Loading video...

Video Failed to Load

There was a problem loading this video. This could be due to a temporary network issue or the video might be unavailable.

Android Universal Root Rooting Pixel 6 and 7 Pro running Android 13 👇 Analysis and Exploitation of CVE-2023-20938 (exploit a use-after-free vulnerability to elevate privileges to root and disable SELinux) [blog] [slides]

Mobile Hacker

61,300 subscribers

21,774 views • 2 years ago •via X (Twitter)

Anya Rossi• Live Now

Private livecam show

5 Comments

Kristijan2 years ago

Patched in Android 14?

Mobile Hacker2 years ago

patched for any Android OS version that received February 2023 security patch, not just 14

DismaltheDeveloper2 years ago

Even Verizon devices?

Jorge Pezo2 years ago

Is it possible to do the test on a real mobile phone?

Mobile Hacker2 years ago

If you have exploit, then yes. However, exploit is not published, because of that I don't think so

Related Videos

Demo of using #BlueDucky to exploit 0-click Bluetooth vulnerability of targeted Android smartphone (CVE-2023-45866) Executed by Raspberry Pi 4 and Android running #NetHunter

Demo of using #BlueDucky to exploit 0-click Bluetooth vulnerability of targeted Android smartphone (CVE-2023-45866) Executed by Raspberry Pi 4 and Android running #NetHunter

Mobile Hacker

129,830 views • 2 years ago

PoC to takeover Android using another Android by exploiting critical Bluetooth vulnerability to install #Metasploit payload without proper Bluetooth pairing (CVE-2023-45866) It still affects Android 10 and bellow #NetHunter

PoC to takeover Android using another Android by exploiting critical Bluetooth vulnerability to install #Metasploit payload without proper Bluetooth pairing (CVE-2023-45866) It still affects Android 10 and bellow #NetHunter

Mobile Hacker

109,355 views • 2 years ago

Use ADB & fastboot in #Termux without root 1. Install Termux and Termux:API apps from F-Droid 2. Install wget: pkg install wget 3. Run termux-adb installation script Now you can use non-rooted Android to unlock bootloader on another Android and even root it. Besides that, you can also run ADB commands to interact with another device. Here is a complete list of all ADB commands - termux-adb:

Use ADB & fastboot in #Termux without root 1. Install Termux and Termux:API apps from F-Droid 2. Install wget: pkg install wget 3. Run termux-adb installation script Now you can use non-rooted Android to unlock bootloader on another Android and even root it. Besides that, you can also run ADB commands to interact with another device. Here is a complete list of all ADB commands - termux-adb:

Mobile Hacker

141,314 views • 3 years ago

PoC for a critical vulnerability in Apple macOS Screen Sharing (CVE-2026-65400). If Screen Sharing is enabled, any network attacker can exploit the bug to log in as any account, without knowing the password. We reverse engineered Apple’s unusual macOS 26.6.1 patch to understand the root cause and exploitation path. Please upgrade your macOS boxes to 26.6.1. Full technical writeup drops tomorrow.

PoC for a critical vulnerability in Apple macOS Screen Sharing (CVE-2026-65400). If Screen Sharing is enabled, any network attacker can exploit the bug to log in as any account, without knowing the password. We reverse engineered Apple’s unusual macOS 26.6.1 patch to understand the root cause and exploitation path. Please upgrade your macOS boxes to 26.6.1. Full technical writeup drops tomorrow.

Calif

456,893 views • 2 months ago

New Pixnapping Attack: allows any Android app without permissions to leak info displayed by other apps exploiting Android APIs and a hardware side channel (CVE-2025-48561) Pixnapping is not fixed and probably affects all Androids. PoC: Not available yet. Steal 2FA codes 👇

New Pixnapping Attack: allows any Android app without permissions to leak info displayed by other apps exploiting Android APIs and a hardware side channel (CVE-2025-48561) Pixnapping is not fixed and probably affects all Androids. PoC: Not available yet. Steal 2FA codes 👇

Mobile Hacker

55,278 views • 1 year ago

GM says it’s removing the Apple CarPlay and Android Auto features in favor of its own proprietary software. Does anybody else feel this is a precursor to charge a subscription fee to use CarPlay and Android Auto?

GM says it’s removing the Apple CarPlay and Android Auto features in favor of its own proprietary software. Does anybody else feel this is a precursor to charge a subscription fee to use CarPlay and Android Auto?

