If anyone remembers the Stagefright exploit (CVE-2015-1538 I think) you would remember that it could potentially achieve root access by sending a corrupt video file to an android device running an un-patched version, with no user interaction required.
My question is, has anyone actually ever replicated this exploit, or has it ever been used in a crime that we know of? I can't even try to replicate it because I don't have an android device and you can't send MMS on the android VM.
Forum Thread:
How to Track Who Is Sms Bombing Me .
4
Replies
Forum Thread:
Removing Pay-as-You-Go Meter on Loan Phones.
1
Replies
Forum Thread:
Hydra Syntax Issue Stops After 16 Attempts
3
Replies
Forum Thread:
moab5.Sh Error While Running Metasploit
17
Replies
Forum Thread:
Execute Reverse PHP Shell with Metasploit
1
Replies
Forum Thread:
Install Metasploit Framework in Termux No Root Needed M-Wiz Tool
1
Replies
Forum Thread:
Hack and Track People's Device Constantly Using TRAPE
35
Replies
Forum Thread:
When My Kali Linux Finishes Installing (It Is Ready to Boot), and When I Try to Boot It All I Get Is a Black Screen.
8
Replies
Forum Thread:
HACK ANDROID with KALI USING PORT FORWARDING(portmap.io)
12
Replies
Forum Thread:
Hack Instagram Account Using BruteForce
208
Replies
Forum Thread:
Metasploit reverse_tcp Handler Problem
47
Replies
Forum Thread:
How to Train to Be an IT Security Professional (Ethical Hacker)
22
Replies
Metasploit Error:
Handler Failed to Bind
41
Replies
Forum Thread:
How to Hack Android Phone Using Same Wifi
21
Replies
How to:
HACK Android Device with TermuX on Android | Part #1 - Over the Internet [Ultimate Guide]
177
Replies
How to:
Crack Instagram Passwords Using Instainsane
36
Replies
Forum Thread:
How to Hack an Android Device Remotely, to Gain Acces to Gmail, Facebook, Twitter and More
5
Replies
Forum Thread:
How Many Hackers Have Played Watch_Dogs Game Before?
13
Replies
Forum Thread:
How to Hack an Android Device with Only a Ip Adress
55
Replies
How to:
Sign the APK File with Embedded Payload (The Ultimate Guide)
10
Replies
How To:
Find Identifying Information from a Phone Number Using OSINT Tools
Steganography:
How to Hide Secret Data Inside an Image or Audio File in Seconds
How To:
Intercept Images from a Security Camera Using Wireshark
How To:
Crack SSH Private Key Passwords with John the Ripper
How To:
Use Burp & FoxyProxy to Easily Switch Between Proxy Settings
How To:
Scan for Vulnerabilities on Any Website Using Nikto
How To:
Crack Password-Protected Microsoft Office Files, Including Word Docs & Excel Spreadsheets
How To:
Use Kismet to Watch Wi-Fi User Activity Through Walls
Hack Like a Pro:
How to Find Directories in Websites Using DirBuster
How To:
Spy on Traffic from a Smartphone with Wireshark
How To:
Dox Anyone
How to Hack Wi-Fi:
Stealing Wi-Fi Passwords with an Evil Twin Attack
How To:
Exploit EternalBlue on Windows Server with Metasploit
How To:
Set Up a Wi-Fi Spy Camera with an ESP32-CAM
How To:
Hack Android Using Kali (Remotely)
How To:
Use the Chrome Browser Secure Shell App to SSH into Remote Devices
How To:
Bypass File Upload Restrictions on Web Apps to Get a Shell
Hack Like a Pro:
Cryptography Basics for the Aspiring Hacker
How To:
Scan, Fake & Attack Wi-Fi Networks with the ESP8266-Based WiFi Deauther
How To:
Intercept & Analyze LAN Traffic with a Packet Squirrel & Wireshark
1 Response
From what I understand, the issue is that the exploit only get you remote code execution but then you still have the problem of finding the correct place in the stack to run your code. This is rendered harder by the factor that many of the newer model of android have "anti-stack corrupting" measure, making harder to reliably run your code.
Pair this with the fact that there are 100's of different kinds of android devices that all works differently. To make an exploit that can reliably be used would be hard to say the least.
All that to say that it would take a fairly skilled and dedicated hacker to make something of it.
Cheers,
Washu
Share Your Thoughts