diff --git a/AndroidManifest.xml b/AndroidManifest.xml index 1707a1e..903d9fc 100644 --- a/AndroidManifest.xml +++ b/AndroidManifest.xml @@ -12,7 +12,7 @@ - + @@ -89,9 +89,10 @@ android:permission="android.permission.BIND_JOB_SERVICE" android:process=":runAtBoot" /> - \ No newline at end of file + + diff --git a/assets/etc/init.d/50userinit b/assets/etc/init.d/50userinit index ab6f769..76f1070 100644 --- a/assets/etc/init.d/50userinit +++ b/assets/etc/init.d/50userinit @@ -1,4 +1,5 @@ #!/system/bin/sh + log running userinit.sh if [ -x /system/xbin/busybox ]; then busybox=/system/xbin/busybox @@ -14,6 +15,72 @@ fi log Running userinit.sh... +mount_sdcard() { + mountpoint -q "$mnt/sdcard" && return 0 + + for sdcard in \ + "$EXTERNAL_STORAGE" \ + /storage/emulated/0 \ + /storage/emulated/legacy \ + /storage/sdcard0 \ + /sdcard + do + [ -d "$sdcard" ] && + $busybox mount -o bind "$sdcard" "$mnt/sdcard" && + return 0 + done + return 1 +} + +mount_external_sd() { + mountpoint -q "$mnt/external_sd" && return 0 + + for external_sd in \ + /storage/extSdCard \ + /storage/sdcard1 \ + /storage/external_sd \ + /external_sd + do + [ -d "$external_sd" ] && + $busybox mount -o bind "$external_sd" "$mnt/external_sd" && + return 0 + done + return 1 +} + +mount_usbdisk() { + mountpoint -q "$mnt/mnt/usbdisk" && return 0 + + for usbdisk in /storage/usb*; do + [ -d "$usbdisk" ] && + $busybox mount -o bind "$usbdisk" "$mnt/mnt/usbdisk" && + return 0 + done + return 1 +} + +mount_external_storage() { + external_sd_mounted=false + usbdisk_mounted=false + mount_external_sd && external_sd_mounted=true + mount_usbdisk && usbdisk_mounted=true + + # try marshmallow storage names + for storage in /storage/*-*; do + # if both mount successfully then skip + $external_sd_mounted && $usbdisk_mounted && return + if [ -d "$storage" ]; then + if ! $external_sd_mounted; then + $busybox mount -o bind "$storage" "$mnt/external_sd" && + external_sd_mounted=true + elif ! $usbdisk_mounted; then + $busybox mount -o bind "$storage" "$mnt/usbdisk" && + usbdisk_mounted=true + fi + fi + done +} + ######### EXPORT ######### #mount -o remount,rw -t yaffs2 /dev/block/mtdblock3 /system export bin=/system/bin @@ -27,8 +94,10 @@ export LOGNAME=root ######### MOUNT ######### $busybox mount -o remount,suid /data -$busybox mount -o bind /system $mnt/system -$busybox mount -o bind /sdcard $mnt/sdcard +$busybox mount -r -o bind /system $mnt/system +mount_sdcard +mount_external_storage +##$busybox mount -o bind /sdcard $mnt/sdcard $busybox mount -o bind /dev $mnt/dev $busybox mount -t devpts devpts $mnt/dev/pts $busybox mount -t proc proc $mnt/proc @@ -66,4 +135,5 @@ echo "kali" > $mnt/proc/sys/kernel/hostname # execute startup script -log userinit.sh is completed. \ No newline at end of file +log userinit.sh is completed. + diff --git a/assets/nh_files/modules/hid-keyboard.c b/assets/nh_files/modules/hid-keyboard.c new file mode 100644 index 0000000..56311e8 --- /dev/null +++ b/assets/nh_files/modules/hid-keyboard.c @@ -0,0 +1,441 @@ +/* hid_gadget_test */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#define BUF_LEN 512 + +struct options { + const char *opt; + unsigned char val; +}; + +static struct options kmod[] = { + {.opt = "left-ctrl", .val = 0x01}, + {.opt = "right-ctrl", .val = 0x10}, + {.opt = "left-shift", .val = 0x02}, + {.opt = "right-shift", .val = 0x20}, + {.opt = "left-alt", .val = 0x04}, + {.opt = "right-alt", .val = 0x40}, + {.opt = "left-meta", .val = 0x08}, + {.opt = "right-meta", .val = 0x80}, + {.opt = NULL} +}; + +static struct options kval[] = { + {.opt = "a", .val = 0x04}, + {.opt = "b", .val = 0x05}, + {.opt = "c", .val = 0x06}, + {.opt = "d", .val = 0x07}, + {.opt = "e", .val = 0x08}, + {.opt = "f", .val = 0x09}, + {.opt = "g", .val = 0x0a}, + {.opt = "h", .val = 0x0b}, + {.opt = "i", .val = 0x0c}, + {.opt = "j", .val = 0x0d}, + {.opt = "k", .val = 0x0e}, + {.opt = "l", .val = 0x0f}, + {.opt = "m", .val = 0x10}, + {.opt = "n", .val = 0x11}, + {.opt = "o", .val = 0x12}, + {.opt = "p", .val = 0x13}, + {.opt = "q", .val = 0x14}, + {.opt = "r", .val = 0x15}, + {.opt = "s", .val = 0x16}, + {.opt = "t", .val = 0x17}, + {.opt = "u", .val = 0x18}, + {.opt = "v", .val = 0x19}, + {.opt = "w", .val = 0x1a}, + {.opt = "x", .val = 0x1b}, + {.opt = "y", .val = 0x1c}, + {.opt = "z", .val = 0x1d}, + {.opt = "1", .val = 0x1e}, + {.opt = "2", .val = 0x1f}, + {.opt = "3", .val = 0x20}, + {.opt = "4", .val = 0x21}, + {.opt = "5", .val = 0x22}, + {.opt = "6", .val = 0x23}, + {.opt = "7", .val = 0x24}, + {.opt = "8", .val = 0x25}, + {.opt = "9", .val = 0x26}, + {.opt = "0", .val = 0x27}, + {.opt = "return", .val = 0x28}, + {.opt = "enter", .val = 0x28}, + {.opt = "esc", .val = 0x29}, + {.opt = "escape", .val = 0x29}, + {.opt = "bckspc", .val = 0x2a}, + {.opt = "backspace", .val = 0x2a}, + {.opt = "tab", .val = 0x2b}, + {.opt = "space", .val = 0x2c}, + {.opt = "minus", .val = 0x2d}, + {.opt = "dash", .val = 0x2d}, + {.opt = "equals", .val = 0x2e}, + {.opt = "equal", .val = 0x2e}, + {.opt = "lbracket", .val = 0x2f}, + {.opt = "rbracket", .val = 0x30}, + {.opt = "backslash", .val = 0x31}, + {.opt = "hash", .val = 0x32}, + {.opt = "number", .val = 0x32}, + {.opt = "semicolon", .val = 0x33}, + {.opt = "quote", .val = 0x34}, + {.opt = "backquote", .val = 0x35}, + {.opt = "tilde", .val = 0x35}, + {.opt = "comma", .val = 0x36}, + {.opt = "period", .val = 0x37}, + {.opt = "stop", .val = 0x37}, + {.opt = "slash", .val = 0x38}, + {.opt = "caps-lock", .val = 0x39}, + {.opt = "capslock", .val = 0x39}, + {.opt = "f1", .val = 0x3a}, + {.opt = "f2", .val = 0x3b}, + {.opt = "f3", .val = 0x3c}, + {.opt = "f4", .val = 0x3d}, + {.opt = "f5", .val = 0x3e}, + {.opt = "f6", .val = 0x3f}, + {.opt = "f7", .val = 0x40}, + {.opt = "f8", .val = 0x41}, + {.opt = "f9", .val = 0x42}, + {.opt = "f10", .val = 0x43}, + {.opt = "f11", .val = 0x44}, + {.opt = "f12", .val = 0x45}, + {.opt = "print", .val = 0x46}, + {.opt = "scroll-lock", .val = 0x47}, + {.opt = "scrolllock", .val = 0x47}, + {.opt = "pause", .val = 0x48}, + {.opt = "insert", .val = 0x49}, + {.opt = "home", .val = 0x4a}, + {.opt = "pageup", .val = 0x4b}, + {.opt = "pgup", .val = 0x4b}, + {.opt = "del", .val = 0x4c}, + {.opt = "delete", .val = 0x4c}, + {.opt = "end", .val = 0x4d}, + {.opt = "pagedown", .val = 0x4e}, + {.opt = "pgdown", .val = 0x4e}, + {.opt = "right", .val = 0x4f}, + {.opt = "left", .val = 0x50}, + {.opt = "down", .val = 0x51}, + {.opt = "up", .val = 0x52}, + {.opt = "num-lock", .val = 0x53}, + {.opt = "numlock", .val = 0x53}, + {.opt = "kp-divide", .val = 0x54}, + {.opt = "kp-multiply", .val = 0x55}, + {.opt = "kp-minus", .val = 0x56}, + {.opt = "kp-plus", .val = 0x57}, + {.opt = "kp-enter", .val = 0x58}, + {.opt = "kp-return", .val = 0x58}, + {.opt = "kp-1", .val = 0x59}, + {.opt = "kp-2", .val = 0x5a}, + {.opt = "kp-3", .val = 0x5b}, + {.opt = "kp-4", .val = 0x5c}, + {.opt = "kp-5", .val = 0x5d}, + {.opt = "kp-6", .val = 0x5e}, + {.opt = "kp-7", .val = 0x5f}, + {.opt = "kp-8", .val = 0x60}, + {.opt = "kp-9", .val = 0x61}, + {.opt = "kp-0", .val = 0x62}, + {.opt = "kp-period", .val = 0x63}, + {.opt = "kp-stop", .val = 0x63}, + {.opt = "application", .val = 0x65}, + {.opt = "power", .val = 0x66}, + {.opt = "kp-equals", .val = 0x67}, + {.opt = "kp-equal", .val = 0x67}, + {.opt = "f13", .val = 0x68}, + {.opt = "f14", .val = 0x69}, + {.opt = "f15", .val = 0x6a}, + {.opt = "f16", .val = 0x6b}, + {.opt = "f17", .val = 0x6c}, + {.opt = "f18", .val = 0x6d}, + {.opt = "f19", .val = 0x6e}, + {.opt = "f20", .val = 0x6f}, + {.opt = "f21", .val = 0x70}, + {.opt = "f22", .val = 0x71}, + {.opt = "f23", .val = 0x72}, + {.opt = "f24", .val = 0x73}, + {.opt = "execute", .val = 0x74}, + {.opt = "help", .val = 0x75}, + {.opt = "menu", .val = 0x76}, + {.opt = "select", .val = 0x77}, + {.opt = "cancel", .val = 0x78}, + {.opt = "redo", .val = 0x79}, + {.opt = "undo", .val = 0x7a}, + {.opt = "cut", .val = 0x7b}, + {.opt = "copy", .val = 0x7c}, + {.opt = "paste", .val = 0x7d}, + {.opt = "find", .val = 0x7e}, + {.opt = "mute", .val = 0x7f}, + {.opt = "volume-up", .val = 0x80}, // These are multimedia keys, they will not work on standard keyboard, they need a different USB descriptor + {.opt = "volume-down", .val = 0x81}, + {.opt = NULL} +}; + +int keyboard_fill_report(char report[8], char buf[BUF_LEN], int *hold) +{ + char *tok = strtok(buf, " "); + int key = 0; + int i = 0; + + for (; tok != NULL; tok = strtok(NULL, " ")) { + + if (strncmp(tok, "--", 2) == 0) + tok += 2; + + if (strcmp(tok, "quit") == 0) + return -1; + + if (strcmp(tok, "hold") == 0) { + *hold = 1; + continue; + } + + if (key < 6) { + for (i = 0; kval[i].opt != NULL; i++) + if (strcmp(tok, kval[i].opt) == 0) { + report[2 + key++] = kval[i].val; + break; + } + if (kval[i].opt != NULL) + continue; + } + + for (i = 0; kmod[i].opt != NULL; i++) + if (strcmp(tok, kmod[i].opt) == 0) { + report[0] = report[0] | kmod[i].val; + break; + } + if (kmod[i].opt != NULL) + continue; + + if (key < 6) + fprintf(stderr, "unknown option: %s\n", tok); + } + return 8; +} + +static struct options mmod[] = { + {.opt = "--b1", .val = 0x01}, + {.opt = "--b2", .val = 0x02}, + {.opt = "--b3", .val = 0x04}, + {.opt = NULL} +}; + +int mouse_fill_report(char report[8], char buf[BUF_LEN], int *hold) +{ + char *tok = strtok(buf, " "); + int mvt = 0; + int i = 0; + for (; tok != NULL; tok = strtok(NULL, " ")) { + + if (strcmp(tok, "--quit") == 0) + return -1; + + if (strcmp(tok, "--hold") == 0) { + *hold = 1; + continue; + } + + for (i = 0; mmod[i].opt != NULL; i++) + if (strcmp(tok, mmod[i].opt) == 0) { + report[0] = report[0] | mmod[i].val; + break; + } + if (mmod[i].opt != NULL) + continue; + + if (!