rapid7/metasploit-framework — pull request #3040 by timwr (2014-02-26 14:44:12+00:00)
Title: Android addJavascriptInterface meterpreter

The addjavascriptinterface returns a shell session, however it's not easy to upgrade that session to meterpreter without dropping a root exploit. After these changes it drops a JNI stager which loads a meterpreter session within the vulnerable application. The javapayload pr is here: https://github.com/rapid7/metasploit-javapayload/pull/9

- [ ] use exploit/android/browser/webview_addjavascriptinterface; exploit
- [ ] navigate to the url on a vulnerable Android device/browser
- [ ] a meterpreter session will be opened instead of a shell session
- [ ] webcam_stream should work if the exploited app has camera permissions (most do)