Nytro Posted June 14, 2014 Report Posted June 14, 2014 [TABLE=width: 100%][TR][TD]Android Cheatsheet (updates to dweinst@insitusec.com) : Vuln/Exploit List (privesc)[/TD][/TR] [/TABLE] [TABLE=class: tblGenFixed][TR=class: rShim][TD][/TD][TD][/TD][TD][/TD][TD][/TD][TD][/TD][TD][/TD][TD][/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s0]Vulnerability/Exploit name[/TD][TD=class: s1]release date[/TD][TD=class: s1]author[/TD][TD=class: s1]effect (root, unlock,...)[/TD][TD=class: s1]notes[/TD][TD=class: s1]link[/TD][TD=class: s2][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]psneuter[/TD][TD][/TD][TD=class: s4]scotty2[/TD][TD=class: s4]root[/TD][TD][/TD][TD=class: s4]https://github.com/tmzt/g2root-kmod/blob/master/scotty2/psneuter/psneuter.c[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Exploid[/TD][TD=class: s5]7/15/2010[/TD][TD=class: s4]Stealth[/TD][TD=class: s4]root[/TD][TD][/TD][TD=class: s4]C-skills: android trickery[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]GingerBreak[/TD][TD=class: s5]5/26/2011[/TD][TD=class: s4]Stealth[/TD][TD=class: s4]root[/TD][TD][/TD][TD=class: s4]C-skills: yummy yummy, GingerBreak![/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]RageAgainstTheCage[/TD][TD][/TD][TD=class: s4]Stealth[/TD][TD=class: s4]root[/TD][TD][/TD][TD][/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]KillingInTheNameOf[/TD][TD][/TD][TD=class: s4]Stealth[/TD][TD=class: s4]root[/TD][TD][/TD][TD=class: s4]C-skills: adb trickery #2[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Zimperlich[/TD][TD=class: s5]2/24/2011[/TD][TD=class: s4]Stealth[/TD][TD][/TD][TD][/TD][TD=class: s4]C-skills: Zimperlich sources[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Zergrush[/TD][TD][/TD][TD=class: s4]Revolutionary[/TD][TD=class: s4]root[/TD][TD][/TD][TD=class: s4]https://github.com/revolutionary/zergRush/blob/master/zergRush.c[/TD][TD=class: s4]Revolutionary - zergRush local root 2.2/2.3 [22-10: Samsung/SE update] - xda-developers[/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Tacoroot[/TD][TD][/TD][TD=class: s4]jcase[/TD][TD=class: s4]root[/TD][TD=class: s4]HTC Recovery symlink attack to local.prop from /data/recovery/something bliss found first, but was too slow![/TD][TD=class: s4]https://github.com/CunningLogic/TacoRoot[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Nachoroot[/TD][TD][/TD][TD=class: s4]jcase[/TD][TD=class: s4]root[/TD][TD=class: s4]AMI304 Magnetic Sensor, symlink to local.prop. [/TD][TD=class: s4]https://github.com/CunningLogic/NachoRoot[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Burritoroot[/TD][TD][/TD][TD=class: s4]jcase[/TD][TD=class: s4]root[/TD][TD=class: s4]Typo prevented app from sending a debugging intent, caused adb to run as root[/TD][TD=class: s4]https://github.com/CunningLogic/BurritoRoot[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Gorditaroot[/TD][TD][/TD][TD=class: s4]jcase[/TD][TD=class: s4]install custom recovery or root[/TD][TD=class: s4]Similar to Nachoroot, different path, AMI304 Magnetic Sensor, symlink to recovery mtd device[/TD][TD=class: s4]https://github.com/CunningLogic/GorditaRoot[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Enchilada[/TD][TD][/TD][TD=class: s4]jcase[/TD][TD=class: s4]root[/TD][TD=class: s4]System left r/w & Internal memory left as ext4? I think. Symlink attack from DCIM dir to install-recovery.sh[/TD][TD=class: s4]https://github.com/CunningLogic/Enchilada[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]ZTERoot (Avail)[/TD][TD][/TD][TD=class: s4]jcase[/TD][TD=class: s4]root[/TD][TD=class: s4]~70 rediculous intents left over from engineering. Stupid OEM.