(tok[0] == '-' && tok[1] == '-') && mvt < 2) { + errno = 0; + report[1 + mvt++] = (char)strtol(tok, NULL, 0); + if (errno != 0) { + fprintf(stderr, "Bad value:'%s'\n", tok); + report[1 + mvt--] = 0; + } + continue; + } + + fprintf(stderr, "unknown option: %s\n", tok); + } + return 3; +} + +static struct options jmod[] = { + {.opt = "--b1", .val = 0x10}, + {.opt = "--b2", .val = 0x20}, + {.opt = "--b3", .val = 0x40}, + {.opt = "--b4", .val = 0x80}, + {.opt = "--hat1", .val = 0x00}, + {.opt = "--hat2", .val = 0x01}, + {.opt = "--hat3", .val = 0x02}, + {.opt = "--hat4", .val = 0x03}, + {.opt = "--hatneutral", .val = 0x04}, + {.opt = NULL} +}; + +int joystick_fill_report(char report[8], char buf[BUF_LEN], int *hold) +{ + char *tok = strtok(buf, " "); + int mvt = 0; + int i = 0; + + *hold = 1; + + /* set default hat position: neutral */ + report[3] = 0x04; + + for (; tok != NULL; tok = strtok(NULL, " ")) { + + if (strcmp(tok, "--quit") == 0) + return -1; + + for (i = 0; jmod[i].opt != NULL; i++) + if (strcmp(tok, jmod[i].opt) == 0) { + report[3] = (report[3] & 0xF0) | jmod[i].val; + break; + } + if (jmod[i].opt != NULL) + continue; + + if (!(tok[0] == '-' && tok[1] == '-') && mvt < 3) { + errno = 0; + report[mvt++] = (char)strtol(tok, NULL, 0); + if (errno != 0) { + fprintf(stderr, "Bad value:'%s'\n", tok); + report[mvt--] = 0; + } + continue; + } + + fprintf(stderr, "unknown option: %s\n", tok); + } + return 4; +} + +void print_options(char c) +{ + int i = 0; + + if (c == 'k') { + printf(" keyboard options:\n" + " hold\n"); + for (i = 0; kmod[i].opt != NULL; i++) + printf("\t\t%s\n", kmod[i].opt); + printf("\n keyboard values:\n" + " [a-z] or [0-9] or\n"); + for (i = 0; kval[i].opt != NULL; i++) + printf("\t\t%-8s%s", kval[i].opt, i % 2 ? "\n" : ""); + printf("\n"); + } else if (c == 'm') { + printf(" mouse options:\n" + " --hold\n"); + for (i = 0; mmod[i].opt != NULL; i++) + printf("\t\t%s\n", mmod[i].opt); + printf("\n mouse values:\n" + " Two signed numbers\n\n"); + } else { + printf(" joystick options:\n"); + for (i = 0; jmod[i].opt != NULL; i++) + printf("\t\t%s\n", jmod[i].opt); + printf("\n joystick values:\n" + " three signed numbers\n" + "--quit to close\n"); + } +} + +int main(int argc, const char *argv[]) +{ + const char *filename = NULL; + int fd = 0; + char buf[BUF_LEN]; + int cmd_len; + char report[8]; + int to_send = 8; + int hold = 0; + fd_set rfds; + int retval, i; + + if (argc < 3) { + fprintf(stderr, "Usage: %s devname mouse|keyboard|joystick\n", + argv[0]); + + print_options('k'); + print_options('m'); + print_options('j'); + + return 1; + } + + if (argv[2][0] != 'k' && argv[2][0] != 'm' && argv[2][0] != 'j') + return 2; + + filename = argv[1]; + + if ((fd = open(filename, O_RDWR, 0666)) == -1) { + perror(filename); + return 3; + } + + while (42) { + + FD_ZERO(&rfds); + FD_SET(STDIN_FILENO, &rfds); + FD_SET(fd, &rfds); + + retval = select(fd + 1, &rfds, NULL, NULL, NULL); + if (retval == -1 && errno == EINTR) + continue; + if (retval < 0) { + perror("select()"); + return 4; + } + + if (FD_ISSET(fd, &rfds)) { + cmd_len = read(fd, buf, BUF_LEN - 1); + printf("recv report:"); + for (i = 0; i < cmd_len; i++) + printf(" %02x", buf[i]); + printf("\n"); + } + + if (FD_ISSET(STDIN_FILENO, &rfds)) { + memset(report, 0x0, sizeof(report)); + cmd_len = read(STDIN_FILENO, buf, BUF_LEN - 1); + + if (cmd_len == 0) + break; + + buf[cmd_len - 1] = '\0'; + hold = 0; + + memset(report, 0x0, sizeof(report)); + if (argv[2][0] == 'k') + to_send = keyboard_fill_report(report, buf, &hold); + else if (argv[2][0] == 'm') + to_send = mouse_fill_report(report, buf, &hold); + else + to_send = joystick_fill_report(report, buf, &hold); + + if (to_send == -1) + break; + + if (write(fd, report, to_send) != to_send) { + perror(filename); + return 5; + } + if (!hold) { + memset(report, 0x0, sizeof(report)); + if (write(fd, report, to_send) != to_send) { + perror(filename); + return 6; + } + } + } + } + + close(fd); + return 0; +} diff --git a/assets/scripts/bootkali b/assets/scripts/bootkali index 5635148..ff80c3e 100755 --- a/assets/scripts/bootkali +++ b/assets/scripts/bootkali @@ -31,8 +31,8 @@ else if [ "$1" == "beef-xss" ] && [ "$2" == "start" ]; then LANG=en_US.UTF-8 LANGUAGE=en_US.UTF-8 LC_ALL=en_US.UTF-8 $busybox chroot $mnt sudo service beef-xss start - sleep 35 - am start -a android.intent.action.VIEW -d http://127.0.0.1:3000/ui/panel + sleep 10 + am start -a android.intent.action.VIEW -d http://127.0.0.1:3000/ui/authentication fi if [ "$1" == "beef-xss" ] && [ "$2" == "stop" ]; then $busybox chroot $mnt sudo service beef-xss stop @@ -100,6 +100,12 @@ else $busybox chroot $mnt service openvpn stop fi + #Open VNC + + if [ "$1" == "vnc" ] && [ "$2" == "start" ]; then + sh /data/data/com.offsec.nethunter/files/scripts/start-vnc $3 $4 $5 $6 $7 $8 + fi + # HID Keyboard Command a.k.a Teensy style # Supported keyboard layouts: US, FR, EN, ES # We can pass language options to bootkali like: @@ -139,15 +145,40 @@ else # bootkali duck-hunt-run {/opt/duckout.sh} if [ "$1" == "duck-hunt-convert" ]; then - $busybox chroot $mnt sudo python /sdcard/nh_files/modules/duckhunter.py -l $2 $3 $4 - $busybox chroot $mnt sudo chmod 755 $4 + $busybox chroot $mnt /usr/bin/python2.7 /sdcard/nh_files/modules/duckhunter.py -l $2 $3 $4 + ## $busybox chroot $mnt sudo chmod 755 $4 + fi if [ "$1" == "duck-hunt-run" ]; then + # Check if hid-keyboard binary is present at $mnt/usr/bin/ + if [ ! -x $mnt/usr/bin/hid-keyboard ]; then + bklog "[!] No hid-keyboard executable is found in kali, now trying to compile it." + if [ -e /sdcard/nh_files/modules/hid-keyboard.c ]; then + $busybox chroot $mnt /usr/bin/sudo apt install gcc binutils + $busybox chroot $mnt /usr/bin/sudo gcc /sdcard/nh_files/modules/hid-keyboard.c -o /usr/bin/hid-keyboard + $busybox chroot $mnt /usr/bin/sudo chmod 755 /usr/bin/hid-keyboard + fi + if [ ! -x $mnt/usr/bin/hid-keyboard ]; then + bklog "[-] Failed to compile hid-keyboard executable to /usr/bin/ , script aborted." + exit 1 + fi + bklog "[+] hid-keyboard executable is successfully compiled." + fi + if [ ! -f /data/local/nhsystem/kali-armhf$2 ]; then - echo "File not found" + bklog "[-] File not found" else - echo "File /data/local/nhsystem/kali-armhf$2 found" - $busybox chroot $mnt /bin/bash $2 + bklog "[+] File /data/local/nhsystem/kali-armhf$2 found" + COUNT=0 + until $busybox chroot $mnt /bin/bash -c "echo volume-up | hid-keyboard /dev/hidg0 keyboard > /dev/null 2>&1"; do + sleep 1 + COUNT=$((COUNT+1)) + if [ $COUNT -gt 60 ]; then #60 seconds + exit 1 + fi + done + bklog "[+] USB cable plugged, executing attack..." + $busybox chroot $mnt /bin/bash $2 fi fi @@ -235,7 +266,7 @@ else $busybox chroot $mnt sudo /usr/bin/kalimenu fi - #YCABLE ¯\_(ಠ_ಠ)_/¯ + #YCABLE if [ "$1" == "ycable" ] && [ "$2" == "start" ]; then if [ -f "/sys/module/msm_otg/parameters/usbhost_charge_mode" ]; then @@ -280,6 +311,14 @@ else $busybox chroot $mnt sudo $commmand fi + #SearchSploit convert_exploitdb_to_csv + + if [ "$1" == "convert_exploitdb" ]; then + [ -f /sdcard/nh_files/SearchSploit ] && rm /sdcard/nh_files/SearchSploit + $busybox chroot $mnt sudo python /sdcard/nh_files/modules/csv2sqlite.py /usr/share/exploitdb/files_exploits.csv /sdcard/nh_files/SearchSploit $2 + [ -f /sdcard/nh_files/SearchSploit ] && return 0 || return 1 + fi + #MFOC MIFARE DUMP if [ "$1" == "dumpmifare" ]; then @@ -309,4 +348,25 @@ else printf "And remember to use the 'Maintain Chroot' button in the Chroot Manager to keep your chroot up-to-date and to install new metapackages.