SonnyBoy🇺🇸

1,070,717 views • 9 months ago

We’re cooked, guys. A new vulnerability has been discovered in sudo and you don’t even need to be in the sudo group to get root. I just tried it 👇

We’re cooked, guys. A new vulnerability has been discovered in sudo and you don’t even need to be in the sudo group to get root. I just tried it 👇

Elorm Daniel

316,138 views • 4 months ago

BootROM → root → lock-screen PIN. We enter BROM mode, load a patched preloader, gain root, extract the lock credential, recover the 6-digit PIN offline, and use it to unlock the phone. Full PoC ↓

BootROM → root → lock-screen PIN. We enter BROM mode, load a patched preloader, gain root, extract the lock credential, recover the 6-digit PIN offline, and use it to unlock the phone. Full PoC ↓

CertiK

29,161 views • 2 months ago

🚨 PROMPT TO MOBILE APP INSTANTLY - COLLECT PAYMENTS Use top models like Claude Opus 4.8. GPT 5.5 and Gemini 3.5 to create iOS and Android apps DEPLOY WITH ONE CLICK START A BUSINESS -> PROMPT TO iOS AND Android APP - backend included - agent swarm can create web, iOS and Android apps - collect payments instantly and set up a business All from one prompt instantly FREE APP HOSTING with ChatLLM subscription

🚨 PROMPT TO MOBILE APP INSTANTLY - COLLECT PAYMENTS Use top models like Claude Opus 4.8. GPT 5.5 and Gemini 3.5 to create iOS and Android apps DEPLOY WITH ONE CLICK START A BUSINESS -> PROMPT TO iOS AND Android APP - backend included - agent swarm can create web, iOS and Android apps - collect payments instantly and set up a business All from one prompt instantly FREE APP HOSTING with ChatLLM subscription

Abacus.AI

4,656,240 views • 4 months ago

Our Reader App is now available worldwide on iOS and Android. Listen to any book, article, PDF or text on the go in hundreds of high quality AI voices. Now in 32 languages. It’s completely free to download and use. Find it on iOS and Android here:

Our Reader App is now available worldwide on iOS and Android. Listen to any book, article, PDF or text on the go in hundreds of high quality AI voices. Now in 32 languages. It’s completely free to download and use. Find it on iOS and Android here:

ElevenLabs

588,479 views • 2 years ago

Microwave sickness: The root cause of the pandemic. Book: The Zapping of America a deep one raytheon microwaves and cell signals. Both are the same frequency. Tutorial on how to disable all of it:

Microwave sickness: The root cause of the pandemic. Book: The Zapping of America a deep one raytheon microwaves and cell signals. Both are the same frequency. Tutorial on how to disable all of it:

Matt From Cultivate Elevate

14,571 views • 6 months ago

Call of Duty: Warzone Mobile seems to be running fine on latest iPhone and iPad devices, but there’s a lot of graphical issues and lag issues if you’re on Android or older phones. Here’s how it looks on recent Android phones. Vid: U/ani177013

Call of Duty: Warzone Mobile seems to be running fine on latest iPhone and iPad devices, but there’s a lot of graphical issues and lag issues if you’re on Android or older phones. Here’s how it looks on recent Android phones. Vid: U/ani177013

CharlieIntel

445,255 views • 2 years ago

someone built an AI RED TEAM that maps your entire attack surface as a knowledge graph, finds every vulnerability, then EXPLOITS them to root access AUTONOMOUSLY its called RedAmon, 9,000 templates. 17 node types, actual Metasploit shells, not reports, no pentesters needed 6 phases of autonomous recon: subdomain discovery, port scanning, http probing, resource enumeration, vulnerability scanning, MITRE mapping every finding stored in a Neo4j graph with 17 node types and 20+ relationship types. the AI reasons about the graph, finds attack paths, and runs actual Metasploit exploits, actual shells stress-tested with zero vulnerability data, zero exploit modules, one instruction find a CVE and exploit it, it went from empty database to root-level RCE in 20 steps, researched the exploit on the web, crafted a custom deserialization payload, debugged itself when the first attempt failed next try, the server responded with root access, the highest privilege level on any Linux system. full control over everything the target was running node-serialize 0.0.4, a package with a critical deserialization flaw (CVE-2017-5941, CVSS 9.8), the server takes your cookie, decodes it, and passes it straight into unserialize() which executes any code inside it, the AI figured this out on its own with no hints built on LangGraph + MCP tool servers for naabu, nuclei, curl, metasploit. hunts leaked secrets across GitHub repos, 40+ regex patterns for AWS keys, Stripe tokens, database creds

