[Android General] adfree:
Please help... need few ideas about folders... from where I can execute Binaries...

Here again stupid test with su as su2 renamed... I can chmod 777 in /cache folder but not execute...

In /cahce I can also mkdir... from system...

adb push su2 to /sdcard i did from other adb Window... as normal user...

This output only from system shell...

S/system/bin/sh: can't find tty fd: No such device or address
/system/bin/sh: warning: won't have full job control
:/ $ ls
ls: .: Permission denied
1|:/ $ cd /data/local/tmp
/system/bin/sh: <stdin>[2]: cd: /data/local/tmp: Permission denied
2|:/ $ cd /data/local/
:/data/local $ ls
ls: .: Permission denied
1|:/data/local $ mkdir test1
mkdir: 'test1': Permission denied
1|:/data/local $ cd ..
:/data $ mkdir test1
mkdir: 'test1': Permission denied
1|:/data $ whoami
system
:/data $ cd ..
:/ $ ls
ls: .: Permission denied
1|:/ $ fd -h
/system/bin/sh: <stdin>[11]: fd: inaccessible or not found
127|:/ $ df -h
Filesystem Size Used Avail Use% Mounted on
/dev/block/dm-0 3.4G 3.3G 99M 98% /
tmpfs 646M 1.2M 645M 1% /dev
tmpfs 646M 0 646M 0% /mnt
/dev/block/dm-1 84M 81M 1.3M 99% /vendor
/dev/block/dm-2 169M 169M 0 100% /product
/dev/block/dm-3 3.9M 984K 2.9M 25% /odm
/dev/block/platform/10500000.dwmmc0/by-name/prism 581M 179M 390M 32% /prism
/dev/block/platform/10500000.dwmmc0/by-name/optics 39M 500K 37M 2% /optics
tmpfs 646M 0 646M 0% /apex
/dev/block/by-name/omr 16M 24K 15M 1% /omr
/dev/block/platform/10500000.dwmmc0/by-name/cache 193M 6.0M 183M 4% /cache
/dev/block/platform/10500000.dwmmc0/by-name/sec_efs 3.8M 1.3M 2.3M 37% /efs
/dev/fuse 8.3G 701M 7.5G 9% /storage/emulated
:/ $ cd /sdcard
:/sdcard $ ls
Alarms
Android
Audiobooks
DCIM
Documents
Download
Movies
Music
Notifications
Pictures
Podcasts
Ringtones
:/sdcard $ ls -a1l
total 36
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Alarms
drwxrws--x 5 media_rw media_rw 3452 2023-01-25 08:04 Android
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Audiobooks
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 DCIM
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Documents
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Download
drwx------ 3 u0_a117 u0_a117 3452 2023-01-25 08:04 Movies
drwxrwxr-x 4 media_rw media_rw 3452 2023-01-25 08:04 Music
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Notifications
drwx------ 3 u0_a117 u0_a117 3452 2023-01-25 08:04 Pictures
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Podcasts
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Ringtones
:/sdcard $ ls -a1l
total 188
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Alarms
drwxrws--x 5 media_rw media_rw 3452 2023-01-25 08:04 Android
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Audiobooks
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 DCIM
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Documents
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Download
drwx------ 3 u0_a117 u0_a117 3452 2023-01-25 08:04 Movies
drwxrwxr-x 4 media_rw media_rw 3452 2023-01-25 08:04 Music
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Notifications
drwx------ 3 u0_a117 u0_a117 3452 2023-01-25 08:04 Pictures
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Podcasts
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Ringtones
-rw------- 1 u0_a117 u0_a117 154452 2023-01-22 22:17 su2
:/sdcard $ chmod 777 su2
:/sdcard $ ls -a1l
total 188
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Alarms
drwxrws--x 5 media_rw media_rw 3452 2023-01-25 08:04 Android
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Audiobooks
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 DCIM
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Documents
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Download
drwx------ 3 u0_a117 u0_a117 3452 2023-01-25 08:04 Movies
drwxrwxr-x 4 media_rw media_rw 3452 2023-01-25 08:04 Music
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Notifications
drwx------ 3 u0_a117 u0_a117 3452 2023-01-25 08:04 Pictures
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Podcasts
drwx------ 2 u0_a117 u0_a117 3452 2023-01-25 08:04 Ringtones
-rw------- 1 u0_a117 u0_a117 154452 2023-01-22 22:17 su2
:/sdcard $ ./su2
/system/bin/sh: <stdin>[18]: ./su2: can't execute: Permission denied
126|:/sdcard $ ./su2
/system/bin/sh: <stdin>[18]: ./su2: can't execute: Permission denied
126|:/sdcard $ cd /cache
:/cache $ ls -a1l
total 48
drwxrwx--- 7 system cache 4096 2023-01-25 08:02 .
drwxr-xr-x 27 root root 4096 2008-12-31 15:00 ..
d????????? ? ? ? ? ? backup
drwx------ 2 system system 4096 2023-01-25 08:02 backup_stage
drwxrwx--- 2 system system 4096 2023-01-25 08:02 fota
drwxrwx--- 2 root root 16384 2023-01-25 08:02 lost+found
drwxrwx--- 2 system cache 4096 2023-01-26 01:52 recovery
:/cache $ mkdir test1
:/cache $ ls -a1l
total 52
drwxrwx--- 8 system cache 4096 2023-01-26 02:10 .
drwxr-xr-x 27 root root 4096 2008-12-31 15:00 ..
d????????? ? ? ? ? ? backup
drwx------ 2 system system 4096 2023-01-25 08:02 backup_stage
drwxrwx--- 2 system system 4096 2023-01-25 08:02 fota
drwxrwx--- 2 root root 16384 2023-01-25 08:02 lost+found
drwxrwx--- 2 system cache 4096 2023-01-26 01:52 recovery
drwx------ 2 system system 4096 2023-01-26 02:10 test1
:/cache $ cd /sdcard
:/sdcard $ cp su2 /cache
:/sdcard $ cd /cache
:/cache $ ls -a1l su2
-rw------- 1 system system 154452 2023-01-26 02:11 su2
:/cache $ chmod 777 su2
:/cache $ ls -a1l su2
-rwxrwxrwx 1 system system 154452 2023-01-26 02:11 su2
:/cache $ ./su2
/system/bin/sh: <stdin>[29]: ./su2: can't execute: Permission denied
126|:/cache $ su2
/system/bin/sh: <stdin>[30]: su2: inaccessible or not found
127|:/cache $ /cache/su2
/system/bin/sh: <stdin>[31]: /cache/su2: can't execute: Permission denied

