User Tools
docu:tutos:android:adb_root_reverse_shell_openssl
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
docu:tutos:android:adb_root_reverse_shell_openssl [2024/01/06 20:33] admin |
docu:tutos:android:adb_root_reverse_shell_openssl [2024/01/06 21:17] (current) admin |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ==== Spawn a usable root shell on your Android, without su, using "ADB as Root" developer option and Termux with openssl ==== | ==== Spawn a usable root shell on your Android, without su, using "ADB as Root" developer option and Termux with openssl ==== | ||
| - | First, we need to have Termux installed and the "Run ADB as Root" developer option enabled. | + | First, we need to have **Termux** installed and the "**Run ADB as Root"** developer option enabled |
| + | |||
| + | This method creates a secure connection (using TLS/SSL) to your root shell and does not have compatibility problems on the tool used (**openssl**) as it happens, for example, when using netcat for reverse shell spawning. | ||
| \\ | \\ | ||
| Line 8: | Line 10: | ||
| pkg update | pkg update | ||
| pkg install openssl | pkg install openssl | ||
| + | pkg install openssl-tool | ||
| + | pkg install python3 | ||
| </ | </ | ||
| Line 16: | Line 20: | ||
| </ | </ | ||
| - | Save this scripts in your Termux home | + | Save this scripts in your Termux home (**~**) and give them execution permissions (chmod +x) |
| <file bash " | <file bash " | ||
| export LHOST=" | export LHOST=" | ||
| Line 23: | Line 27: | ||
| openssl s_server -quiet -tls1_2 -cipher PSK-CHACHA20-POLY1305: | openssl s_server -quiet -tls1_2 -cipher PSK-CHACHA20-POLY1305: | ||
| </ | </ | ||
| + | |||
| + | <file bash " | ||
| + | # | ||
| + | mkdir -p / | ||
| + | rm / | ||
| + | export RHOST=" | ||
| + | export RPORT=" | ||
| + | export PSK=" | ||
| + | export PIPE="/ | ||
| + | mkfifo $PIPE; /bin/sh -i < $PIPE 2>&1 | \ | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | \\ | ||
| + | |||
| + | Once you run **adb shell** on your Android, from any other device connected by usb to it, make sure you are root (run **whoami**, **id** or similar), otherwise you might need to run **adb root** first, but sometimes you only need to enable the "ADB as Root" option in developer options. | ||
| + | |||
| + | As it is a reverse shell, we need to bind the " | ||
| + | < | ||
| + | ~ $ ./shserver | ||
| + | |||
| + | # (nothing will show up at first, until we run the next steps) | ||
| + | </ | ||
| + | |||
| + | Now, do as follows on your **host device** (the ones running adb to the Android system) | ||
| + | < | ||
| + | $ adb shell | ||
| + | devname:/ # cd / | ||
| + | devname:/ | ||
| + | # (now you can exit the adb shell. If " | ||
| + | </ | ||
| + | |||
| + | Return again to the Termux Android terminal and run the following things to have a neat and usable shell (capture ctrl+c, enable tab completion, use bash... etc) | ||
| + | < | ||
| + | # (something like this should show up in your Termux terminal after previous adb shell commands) | ||
| + | devname:/ | ||
| + | |||
| + | # Run the following commands: | ||
| + | devname:/ | ||
| + | .../ | ||
| + | # now ctrl+z the terminal (stop the job) | ||
| + | ~ $ stty raw -echo | ||
| + | ~ $ fg | ||
| + | # now terminal seems unusable, but press " | ||
| + | .../ | ||
| + | root | ||
| + | </ | ||
| + | |||
| + | To run the Termux apps as root on your new fancy root shell, you will need to add **usr/bin** of the Termux installation on your **PATH** variable on the shell. | ||
| + | <code bash> | ||
| + | $ export PATH=$PATH:/ | ||
| + | </ | ||
| + | |||
| + | Enjoy! | ||
| + | |||
| + | Sources: | ||
| + | * (Usable fancy shell on reverse shell) https:// | ||
| + | * (Openssl PKI-based reverse shell and other useful stuff) https:// | ||
docu/tutos/android/adb_root_reverse_shell_openssl.1704573238.txt.gz · Last modified: 2024/01/06 20:33 by admin
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: GNU Free Documentation License 1.3
