User Tools
docu:tutos:android:adb_root_reverse_shell_openssl
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
docu:tutos:android:adb_root_reverse_shell_openssl [2024/01/06 21:01] admin |
docu:tutos:android:adb_root_reverse_shell_openssl [2024/01/06 21:17] (current) admin |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ==== Spawn a usable root shell on your Android, without su, using "ADB as Root" developer option and Termux with openssl ==== | ==== Spawn a usable root shell on your Android, without su, using "ADB as Root" developer option and Termux with openssl ==== | ||
| - | First, we need to have Termux installed and the "Run ADB as Root" developer option enabled on your Android " | + | First, we need to have **Termux** installed and the "**Run ADB as Root"** developer option enabled on your Android " |
| + | |||
| + | This method creates a secure connection (using TLS/SSL) to your root shell and does not have compatibility problems on the tool used (**openssl**) as it happens, for example, when using netcat for reverse shell spawning. | ||
| \\ | \\ | ||
| Line 18: | Line 20: | ||
| </ | </ | ||
| - | Save this scripts in your Termux home and give them execution permissions (chmod +x) | + | Save this scripts in your Termux home (**~**) |
| <file bash " | <file bash " | ||
| export LHOST=" | export LHOST=" | ||
| Line 40: | Line 42: | ||
| \\ | \\ | ||
| - | Once you run **adb shell** on your Android, from any other device connected by usb to it, make sure you are root, otherwise you might need to run **adb root** first, but sometimes you only need to enable the "ADB as Root" option in developer options. | + | Once you run **adb shell** on your Android, from any other device connected by usb to it, make sure you are root (run **whoami**, **id** or similar), otherwise you might need to run **adb root** first, but sometimes you only need to enable the "ADB as Root" option in developer options. |
| - | As it is a reverse shell, we need first to bind the " | + | As it is a reverse shell, we need to bind the " |
| < | < | ||
| ~ $ ./shserver | ~ $ ./shserver | ||
| Line 54: | Line 56: | ||
| devname:/ # cd / | devname:/ # cd / | ||
| devname:/ | devname:/ | ||
| - | # (now you can exit the adb shell) | + | # (now you can exit the adb shell. If " |
| </ | </ | ||
| Line 64: | Line 66: | ||
| # Run the following commands: | # Run the following commands: | ||
| devname:/ | devname:/ | ||
| - | ../ | + | .../ |
| # now ctrl+z the terminal (stop the job) | # now ctrl+z the terminal (stop the job) | ||
| ~ $ stty raw -echo | ~ $ stty raw -echo | ||
| ~ $ fg | ~ $ fg | ||
| # now terminal seems unusable, but press " | # now terminal seems unusable, but press " | ||
| + | .../ | ||
| + | root | ||
| </ | </ | ||
| + | |||
| + | To run the Termux apps as root on your new fancy root shell, you will need to add **usr/bin** of the Termux installation on your **PATH** variable on the shell. | ||
| + | <code bash> | ||
| + | $ export PATH=$PATH:/ | ||
| + | </ | ||
| + | |||
| + | Enjoy! | ||
| + | |||
| + | Sources: | ||
| + | * (Usable fancy shell on reverse shell) https:// | ||
| + | * (Openssl PKI-based reverse shell and other useful stuff) https:// | ||
docu/tutos/android/adb_root_reverse_shell_openssl.1704574904.txt.gz · Last modified: 2024/01/06 21:01 by admin
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: GNU Free Documentation License 1.3
