab:
I'm wondering if : CVE-2014-7911: Android <5.0 Privilege Escalation using ObjectInputStream.

Is what jcase was testing with.
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
I doubt it if you look at the listing it doesn't show any chance for privilege escalation which you would need to hot any of the write protected directories

---------- Post added at 09:02 PM ---------- Previous post was at 08:54 PM ----------

I'm far from a dev my friend I just have a decent grasp on how Linux does it's thing and have decent reading comprehension skills... I just got home in going to start testing on getting meterpreter to migrate to a system process if it works I should be able to open a root shell.. If not I'm going to change my point of attack....
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
There are hot parameters in the busybox code
[ZTE ZMAX Guides, News, & Discussion] thegrim11:
Man... I really need to read up on and learn coding :P My experience is only building ROMS :eek:
[ZTE ZMAX Guides, News, & Discussion] Rusell:
The zip failed to flash on recovery "installation aborted"

Could not verify zip
[ZTE ZMAX Guides, News, & Discussion] tech_yeet:
https://drive.google.com/folder/d/0B-gILDzs5fkbRGprN2d3dF83SzA/edit

The ZTE Z max dose not have a good camera they say LOOK AT what I did this is wallpaper quality stuff!???
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
Pretty much need to ensure that you follow the rules stated and ensure that you don't write to a block where the file wont fit? Needing to see the MTP interface and how it works.

---------- Post added at 07:15 AM ---------- Previous post was at 07:10 AM ----------

BAM!!!!!!!!!

Older Android devices support USB mass storage for transferring files back and forth with a computer. Modern Android devices use the MTP or PTP protocols — you can choose which one you prefer.

To select a USB connection protocol, open the Settings app, tap Storage, tap the menu button, and tap USB computer connection. You’ll also see the protocol your device is using as a notification when it’s connected to a computer via USB.

Will this allow us to see this in the MTP mode outside of the OS? idk, im tired. I think i am confusing myself. Maybe not. help me clarify guys. i was the accident that does this to me.
[ZTE ZMAX Guides, News, & Discussion] Vyrus69:
Didn't get it to work yet..but I may have something promising.

Sent from my Z970
[ZTE ZMAX Guides, News, & Discussion] ghet2rockuu:
just take a break dude
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
Shell script to find all programs and scripts with setuid bit set on: BADASS:

1|shell@draconis:/ $ busybox find $DIRNAME -xdev -type f -

busybox find $DIRNAME -xdev -type f -perm +u=s -print

find: ./storage/sdcard1: Permission denied

find: ./config: Permission denied

find: ./mnt/media_rw: Permission denied

find: ./sbin: Permission denied

find: ./root: Permission denied

1|shell@draconis:/ $

---------- Post added at 08:27 AM ---------- Previous post was at 07:47 AM ----------

Here is the Operating system version and it's release:

Linux GNU

3.4.0-g30db9cf-00504-g729e089
[ZTE ZMAX Guides, News, & Discussion] monark88:
I can see that you're hard at work, that's awesome.

MTP is simply a protocol for transferring files to and from a phone and computer.

You can not use MTP to achieve root. It's a file transfer.

I can go to a website right now on any device and download a virus through FTP or HTTP. That moves the virus from the website server to my computer. That's it.

I have to execute the binaries for the virus to work on my machine.

We can transfer su all day long. We've achieved this already. We need to have it in system and executable by SuperUser or SuperSU, etc.

A simple ADB push can get su on the device.

MTP will never achieve root. If it could we probably would have had root a long time ago, on a myriad of unrootable phones

adb shell cat /proc/version

gives us kernel version
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
OK guys I've logged on to say a few things... I'm going to say what allot of the people who are informed and understand the situation figured out a while ago.. Without some sort of base privilege explanation escalation we are dead in the water... We need someone who is familiar (or brave enough ) with writing and testing exploits to code out a few and run them against the phone... There are two that look promising... I would take on the task but with my girlfriend pregnant ( and almost due ) with my first child and work I don't have time to learn how to code in java and debug and troubleshoot the exploits.... I'll still be here to lend a hand but digging in in protected files only gets us so far we need at least a temp root to push this to the next level.....
[ZTE ZMAX Guides, News, & Discussion] imhumanoid:
Iv been watching this for several months now, old thread and new. I would like to thank those of you who are working so hard on achieving root for this phone. :good:

If there is any way I can help, let me know. I am using a laptop running windows 8.1.... I dont have access to a linux machine sadly.
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
That's fine and good problem with what you proposed is this.. In order to alter the fuse mounted operating system your gonna need root permission... I still think the java call exploits would be our best bet... Looking at the problem as a whole..the fuse is what is locking out privileges in the first place.. Without gaining at least a temp root we aren't going to get anywhere... My suggestion would be is...

A) one of us learns enough java to put both exploits into apps and have it write and change permission to the su binary so we can use it till reboot.

B) we find someone who can write the apks for us and we take it from that point..

After we gain a temp root we can figure out how to modify the existing fuse so we don't have to rerun the apk after every boot
[ZTE ZMAX Guides, News, & Discussion] Djoec1983:
At this point I'd be more than satisfied with a temp root, its a bit of an annoyance but so be it
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
That's the thing if we gain temp with a little development we maybe able to turn temp into full.....