[/TD][TD=class: s4]https://github.com/CunningLogic/ZTERoot[/TD][TD=class: s4][Exclusive] Developer Codes Left In Retail ZTE Avail (AT&T) Offer Quick And Easy Root Access[/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]ZTERoot (Merrit)[/TD][TD][/TD][TD=class: s4]jcase[/TD][TD=class: s4]root[/TD][TD=class: s4]Symlink attack from debugging/logging app[/TD][TD=class: s4][ROOT] ZTE z990g Merit (An avail variant?) - xda-developers[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]LG ICS Root[/TD][TD][/TD][TD=class: s4]jcase[/TD][TD=class: s4]root[/TD][TD=class: s4]Symlink attack[/TD][TD=class: s4][ROOT] LG Intuition & LG Spectrum ICS - xda-developers[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]DefyXT Root[/TD][TD][/TD][TD=class: s4]jcase[/TD][TD=class: s4]root[/TD][TD=class: s6]Unprotected intent allowing various permission changes.[/TD][TD=class: s4][Root] Republic Wireless Motorola Defy XT - xda-developers[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Cyanide[/TD][TD][/TD][TD=class: s4]jcase[/TD][TD=class: s4]root[/TD][TD=class: s4]DeftXT Root Loggerlancher changing permissions, system mounted r/w[/TD][TD=class: s4]https://github.com/CunningLogic/Cyanide[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]LG Optimus Logic[/TD][TD][/TD][TD=class: s4]jcase[/TD][TD=class: s4]root[/TD][TD][/TD][TD][/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]LG Optmus Elite[/TD][TD][/TD][TD=class: s4]jcase[/TD][TD=class: s4]root[/TD][TD=class: s4]LG not verifying integrity of system partition when flashing through download mode. TOT images are patchable. Probably valid on all LG devices.[/TD][TD=class: s4][Exclusive] How To Root The Virgin Mobile LG Optimus Elite[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Pantech[/TD][TD][/TD][TD=class: s4]jcase[/TD][TD=class: s4]root[/TD][TD=class: s4]Pantach does not verify integerty of system partition when flashing through download mode. PDL images are patchable.[/TD][TD=class: s4]unpublished[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]HTC DNA[/TD][TD][/TD][TD=class: s4]jcase[/TD][TD=class: s4]enable unlocking[/TD][TD=class: s4]Backupmanger sets /data 777, then symlink to mmbblk0p5 to change CID. Not root, but enables bootloader unlock[/TD][TD=class: s4][unlock] Bootloader unlock - Updated November 26th 2012 - xda-developers[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]HTC One X AT&T[/TD][TD][/TD][TD=class: s4]jcase[/TD][TD=class: s4]root[/TD][TD=class: s4]HTC Ready2go webapp triggering chmod 777 on file in world writable dir. Lasted whole 4 hours.[/TD][TD=class: s4][Exclusive] How To Root The AT&T HTC One X On Version 1.85 (Or Earlier)[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Hisense Pulse[/TD][TD][/TD][TD=class: s4]cj_000[/TD][TD=class: s4]root[/TD][TD=class: s4]ro.debuggable=1 on initial firmware[/TD][TD][/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Generic LG[/TD][TD][/TD][TD=class: s7]?[/TD][TD=class: s4]root[/TD][TD=class: s4]ro.debuggable=1 on some older LGs[/TD][TD=class: s4]unpublished[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]LG ADB Backdoor[/TD][TD][/TD][TD=class: s4]Giantpune[/TD][TD=class: s4]root[/TD][TD=class: s4]Backdoor, restarts adb as root with key[/TD][TD][/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Poot[/TD][TD][/TD][TD=class: s4]Giantpune[/TD][TD=class: s4]root[/TD][TD=class: s4]Qualcomm diag device[/TD][TD][/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Lit[/TD][TD][/TD][TD=class: s4]Giantpune[/TD][TD=class: s4]root[/TD][TD=class: s4]LG Backlight[/TD][TD][/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]ZTE Backdoor[/TD][TD][/TD][TD=class: s4]"Anonymous"[/TD][TD=class: s4]root[/TD][TD=class: s4]binary spawned root shell, password protected.