rapid7/metasploit-framework — pull request #4186 by jvennix-r7 (2014-11-12 16:01:52+00:00)
Title: Add module for samsung knox android root exploit

Disclosed [here](http://blog.quarkslab.com/abusing-samsung-knox-to-remotely-install-a-malicious-application-story-of-a-half-patched-vulnerability.html) last week.

I wrote this and it behaves like the PoC in the advisory, but I don't have a compatible device to test. Putting this up in case someone has a Samsung Galaxy S4/S5/Ace 4/Note 3 and doesn't mind testing and scrapping/reinstalling the OS afterwards.

Verification
- [ ] set LHOST and run the module
- [ ] On a Samsung Galaxy S4/S5/Ace 4/Note 3, browse to the URL
- [ ] You'll see a prompt to install something official
- [ ] No way! Click no
- [ ] You'll see the prompt again and again
- [ ] Finally give in, click yes
- [ ] Android meterpreter is installed with root permissions
- [ ] session handler successful
- [ ] reinstall your phone's firmware