Maybe other usefull Binaries possible to run... or some *.sh shell scripts...

Thanx for every idea...

If we can not access to /system/bin... then maybe we can Copy and Paste to other path and run...

Who knows....:alien:

Best Regards

Edit 1.

Google search...

Execute a pure binary file on Android

Is there a way to run a binary executable file (compile with NDK), on Android? /* #includes #defines ... */ int main(){ // Do something when this is executed return 0; } I want it to run

stackoverflow.com

/data/bin

Hmmm... seems not exists in my device... I can not mkdir bin in /data

Edit 2.

From ADB Window...

freshul:/sdcard $ ls
Alarms Android Audiobooks DCIM Documents Download Movies Music Notifications Pictures Podcasts Ringtones su2
freshul:/sdcard $ cp su2 /data/local/tmp
freshul:/sdcard $ cd /data/local/tmp
freshul:/data/local/tmp $ ls -a1l
total 15758
drwxrwx--x 2 shell shell 3452 2023-01-26 02:37 .
drwxr-x--x 4 root root 3452 2023-01-25 08:02 ..
-rw-rw-rw- 1 shell shell 15955101 2023-01-18 17:08 samsungTTSVULN2.apk
-rw------- 1 shell shell 154452 2023-01-26 02:37 su2
freshul:/data/local/tmp $ chmod 777 su2
freshul:/data/local/tmp $ ls -a1l
total 15758
drwxrwx--x 2 shell shell 3452 2023-01-26 02:37 .
drwxr-x--x 4 root root 3452 2023-01-25 08:02 ..
-rw-rw-rw- 1 shell shell 15955101 2023-01-18 17:08 samsungTTSVULN2.apk
-rwxrwxrwx 1 shell shell 154452 2023-01-26 02:37 su2

Edit 3.

