[Android Head-Units] jake5253:
You guys, I just did a thing!!!

I was trying to exploit this thing with dirtyc0w, and at some point, I decided f*** it, i'm just gonna use a for-loop and try to echo a simple string to a file, on every folder up to about ten directories deep. That's when I realized the folder /bootloader/ was mounted with all permissions. As in 0777, a=wrx. I copied dirtyc0w over to /bootloader/ and tried to run it. Naturally, I was met with an error, but then my SSH session locked up. I dont know if the exploit actually ran or what the hell happened, but ultimately, I had to reboot after a few minutes because the unit became entirely unresponsive over SSH. I don't even know why I arrived at dirtyc0w. I have no evidence that this thing is exploitable with dirtyc0w. It was a total shot in the dark. Anyway, it was probably just a coincidence that it locked me out of SSH. My wifi runs through my phone's hotspot and it's a bit dodgy, at best. So back in a fresh boot, now /bootloader is locked down. Read only. I started throwing commands at it, trying to get /bootloader writable and executable again. I was trying a variety pack of busybox and busybox-smp commands.. (by the way busybox-smp is freakin awesome)..but all to no avail. permission denied denied denied... finally, I arrived at the idea of running a for-loop against everything, afterall, that's how I originally found out /bootloader was RW for a bit. I used a horribly programmed for-loop trying to remount EVERYTHING as RW....which somehow... worked..?!? WAIT WHAT?!?!?!

I know it's a terrible for loop. Its 1am and I've been dicking around with this thing for about 16 hours straight today. But I give you, THE for-loop.

for a in $(cat /proc/mounts | cut -d " " -f2); do adb root su -c mount -o remount,rw $a; done

I swear on my life, almost everything became mounted as RW (except [ / ] root ). I don't know why. I don't know how. It has to be the `adb root su -c` part of it. I almost peed myself.

Immediately, I slammed it with dd to dump boot to the sdcard, which succeeded, and then I proceeded to use Magisk Manager (canary) to root the boot-image file, then I dd'd it back to boot. Rebooted. and I have root!

In theory, no PC is required, probably? I was in an SSH session, but my whoami showed me as an untrusted app (UID: 10052). So I would guess you could use Terminal Emulator or anything else that, well, emulates terminals.

SSH Server app: hxxps://play.google.com/store/apps/details?id=net.xnano.android.sshserver (I have no affiliation with this app, it just happens to be what I was using as an ssh server without root)

**IF YOU TRY THIS, ITS AT YOUR OWN RISK AND PERIL**

If someone is daring enough to give it a try, let us know if you can get rooted this way, too? Would be awesome if this was the new way to get root on these things.

I'm actually pretty sure you don't need that sh***y for-loop. I'm guessing you could get away with something like `adb root su -c mount -o remount, rw /` or something... I don't seem to have /boot in my mounts list... I don't know. I just don't condone mounting EVERYTHING as RW. That just seems wreckless to me.

I also ran `adb root su -c setenforce 0` but I don't think it did anything. I don't recall if I did that before dd'ing boot or after, or if it even matters.