[Android General] George_Jetson:
Hi there,

what my friend [MENTION=5182519]phonecapone[/MENTION] here means is ,

We have found a way to dirty cow pretty much anything in the phone here.

and even get UiD #0

on a shell...

but we cant seem to find a proper way to bypass the built in Selinux/Se-Android Security measures.

I Have A Shell on ADB.

ON Pixy4.

Says I'm Root but Se-context Is That of the Shell

I can Hijack certain other apps and binaries' Processes and end with

# Uid 0

Context Radio ...................... ---> meaning execute commands, and run stuff with the Modem's context....

or that of certain apps running on the device.

We are hoping That Your experience with these devices may shed light into the contexts and file structure that is usually Common to these devices.

if we can find any binary or process that the default Sepolicy's would allow us to use as a foot hold to execute code in a way to write a file to /system maby by useing a .sh shell script and how i think i could do that is append it to a script thats already in /system/bin like say " applypatch" or the like and then we just trigger what ever it takes to run the file.

maby we set up a chain of events where we dirtycow a script to /system/bin/wifi_supplicant that script runs and calls another script that we dirtycowed to a different location like /system/bin/dd or something. and that inturn mounts remounts moves and installs our su .

at the end of the script we do something like .

su --install && su --daemon && exit

edit: and we start it up by toggleing the Wifi switch in settings

we're not familiar with the Device on a level with You, You've really Done Great with all of these MTK versions of the device. and we are familliar with the msm8909 platform from some of our other recent projects, So we're hoping you may have some Suggestions since you have access or experience with it's sister phone's internals. and at this time we're shooting in the dark.

We congratulate you on your Successful Exploits on the Pixi devices !

And hope you'll help us all out with this version too.

we are willing to Test ANYTHING you come up with just post it here .

Thanks for All the Time Effort Money And thought you've put into all of this!

Cheers!!!

GJ

---------- Post added at 03:47 AM ---------- Previous post was at 03:32 AM ----------

There's lots of tut's but none are for this device.

So we've been trying and testing bit's and pieces of tut's and lots of things from github. while tweaking a line or two of code or attacking slightly different processes from what the tut's say because the exact nature of these tuts don't apply as theres different drivers modem firmware and binaries from a different Oem manufacturer than the devices in the tut's

so you see,

your familiarity may be of great assistance just because the devices made by the same manufacturer will most likely have many of the same binaries drivers or exploitable code in apps.

the build platform differs because of the chipset ( MSM -vs- MTK ) but i'd bet the folder structure's are nearly identical in both along with the content of /vendor and other things.

we've got a weapon or two but are trying to find the attack vector/platform.

anything you'd feel like contributing to our efforts will be Greatly appreciated.

Cheers !!!

GJ