\n\n" echo -e "\e[0m" fi + #Extract kali chroot with symlink. + + if [ "$1" == "extract-chroot" ] && [ "$2" != "" ]; then + $busybox chroot $mnt /bin/tar xzf "$2" --hard-dereference --keep-old-files --keep-directory-symlink -C "/" > /dev/null 2>&1 + fi + + #Backup kali chroot + + if [ "$1" == "backup-chroot" ] && [ "$2" != "" ]; then + if [ -f "/sdcard/$2" ]; then + bklog "[-] /sdcard/$2 existed already, please rename the existed filename to another first." + else + $busybox chroot $mnt sudo /bin/tar czf "/sdcard/$2" --hard-dereference --exclude='./system' --exclude='./sys' --exclude='./proc' --exclude='./dev' --exclude='./sdcard' --exclude='./lib/modules' -C "/" . + bklog "[+] Done. Successfully backup to /sdcard/$2" + fi + fi + + if [ "$1" == "test" ]; then + $busybox chroot $mnt sudo printenv + fi fi + diff --git a/assets/scripts/bootkali_env b/assets/scripts/bootkali_env index b6a66cf..0065fa1 100755 --- a/assets/scripts/bootkali_env +++ b/assets/scripts/bootkali_env @@ -2,6 +2,7 @@ ######### IMPORT BOOTKALI INITIALIZATION ######### SCRIPT_PATH=$(readlink -f $0) +. ${SCRIPT_PATH%/*}/bootkali_log . ${SCRIPT_PATH%/*}/bootkali_init ######### EXPORT ENVIRONMENT ######### diff --git a/assets/scripts/bootkali_init b/assets/scripts/bootkali_init index 5e46174..9b9e83f 100755 --- a/assets/scripts/bootkali_init +++ b/assets/scripts/bootkali_init @@ -1,30 +1,55 @@ #!/system/bin/sh +######### Determine which busybox binary to use ######### if [ -x /system/xbin/busybox_nh ]; then busybox=/system/xbin/busybox_nh -elif [ -x /sbin/busybox_nh ]; then - busybox=/sbin/busybox_nh elif [ -x /system/xbin/busybox ]; then busybox=/system/xbin/busybox -elif [ -x /data/local/bin/busybox ]; then - busybox=/data/local/bin/busybox elif [ -x /system/bin/busybox ]; then busybox=/system/bin/busybox -elif [ -x /su/bin/busybox ]; then - busybox=/su/bin/busybox +elif [ -x /data/adb/magisk/busybox ]; then + busybox=/data/adb/magisk/busybox else - echo "Busybox not found! Install it, dummy!" - log "Busybox not found! Install it, dummy!" + bklog "[-] Busybox not found! Install it, dummy!" exit 1 fi -su -c setenforce 0 + +## Not need to manually set to permissive mode now as patched in kernel. +#su -c setenforce 0 + +######### VARIABLES ######### +mnt=/data/local/nhsystem/kali-armhf +nhsys=/data/local/nhsystem +chroot_image=/sdcard/kali-chroot.img ## for File method + +######### CHECK FOR ENCRYPTION ######### +isEncrypted=false +[ "$(getprop ro.crypto.state)" = "encrypted" ] && isEncrypted=true + +######### CHECK IF EVERYTHING IS READY ######### +f_isAllReady(){ + fs=(proc sys dev dev/shm dev/pts sdcard) + for i in "${fs[@]}"; do + if [ "$(grep $mnt/$i /proc/mounts)" ]; then + bklog "[+] $i was mounted already." + continue + else + bklog "[-] $i is not yet mounted." + return 1 + fi + done + [ ! -e "/dev/fd" -o ! -e "/dev/stdin" -o ! -e "/dev/stdout" -o ! -e "/dev/stderr" ] && return 1 + [ -e "/dev/tty0" ] || return 1 + [ -e "/dev/net/tun" ] || return 1 + return 0 +} ######### CHECK FOR ROOT ######### f_checkforroot(){ perm=$(id | $busybox cut -b 5) if [ "$perm" != "0" ]; then - echo "ROOT NOT DETECTED! Type: su or install SuperSU to fix" + bklog "[-] ROOT NOT DETECTED! Type: Please install SuperSU or Magisk to fix it." exit 1 fi } @@ -32,53 +57,13 @@ f_checkforroot(){ ######### VARIABLES ######### mnt=/data/local/nhsystem/kali-armhf -######### CHECK FOR INSTALL ######### -# -# There is a bug that will create the resolv.conf -# If we continue on with bootkali even after we -# remove chroot. So stop here if removed or else -# chroot is never uninstalled. - -if [ ! -d "$mnt/usr" ]; then - echo "Missing a required folder. Something isn't right" - exit 1 -fi - -######### SET TUN ######## -mkdir -p /dev/net -rm -f /dev/net/tun - -# This appears to work with miredo -mknod /dev/net/tun c 10 200 - -# ln -s /dev/tun /dev/net/tun 2> /dev/null - -######### SET DNS ######## -> $mnt/etc/resolv.conf # empty dns entries - -for i in 1 2 3 4; do - if [ -z "$(getprop net.dns${i})" ]; then - # we go through 1-4 dns servers and break out of loop on empty - break - else - # add local/device dns server first - echo "nameserver $(getprop net.dns${i})" >> $mnt/etc/resolv.conf - fi -done - -# lastly add two default dns entries -echo "nameserver 208.67.222.222" >> $mnt/etc/resolv.conf -echo "nameserver 208.67.220.220" >> $mnt/etc/resolv.conf -chmod 644 $mnt/etc/resolv.conf - ######### MOUNT ######### -## Should run always (https://su.chainfire.eu/#how-mount) -$busybox mount -o remount,suid /data - mount_sdcard() { - mountpoint -q "$mnt/sdcard" && return 0 - + if [ -d "$mnt/sdcard" ]; then + mountpoint -q "$mnt/sdcard" && return 0 + fi + mkdir -p $mnt/sdcard for sdcard in \ "$EXTERNAL_STORAGE" \ /storage/emulated/0 \ @@ -87,15 +72,17 @@ mount_sdcard() { /sdcard do [ -d "$sdcard" ] && - $busybox mount -o bind "$sdcard" "$mnt/sdcard" && + $busybox mount -o bind "$sdcard" "$mnt/sdcard" && bklog "[+] binded sdcard" && return 0 done return 1 } mount_external_sd() { - mountpoint -q "$mnt/external_sd" && return 0 - + if [ -d "$mnt/external_sd" ]; then + mountpoint -q "$mnt/external_sd" && return 0 + fi + mkdir -p $mnt/external_sd for external_sd in \ /storage/extSdCard \ /storage/sdcard1 \ @@ -103,75 +90,149 @@ mount_external_sd() { /external_sd do [ -d "$external_sd" ] && - $busybox mount -o bind "$external_sd" "$mnt/external_sd" && + $busybox mount -o bind "$external_sd" "$mnt/external_sd" && bklog "[+] binded external_sd" && return 0 done return 1 } -mount_usbdisk() { - mountpoint -q "$mnt/mnt/usbdisk" && return 0 +## [ MOUNTING AND BINDING FILESYSTEM ] ## +mount_fs_to_kali() { - for usbdisk in /storage/usb*; do - [ -d "$usbdisk" ] && - $busybox mount -o bind "$usbdisk" "$mnt/mnt/usbdisk" && - return 0 - done - return 1 -} + f_checkforroot + $busybox mount -o remount,suid /data && chmod +s $mnt/usr/bin/sudo + + ######### SET FD, Thanks @feefik and @zer0conf ######## + if [ ! -e "/dev/fd" -o ! -e "/dev/stdin" -o ! -e "/dev/stdout" -o ! -e "/dev/stderr" ]; then + [ -e "/dev/fd" ] || ln -s /proc/self/fd /dev/ && bklog "[+] linked /proc/self/fd to /dev/" + [ -e "/dev/stdin" ] || ln -s /proc/self/fd/0 /dev/stdin && bklog "[+] linked /proc/self/fd/0 to /dev/stdin" + [ -e "/dev/stdout" ] || ln -s /proc/self/fd/1 /dev/stdout && bklog "[+] linked /proc/self/fd/2 to /dev/stdout" + [ -e "/dev/stderr" ] || ln -s /proc/self/fd/2 /dev/stderr && bklog "[+] linked /proc/self/fd/3 to /dev/stderr" + fi -mount_external_storage() { - external_sd_mounted=false - usbdisk_mounted=false - mount_external_sd && external_sd_mounted=true - mount_usbdisk && usbdisk_mounted=true - - # try marshmallow storage names - for storage in /storage/*-*; do - # if both mount successfully then skip - $external_sd_mounted && $usbdisk_mounted && return - if [ -d "$storage" ]; then - if ! $external_sd_mounted; then - $busybox mount -o bind "$storage" "$mnt/external_sd" && - external_sd_mounted=true - elif ! $usbdisk_mounted; then - $busybox mount -o bind "$storage" "$mnt/usbdisk" && - usbdisk_mounted=true - fi - fi - done -} + ######### SET TUN ######## + if [ ! -e "/dev/net/tun" ]; then + [ ! -d "/dev/net" ] && mkdir -p /dev/net + mknod /dev/net/tun c 10 200 && bklog "[+] created /dev/net/tun" + fi -# If chroot's /dev is mounted, assume the chroot is already running and skip initialization -if ! $busybox mountpoint -q $mnt/dev; then - f_checkforroot + ######### SET DEV ######## + if [ ! "$(mountpoint $mnt/dev 2> /dev/null | grep 'is a')" ]; then + [ ! -d $mnt/dev ] && mkdir -p $mnt/dev + $busybox mount -o bind /dev $mnt/dev && bklog "[+] binded /dev" + fi + + ######### SET DEV PTS ######## + if [ ! "$(mountpoint $mnt/dev/pts 2> /dev/null | grep 'is a')" ]; then + $busybox mount -t devpts devpts $mnt/dev/pts && bklog "[+] mounted /dev/pts" + fi - $busybox mount -r -o bind /system $mnt/system + ######### SET PROC ######## + if [ ! "$(mountpoint $mnt/proc 2> /dev/null | grep 'is a')" ]; then + [ ! -d $mnt/proc ] && mkdir -p $mnt/proc + $busybox mount -t proc proc $mnt/proc && bklog "[+] mounted /proc" + fi - # enable depmod/modprobe support in rootfs - $busybox mount -r -o bind /system/lib/modules $mnt/lib/modules + ######### SET SYS ######## + if [ ! "$(mountpoint $mnt/sys 2> /dev/null | grep 'is a')" ]; then + [ ! -d $mnt/sys ] && mkdir -p $mnt/sys + $busybox mount -t sysfs sys $mnt/sys && bklog "[+] mounted /sys" + fi + ######### SET INTERNAL | EXTERNAL SDCARD | USBDISK ######## mount_sdcard - mount_external_storage - - $busybox mount -o bind /dev $mnt/dev - $busybox mount -t devpts devpts $mnt/dev/pts - $busybox mount -t proc proc $mnt/proc - $busybox mount -t sysfs sysfs $mnt/sys + mount_external_sd + ######### $busybox