Jump to content


Photo

[ROOT] Motoshare 2: Old Bug, New Exploit


  • Please log in to reply
985 replies to this topic

#101 crass0405

crass0405

    n00b

  • Members
  • Pip
  • 3 posts
  • Current Device(s):Droid Bionic

Posted 22 April 2013 - 05:05 PM

You have bigger issues.  I'm assuming you're 64 bit Ubuntu, as well?

 

 

Ok, I copied and pasted the error stuff from the other guy's thread.  My console is on another computer so I cant copy it here.  I'm going to try once more, and wait for the phone to reboot and post my (hopefully) success story.



#102 bigv5150

bigv5150

    Member

  • Members
  • PipPip
  • 150 posts
  • LocationDirty Jerzey
  • Current Device(s):Droid Maxx

Posted 22 April 2013 - 05:06 PM

ok I am almost there first I didnt have samba I found the command to update and then I got to the end but I have to be putting something on the wrong line so here goes:

I think this is where I am having a problem When I put this sudo gedit /etc/samba/smb.conf in the terminal another box opens with alot of stuff in it I go to the bottom and paste

 

# If you don't want to use auto-mounting/unmounting make sure the CD
#    is mounted on /cdrom
#
;   preexec = /bin/mount /cdrom
;   postexec = /bin/umount /cdrom
[share]
path = /tmp/share
available = yes
valid users = guest
read only = yes
browsable = yes
public = yes

then save I am putting it on the last line just like it is should it be put behind the last entry and not have it's own line.

 

 

then at this step do I put all for lines in at the same time or one at a time.

 

cd /tmp/share
wget http
://vulnfactory.org/public/motoshare2.tgz
tar xvf motoshare2.tgz
sudo chmod
755 run.sh

 

 

Same question with this do they both get put behind sudo shmod755 run.sh or do they get there own line also do they get seperated or put on the same line together.

 

cd /tmp/share/
sudo ./run.sh

 

My phone connects and in the remote storage Ihave several files all with ? except SU apk Im so close yet so far away can someone help.

 

Below is the last time attempted and it keeps ending like this error loading shared libraries.

 

 

 

ubuntu@ubuntu:~$ mkdir /tmp/share
mkdir: cannot create directory `/tmp/share': File exists
ubuntu@ubuntu:~$ sudo apt-get install samba
Reading package lists... Done
Building dependency tree       
Reading state information... Done
samba is already the newest version.
0 upgraded, 0 newly installed, 0 to remove and 178 not upgraded.
ubuntu@ubuntu:~$ sudo gedit /etc/samba/smb.conf
ubuntu@ubuntu:~$ sudo restart smbd
smbd start/running, process 10086
ubuntu@ubuntu:~$ cd /tmp/share
ubuntu@ubuntu:/tmp/share$ wget

Please Login or Register to see this Hidden Content


--2013-04-23 01:13:25-- 

Please Login or Register to see this Hidden Content


Resolving vulnfactory.org (vulnfactory.org)... 199.188.204.9
Connecting to vulnfactory.org (vulnfactory.org)|199.188.204.9|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3304852 (3.2M) [application/x-tar]
Saving to: `motoshare2.tgz.11'

100%[======================================>] 3,304,852   1.14M/s   in 2.8s    

2013-04-23 01:13:28 (1.14 MB/s) - `motoshare2.tgz.11' saved [3304852/3304852]

ubuntu@ubuntu:/tmp/share$ tar xvf motoshare2.tgz
adb.linux
adb.osx
busybox
pwn
run.sh
su
Superuser.apk
ubuntu@ubuntu:/tmp/share$ sudo chmod 755 run.sh
ubuntu@ubuntu:/tmp/share$ cd /tmp/share/
ubuntu@ubuntu:/tmp/share$ sudo ./run.sh
./adb.linux: error while loading shared libraries: libncurses.so.5: cannot open shared object file: No such file or directory
[+] Waiting for device...
./adb.linux: error while loading shared libraries: libncurses.so.5: cannot open shared object file: No such file or directory
[+] Device found.
[+] Pushing exploit...
./adb.linux: error while loading shared libraries: libncurses.so.5: cannot open shared object file: No such file or directory
./adb.linux: error while loading shared libraries: libncurses.so.5: cannot open shared object file: No such file or directory
./adb.linux: error while loading shared libraries: libncurses.so.5: cannot open shared object file: No such file or directory
./adb.linux: error while loading shared libraries: libncurses.so.5: cannot open shared object file: No such file or directory
./adb.linux: error while loading shared libraries: libncurses.so.5: cannot open shared object file: No such file or directory
[+] Rooting phone...
[+] Your phone may appear to reboot. Please ignore this and continue with the exploit.
./adb.linux: error while loading shared libraries: libncurses.so.5: cannot open shared object file: No such file or directory
[+] Please press any hardware button on your phone.
[+] Don't worry if the phone is unresponsive at this time.
[+] Press enter to continue once you have pressed a hardware button.
 



