ADB (Android Debug Bridge)
Common Network Port: 5555
The Android Debug Bridge (ADB) is a command-line tool that allows communication with an Android device. If not configured properly, it can be exploited to access sensitive data or even full command of the device.
Connect
ADB devices configured for TCP/IP debugging commonly listen on port 5555. The local ADB server uses port 5037, while adb connect targets the device's network endpoint.
adb connect <ip>:<port>
adb devices
Recon
Identifying an ADB Server
You can use Nmap to check if there's an ADB server on a target host like this:
nmap -p 5555 X.X.X.X
Enumeration
After connecting, you can list detailed device information and check the current user, device model, and Android version:
adb devices -l
adb shell id
adb shell getprop ro.product.model
adb shell getprop ro.build.version.release
Attack Vectors
ADB can be exploited in various ways due to misconfiguration or failure to secure the device properly:
Unrestricted shell access: With an ADB shell, you have Linux command-line access which means you can essentially perform any operation on the device.
Push and Pull data: ADB allows you to transfer data to and from a device. This means you can copy sensitive data or push malicious files.
Post-Exploitation
Ghost Framework
Ghost Framework is an Android post-exploitation framework for interacting with devices over ADB. The current release is installed with pip:
pip3 install git+https://github.com/EntySec/Ghost
ghost
Connect to the device, select the connection, and run device modules from the interactive prompt:
(ghost)> connect <ip>:<port>
(ghost)> devices
(ghost)> interact 0
(ghost: <ip>)> list /
(ghost: <ip>)> shell id
Common ADB Commands
| Command | Description | Usage |
|---|---|---|
adb devices | List of connected Android devices | adb devices |
adb shell | Open a remote shell to the device | adb shell |
adb install <APK> | Install an APK onto the connected device | adb install example.apk |
adb uninstall <PACKAGE> | Uninstall an app from the connected device | adb uninstall com.example.app |
adb pull <REMOTE> <LOCAL> | Copy a file from the device to your computer | adb pull /sdcard/example.txt . |
adb push <LOCAL> <REMOTE> | Copy a file from your computer to the device | adb push example.txt /sdcard/ |
adb logcat | View the device log output | adb logcat |
adb reboot | Reboot the device | adb reboot |
adb shell am start <PACKAGE> | Launch an app on the device | adb shell am start -n com.example.app/.MainActivity |
adb shell pm list packages | List all installed packages on the device | adb shell pm list packages |
adb shell dumpsys | Dump system information | adb shell dumpsys |
adb shell screencap | Capture a screenshot of the device screen | adb shell screencap /sdcard/screen.png |
adb shell input keyevent <KEY> | Simulate a key press on the device | adb shell input keyevent KEYCODE_POWER |