chmod 666 /dev/null - # SET 250MB TO ALLOW POSTGRESQL # + ######### SET 250MB TO ALLOW POSTGRESQL ######### $busybox sysctl -w kernel.shmmax=268435456 - # NETWORK SETTINGS # + ######### SET DNS ######## + > $mnt/etc/resolv.conf # empty dns entries + for i in 1 2 3 4; do + if [ -z "$(getprop net.dns${i})" ]; then + # we go through 1-4 dns servers and break out of loop on empty + break + else + # add local/device dns server first + echo "nameserver $(getprop net.dns${i})" >> $mnt/etc/resolv.conf + fi + done + + # lastly add two default dns entries + echo "nameserver 208.67.222.222" >> $mnt/etc/resolv.conf + echo "nameserver 208.67.220.220" >> $mnt/etc/resolv.conf + chmod 644 $mnt/etc/resolv.conf + + ######### SET NETWORK AND HOSTNAME ######## $busybox sysctl -w net.ipv4.ip_forward=1 echo "127.0.0.1 localhost kali" > $mnt/etc/hosts echo "::1 localhost ip6-localhost ip6-loopback" >> $mnt/etc/hosts echo "kali" > $mnt/proc/sys/kernel/hostname - echo "The Kali chroot has been started." - log "The Kali chroot has been started." -else - echo "The Kali chroot is already running!" + ######### Setup done ######### + bklog "[+] The Kali chroot has been started." +} + +############ STARTING ############ +## First create the chroot directory: $mnt +if [ ! -d "$mnt" ]; then + mkdir -p $mnt +fi + +## Second check if the kali chroot image is already mounted to $mnt or chroot is installed already by Directory method +if [ ! "$($busybox chroot $mnt /bin/uname -n 2> /dev/null)" ]; then + bklog "[-] Kali chroot is not yet mounted from $chroot_image or installed by directory mothod..." + ## For enrypted device with chroot image + if [ "$isEncrypted" = true ] && [ -f $chroot_image ]; then + bklog "[!] This is encrypted device and $chroot_image is found.\n [!] mounting $chroot_image to $mnt now.." + ## But first check if the image has been setup to loop device already, then we avoid adding it to loop device again. + if [ "$(losetup -a | grep $chroot_image)" ]; then + bklog "[!] $chroot_image is already mounted as loop device." + if [ "$($busybox mount $(losetup -a | grep $chroot_image | awk -F':' '{print $1}') $mnt)" ]; then + bklog "[-] Failed to mount image. Please verify the image is valid." && exit 1 + else + bklog "[+] mounted $chroot_image to $mnt" + fi + else + if [ "$($busybox mount -o loop $chroot_image $mnt)" ]; then + bklog "[-] Failed to mount image. Please verify the image is valid." && exit 1 + else + bklog "[+] mounted $chroot_image to $mnt" + fi + fi + ## For uncrypted device with chroot image + elif [ "$isEncrypted" = false ] && [ -f $chroot_image ]; then + bklog "[!] This is unencrypted device and $chroot_image is found\n [!] mounting $chroot_image to $mnt now.." + ## But first check if the image has been setup to loop device already, then we avoid adding it to loop device again. + if [ "$(losetup -a | grep $chroot_image)" ]; then + bklog "[!] $chroot_image is already mounted as loop device." + if [ "$($busybox mount $(losetup -a | grep $chroot_image | awk -F':' '{print $1}') $mnt)" ]; then + bklog "[-] Failed to mount image. Please verify the image is valid." && exit 1 + else + bklog "[+] mounted $chroot_image to $mnt" + fi + else + if [ "$($busybox mount -o loop $chroot_image $mnt)" ]; then + bklog "[-] Failed to mount image. Please verify the image is valid." && exit 1 + else + bklog "[+] mounted $chroot_image to $mnt" + fi + fi + else + bklog "[-] No $chroot_image is found, Please make sure kali chroot is either installed by directory method(extract .tar.gz method) or $chroot_image is presented." + exit 1 + fi +fi + + +## Lastly check if all Filesystems are mounted. +bklog "[!] Checking chroot environment." +f_isAllReady +local res=$? +if [ $res -eq 1 ]; then + bklog "[!] mounting fs to kali chroot..." + mount_fs_to_kali fi diff --git a/assets/scripts/bootkali_log b/assets/scripts/bootkali_log new file mode 100755 index 0000000..3b36954 --- /dev/null +++ b/assets/scripts/bootkali_log @@ -0,0 +1,10 @@ +#!/system/bin/sh + +######### Log function for bootkali* script ######### +bklog() { + ## normal output to terminal + echo "$1" + ## log it into logcat so that we can run "logcat | grep bklog" to see only the log messages from bootkali script + log -t "bklog" "$(basename $0) -> $1" +} + diff --git a/assets/scripts/check-kaliapache b/assets/scripts/check-kaliapache index 81de114..5a34899 100755 --- a/assets/scripts/check-kaliapache +++ b/assets/scripts/check-kaliapache @@ -1,7 +1,6 @@ unset LD_PRELOAD -if [[ -n $(ps |grep '/usr/sbin/apache2') ]]; then +if [[ $(ps | grep apache2) ]]; then echo "1" else echo "0" fi - diff --git a/assets/scripts/check-kalibeef-xss b/assets/scripts/check-kalibeef-xss index d87000b..b2add22 100755 --- a/assets/scripts/check-kalibeef-xss +++ b/assets/scripts/check-kalibeef-xss @@ -1,5 +1,5 @@ unset LD_PRELOAD -if [[ -n $(ps |grep ruby|grep 104) ]]; then +if [[ $(ps | grep ruby | grep 116) ]]; then echo "1" else echo "0" diff --git a/assets/scripts/check-kalidnsmq b/assets/scripts/check-kalidnsmq index f939272..204ba91 100755 --- a/assets/scripts/check-kalidnsmq +++ b/assets/scripts/check-kalidnsmq @@ -1,5 +1,5 @@ unset LD_PRELOAD -if [[ -n $(ps |grep '/usr/sbin/dnsmasq') ]]; then +if [[ $(ps | grep dnsmasq) ]]; then echo "1" else echo "0" diff --git a/assets/scripts/check-kalihostapd b/assets/scripts/check-kalihostapd index e369c3e..63d6ee5 100755 --- a/assets/scripts/check-kalihostapd +++ b/assets/scripts/check-kalihostapd @@ -1,5 +1,5 @@ unset LD_PRELOAD -if [[ -n $(ps |grep '/usr/sbin/hostapd') ]]; then +if [[ $(ps | grep hostapd) ]]; then echo "1" else echo "0" diff --git a/assets/scripts/check-kalissh b/assets/scripts/check-kalissh index 3641ddf..c263327 100755 --- a/assets/scripts/check-kalissh +++ b/assets/scripts/check-kalissh @@ -1,7 +1,6 @@ unset LD_PRELOAD -if [[ -n $(ps |grep '/usr/sbin/sshd') ]]; then +if [[ $(ps | grep sshd) ]]; then echo "1" else echo "0" fi - diff --git a/assets/scripts/check-kalivpn b/assets/scripts/check-kalivpn index a4f37d5..aa764e6 100755 --- a/assets/scripts/check-kalivpn +++ b/assets/scripts/check-kalivpn @@ -1,7 +1,6 @@ unset LD_PRELOAD -if [[ -n $(ps |grep '/usr/sbin/openvpn') ]]; then +if [[ $(ps | grep openvpn) ]]; then echo "1" else echo "0" fi - diff --git a/assets/scripts/killkali b/assets/scripts/killkali index 44a60a6..433b113 100755 --- a/assets/scripts/killkali +++ b/assets/scripts/killkali @@ -1,20 +1,18 @@ #!/system/bin/sh +SCRIPT_PATH=$(readlink -f $0) +. ${SCRIPT_PATH%/*}/bootkali_log + if [ -x /system/xbin/busybox_nh ]; then busybox=/system/xbin/busybox_nh -elif [ -x /sbin/busybox_nh ]; then - busybox=/sbin/busybox_nh elif [ -x /system/xbin/busybox ]; then busybox=/system/xbin/busybox -elif [ -x /data/local/bin/busybox ]; then - busybox=/data/local/bin/busybox elif [ -x /system/bin/busybox ]; then busybox=/system/bin/busybox -elif [ -x /su/bin/busybox ]; then - busybox=/su/bin/busybox +elif [ -x /data/adb/magisk/busybox ]; then + busybox=/data/adb/magisk/busybox else - echo "Busybox not found! Install it, dummy!" - log "Busybox not found! Install it, dummy!" + bklog "Busybox not found! Install it, dummy!" exit fi @@ -31,23 +29,72 @@ unset LD_PRELOAD $busybox sysctl -w kernel.shmmax=134217728 -echo "Shutting down SSH Server" +bklog "[!] Shutting down SSH Server" $busybox chmod 666 /dev/null $busybox chroot $mnt /etc/init.d/ssh stop -echo "Shutting down Postgresql" +bklog "[!] Shutting down Postgresql" $busybox chroot $mnt /etc/init.d/postgresql stop +bklog "[!] Shutting down VNCserver" +pkill Xtightvnc +rm -f $mnt/root/.vnc/*.log *.pid > /dev/null 2>&1 +rm -f $mnt/tmp/.X*-.lock .X*-unix/* > /dev/null 2>&1 + +########## Kill all running kali terminals first ########## +bklog "[!] Killing all running kali terminals.." +kill_pids + # unmount everything -echo "Removing all Kali mounts" +bklog "[!] Removing all Kali mounts .." $busybox umount $mnt/dev/pts && echo "unmounted pts" $busybox umount $mnt/dev && echo "unmounted dev" $busybox umount $mnt/proc && echo "unmounted proc" $busybox umount $mnt/sys && echo "unmounted sys" $busybox umount $mnt/system && echo "unmounted system" -$busybox umount $mnt/sdcard && echo "unmounted sdcard" +$busybox umount $mnt/sdcard && echo "unmounted $mnt$sdcard" $busybox umount $mnt/external_sd && echo "unmounted external_sd" +if [ $($busybox umount $mnt 2>&1 > /dev/null) ]; then + bklog " [-] Unable to umount the kali chroot image." + bklog " [-] Please close all the kali terminals and umount all the mointpoint on kali chroot first then try again." +else + bklog "unmounted kali-armhf" +fi + +if [ -d "$mnt/dev" ]; then + rmdir $mnt/dev +fi + +if [ -d "$mnt/proc" ]; then + rmdir $mnt/proc +fi + +if [ -d "$mnt/sys" ]; then + rmdir $mnt/sys +fi + +###### umount the chroot as well if it is being mounted. Here the directory method will not be affected. ###### +if [ "$(losetup -a | grep $chroot_image)" ]; then + if [ "$($busybox umount $mnt 2>&1 > /dev/null)" ]; then + bklog "[-] Unable to umount the kali chroot image." + bklog "[!] If so, please try to close all the kali terminals first, secondly manually umount all the mointpoints on kali chroot, and lastly kill all the running services like ssh, vnc, webservice etc..." + else + bklog "[+] umounted kali-armhf" + fi +fi + +# Run e2fsck everytime we umount the kali chroot image on enrypted device. +if [ -f "$chroot_image" ]; then + bklog "[!] Running e2fsck to check image $chroot_image.." + e2fsck -y $chroot_image +fi + +# Check again if chroot image is really umounted. +if [ "$(losetup -a | grep $chroot_image)" ]; then + bklog "[!] $mnt is still being mounted. Something is wrong!" && read +fi + export PATH=$PRESERVED_PATH diff --git a/assets/scripts/setHID b/assets/scripts/setHID new file mode 100644 index 0000000..8c0ab13 --- /dev/null +++ b/assets/scripts/setHID @@ -0,0 +1,5 @@ +#!