#103 SamuriHL

SamuriHL

    Android Warrior

  • Smod
  • 43,458 posts
  • Current Device(s):S21 Ultra, Pixel 6

Posted 22 April 2013 - 05:06 PM

So for the 64 bit people that have adb.linux missing errors, it's because adb is 32 bit.  If the command I gave fails for you, then your architecture is probably different than mine so you may have to do some research into figuring out how to run 32 bit stuff in your install.  Sorry, that's the best I can give you.  But until you fix that error, IT WILL NOT WORK no matter how many times you run it.


  • Int_Rnd_Pooka likes this

Non potest esse nisi unus


#104 xtr3m3dr01d

xtr3m3dr01d

    n00b

  • Members
  • Pip
  • 3 posts

Posted 22 April 2013 - 05:06 PM

Thanks for the help, Sam.  Here's what I get...

 

ubuntu@ubuntu:/tmp/share$ sudo apt-get install ia32-libs
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Package ia32-libs is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source
However the following packages replace it:
  lib32z1 lib32ncurses5 lib32bz2-1.0 lib32asound2

E: Package 'ia32-libs' has no installation candidate
ubuntu@ubuntu:/tmp/share$ sudo ./run.sh
./run.sh: line 30: ./adb.linux: No such file or directory
[+] Waiting for device...
./run.sh: line 33: ./adb.linux: No such file or directory
[+] Device found.
[+] Pushing exploit...
./run.sh: line 38: ./adb.linux: No such file or directory
./run.sh: line 39: ./adb.linux: No such file or directory
./run.sh: line 40: ./adb.linux: No such file or directory
./run.sh: line 42: ./adb.linux: No such file or directory
./run.sh: line 43: ./adb.linux: No such file or directory
[+] Rooting phone...
[+] Your phone may appear to reboot. Please ignore this and continue with the exploit.
./run.sh: line 49: ./adb.linux: No such file or directory
[+] Please press any hardware button on your phone.
[+] Don't worry if the phone is unresponsive at this time.
[+] Press enter to continue once you have pressed a hardware button.

[*] Cleaning up...
./run.sh: line 58: ./adb.linux: No such file or directory
./run.sh: line 59: ./adb.linux: No such file or directory
./run.sh: line 60: ./adb.linux: No such file or directory
[*] Exploit complete. Press enter to reboot and exit.
 

I am also running 64-bit Ubuntu. I got this to work by installing all the packages listed under packages that replace this, and also lib32stdc++6.

 

So type: sudo apt-get install lib32z1 lib32ncurses5 lib32bz2-1.0 lib32asound2 lib32stdc++6

 

Probably not the best way to do it, but it got the program running for me.

 

EDIT: Program just said I had root, went into root checker and didnt actually have root :(
 



#105 rhyrlix

rhyrlix

    n00b

  • Members
  • Pip
  • 2 posts

Posted 22 April 2013 - 05:10 PM

Also works on XT910, right?



#106 Badger1313

Badger1313

    Alive and kicking

  • Dedicated Supporter
  • PipPipPipPipPip
  • 8,730 posts
  • LocationSeattle
  • Current Device(s):S4 ME7, Razr M (wife), Nexus 7

Posted 22 April 2013 - 05:12 PM

Thank you Dan, you are a treasure. I pledged $10 but sent $15. Everyone in the Droid/Bionic community appreciates what you do for us. :)

Sent from my DROID BIONIC using Tapatalk 2
  • DroidOG75 likes this

#107 livinginkaos

livinginkaos

    I don't know what I'm doing anymore.....

