Jump to content
Sign in to follow this  
PSherlock70

Payload Idea

Recommended Posts

Hello, 

After doing some reading on the SMB Exfiltration, would it be possible to create the same kind of payload but for an Android phone? Say for someone to connect the BB to an Android phone and copy over a certain file. 

 

Share this post


Link to post
Share on other sites

This would be much easier if the BB allowed Host Mode configuration. You could easily use ADB or MTP to grab files.

I would look at the android section of the payload repo. Demmsec has a payload that pushes a payload to a FireTV via remote ADB.

  • Upvote 1

Share this post


Link to post
Share on other sites

I've been playing around with this kind of stuff on my phone.

Managed to get BunnyWeb (python web server that runs on the BB) working on my Android phone, with access to the HTML website on my phone.
Also, there is a list of shortcuts you can use to control the Android phone via a HID attack. Here's a link to a list of shortcuts.

For obvious reasons, powershell/batch payloads will not work on an Android phone. Kind of sad, considering how powerful they are.

You could potentially turn your phone into a WiFi Pineapple with the BB plugged in using the phone's hotspot...Ooo, that could be fun...:ph34r:

  • Upvote 2

Share this post


Link to post
Share on other sites
10 hours ago, Dave-ee Jones said:

You could potentially turn your phone into a WiFi Pineapple with the BB plugged in using the phone's hotspot...Ooo, that could be fun...:ph34r:

This seems to be really powerfull when it comes to pranking friends, but since you already could have done it manually, I either didn't hear of it yet or it isn't possible or you are really the first one to think of that attack vector.

When it comes to android exfiltration, I would write an exfil app and then push it to the app like Demnsec did or register the bash bunny as storage and then manually install and use an file manager or use ADB to copy the files to the BB.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
Sign in to follow this  

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...