/system/bin/sh +unset LD_PRELOAD + +current_state="$(getprop sys.usb.state)" +usb_state=("mtp" "adb" "rndis" "rndis,adb" "") diff --git a/assets/scripts/sqlite3 b/assets/scripts/sqlite3 new file mode 100644 index 0000000..2c1f671 Binary files /dev/null and b/assets/scripts/sqlite3 differ diff --git a/assets/scripts/start-apache b/assets/scripts/start-apache index 923a03e..2132b64 100755 --- a/assets/scripts/start-apache +++ b/assets/scripts/start-apache @@ -1,5 +1,3 @@ unset LD_PRELOAD -/system/xbin/chroot /data/local/nhsystem/kali-armhf /bin/bash -c "chmod 777 /dev/null" -LANG=C PATH=$PATH:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /system/xbin/chroot /data/local/nhsystem/kali-armhf /usr/sbin/apachectl start - - +busybox chroot /data/local/nhsystem/kali-armhf /bin/bash -c "chmod 777 /dev/null" +busybox chroot /data/local/nhsystem/kali-armhf /bin/bash -c "/etc/init.d/apache2 start" diff --git a/assets/scripts/start-beef-xss b/assets/scripts/start-beef-xss index 95a9604..6d650f4 100755 --- a/assets/scripts/start-beef-xss +++ b/assets/scripts/start-beef-xss @@ -1,6 +1,6 @@ unset LD_PRELOAD -chroot /data/local/nhsystem/kali-armhf /bin/bash -c "chmod 777 /dev/null" -chroot /data/local/nhsystem/kali-armhf /bin/bash -c "/etc/init.d/beef-xss start" -sleep 35 -am start -a android.intent.action.VIEW -d http://127.0.0.1:3000/ui/panel +busybox chroot /data/local/nhsystem/kali-armhf /bin/bash -c "chmod 777 /dev/null" +busybox /data/local/nhsystem/kali-armhf /bin/bash -c "/etc/init.d/beef-xss start" +sleep 10 +am start -a android.intent.action.VIEW -d http://127.0.0.1:3000/ui/authentication diff --git a/assets/scripts/start-dnsmasq b/assets/scripts/start-dnsmasq index 97f8b99..107166c 100755 --- a/assets/scripts/start-dnsmasq +++ b/assets/scripts/start-dnsmasq @@ -1,3 +1,3 @@ unset LD_PRELOAD -chroot /data/local/nhsystem/kali-armhf /bin/bash -c "chmod 777 /dev/null" -chroot /data/local/nhsystem/kali-armhf /bin/bash -c "/etc/init.d/dnsmasq start" +busybox chroot /data/local/nhsystem/kali-armhf /bin/bash -c "chmod 777 /dev/null" +busybox chroot /data/local/nhsystem/kali-armhf /bin/bash -c "/etc/init.d/dnsmasq start" diff --git a/assets/scripts/start-hostapd b/assets/scripts/start-hostapd index fb19b3d..c133c09 100755 --- a/assets/scripts/start-hostapd +++ b/assets/scripts/start-hostapd @@ -1,4 +1,3 @@ unset LD_PRELOAD -chroot /data/local/nhsystem/kali-armhf /bin/bash -c "chmod 777 /dev/null" -{ chroot /data/local/nhsystem/kali-armhf /usr/sbin/hostapd /etc/hostapd/hostapd.conf >/dev/null 2>&1 /dev/null 2>&1 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/res/layout/deauth.xml b/res/layout/deauth.xml index bcbb3d9..b6e57ee 100644 --- a/res/layout/deauth.xml +++ b/res/layout/deauth.xml @@ -23,6 +23,7 @@ + android:text="Duckyscripts" /> + + + android:layout_height="38dp" /> - \ No newline at end of file + diff --git a/res/layout/metapackagechooser.xml b/res/layout/metapackagechooser.xml index 50cc045..6dac59a 100644 --- a/res/layout/metapackagechooser.xml +++ b/res/layout/metapackagechooser.xml @@ -26,8 +26,13 @@ android:checked="true" android:layout_width="match_parent" android:layout_height="wrap_content" - android:text="kali-linux-nethunter" /> + android:text="FixedUpdatingToLatestKali" /> + + + - \ No newline at end of file + diff --git a/res/layout/nethunter.xml b/res/layout/nethunter.xml index 0439cb2..981285b 100644 --- a/res/layout/nethunter.xml +++ b/res/layout/nethunter.xml @@ -54,15 +54,7 @@ - - + android:id="@+id/listViewHid" /> - diff --git a/res/values/config.xml b/res/values/config.xml new file mode 100644 index 0000000..e1f39db --- /dev/null +++ b/res/values/config.xml @@ -0,0 +1,5 @@ + + + false + + diff --git a/res/values/strings.xml b/res/values/strings.xml index 5c329f7..76e6d09 100644 --- a/res/values/strings.xml +++ b/res/values/strings.xml @@ -113,6 +113,7 @@ Custom MAC Nethunter: auto-running startup scripts Uh oh! Nethunter can\'t find busybox! + Read-only Random MAC Custom MAC @@ -124,6 +125,25 @@ rndis0 (USB > Ethernet) usb0 (USB > Ethernet Nexus7 2013 when tethering | badusb) + + Reset + mtp,hid + hid + mass_storage + rndis + hid,mass_storage + rndis,hid + rndis,mass_storage + rndis,hid,mass_storage + + + Windows + Mac OS + + + No adb + adb + Written by @byt3bl33d3r, MITMf aims to provide a one-stop-shop for Man-In-The-Middle and network attacks while updating and improving existing attacks and techniques. diff --git a/src/com/offsec/nethunter/AppNavHomeActivity.java b/src/com/offsec/nethunter/AppNavHomeActivity.java index 5d3e534..4204063 100644 --- a/src/com/offsec/nethunter/AppNavHomeActivity.java +++ b/src/com/offsec/nethunter/AppNavHomeActivity.java @@ -485,17 +485,16 @@ private void askMarshmallowPerms(Integer permnum) { 5); } } + // Log.d("HOLA", "CODE0: " + permnum); + // if (ContextCompat.checkSelfPermission(this, + // "com.offsec.nhvnc.permission.OPEN_VNC_CONN") + // != PackageManager.PERMISSION_GRANTED) { + // ActivityCompat.requestPermissions(this, + // new String[]{"com.offsec.nhvnc.permission.OPEN_VNC_CONN"}, + // 6); + // } + //} if (permnum == 6) { - Log.d("HOLA", "CODE0: " + permnum); - if (ContextCompat.checkSelfPermission(this, - "com.offsec.nhvnc.permission.OPEN_VNC_CONN") - != PackageManager.PERMISSION_GRANTED) { - ActivityCompat.requestPermissions(this, - new String[]{"com.offsec.nhvnc.permission.OPEN_VNC_CONN"}, - 6); - } - } - if (permnum == 7) { Log.d("HOLA", "CODE0: " + permnum); if (ContextCompat.checkSelfPermission(this, Manifest.permission.ACCESS_FINE_LOCATION) @@ -505,7 +504,7 @@ private void askMarshmallowPerms(Integer permnum) { 7); } } - if (permnum == 8) { + if (permnum == 7) { Log.d("HOLA", "CODE0: " + permnum); if (ContextCompat.checkSelfPermission(this, Manifest.permission.ACCESS_COARSE_LOCATION) diff --git a/src/com/offsec/nethunter/ChrootManagerFragment.java b/src/com/offsec/nethunter/ChrootManagerFragment.java index 07dbc6b..b6d08e9 100644 --- a/src/com/offsec/nethunter/ChrootManagerFragment.java +++ b/src/com/offsec/nethunter/ChrootManagerFragment.java @@ -82,9 +82,8 @@ * on some devices */ - -public class ChrootManagerFragment extends Fragment { - +public class +ChrootManagerFragment extends Fragment { public static final String MIGRATE_CHROOT_TAG = "MIGRATE_CHROOT_TAG"; public static final String DELETE_CHROOT_TAG = "DELETE_CHROOT_TAG"; @@ -99,13 +98,14 @@ public class ChrootManagerFragment extends Fragment { private static final String URI_MINIMAL = IMAGE_SERVER + FILENAME_MINIMAL; private static final String URI_FULL = IMAGE_SERVER + FILENAME_FULL; + private static final String FILENAME_BACKUP = "kalifs-backup.tar.gz"; private final ShellExecuter x = new ShellExecuter(); /* Certificate pinning openssl s_client -showcerts -connect images.offensive-security.com:443 /dev/null|openssl x509 -outform PEM >mycertfile.pem Generated by tools/pin.py @ https://github.com/moxie0/AndroidPinning */ - private final String[] pins = new String[]{"58abb6b0e372476d592d43893fafb327e3aca769"}; + private final String[] pins = new String[]{"56a771798c059a990c948db4bea5cb5965d875be"}; private String SHA512_MINIMAL; private String SHA512_FULL; private String SHA512; @@ -291,8 +291,15 @@ public void onClick(DialogInterface dialog, int which) { private void downloadOrSdcard() { AlertDialog.Builder adb = new AlertDialog.Builder(getActivity()); - adb.setTitle("Select Chroot install mode:") - .setMessage("Download is the prefered mode. Get the latest chroot from the offsec servers.