  • Administrator
  • 15,282 posts
  • Google+:Hangouts - livinginkaos@gmail.com
  • LocationOregon
  • Current Device(s):Samsung S8+ / Pixel XL 128gb / iPhone 7+ 256gb / iPad Pro 12.9" / Samsung Chromrbook Plus / Pixel C / Nexus 6p 128gb / Nexus 6 / Nexus 6 on Fi / Nexus 9 / Moto 360^2 / Nvidia Shield TV Pro / Nvidia Shield Tablet / HTC EVODesign on FreedomPop / Chromecast / Surface Pro 3 i7 / Samsung Tab Pro 12.2 / Lenovo Win8 Tab / Eee Slate / '13 Nexus 7

Posted 22 April 2013 - 05:12 PM

Also works on XT910, right?


Yes

b2wvCBn.png

Sig by livinginkaos
Samsung S8+ / Pixel XL 128gb / iPhone 7+ 256gb / iPad Pro 12.9" / Samsung Chromrbook Plus / Pixel C / Nexus 6p 128gb / Nexus 6 / Nexus 6 on Fi / Nexus 9 / Moto 360^2 / Nvidia Shield TV Pro / Nvidia Shield Tablet / HTC EVODesign on FreedomPop / Chromecast / Surface Pro 3 i7 / Samsung Tab Pro 12.2 / Lenovo Win8 Tab / Eee Slate / '13 Nexus 7


#108 SamuriHL

SamuriHL

    Android Warrior

  • Smod
  • 43,458 posts
  • Current Device(s):S21 Ultra, Pixel 6

Posted 22 April 2013 - 05:14 PM

Also works on XT910, right?

 

It should.


Non potest esse nisi unus


#109 Eric214

Eric214

    Member

  • Members
  • PipPip
  • 108 posts
  • LocationMaryland
  • Current Device(s):Droid Bionic

Posted 22 April 2013 - 05:14 PM

Well i cant get this to work on my bionic at all been trying for 3 hours This is what i get

 

ubuntu@ubuntu:/tmp/share$ sudo ./run.sh
./run.sh: line 30: ./adb.linux: No such file or directory
[+] Waiting for device...
./run.sh: line 33: ./adb.linux: No such file or directory
[+] Device found.
[+] Pushing exploit...
./run.sh: line 38: ./adb.linux: No such file or directory
./run.sh: line 39: ./adb.linux: No such file or directory
./run.sh: line 40: ./adb.linux: No such file or directory
./run.sh: line 42: ./adb.linux: No such file or directory
./run.sh: line 43: ./adb.linux: No such file or directory
[+] Rooting phone...
[+] Your phone may appear to reboot. Please ignore this and continue with the exploit.
./run.sh: line 49: ./adb.linux: No such file or directory
[+] Please press any hardware button on your phone.
[+] Don't worry if the phone is unresponsive at this time.
[+] Press enter to continue once you have pressed a hardware button.

[*] Cleaning up...
./run.sh: line 58: ./adb.linux: No such file or directory
./run.sh: line 59: ./adb.linux: No such file or directory
./run.sh: line 60: ./adb.linux: No such file or directory
[*] Exploit complete. Press enter to reboot and exit.

./run.sh: line 65: ./adb.linux: No such file or directory
./run.sh: line 66: ./adb.linux: No such file or directory
 



#110 SamuriHL

SamuriHL

    Android Warrior

  • Smod
  • 43,458 posts
  • Current Device(s):S21 Ultra, Pixel 6

Posted 22 April 2013 - 05:15 PM

I am also running 64-bit Ubuntu. I got this to work by installing all the packages listed under packages that replace this, and also lib32stdc++6.

 

So type: sudo apt-get install lib32z1 lib32ncurses5 lib32bz2-1.0 lib32asound2 lib32stdc++6

 

Probably not the best way to do it, but it got the program running for me.