If I had time id learn java myself but in this aspect I think someone with programming experience is necessary
[ZTE ZMAX Guides, News, & Discussion] Vee63b:
Just chiming in. I've been keeping tabs on this thread, and haven't had any time to try again on this phone since the old thread because of Med school, but some other people and myself was saying in the last thread that 4.4.2 is vulnerable to the ASEC exploit, I was messing with that and trying to script something for the ZMAX then, but then I got busy, but if anybody else would like to give it a go, that might be another good starting point. The last I heard was the ASEC exploit would work on a locked bootloader, like it did for the xperia.
[ZTE ZMAX Guides, News, & Discussion] monark88:
i'm with you
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
I was reading on how the MTP is the interface for the fuse. thats all I got it confused with the FTM mode.
[ZTE ZMAX Guides, News, & Discussion] Vee63b:
I was thinking ASEC because it wasn't patched until 4.4.3 was released, so maybe the T-Mobile variant can achieve temp root at least. I was trying to achieve something "like" - and I use that term loosely - to the xperia or moto methods. The basics of it should work, in theory, would just have to use and crash something else other than the service menu and create a script specifically for the ZMAX. I'll try some more today when I get home.
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
I wonder if we could modify aprevious devices driver to work with our phone.... I remember someone linking software in the precious thread for ftm i believe it was for the blade

---------- Post added at 07:09 PM ---------- Previous post was at 07:07 PM ----------

And as far as asec it now has my attention and I will look into it in not sure if it'll happen tonight but I'll look at it
[ZTE ZMAX Guides, News, & Discussion] skinlab:
I know I brought this up already but, Why couldn't we use retme's root package? I know it's for the nexus but, it's for 4.4.4. He says The exploit may also work on other devices if the offsets of the rop chain are modified.

http://packetstormsecurity.com/files/130112/Android-CVE-2014-7911-CVE-2014-4322-Local-Exploit.html

android-root.zip (1.8 MB)

http://packetstormsecurity.com/files/download/130112/android-root.zip
[ZTE ZMAX Guides, News, & Discussion] shabbypenguin:
this was discussed previously :).
[ZTE ZMAX Guides, News, & Discussion] xtremeasure:
If we find someone interested enough to look at it.. I couldn't even begin to tell you how to edit a rop chain
[ZTE ZMAX Guides, News, & Discussion] skinlab:
Nice to see you here Shabbypenguin.

---------- Post added at 10:59 PM ---------- Previous post was at 10:57 PM ----------

Bliss would have had this figured out already. Wish he was in on this.

---------- Post added at 11:01 PM ---------- Previous post was at 10:59 PM ----------

I understand. I have no idea either brudder.
[ZTE ZMAX Guides, News, & Discussion] shabbypenguin:
indeed, unfortunate that he was driven away by entitled users who kept demanding root :/
[ZTE ZMAX Guides, News, & Discussion] skinlab:
Yes sir I understand. I haven't done anything of value here to ever feel even remotely entitled. Nobody owes me a thing. It's a shame brudder, I've been around since the Optimus M. I've seen the ungrateful many times. It's worse now.
[ZTE ZMAX Guides, News, & Discussion] shabbypenguin:
Oh please dont misunderstand i wasnt talking about anyone here :).
[ZTE ZMAX Guides, News, & Discussion] skinlab:
Truthfully, this is probably my favorite phone I've owned. If root comes, great. If not, I can't say I really care.

Truth is, I think the way things are going, root will turn into the same as old school Direct TV cards.. You will need to pay to send your phone to a dev and have them root it and send it back to you.. Call me crazy but, I see it coming.

---------- Post added at 11:27 PM ---------- Previous post was at 11:25 PM ----------

I know where you are talking about. I remember when you left because of a bunch of spoiled azz punks felt like you owed them.

---------- Post added at 11:30 PM ---------- Previous post was at 11:27 PM ----------

I know I'm taking shots in the dark here but, would this be of any use? www.cvedetails.com/cve/CVE-2015-1474/

---------- Post added at 11:46 PM ---------- Previous post was at 11:30 PM ----------

That bug was released this month.. Affecting Android 5.0.1 and below. I will keep digging..
[ZTE ZMAX Guides, News, & Discussion] mingolianbeef:
I can't help but feel like I've seen your name a lot at one point (actually, I know I have). Did you work on the Evo 3D back in the day by any chance?
[ZTE ZMAX Guides, News, & Discussion] shabbypenguin:
Mytouch 3G Slide > Kyocera Echo > HTC Evo 3D > Samsung Nexus S 4G > LG Optimus G (Backup) > Samsung Galaxy S4 > HTC One M7 > ZTE ZMAX (Current)

bolded phones are ones i worked on, the echo is one i talked about working on and finally only managed to purchase one after heartheecho forum was long since dead.
[ZTE ZMAX Guides, News, & Discussion] skinlab:
Shabbypenguin has been around for ages.. If he isn't personally responsible for root, he made it happen so you got root..

I'm not on your nutz Shabby, I'm giving credit where credit is due..
[ZTE ZMAX Guides, News, & Discussion] mingolianbeef:
Dude I started HTE back when the echo was out and nobody was giving it a shot! I believe my name was either ognimnella or bfg_sgtrecon (don't judge me for the latter lol, I was like 16 and that was my XBL gamertag then) at the time (its been so long) and I believe the S4 was where I remember your name from more specifically, talk about 7 degrees of separation.
[ZTE ZMAX Guides, News, & Discussion] sketchscarz:
Change History 4 change records found

Change History 4 change records found
[ZTE ZMAX Guides, News, & Discussion] DroidisLINUX:
Please delete this is fake, and a waste not possible we don't have a fastboot or bootloader.
[ZTE ZMAX Guides, News, & Discussion] therealduckie:
Kardeef, delete your post NOW. Every site you listed is in the DO NOT POST list on the first page.

Read it.