Hey guys,
In this blog, we are going to see about hacking an android device using Phonesploit. It uses the same thing as before, the misconfiguration in ADB, but this eases most of the work for you.
Phonesploit:
Phonesploit is a framework using which we can exploit android devices, It uses the ADB port 5555 to connect to a device and run commands on it. Some commands are pre-built in this framework, so you don’t need to memorize or look back the ADB commands each time, which I hope make things easy for you.
Lets get started!
The tool runs on python2, if you don’t have it please install it.
The beauty is this is platform independent because, it uses only python2.
Having your python ready. We need a package called colorama,
Install it as,
pip install colorama
Now getting on to the tool, just clone the repo as, git clone https://www.github.com/Zucccs/PhoneSploit.git
Having cloned the repository, lets move on to the directory, to check out what it has for us.
cd PhoneSploit
ls
Lets jump into the fun part!
if you are on a linux system, run the main_linux.py file, if you are using Windows, run the main.py file as,
python main_linux.py
When you run it, it confirms whether you have installed ADB or not, If you have seen my previous blog, you would have installed it by now. Though its not a problem, if you haven’t installed, the tool installs it automatically. Since I had it installed, It skipped the step.
Then it would greet us with a wonderful screen like this,
As you can see, you could do a lot with it and automate most of the that should be performed manually. And also, as I said before, If you are familiar with Metasploit, you could play around these tools easily. By the way, I hope, you will get to know about Metasploit, if you don’t know about it. Go on it would be fun.
We should use the number as the means to interact with the program.
To get connected to a device, type in 3 And to connect to a remote device we need its IP address. So we can remotely gain access to an android device.
The error is displayed because, first the program searches for Android emulators locally on the device. After which it asks for the IP address to connect. If there is already a emulator, it would connect to it automatically.
This is running adb connect command as you would know from my previous blog, where you did it manually.
After this you may start playing around with this device as you wish.
Lets get some information about the connected devices using number 1.
Lets do an interesting thing, We could see if we can pull a screenshot from the device. Again you don’t need to memorize or look back at any commands for this, the program takes care of this.
It confirms the device IP to take screenshot of, and asks for the location to save the screenshot to. Crazy isn’t it. It really pulled a screenshot of the device, it was just a black screen.
Hope you are happy that you have an easy way to exploit an android device, Ghost Framework is also similar to this, consider seeing it also.
With this you can’t exploit any random android device out there, you can only gain access to those that have their ADB port 5555 open without any security.
Thank you for reading. Hope you learned something.
If you have any problems, please watch this video
