I've been trying to do that too. There are various Android vulnerabilities around, and I know how to cross compile C code for Android, and transfer the executable to the phone, but unfortunately I can't find a place to run it that's writeable and not mounted with noexec. Perhaps I'd need to...