 

EDIT: Program just said I had root, went into root checker and didnt actually have root :(
 

 

What do these commands show:

 

sudo ./adb.linux shell ls -l /system/bin/su*

sudo ./adb.linux shell ls -l /system/xbin/su*


Non potest esse nisi unus


#111 SamuriHL

SamuriHL

    Android Warrior

  • Smod
  • 43,458 posts
  • Current Device(s):S21 Ultra, Pixel 6

Posted 22 April 2013 - 05:16 PM

Well i cant get this to work on my bionic at all been trying for 3 hours This is what i get

 

ubuntu@ubuntu:/tmp/share$ sudo ./run.sh
./run.sh: line 30: ./adb.linux: No such file or directory
[+] Waiting for device...
./run.sh: line 33: ./adb.linux: No such file or directory
[+] Device found.
[+] Pushing exploit...
./run.sh: line 38: ./adb.linux: No such file or directory
./run.sh: line 39: ./adb.linux: No such file or directory
./run.sh: line 40: ./adb.linux: No such file or directory
./run.sh: line 42: ./adb.linux: No such file or directory
./run.sh: line 43: ./adb.linux: No such file or directory
[+] Rooting phone...
[+] Your phone may appear to reboot. Please ignore this and continue with the exploit.
./run.sh: line 49: ./adb.linux: No such file or directory
[+] Please press any hardware button on your phone.
[+] Don't worry if the phone is unresponsive at this time.
[+] Press enter to continue once you have pressed a hardware button.

[*] Cleaning up...
./run.sh: line 58: ./adb.linux: No such file or directory
./run.sh: line 59: ./adb.linux: No such file or directory
./run.sh: line 60: ./adb.linux: No such file or directory
[*] Exploit complete. Press enter to reboot and exit.

./run.sh: line 65: ./adb.linux: No such file or directory
./run.sh: line 66: ./adb.linux: No such file or directory
 

 

64 bit issues again...see above for hints on what may or may not work for you.  Alternatively, you guys could grab a 32 bit Live CD and avoid this problem.


  • Int_Rnd_Pooka likes this

Non potest esse nisi unus


#112 crass0405

crass0405

    n00b

  • Members
  • Pip
  • 3 posts
  • Current Device(s):Droid Bionic

Posted 22 April 2013 - 05:17 PM

OK For anyone wondering.

 

[+] Your phone may appear to reboot. Please ignore this and continue with the exploit.

[+] Please press any hardware button on your phone.
[+] Don't worry if the phone is unresponsive at this time.
[+] Press enter to continue once you have pressed a hardware button.

 

 

When you get to this part, wait for your phone to reboot completely.  Then press a button (I used volume up) then it will reboot again. 

 

Then wait for another reboot.

[*] Exploit complete. Press enter to reboot and exit.

 

Once it is rebooted, press enter here and it will reboot one more time.  After that I had superuser, and rootcheck verified root access.


  • mrcavity, SamuriHL, DroidOG75 and 2 others like this

#113 Int_Rnd_Pooka

Int_Rnd_Pooka

    Member

  • Members
  • PipPip
  • 284 posts
  • Current Device(s):Bionic

Posted 22 April 2013 - 05:19 PM

alright so firstly forget all this samba and guest account nonsense. that got me nowhere. somewhere along the line of setting up samba i enabled root access (not sure this matters but including it to be thorough) which is trickier on 10.6 osx because useradd is a linux command and dscl echoed back domain admin errors so if you want to do this go to preferences, accounts, click the lock and log in, click log in options then network account server "join/add" then "open directory" click the lock again, now running "directory utility" access the edit menu which allows you to either enable or disable root user. Again, not sure if this was totally necessary but netinfo manager is gone in 10.6

 

ok real next step is making the smb shares on your mac available.

go to system preferences again but open up sharing instead of accounts

turn on file sharing and go to options. I disabled afp and ftp and only enabled SMB

instead of using /tmp/share or /public I just put motoshare2 in the root of my HD and shared it 

make sure that motoshare folder can be read and written to and that you can share on SMB using an account to which you have the password

 

go to the files app on your bionic. Make sure both mac and bionic are on the same wifi network.

add network storage, using the IP address from the sharing preference pane on your mac. Then use WORKGROUP, motoshare2 for shared folder, and log in using your (i used my default which is an administrative account) account which was enabled to access the shared files/folder.

once the bionic has logged into the network share just ensure debugging is enabled, plug in the bionic to the mac

then go to the terminal and cd to motoshare2

then sudo /motoshare2/run.sh and bob's your uncle

 

if you want to make sure you don't get typos i drag and drop a lot of stuff into the terminal window from the finder when I can. (for instance just typing sudo and a space then dragging in run.sh and hitting enter.