Hmmmmmmmmmm... from ADB Window...

freshul:/data/local/tmp $ /data/local/tmp/su2
su2: applet not found
1|freshul:/data/local/tmp $ /data/local/tmp/su2 -version
su2: applet not found
1|freshul:/data/local/tmp $ /data/local/tmp/su2 -h
su2: applet not found
1|freshul:/data/local/tmp $ /data/local/tmp/su2 --help
su2: applet not found

This su is taken from Magisk 25.2 ... will check some easier Binary...

Edit 4.

after found this...

Google Issue Tracker

issuetracker.google.com

Tried via system shell...

:/data/user/0 $ ls
android
com.acr.shellterminalemulator
com.android.backupconfirm
com.android.bluetooth
com.android.captiveportallogin
com.android.carrierconfig
com.android.cellbroadcastreceiver
com.android.certinstaller
com.android.companiondevicemanager
com.android.cts.ctsshim
com.android.cts.priv.ctsshim
com.android.dynsystem
com.android.hotspot2.osulogin
com.android.inputdevices
com.android.keychain
com.android.localtransport
com.android.location.fused
com.android.managedprovisioning
com.android.mms.service
com.android.modulemetadata
com.android.mtp
com.android.networkstack.inprocess
com.android.networkstack.permissionconfig
com.android.networkstack.tethering.inprocess
com.android.nfc
com.android.phone
com.android.providers.blockednumber
com.android.providers.calendar
com.android.providers.downloads
com.android.providers.media
com.android.providers.media.module
com.android.providers.settings
com.android.providers.telephony
com.android.providers.userdictionary
com.android.se
com.android.server.telecom
com.android.shell
com.android.soundpicker
com.android.statementservice
com.android.vending
com.android.wallpaperbackup
com.android.wearable.resources
com.android.wifi.resources
com.corproxy.files
com.google.android.apps.maps
com.google.android.apps.messaging
com.google.android.apps.wearable.retailattractloop
com.google.android.apps.wearable.settings
com.google.android.apps.wearable.systemui
com.google.android.apps.work.clouddpc
com.google.android.clockwork.oemsetup
com.google.android.ext.services
com.google.android.ext.shared
com.google.android.gms
com.google.android.gsf
com.google.android.marvin.talkback
com.google.android.networkstack.tethering.overlay
com.google.android.overlay.modules.cellbroadcastreceiver
com.google.android.packageinstaller
com.google.android.partnersetup
com.google.android.permissioncontroller
com.google.android.tts
com.google.android.wearable.ambient
com.google.android.wearable.app
com.google.android.wearable.app.overlay.refsysui.default
com.google.android.wearable.assistant
com.google.android.wearable.batteryservices
com.google.android.wearable.frameworkpackagestubs
com.google.android.wearable.healthservices
com.google.android.wearable.overlay.home.merlot
com.monotype.android.font.chococooky
com.monotype.android.font.cooljazz
com.monotype.android.font.foundation
com.monotype.android.font.rosemary
com.monotype.android.font.samsungone
com.samsung.SMT
com.samsung.SMT.lang.poc
com.samsung.aasaservice
com.samsung.accessibility
com.samsung.advancedcallservice
com.samsung.advp.imssettings
com.samsung.android.aircommandmanager
com.samsung.android.app.contacts
com.samsung.android.app.esimkeystring
com.samsung.android.app.reminder
com.samsung.android.app.routines
com.samsung.android.app.telephonyui
com.samsung.android.apps.wearable.recent
com.samsung.android.batterysavingsettings
com.samsung.android.bixby.agent
com.samsung.android.bixby.wakeup
com.samsung.android.calendar
com.samsung.android.cidmanager
com.samsung.android.clientconnection
com.samsung.android.dialer
com.samsung.android.dqagent
com.samsung.android.gallery.watch
com.samsung.android.honeyboard
com.samsung.android.incallui
com.samsung.android.location.locproxy
com.samsung.android.mcfds
com.samsung.android.mdecservice
com.samsung.android.mediacontroller
com.samsung.android.messaging
