Adding --mount-external-android-writable

[oddbyte]

Hello
I have been looking in the source code of AOSP Zygote, and have noticed the flag --mount-external-android-writable

I believe that if you set this flag when spawning the shell, you can get access to /sdcard/*

I will test later today and get back with results

[oddbyte]

This is the code I am referencing:

Source: https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/os/ZygoteProcess.java

[oddbyte]

I can now confirm that it works:

[oddbyte]

I suggest you add this flag to your PoC for others

[oddbyte]

testing --mount-external-installer to see if it has more access, as --mount-external-android-writable cannot rw to /sdcard/Android/obb or /sdcard/Android/data/

[oddbyte]

I have managed to escalate my permissions by running as a platform_app (com.google.android.gms), and setting --setgroups=1000 to maintain system access:

[forch363652]

I have managed to escalate my permissions by running as a platform_app (com.google.android.gms), and setting --setgroups=1000 to maintain system access:

hey bro! Your great work has captivated me, but I can't seem to reproduce it.

[forch363652]