[/TD][TD][/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]HTC Eris 2.1 Root[/TD][TD][/TD][TD=class: s4]wag3slav3[/TD][TD=class: s4]install custom recovery[/TD][TD=class: s4]symlink attack from /data/local/something to recovery block device[/TD][TD=class: s4]? XDA Forums[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Droid 3 Root[/TD][TD=class: s5]8/25/2011[/TD][TD=class: s4]bliss[/TD][TD=class: s4]root[/TD][TD=class: s4]symlink attack from /data/local/something to local.prop[/TD][TD=class: s4]Security Research by Dan Rosenberg[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Motofail[/TD][TD=class: s5]2/11/2012[/TD][TD=class: s4]bliss[/TD][TD=class: s4]root[/TD][TD=class: s4]symlink attack on /data/dontpanic and /data/logger[/TD][TD=class: s4]http://vulnfactory.org/public/motofail_windows.zip[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]XYZ[/TD][TD=class: s5]2/17/2012[/TD][TD=class: s4]bliss[/TD][TD=class: s4]root[/TD][TD=class: s4]symlink attack on /pds/public/battd, /data/dontpanic, and /data/logger[/TD][TD=class: s4]http://vulnfactory.org/public/xyz_windows.zip[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]LG Spectrum Root[/TD][TD=class: s5]2/19/2012[/TD][TD=class: s4]bliss[/TD][TD=class: s4]root[/TD][TD=class: s4]symlink attack on /data/gpscfg/gps_env.conf[/TD][TD=class: s4]http://vulnfactory.org/public/spectrum_root_windows.zip[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Megatron[/TD][TD=class: s5]2/26/2012[/TD][TD=class: s4]bliss[/TD][TD=class: s4]root[/TD][TD=class: s4]symlink attack on com.ti.fmrxapp[/TD][TD=class: s4]Security Research by Dan Rosenberg[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]LG Esteem Root[/TD][TD=class: s5]2/15/2012[/TD][TD=class: s4]bliss[/TD][TD=class: s4]root[/TD][TD=class: s4]symlink attack on /data/bootlogo/bootlogopid[/TD][TD=class: s4]http://vulnfactory.org/public/LG_Esteem_Root_v2_Windows.zip[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Razr's Edge[/TD][TD=class: s5]6/21/2012[/TD][TD=class: s4]bliss[/TD][TD=class: s4]root[/TD][TD=class: s4]symlink attack on /data/local/12m[/TD][TD=class: s4]http://vulnfactory.org/public/razrs_edge_windows.zip[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Razr Blade[/TD][TD=class: s5]1/15/2013[/TD][TD=class: s4]bliss[/TD][TD=class: s4]root[/TD][TD=class: s4]symlink attack on /data/dontpanic, overwriting SmartActions .jar file to run code as system[/TD][TD=class: s6]http://vulnfactory.org/public/razr_blade.zip[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]X-Factor[/TD][TD=class: s5]10/23/2012[/TD][TD=class: s4]bliss[/TD][TD=class: s4]change CID[/TD][TD=class: s4]symlink attack on telephony ADB restore to change permissions on /dev/diag, followed by kernel exploit (same as Poot)[/TD][TD=class: s4][ROOT] HTC One X AT&T 2.20 Firmware - X-Factor root exploit - xda-developers[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Samsung Admire Root[/TD][TD=class: s5]9/12/2011[/TD][TD=class: s4]bliss[/TD][TD=class: s4]root[/TD][TD=class: s4]symlink attack on /data/log/dumpState_app_native.log[/TD][TD=class: s4]Security Research by Dan Rosenberg[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Thinkpad Tablet[/TD][TD=class: s5]1/22/2012[/TD][TD=class: s4]bliss[/TD][TD=class: s4]root[/TD][TD=class: s4]symlink attack on Lenovo Mobility Manager[/TD][TD=class: s4]http://vulnfactory.org/public/Thinkpad_Root_Windows.zip[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Sony Tablet S[/TD][TD=class: s5]2/8/2012[/TD][TD=class: s4]bliss[/TD][TD=class: s4]root[/TD][TD=class: s4]symlink attack on /log to change package.list, followed by symlink attack on "pm" (replace "lib" directory of system app to remove arbitrary files)[/TD][TD=class: s4]Security Research by Dan Rosenberg[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Xoomfail[/TD][TD=class: s5]2/18/2012[/TD][TD=class: s4]bliss[/TD][TD=class: s4]root[/TD][TD=class: s4]cmdclient changed perms on /data to 0777 by design[/TD][TD=class: s4]Security Research by Dan Rosenberg[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Motofail2Go[/TD][TD=class: s5]10/16/2012[/TD][TD=class: s4]bliss[/TD][TD=class: s4]root[/TD][TD=class: s4]symlink attack on data directory for bug2go[/TD][TD=class: s4]http://vulnfactory.org/public/motofail2go_windows.zip[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]XPRT[/TD][TD=class: s5]10/8/2012[/TD][TD=class: s4]bliss[/TD][TD=class: s4]root[/TD][TD=class: s4]symlink attack on /data/dontpanic[/TD][TD=class: s4]http://vulnfactory.org/public/xprt_root_windows.zip[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Nandpwn[/TD][TD=class: s5]8/4/2012[/TD][TD=class: s4]bliss[/TD][TD=class: s4]root[/TD][TD=class: s4]Ridiculousness on Logitech Revue[/TD][TD=class: s4]https://github.com/djrbliss/revue/tree/master/nandpwn[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Motochopper[/TD][TD=class: s8]4/9/2013[/TD][TD=class: s4]bliss[/TD][TD=class: s4]root[/TD][TD][/TD][TD=class: s4]http://vulnfactory.org/public/motochopper.zip[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]ADB Restore Root[/TD][TD][/TD][TD=class: s4]bin4ry[/TD][TD=class: s4]root[/TD][TD][/TD][TD][/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Exynos-abuse[/TD][TD][/TD][TD=class: s4]alephzain[/TD][TD=class: s4]root[/TD][TD=class: s4]Access to system memory through /dev/exynos-mem on Exynos devices[/TD][TD=class: s4][ROOT][sECURITY] Root exploit on Exynos - xda-developers[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]IconiaRoot[/TD][TD][/TD][TD=class: s4]alephzain[/TD][TD=class: s4]root[/TD][TD][/TD][TD=class: s4][ROOT][sECURITY] Root exploit on Exynos - xda-developers[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]fr3vo[/TD][TD][/TD][TD=class: s4]Kevin Bruckert[/TD][TD=class: s4]root[/TD][TD=class: s4]Arbitrary kernel write in Qualcomm's MSM rotator[/TD][TD][/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]levitator[/TD][TD][/TD][TD=class: s4]Jon Larimer, Jon Oberheide[/TD][TD=class: s4]root[/TD][TD=class: s4]Out-of-bounds memory mapping in pvrsrvkm[/TD][TD=class: s4]http://jon.oberheide.org/files/levitator.c[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]mempodroid[/TD][TD][/TD][TD=class: s4]saurik/zx2c4[/TD][TD=class: s4]root[/TD][TD=class: s4]Bad kernel jazz with /proc/pid/mem and suid binaries[/TD][TD][/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]asroot (Wunderbar?)[/TD][TD][/TD][TD=class: s4]zinx[/TD][TD=class: s4]root[/TD][TD][/TD][TD=class: s4]http://code.google.com/p/flashrec/source/browse/#svn%2Ftrunk%2Fandroid-root[/TD][TD][/TD][/TR][TR][TD=class: hd].[/TD][TD=class: s3]Samsung Infuse 4G[/TD][TD=class: s5]1/3/2012[/TD][TD=class: s4]Michael Coppola[/TD][TD=class: s4]root[/TD][TD=class: s4]symlink attack on /data/data/.drm/.wmdrm/sample.hds[/TD][TD=class: s4]Rooting the Samsung Infuse 4G | Michael Coppola's Blog[/TD][TD][/TD][/TR][/TABLE] Publicat de Google Drive – Raporta?i un abuz – Se actualizeaz? automat la fiecare 5 minute Quote