someone built an AI RED TEAM that maps your entire attack surface as a knowledge graph, finds every vulnerability, then EXPLOITS them to root access AUTONOMOUSLY its called RedAmon, 9,000 templates. 17 node types, actual Metasploit shells, not reports, no pentesters needed 6 phases of autonomous recon: subdomain discovery, port scanning, http probing, resource enumeration, vulnerability scanning, MITRE mapping every finding stored in a Neo4j graph with 17 node types and 20+ relationship types. the AI reasons about the graph, finds attack paths, and runs actual Metasploit exploits, actual shells stress-tested with zero vulnerability data, zero exploit modules, one instruction find a CVE and exploit it, it went from empty database to root-level RCE in 20 steps, researched the exploit on the web, crafted a custom deserialization payload, debugged itself when the first attempt failed next try, the server responded with root access, the highest privilege level on any Linux system. full control over everything the target was running node-serialize 0.0.4, a package with a critical deserialization flaw (CVE-2017-5941, CVSS 9.8), the server takes your cookie, decodes it, and passes it straight into unserialize() which executes any code inside it, the AI figured this out on its own with no hints built on LangGraph + MCP tool servers for naabu, nuclei, curl, metasploit. hunts leaked secrets across GitHub repos, 40+ regex patterns for AWS keys, Stripe tokens, database creds

chiefofautism

70,352 views • 7 months ago

Putin after returning from Moscow recounts how he explained to Trump the “root causes” of the war in Ukraine and says that removing those “root causes” must be the basis for settling the war. The root cause for the Kremlin, of course, is the very existence of a Ukraine independent of Russia and able to defend itself. It’s not about land grabs, Putin still wants all of Ukraine, and more. Full stop.

Putin after returning from Moscow recounts how he explained to Trump the “root causes” of the war in Ukraine and says that removing those “root causes” must be the basis for settling the war. The root cause for the Kremlin, of course, is the very existence of a Ukraine independent of Russia and able to defend itself. It’s not about land grabs, Putin still wants all of Ukraine, and more. Full stop.

Yaroslav Trofimov

157,381 views • 1 year ago

Because of a bug in Android 8.0, it is possible to bypass lock-screen timeout and disable Android PIN/Password/Pattern using ADB commands In the video, I automatically tested 26 different PINs in a row without 30 seconds timeout being triggered. As a result, PIN was found and lock-screen protection removed. This bug was fixed in Android 8.1 and above OS versions. This method can be used only on devices with enabled debugging. More info:

Because of a bug in Android 8.0, it is possible to bypass lock-screen timeout and disable Android PIN/Password/Pattern using ADB commands In the video, I automatically tested 26 different PINs in a row without 30 seconds timeout being triggered. As a result, PIN was found and lock-screen protection removed. This bug was fixed in Android 8.1 and above OS versions. This method can be used only on devices with enabled debugging. More info:

Mobile Hacker

118,663 views • 3 years ago

Discord… can you explain why using a GIF costs $100? We did the math and a hosted gif costs… NOTHING! That’s why at Root, Animated PFPs, Animated Banners, Community personalization, Profile Customization, Custom emojis to be used everywhere. ALL FREE on ROOT. Tens of thousands of users are joining us on Root, don’t be shy, come join us at and make new friends and new communities today! #profile #Customization #free #Discord #Alternative

Root

10,304 views • 17 days ago

🚨 PROMPT TO PRODUCTION APP IN 10 MINUTES - NO CODING REQUIRED Use top models like Opus 4.8. GPT 5.5 and Gemini 3.5 to create iOS and Android apps With one prompt create an entire production-ready app - accept payments - in-build database and auth - create companion iOS and android apps - scale to millions of users All from one prompt in 10 minutes. FREE APP AND DATABASE HOSTING with ChatLLM subscription

🚨 PROMPT TO PRODUCTION APP IN 10 MINUTES - NO CODING REQUIRED Use top models like Opus 4.8. GPT 5.5 and Gemini 3.5 to create iOS and Android apps With one prompt create an entire production-ready app - accept payments - in-build database and auth - create companion iOS and android apps - scale to millions of users All from one prompt in 10 minutes. FREE APP AND DATABASE HOSTING with ChatLLM subscription

Abacus.AI

8,825,179 views • 4 months ago