\n\n Also you can place a custom\nkalifs-[minimal|full].tar.xz in /sdcard\nand skip the download.") + adb.setTitle("Select chroot install mode:") + .setMessage("Download is the prefered mode. Get the latest chroot from the offsec servers.\n\nYou can place a custom\nkalifs-[minimal|full].tar.xz in /sdcard\nand skip the download.\n\nAlso, You can place a back up kalifs-backup.tar.gz in /sdcard to restore your backup chroot.") + .setNegativeButton("Restore from SdCard", new DialogInterface.OnClickListener() { + @Override + public void onClick(DialogInterface dialog, int which) { + dialog.cancel(); + restoreBackup(false); + } + }) .setNeutralButton("Use SdCard", (dialog, which) -> { dialog.cancel(); fullOrMinimal(false); @@ -301,8 +308,9 @@ private void downloadOrSdcard() { dialog.cancel(); fullOrMinimal(true); }); + AlertDialog ad = adb.create(); - ad.setCancelable(false); + ad.setCancelable(true); ad.show(); } @@ -345,6 +353,13 @@ private void fullOrMinimal(final Boolean shouldDownload) { ad.show(); } + private void restoreBackup(final Boolean shouldDownload) { + zipFilePath = nh.SD_PATH + "/" + FILENAME_BACKUP; + if (!shouldDownload) { + UnziptarTask mytask = new UnziptarTask(); + mytask.execute(); + } + } private void addMetaPackages() { //for now, we'll hardcode packages in the dialog view. At some point we'll want to grab them automatically. @@ -390,7 +405,12 @@ private void installAndUpgrade(String packages) { try { Intent intent = new Intent("com.offsec.nhterm.RUN_SCRIPT_NH"); intent.addCategory(Intent.CATEGORY_DEFAULT); - intent.putExtra("com.offsec.nhterm.iInitialCommand", nh.makeTermTitle("Updating") + "apt-get install " + packages + " && echo \"\nKali Linux Nethunter setup is complete.\nEnjoy. (You can close the terminal now)\n\""); + intent.putExtra("com.offsec.nhterm.iInitialCommand", nh.makeTermTitle("Updating") + "echo \"Updating gpg key..\" && wget -q -O - https://archive.kali.org/archive-key.asc | apt-key add && apt-get update && apt-get install " + packages + " -y && apt-get dist-upgrade -y && echo \"\nKali Linux Nethunter setup is complete.\nEnjoy. (You can close the terminal now)\n\""); + if (packages.equals("FixedUpdatingToLatestKali")) { + intent.putExtra("com.offsec.nhterm.iInitialCommand", nh.makeTermTitle("Updating") + "echo \"Updating gpg key..\" && wget -q -O - https://archive.kali.org/archive-key.asc | apt-key add && apt-get update && apt-get install kali-linux-all -y && apt-get dist-upgrade -y && echo \"\nKali Linux Nethunter setup is complete.\nEnjoy. (You can close the terminal now)\n\""); + } else { + intent.putExtra("com.offsec.nhterm.iInitialCommand", nh.makeTermTitle("Updating") + "apt-get update && apt-get install " + packages + " && echo \"\nUpgrade completed.\nEnjoy. (You can close the terminal now)\n\""); + } Log.d("PACKS:", "PACKS:" + packages); startActivity(intent); @@ -433,15 +453,17 @@ private boolean isExternalStorageWritable() { private void deleteFile(String filePath) { File checkFile = new File(filePath); - if (checkFile.exists()) { - statusLog(filePath + " found."); - statusLog(getActivity().getString(R.string.deletingforroom)); - if (checkFile.delete()) { - statusLog("File deleted."); - return; - } else { - statusLog(getActivity().getString(R.string.problemdeletingoldfile)); - return; + if (!filePath.contains("kalifs-backup.tar.gz")){ + if (checkFile.exists()) { + statusLog(filePath + " found."); + statusLog(getActivity().getString(R.string.deletingforroom)); + if (checkFile.delete()) { + statusLog("File deleted."); + return; + } else { + statusLog(getActivity().getString(R.string.problemdeletingoldfile)); + return; + } } } } @@ -605,6 +627,8 @@ protected void onPreExecute() { pd = new ProgressDialog(getActivity()); pd.setTitle(getActivity().getString(R.string.installing_notice)); pd.show(); + pd.setCancelable(false); + pd.setCanceledOnTouchOutside(false); statusLog(getActivity().getString(R.string.unzippinganduntarring)); super.onPreExecute(); } @@ -628,13 +652,18 @@ protected Boolean doInBackground(Void... Void) { String fExists = x.RunAsRootOutput("[ -f " + zipFilePath + " ] && echo \"1\" || echo \"0\""); if (fExists.equals("0")) { - Log.d(TAG, "Error: No tar.xz found"); + if ( zipFilePath.contains("tar.gz")) Log.d(TAG, "Error: No tar.gz found"); + else Log.d(TAG, "Error: No tar.xz found"); publishProgress("Error: Missing file: " + zipFilePath + " not found."); return false; } // Decompress, extract, and deploy the .tar.xz to the chroot destination in one step publishProgress(getActivity().getString(R.string.extract_chroot)); - x.RunAsRootWithException(nh.whichBusybox() + " tar -xJf '" + zipFilePath + "' -C '" + nh.NH_SYSTEM_PATH + "'"); + if ( zipFilePath.contains("tar.gz")) { + x.RunAsRootOutput(nh.whichBusybox() + " tar -xzf '" + zipFilePath + "' -C '" + nh.NH_SYSTEM_PATH + "'"); + } else { + x.RunAsRootOutput(nh.whichBusybox() + " tar -xJf '" + zipFilePath + "' -C '" + nh.NH_SYSTEM_PATH + "'"); + } } catch (RuntimeException e) { Log.d(TAG, "Error: ", e); publishProgress("Error: " + e.toString()); @@ -728,8 +757,8 @@ protected String doInBackground(String... sUrl) { JSONObject jsonObject; try { jsonObject = new JSONObject(jsonstring); - SHA512_FULL = jsonObject.getString("chroot_sha512_full"); - SHA512_MINIMAL = jsonObject.getString("chroot_sha512_min"); + SHA512_FULL = "1c981b91b188488aec143a94d79aa2e7d81fd01badea99ff9b5a4c21ed588b485f8cadcf2edcb0ff26f3c6def3ca27beb8d60f8712c3dadf8d0ed41198dcb8c7"; + SHA512_MINIMAL = "805f5e4dccb8468f53f670346771880b011e1819bd251b6be2f3a8c2e275c87d96ca91ff8916872abfbc68e17c60886ecae0b2be0de6f7ebe7e84945c7de5ccb"; if (isFull) { // asign the value so the integryty check works ^^ SHA512 = SHA512_FULL; diff --git a/src/com/offsec/nethunter/CustomCommandsFragment.java b/src/com/offsec/nethunter/CustomCommandsFragment.java index 7dd6c44..8b58aaa 100644 --- a/src/com/offsec/nethunter/CustomCommandsFragment.java +++ b/src/com/offsec/nethunter/CustomCommandsFragment.java @@ -370,6 +370,8 @@ private void setUpInitialCommands() { database.addCommand("Wlan1 Monitor Mode", nh.makeTermTitle("Wlan1 Monitor UP") + "sudo ifconfig wlan1 down && sudo iwconfig wlan1 mode monitor && sudo ifconfig wlan1 up && echo \"wlan1 Monitor mode enabled\" && sleep 3 && exit", "INTERACTIVE", "KALI", 0); database.addCommand("Launch Wifite", nh.makeTermTitle("Wifite") + "wifite", "INTERACTIVE", "KALI", 0); database.addCommand("Dump Mifare", nh.makeTermTitle("DumpMifare") + "dumpmifare.sh", "INTERACTIVE", "KALI", 0); + database.addCommand("Backup Kali chroot", nh.makeTermTitle("Backup_Kali_Chroot") + "echo \"Creating kalifs-backup.tar.gz in your /sdcard folder.\" && su -c 'bootkali backup-chroot kalifs-backup.tar.gz'", + "INTERACTIVE", "ANDROID", 0); } } diff --git a/src/com/offsec/nethunter/DuckHunterFragment.java b/src/com/offsec/nethunter/DuckHunterFragment.java index f53ab7a..f1b4c1e 100644 --- a/src/com/offsec/nethunter/DuckHunterFragment.java +++ b/src/com/offsec/nethunter/DuckHunterFragment.java @@ -35,6 +35,7 @@ import java.io.IOException; import java.io.InputStreamReader; import java.io.OutputStreamWriter; +import java.util.ArrayList; import androidx.appcompat.app.ActionBar; import androidx.appcompat.app.AlertDialog; @@ -57,6 +58,7 @@ public class DuckHunterFragment extends Fragment implements ActionBar.TabListene private static final String TAG = "DuckHunterFragment"; private static NhPaths nh; private static String prwText = ""; + private boolean isHIDenable = false; public DuckHunterFragment() { } @@ -88,6 +90,7 @@ public void onPageSelected(int position) { }); setHasOptionsMenu(true); sharedpreferences = getActivity().getSharedPreferences("com.offsec.nethunter", Context.MODE_PRIVATE); + check_HID_enable(); return rootView; } @@ -159,24 +162,35 @@ private void setLang() { public boolean onOptionsItemSelected(final MenuItem item) { switch (item.getItemId()) { case R.id.duckConvertAttack: - setLang(); - nh.showMessage("Launching Attack"); - if (getView() == null) { - return true; - } - final View v = getView(); - new Thread(() -> { - if (shouldConvert) { - convert(); - try { - Thread.sleep(2000); // Slow down - } catch (InterruptedException e) { - e.printStackTrace(); + if (isHIDenable) { + setLang(); + nh.showMessage("Launching Attack"); + if (getView() == null) { + return true; + } + final View v = getView(); + new Thread(new Runnable() { + public void run() { + if (shouldConvert) { + convert(); + try { + Thread.sleep(2000); // Slow down + } catch (InterruptedException e) { + e.printStackTrace(); + } + start(); + v.post(new Runnable() { + @Override + public void run() { + nh.showMessage("Attack