[Samsung Galaxy S22 Ultra] K0mraid3:
Devices & Linux Versions I or other Testers have Successfully Gained Root on:

(Likely All) MTK CPU Based Android devices UP TO 11 (Maybe 12? I haven't tested) (I.e LG, Sony, Select Samsung devices)

Android Devices with LINUX KERNEL VERSIONS - 5.8 - 4.14 - Maybe More? (Needs Testing)

-THIS GUIDE IS NOT BEGINNER FRIENDLY - BASIC UNDERSTANDING OF PYTHON, UNIX/LINUX ETC WILL BE REQUIRED!-​

If you have been holding off updating your device, well here's some good news, your device may still be vulnerable to a method to gain root access (and subsequently, possibly the ability to edit Build.prop and therefore allow the ability for OEM unlocking on USA based devices.) <- correct me if I'm wrong, but this should be possible, and once done, should persist across updates, correct?

As of the time of writing this, there is not currently a simplified APK method, but, still this process is relatively straight forward.

Alot of the methods used HAVE been patched from what I understand, but there have got to be plenty of devices out there still which are not updated. This project aims to compile all current, former and future Root methods into an APK that will do all the leg-work. If its able to find a working method, the GUI will pop a root shell for the end user. This SHOULD work, regardless of the setting of the "OEM UNLOCK" option in the dev options. A bypass, essentially.

Regardless, The project linked below uses a myriad of known exploits & vulnerabilities and looks to find one that will work.

Methods used are:

Nearly all of GTFOBins

Writeable docker.sock

CVE-2022-0847 (Dirty pipe)

CVE-2021-4034 (pwnkit)

CVE-2021-3560

It'll exploit most sudo privileges listed in GTFOBins to pop a root shell, as well as exploiting issues like a writable docker.sock, or the recent dirty pipe (CVE-2022-0847). More methods to root will be added over time too.

There is also an alternative (Dirty Pipe) injection method the uses @topjohnwu 's Magisk , this should be implemented into the apk. See this Github repo, Here.

I would imagine this could be implented in a way to target devices that have stopped being supported for updates, aswell, that do not have TWRP, such as the SM-T307U.

One big note - I am betting there are still ALOT of devices that are in inventory at retailers that remain on the vulnerable OS. So keeping that in mind, I'd say this is worth building.

What needs to be done:

TESTING!

Build APK - HELP NEEDED WITH THIS!

Deploy

Main Goals:

Get bootloader unlock ability for devices normally not unlockable (I.e North American Samsung Galaxy S22, Etc)

Above can be achieved by getting temp root via methods detailed here or otherwise, then editing build.prop, altering the below settings (The settings may be worded differently or simply not present at all, depending on device and Firmware version):

sys.oem_unlocking_allowed to 1

ro.oem_unlock_supported to 1 (most devices are set to 1 by default.)

ro.boot.flash.locked to 0

ro.secure to 0

ro.debuggable to 1

I think there may be one or two more that pretaint to Flash.locked. I.e flash.locked.other--or something very close.

Locally, gain temp root (System preferred, but any root will do.) on as many device types as possible.

Give device control back to end user.

Stay up-to-date on new exploits for root access & update apk accordingly.

STAY ETHICAL!!!! This is, in the end, a research project. Meaning all work preformed in the context of this project could result in a damaged or bricked device. By participating in this project you acknoledge these risks and accept them, and agree to not hold me, XDA, or anyone else responsible if you do some dumb ****. - k0mraid3

Github Project link: HERE for my fork & HERE for the original project.

My fork will incorporate the original project, as well as other found root access methods, such as the magisk injection method mentioned above - my repo is mainly used as a hub for the APK's dev - i don't have enough time to work on it at the moment but all are welcome to help.

July 15th 2022 (UPDATE) (SAMSUNG DEVICES ONLY): A new Escalation method has been found via the Galaxy app store (Versions BEFORE Galaxy Store 4.5.41.8). No details known yet, but it is said to be very easy. See CVE-2022-33708 (July132022). Unknown if downgrading the app to 4.5.0.0 will enable the method again or not.

Cred: liamg

One method to run Traitor on device - Thanks @DevinDking for sharing this.

Tools & References:

Linux (and Android, FTMP) Privilege Escalation Techniques

Dirty Pipe - Magisk Injection

Traitor - Main Repo

GTFOBins

CVE Database (Public Database for exploits, vulnerabilities, etc.)

Windows Subsystem For Linux (Great for Dev)

ADB App Control - Cred @Cyber.Cat

Leaked Samsung Source Code ***Mod Edit: Link Removed***

Crontab Root Template script (File Attached - you still must edit crontab with "crontab -e" and point it to this file, see comments for guide, I will add one to post later)

Android Image Kitchen Used to create custom image's etc.

MTK Client

MTK Meta Utility (Source-???)

Will add more as time goes on and more found.

Interesting Attack vectors -

GFX Componets of a system.

Issues with Linux itself (i.e Dirty Pipe)

Privilage escalation via any means (I.e GTFOBins)

unprotected system process - Hijack them if possible (i.e RILService Mode, and a wide range of other OEM apps left on devices after ship)

7/24/22 - Samsung, LG & Other OEM's obfuscating (Intentionally Hiding) Fastboot and ADB Bootloader interfaces on PC

So over the last week or so i dived head first into USB Dev - ill save you the time and sum it up.

Vendors and OEM's are actively obfuscating the USB connection between your smartphone and the PC to keep you from Rooting. As far as im aware, there is no Universal way to fix this as each OEM screws with the USB drivers differently. THIS needs to be a point of focus for the rooting community. However, i have found a few tools for Dev if you wish to screw with this. (I'll upload them tonight)

7/24/22 - MTK (MediaTek) based Exploits

I Will try to compile a few methods for FORCING Bootloader Unlock on MTK based Devices as well as a way for manipulating said devices. I will attach two tools to this thread, these tools are EXTREMELY POWERFUL and can completely **** up your device. When i say REALLY F*CK UP your device, I mean to the point you cant even access recovery, Download OR bootloader mode. I'm Talking a blank DEAD device. So use with caution.

With that said, lets talk about the tools. You will need a basic understanding of Python to make use of MTK Client

First up, we have MTK Meta Utility (Currently Version 44) (Download Below)

Next we have MTK Client (Github Link)

So what can you do? Well, you can crash the Preloader to Brom with MTK Meta Utility while at the same time using MTK Client to send any payload you like to the device via Fastboot.

I know, vague right now, but ill add detail over the coming days.

I will continue to update the below list as new methods are discovered.

If you find Guides, tutorials or new exploits, please link them in the comments so I can include them in future development!

Telegram Channel: Here.

Information on Vulnerabilities, exploits & methods - CVE-2022-0847 (Jfrog) - The Story Of "Dirty Pipe" - XDA - Dirty Pipe - PWNKIT (CVE--2021-4034) - CVE-2021-3560 - Docker Breakout / Privilege Escalation - CVE-2022-33708 (July132022) - CVE-2022-33701 (July122022) - CVE-2022-22268 (Unlock Knox Guard with DEX) (JAN2022) - MTK Client -

Dev Team & credit to -

@topjohnwu - LiamG - @wr3cckl3ss1 - bkerler -

UPDATED - 7/29/22