I want to reiterate the clean up process did not work i think the adb server needed to be restarted or something. maybe look at the script to see where that fell down. Clean up was not necessary for me as superuser was present upon reinstall and voodoo indicated the device was rooted.

 

Since SMB *is* Samba/CIFS sharing, you don't need to install Samba. ServerMessageBlock is the protocol used by both CIFS and Samba, if I'm remembering it properly

 

Windows users need to use a bootable linux USB stick or run ubuntu in a virtual machine. I PROMISE you, this is not a new exploit. This is a beaten dead horse. If Dan says it'll never happen....trust him...it's not happening.

 

I appreciate your vote of confidence, but I've seen far too many "never gonna happens" become commonplace occurrences to not at least TRY. (See: unlocked bootloaders on the recent Moto phones. See: kexec kernel substitution in a running Android OS. See: pretty much running any custom ROM on Moto phones to begin with. See: Safestrap. See: a whole lot of stuff, but I'm sure you get the idea)

 

So for the 64 bit people that have adb.linux missing errors, it's because adb is 32 bit.  If the command I gave fails for you, then your architecture is probably different than mine so you may have to do some research into figuring out how to run 32 bit stuff in your install.  Sorry, that's the best I can give you.  But until you fix that error, IT WILL NOT WORK no matter how many times you run it.

 

Good to know. I'm running 64 bit gentoo and 64 bit Win7, but on the upside I already have a 32 bit emul-linux going on in gentoo. If I can't get this working with some sort of cygwin-esque linux dll for Windows or something along those lines, I know I can at least root in gentoo.

 

Now, the big step is to go ahead and take the OTA or FXZ and be without root. A bit of research and legwork to be done before I get to that step, though.



#114 xtr3m3dr01d

xtr3m3dr01d

    n00b

  • Members
  • Pip
  • 3 posts

Posted 22 April 2013 - 05:20 PM

What do these commands show:

 

sudo ./adb.linux shell ls -l /system/bin/su*

sudo ./adb.linux shell ls -l /system/xbin/su*

ubuntu@ubuntu:/tmp/share$ sudo ./adb.linux shell ls -l /system/bin/su*
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
-rwxr-xr-x root     shell       22364 2012-05-24 09:07 su
-rwxr-xr-x root     shell        5352 2013-04-20 06:21 surfaceflinger
ubuntu@ubuntu:/tmp/share$ sudo ./adb.linux shell ls -l /system/xbin/su*
lrwxrwxrwx root     root              2012-12-01 23:04 su -> /system/bin/su
-rwxr-xr-x root     shell     1867568 2012-05-24 09:07 sulogin
-rwxr-xr-x root     shell     1867568 2012-05-24 09:07 sum



#115 ReservedName

ReservedName

    Member

  • Members
  • PipPip
  • 130 posts

Posted 22 April 2013 - 05:23 PM

hey now that i'm rooted again i'm gonna try out this thing called "bionic bootstrap" what do you think samuri?

 

 

 

 

 

 

 

 

 

 

 

JUST KIDDING :D


  • Ashgarden likes this

#116 tucstwo

tucstwo

    www.drdevs.com

  • Administrator
  • 14,435 posts
  • Twitter:tucstwo
  • Google+:tucstwo@gmail.com
  • LocationNJ
  • Current Device(s):LG G3 VS985, Nexus 7 (flo)

Posted 22 April 2013 - 05:24 PM

Since SMB *is* Samba/CIFS sharing, you don't need to install Samba. ServerMessageBlock is the protocol used by both CIFS and Samba, if I'm remembering it properly

 

 

I appreciate your vote of confidence, but I've seen far too many "never gonna happens" become commonplace occurrences to not at least TRY. (See: unlocked bootloaders on the recent Moto phones. See: kexec kernel substitution in a running Android OS. See: pretty much running any custom ROM on Moto phones to begin with. See: Safestrap. See: a whole lot of stuff, but I'm sure you get the idea)

 

 

Good to know. I'm running 64 bit gentoo and 64 bit Win7, but on the upside I already have a 32 bit emul-linux going on in gentoo. If I can't get this working with some sort of cygwin-esque linux dll for Windows or something along those lines, I know I can at least root in gentoo.