com.samsung.android.networkstack
com.samsung.android.providers.contacts
com.samsung.android.providers.factory
com.samsung.android.samsungnetworklocation
com.samsung.android.samsungpay.gear
com.samsung.android.scloud
com.samsung.android.sdk.handwriting.watch
com.samsung.android.service.health
com.samsung.android.shealthmonitor
com.samsung.android.smartgesture
com.samsung.android.stextclassifier
com.samsung.android.storage.watchstoragemanager
com.samsung.android.video.wearable
com.samsung.android.watch.alarm
com.samsung.android.watch.cameracontroller
com.samsung.android.watch.compass
com.samsung.android.watch.findmyphone
com.samsung.android.watch.findmywatch
com.samsung.android.watch.flashlight
com.samsung.android.watch.runestone.app
com.samsung.android.watch.safety_assistance
com.samsung.android.watch.screencapture
com.samsung.android.watch.stf
com.samsung.android.watch.stopwatch
com.samsung.android.watch.timer
com.samsung.android.watch.watchface.analogmodular
com.samsung.android.watch.watchface.analoguefont
com.samsung.android.watch.watchface.animal
com.samsung.android.watch.watchface.aremoji
com.samsung.android.watch.watchface.basicclock
com.samsung.android.watch.watchface.basicdashboard
com.samsung.android.watch.watchface.bespoke
com.samsung.android.watch.watchface.bitmoji
com.samsung.android.watch.watchface.companionhelper
com.samsung.android.watch.watchface.digitalfont
com.samsung.android.watch.watchface.digitalmodular
com.samsung.android.watch.watchface.dualwatch
com.samsung.android.watch.watchface.emergency
com.samsung.android.watch.watchface.endangeredanimal
com.samsung.android.watch.watchface.healthmodular
com.samsung.android.watch.watchface.large
com.samsung.android.watch.watchface.livewallpaper
com.samsung.android.watch.watchface.myphoto
com.samsung.android.watch.watchface.mystyle
com.samsung.android.watch.watchface.premiumanalog
com.samsung.android.watch.watchface.simpleanalogue
com.samsung.android.watch.watchface.simpleclassic
com.samsung.android.watch.watchface.simplecomplication
com.samsung.android.watch.watchface.superfiction
com.samsung.android.watch.watchface.tickingsound
com.samsung.android.watch.watchface.together
com.samsung.android.watch.watchface.typography
com.samsung.android.watch.watchface.weather
com.samsung.android.watch.weather
com.samsung.android.watch.worldclock
com.samsung.android.wcs.extension
com.samsung.android.wear.blockednumber
com.samsung.android.wear.calculator
com.samsung.android.wear.musictransfer
com.samsung.android.wear.shealth
com.samsung.android.wear.voicerecorder
com.samsung.android.wearable.music
com.samsung.android.wearable.samsungaccount
com.samsung.android.wearable.setupwizard
com.samsung.android.wearable.sysui
com.samsung.euicc
com.samsung.euicc.wmservice
com.samsung.packageinstalleroverlay
com.samsung.sec.android.application.csc
com.samsung.sree.classic
com.samsung.sree.countdown
com.samsung.sree.digital
com.samsung.sree.spin
com.samsung.wear.contacts.sync
com.sds.emm.cloud.knox.samsung
com.sec.android.RilServiceModeApp
com.sec.android.app.bluetoothtest
com.sec.android.app.factorykeystring
com.sec.android.app.factorymode
com.sec.android.app.hwmoduletest
com.sec.android.app.parser
com.sec.android.app.personalization
com.sec.android.app.servicemodeapp
com.sec.android.app.wlantest
com.sec.android.diagmonagent
com.sec.android.easyMover
com.sec.android.sdhms
com.sec.android.soagent
com.sec.app.RilErrorNotifier
com.sec.automation
com.sec.bcservice
com.sec.factory
com.sec.hiddenmenu
com.sec.imsservice
com.sec.location.nfwlocationprivacy
com.sec.modem.settings
com.sec.phone
com.sec.usbsettings
com.sem.factoryapp
com.skms.android.agent
com.wssyncmldm
de.szalkowski.activitylauncher
:/data/user/0 $

:/data/user/0 $ cd /sdcard
:/sdcard $ cp su2 /data/user/0
cp: /data/user/0/su2: Permission denied