rapid7/metasploit-framework — pull request #2942 by jvennix-r7 (2014-02-04 20:02:02+00:00)
Title: Android < 4.2 WebView addJavascriptInterface RCE

I was rewiring jduck's [module](https://github.com/jduck/addjsif/) for a side-channel attack on embedded Android WebView components, then noticed this actually gets you a shell on some versions of Android's Browser. So hooray, we now have an android browser exploit. Since it is easy to detect the presence of this vuln from JS code, I added it to browser_autopwn as well. A few other Android third party browsers were also vulnerable (notably baidu and QQ browsers: http://blog.trustlook.com/2013/09/04/alert-android-webview-addjavascriptinterface-code-execution-vulnerability/)

- [ ] Download the Android SDK, download the 4.1.2 SDK (GoogleAPIs version), and create a new 4.1.2 GoogleAPIs 4.1.2 AVD device
- [ ] Run the simulator for the 4.1.2 device, run the msf module. Open the Android Browser app and browse to the URL specified in the module
- [ ] Shells