 

Now, the big step is to go ahead and take the OTA or FXZ and be without root. A bit of research and legwork to be done before I get to that step, though.

I'm just saying, it's been tried and tested ad naseum. If you are on par with Hascode, Dhacker and Dan Rosenberg pertaining to development skills then I apologize, by all means...have at it. I'm just saying. No one thus far has been this lucky. Dan said in the op HIMSELF to give up on windows as it's not going to work. But I will not discourage you from trying. Be our guest.  ;)


Visit DRDevs.com hosting site for all official Droidrzr.com ROMs, Apps, GApps and other mods/files!!
Please PM me if you need help!
I will be hosting AOSP-Based ROM GApps packages!
Download the most Up-to-Date GApps Packages for AOSP ROMs from me here!


#117 SamuriHL

SamuriHL

    Android Warrior

  • Smod
  • 43,458 posts
  • Current Device(s):S21 Ultra, Pixel 6

Posted 22 April 2013 - 05:24 PM

ubuntu@ubuntu:/tmp/share$ sudo ./adb.linux shell ls -l /system/bin/su*
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
-rwxr-xr-x root     shell       22364 2012-05-24 09:07 su
-rwxr-xr-x root     shell        5352 2013-04-20 06:21 surfaceflinger
ubuntu@ubuntu:/tmp/share$ sudo ./adb.linux shell ls -l /system/xbin/su*
lrwxrwxrwx root     root              2012-12-01 23:04 su -> /system/bin/su
-rwxr-xr-x root     shell     1867568 2012-05-24 09:07 sulogin
-rwxr-xr-x root     shell     1867568 2012-05-24 09:07 sum

 

Argh.  You have and old su binary from before you lost root on there I see.  I'd ALMOST recommend flashing system.img from the 98.72.22 FXZ before trying again.  JUST the system.img though.  I don't if that's causing a problem but I'd at least try.


Non potest esse nisi unus


#118 SamuriHL

SamuriHL

    Android Warrior

  • Smod
  • 43,458 posts
  • Current Device(s):S21 Ultra, Pixel 6

Posted 22 April 2013 - 05:25 PM

hey now that i'm rooted again i'm gonna try out this thing called "bionic bootstrap" what do you think samuri?

 

 

 

 

 

 

 

 

 

 

 

JUST KIDDING :D

 

My middle finger is giving you a standing ovation for that brilliance.  :p


  • ReservedName, jayrod and soocold like this

Non potest esse nisi unus


#119 SamuriHL

SamuriHL

    Android Warrior

  • Smod
  • 43,458 posts
  • Current Device(s):S21 Ultra, Pixel 6

Posted 22 April 2013 - 05:26 PM

I'm just saying, it's been tried and tested ad naseum. If you are on par with Hascode, Dhacker and Dan Rosenberg pertaining to development skills then I apologize, by all means...have at it. I'm just saying. No one thus far has been this lucky. Dan said in the op HIMSELF to give up on windows as it's not going to work. But I will not discourage you from trying. Be our guest.  ;)

 

It's all a matter of whether you can achieve linux permissions in windows samba.  If yes, great.  If not, and it's based on windows permissions, then it ain't gonna work.  If someone wants to try, let em.  :)


Non potest esse nisi unus


#120 rlewis312010

rlewis312010

    Member

  • Members
  • PipPip
  • 111 posts

Posted 22 April 2013 - 05:27 PM

32 bit Ubuntu, I get here and it freezes.  I plugged device in, appears to find (VM) and then this on final commands:

thetruth@ubuntu:/tmp/share$ sudo chmod 755 run.sh
thetruth@ubuntu:/tmp/share$ cd /tmp/share/
thetruth@ubuntu:/tmp/share$ sudo ./run.sh
[+] Waiting for device...
* daemon not running. starting it now on port 5037 *
* daemon started successfully *
 

--Nothing happens, it freezes here.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users