launched!"); + } + }); } } - start(); - v.post(() -> nh.showMessage(getString(R.string.attack_launched))); - }).start(); + }).start(); + } else { + nh.showMessage_long("HID interfaces are not enabled or something wrong with the permission of /dev/hidg*, make sure they are enabled and permissions are granted as 666"); + } return true; case R.id.chooseLanguage: @@ -208,7 +222,7 @@ private static void convert() { ShellExecuter exe = new ShellExecuter(); if (updatefile()) { String[] command = new String[1]; - Log.d("LANGGG", lang); + Log.d(TAG, lang); command[0] = "su -c '" + nh.APP_SCRIPTS_PATH + "/bootkali duck-hunt-convert " + lang + " /sdcard/nh_files/modules/duckconvert.txt " + "/opt/" + DuckHunterPreviewFragment.configFileFilename + "'"; @@ -344,6 +358,7 @@ public View onCreateView(LayoutInflater inflater, ViewGroup container, EditText source = rootView.findViewById(R.id.editSource); + String duckyscript_file[] = getDuckyScriptFiles(); source.addTextChangedListener(new TextWatcher() { @Override @@ -383,34 +398,33 @@ public void afterTextChanged(Editable s) { // Duckhunter preset spinner templates - Spinner presetSpinner = rootView.findViewById(R.id.duckhunter_preset_spinner); - ArrayAdapter presetAdapter = ArrayAdapter.createFromResource(getActivity(), - R.array.duckhunter_preset_array, android.R.layout.simple_spinner_item); - presetAdapter.setDropDownViewResource(android.R.layout.simple_spinner_dropdown_item); - presetSpinner.setAdapter(presetAdapter); - presetSpinner.setOnItemSelectedListener(new AdapterView.OnItemSelectedListener() { + Spinner duckyscriptSpinner = (Spinner) rootView.findViewById(R.id.duckhunter_preset_spinner); + ArrayAdapter duckyscriptAdapter = new ArrayAdapter(getActivity(), android.R.layout.simple_spinner_item, duckyscript_file); + duckyscriptAdapter.setDropDownViewResource(android.R.layout.simple_spinner_dropdown_item); + duckyscriptSpinner.setAdapter(duckyscriptAdapter); + duckyscriptSpinner.setOnItemSelectedListener(new AdapterView.OnItemSelectedListener() { @Override public void onItemSelected(AdapterView parent, View view, int pos, long id) { - String selectedItemText = parent.getItemAtPosition(pos).toString(); - switch (pos) { - case 0: - break; - case 1: - getPreset("helloworld"); // Hello World! - break; - case 2: - getPreset("osx_perl_reverse_shell"); // OSX Perl: Reverse Shell - break; - case 3: - getPreset("osx_ruby_reverse_shell"); // OSX Ruby: Reverse Shell - break; - case 4: - getPreset("windows_rdp"); // Enable RDP in Windows - break; - case 5: - getPreset("FakeUpdateWin10"); // Open a fake windows 10 update web page - break; - } + //String selectedItemText = parent.getSelectedItem().toString(); + getPreset(duckyscriptSpinner.getSelectedItem().toString()); + //switch (pos) { + // case 0: + // break; + // case 1: + // getPreset("helloworld"); // Hello World! + // break; + // case 2: + // getPreset("osx_perl_reverse_shell"); // OSX Perl: Reverse Shell + // break; + // case 3: + // getPreset("osx_ruby_reverse_shell"); // OSX Ruby: Reverse Shell + // break; + // case 4: + // getPreset("windows_rdp"); // Enable RDP in Windows + // break; + // case 5: + // getPreset("fake_win10_update"); + //} } @Override @@ -547,13 +561,26 @@ public void onActivityResult(int requestCode, int resultCode, Intent data) { } } + + private String[] getDuckyScriptFiles() { + ArrayList result = new ArrayList(); + File script_folder = new File("/sdcard/nh_files/duckyscripts"); + File[] filesInFolder = script_folder.listFiles(); + for (File file : filesInFolder) { + if (!file.isDirectory()) { + result.add(file.getName()); + } + } + return result.toArray(new String[0]); + } } //end of class public static class DuckHunterPreviewFragment extends Fragment { // Error reading chroot_path - public static final String configFilePath = nh.CHROOT_PATH + "/opt/"; + //public static final String configFilePath = nh.CHROOT_PATH + "/opt/"; + public static final String configFilePath = "/data/local/nhsystem/kali-armhf/opt/"; public static final String configFileFilename = "duckout.sh"; @Override @@ -611,4 +638,21 @@ public void readFileForPreview() { } } + + + private void check_HID_enable() { + new Thread(new Runnable() { + public void run() { + ShellExecuter exe_check = new ShellExecuter(); + String hidgs[] = {"/dev/hidg0", "/dev/hidg1"}; + for (String hidg : hidgs) { + if (!exe_check.RunAsRootOutput("su -c \"stat -c '%a' " + hidg + "\"").equals("666")) { + isHIDenable = false; + break; + } + isHIDenable = true; + } + } + }).start(); + } } diff --git a/src/com/offsec/nethunter/HidFragment.java b/src/com/offsec/nethunter/HidFragment.java index dee6018..ee95862 100644 --- a/src/com/offsec/nethunter/HidFragment.java +++ b/src/com/offsec/nethunter/HidFragment.java @@ -53,6 +53,7 @@ public static HidFragment newInstance(int sectionNumber) { fragment.setArguments(args); return fragment; } + private boolean isHIDenable = false; @Override public View onCreateView(LayoutInflater inflater, ViewGroup container, Bundle savedInstanceState) { @@ -74,7 +75,9 @@ public void onPageSelected(int position) { }); setHasOptionsMenu(true); sharedpreferences = getActivity().getSharedPreferences("com.offsec.nethunter", Context.MODE_PRIVATE); + check_HID_enable(); return rootView; + } @@ -98,7 +101,11 @@ public void onPrepareOptionsMenu(Menu menu) { public boolean onOptionsItemSelected(MenuItem item) { switch (item.getItemId()) { case R.id.start_service: - start(); + if (isHIDenable) { + start(); + } else { + nh.showMessage_long("HID interfaces are not enabled or something wrong with the permission of /dev/hidg*, make sure they are enabled and permissions are granted as 666"); + } return true; case R.id.stop_service: reset(); @@ -168,6 +175,7 @@ private void start() { } int UACBypassIndex = sharedpreferences.getInt("UACBypassIndex", 0); + final String[] check_hid_permission = new String[2]; final String[] command = new String[1]; int pageNum = mViewPager.getCurrentItem(); if (pageNum == 0) { @@ -584,5 +592,20 @@ private void loadOptions(final View rootView) { } } + private void check_HID_enable() { + new Thread(new Runnable() { + public void run() { + ShellExecuter exe_check = new ShellExecuter(); + String hidgs[] = {"/dev/hidg0", "/dev/hidg1"}; + for (String hidg : hidgs) { + if (!exe_check.RunAsRootOutput("su -c \"stat -c '%a' " + hidg + "\"").equals("666")) { + isHIDenable = false; + break; + } + isHIDenable = true; + } + } + }).start(); + } } diff --git a/src/com/offsec/nethunter/NetHunterFragment.java b/src/com/offsec/nethunter/NetHunterFragment.java index bd934a5..b56d793 100644 --- a/src/com/offsec/nethunter/NetHunterFragment.java +++ b/src/com/offsec/nethunter/NetHunterFragment.java @@ -3,6 +3,7 @@ import android.content.Context; import android.content.pm.PackageManager; import android.os.Bundle; +import android.os.Build; import android.os.StrictMode; import android.util.Log; import android.view.LayoutInflater; @@ -68,19 +69,6 @@ public View onCreateView(LayoutInflater inflater, ViewGroup container, Bundle sa addClickListener(v -> getExternalIp(), rootView); getInterfaces(rootView); - // HID Switch for newer kernels to turn on HID - HIDSwitch = rootView.findViewById(R.id.hidSWITCH); - HIDSwitch.setOnClickListener(v -> { - - if(HIDSwitch.isChecked()) - { - setHIDON(); - } - else { - setHIDOff(); - } - }); - return rootView; } @@ -124,27 +112,6 @@ public void run() { } - private void setHIDON() { - new Thread(() -> { - try { - Process p = Runtime.getRuntime().exec("su -c getprop sys.usb.config > /data/local/usb.config.tmp && su -c setprop sys.usb.config `cat /data/local/usb.config.tmp`,hid"); - } catch (IOException e) { - e.printStackTrace(); - } - }).start(); - } - - private void setHIDOff() { - new Thread(() -> { - try { - Process p = Runtime.getRuntime().exec("su -c setprop sys.usb.config `cat /data/local/usb.config.tmp` && su -c rm /data/local/usb.config.tmp"); - } catch (IOException e) { - e.printStackTrace(); - } - }).start(); - } - - private void getInterfaces(final View rootView) { nh = new NhPaths(); @@ -325,4 +292,14 @@ private void doCopy(String text) { Toast.makeText(getContext(), "Error copying: " + text, Toast.LENGTH_SHORT).show(); } } -} \ No newline at end of file + private String getDeviceName() { + return Build.DEVICE; + } + + public Boolean isOPO5() { + return getDeviceName().equalsIgnoreCase("A5000") || + getDeviceName().equalsIgnoreCase("A5010") || + getDeviceName().equalsIgnoreCase("OnePlus5") || + getDeviceName().equalsIgnoreCase("OnePlus5T"); + } +} diff --git a/src/com/offsec/nethunter/SearchSploit.java b/src/com/offsec/nethunter/SearchSploit.java index c9bcb47..9908a1b 100644 --- a/src/com/offsec/nethunter/SearchSploit.java +++ b/src/com/offsec/nethunter/SearchSploit.java @@ -25,14 +25,14 @@ public SearchSploit() { } - public SearchSploit(long id, String file, String description, String date, String author, String platform, String type, Integer port) { + public SearchSploit(long id, String file, String description, String date, String author, String type, String platform, Integer port) { this.id = id; this.file = file; this.description = description; this.date = date; this.author = author; - this.platform = platform; this.type = type; + this.platform = platform; this.port = port; } @@ -99,6 +99,4 @@ public Integer getPort() { public void setPort(Integer port) { this.port = port; } - - -} \ No newline at end of file +} diff --git a/src/com/offsec/nethunter/SearchSploitSQL.java b/src/com/offsec/nethunter/SearchSploitSQL.java index 290684d..01ad257 100644 --- a/src/com/offsec/nethunter/SearchSploitSQL.java +++ b/src/com/offsec/nethunter/SearchSploitSQL.java @@ -39,6 +39,7 @@ public void onCreate(SQLiteDatabase database) { SearchSploit.TYPE + " TEXT," + SearchSploit.PORT + " INTEGER)"; database.execSQL(CREATE_SEARCHSPLOIT_TABLE); + database.disableWriteAheadLogging(); } public void onUpgrade(SQLiteDatabase database, int oldVersion, int newVersion) { @@ -170,4 +171,4 @@ private List createStringList(Cursor cursor) { return strList; } -} \ No newline at end of file +} diff --git a/src/com/offsec/nethunter/VNCFragment.java b/src/com/offsec/nethunter/VNCFragment.java index 6374d05..d244a32 100644 --- a/src/com/offsec/nethunter/VNCFragment.java +++ b/src/com/offsec/nethunter/VNCFragment.java @@ -3,6 +3,7 @@ import android.content.Context; import android.content.Intent; import android.content.SharedPreferences; +import android.content.pm.PackageManager; import android.os.Bundle; import android.util.DisplayMetrics; import android.util.Log; @@ -17,6 +18,20 @@ import android.widget.Toast; import com.offsec.nethunter.utils.NhPaths; +import com.offsec.nethunter.utils.ShellExecuter; + +import java.io.File; +import java.nio.file.Files; +import java.nio.file.LinkOption; +import java.nio.file.Path; +import java.nio.file.Paths; +import java.nio.file.attribute.AttributeView; +import java.nio.file.attribute.FileOwnerAttributeView; +import java.nio.file.attribute.GroupPrincipal; +import java.nio.file.attribute.PosixFileAttributeView; +import java.nio.file.attribute.PosixFileAttributes; +import java.nio.file.attribute.UserPrincipal; +import java.util.UUID; import androidx.fragment.app.Fragment; @@ -27,6 +42,7 @@ public class VNCFragment extends Fragment { private String xheight; private String localhostonly = ""; + private boolean isbVNCinstalled = false; NhPaths nh; private static final String ARG_SECTION_NUMBER = "section_number"; @@ -99,6 +115,7 @@ public View onCreateView(LayoutInflater inflater, ViewGroup container, Bundle sa }); + check_bVNC(); return rootView; } @@ -113,29 +130,46 @@ private void intentClickListener_VNC() { return; } - String _R_IP = ((EditText) getView().findViewById(R.id.vnc_R_IP)).getText().toString(); - String _R_PORT = ((EditText) getView().findViewById(R.id.vnc_R_PORT)).getText().toString(); + if (!isbVNCinstalled) { + Toast.makeText(getActivity().getApplicationContext(), "bVNC app not found!", Toast.LENGTH_LONG).show(); + return; + } + + String _R_IP = ((EditText) getView().findViewById(R.id.vnc_R_IP)).getText().toString().replaceAll(" ", ""); + String _R_PORT = ((EditText) getView().findViewById(R.id.vnc_R_PORT)).getText().toString().replaceAll(" ", ""); String _PASSWD = ((EditText) getView().findViewById(R.id.vnc_PASSWD)).getText().toString(); - String _NICK = ((EditText) getView().findViewById(R.id.vnc_CONN_NICK)).getText().toString(); + String _NICK = ((EditText) getView().findViewById(R.id.vnc_CONN_NICK)).getText().toString().replaceAll(" ",""); String _USER = ((EditText) getView().findViewById(R.id.vnc_USER)).getText().toString(); int _RESOLUTION = ((Spinner) getView().findViewById(R.id.resolution_spinner)).getSelectedItemPosition(); + if (!_R_IP.equals("") && !_R_PORT.equals("") && !_NICK.equals("")) { - Intent intent = getActivity().getApplicationContext().getPackageManager().getLaunchIntentForPackage("com.offsec.nhvnc"); - intent.addFlags(Intent.FLAG_ACTIVITY_MULTIPLE_TASK); - intent.putExtra("com.offsec.nhvnc.EXTRA_CONN_DATA", true); - intent.putExtra("R_IP", _R_IP); - intent.putExtra("R_PORT", _R_PORT); - intent.putExtra("PASSWD", _PASSWD); - intent.putExtra("NICK", _NICK); - intent.putExtra("USER", _USER); - intent.putExtra("COLORMODEL", _RESOLUTION); - - startActivity(intent); + + //Intent intent = getActivity().getApplicationContext().getPackageManager().getLaunchIntentForPackage("com.offsec.nhvnc"); + Intent intent = getActivity().getApplicationContext().getPackageManager().getLaunchIntentForPackage("com.realvnc.viewer.android"); + if (intent == null) { + Toast.makeText(getActivity().getApplicationContext(), "Make sure ip,port,nickname & password are not empty!", Toast.LENGTH_LONG).show(); + } else { + ShellExecuter exe = new ShellExecuter(); + String command; + String uuid = UUID.randomUUID().toString(); + command = "su -c '/data/data/com.offsec.nethunter/files/scripts/bootkali vnc start " + uuid + " " + _NICK + " " + _R_IP + " " + _R_PORT + " " + _PASSWD + "'"; + exe.RunAsRootWithException(command); + + //intent.addFlags(Intent.FLAG_ACTIVITY_MULTIPLE_TASK); + //intent.putExtra("com.offsec.nhvnc.EXTRA_CONN_DATA", true); + //intent.putExtra("R_IP", _R_IP); + //intent.putExtra("R_PORT", _R_PORT); + //intent.putExtra("PASSWD", _PASSWD); + //intent.putExtra("NICK", _NICK); + //intent.putExtra("USER", _USER); + //intent.putExtra("COLORMODEL", _RESOLUTION); + //startActivity(intent); + } } } catch (Exception e) { Log.d("errorLaunching", e.toString()); - Toast.makeText(getActivity().getApplicationContext(), "NetHunter VNC not found!", Toast.LENGTH_SHORT).show(); + Toast.makeText(getActivity().getApplicationContext(), e.toString(), Toast.LENGTH_LONG).show(); } } @@ -151,4 +185,15 @@ private void intentClickListener_NH(final String command) { } } -} \ No newline at end of file + private void check_bVNC() { + new Thread(new Runnable() { + public void run() { + ShellExecuter exe_check = new ShellExecuter(); + if (exe_check.RunAsRootOutput("pm list packages | grep com.iiordanov.freebVNC").equals("")) { + isbVNCinstalled = false; + } else isbVNCinstalled = true; + } + }).start(); + } + +} diff --git a/src/com/offsec/nethunter/gps/LocationUpdateService.java b/src/com/offsec/nethunter/gps/LocationUpdateService.java index 1ffb63f..3849470 100644 --- a/src/com/offsec/nethunter/gps/LocationUpdateService.java +++ b/src/com/offsec/nethunter/gps/LocationUpdateService.java @@ -10,6 +10,7 @@ import android.os.Binder; import android.os.Bundle; import android.os.IBinder; +import android.os.StrictMode; import android.util.Log; import com.google.android.gms.common.ConnectionResult; @@ -222,6 +223,13 @@ private void startLocationUpdates() { public void onLocationChanged(Location location) { String nmeaSentence = nmeaSentenceFromLocation(location); + // Workaround to allow network operations in main thread + if (android.os.Build.VERSION.SDK_INT > 8) + { + StrictMode.ThreadPolicy policy = new StrictMode.ThreadPolicy.Builder().permitAll().build(); + StrictMode.setThreadPolicy(policy); + } + if (clientSocket != null) { PrintWriter out = null; @@ -230,6 +238,7 @@ public void onLocationChanged(Location location) { } catch (IOException e) { e.printStackTrace(); } + Log.d(TAG, "NMEA update: "+nmeaSentence); out.println(nmeaSentence); @@ -273,4 +282,5 @@ public void onDestroy() { } super.onDestroy(); } -} \ No newline at end of file +} + diff --git a/src/com/offsec/nethunter/utils/NhPaths.java b/src/com/offsec/nethunter/utils/NhPaths.java index 432e412..d64adbd 100644 --- a/src/com/offsec/nethunter/utils/NhPaths.java +++ b/src/com/offsec/nethunter/utils/NhPaths.java @@ -108,13 +108,21 @@ public void showMessage(String message) { toast.setGravity(Gravity.TOP | Gravity.CENTER_HORIZONTAL, 0, 0); toast.show(); } + public void showMessage_long(String message) { + int duration = Toast.LENGTH_LONG; + Toast toast = Toast.makeText(getAppContext(), message, Toast.LENGTH_LONG); + toast.setGravity(Gravity.TOP | Gravity.CENTER_HORIZONTAL, 0, 0); + toast.show(); + } public String whichBusybox() { String[] BB_PATHS = { "/system/xbin/busybox_nh", "/sbin/busybox_nh", "/system/bin/busybox", "/data/local/bin/busybox", - "/system/xbin/busybox" + "/system/xbin/busybox", + "/data/adb/magisk/busybox", + "/sbin/.magisk/busybox/busybox" }; for (String BB_PATH : BB_PATHS) { File busybox = new File(BB_PATH);