Metasploit-framework: Android exploits

[AlistairXX]

Are there no new Android exploits...I mean we didn't have any actual updates in our Android exploit database, recently blueborne (no official code available)and quadrooter were the newest exploit...is there any possibility to add new exploits for Android

[timwr]

Pull requests are welcome :)
For quadrooter and a few others there isn't any source code available for the exploit, which is why we haven't added them.

[AlistairXX]

Are there no new updates available for Android because I feel like Android is always left out.....There are many major exploits with source code even available on Cve website

[timwr]

Can you provide some links?

[AlistairXX]

Sure

[AlistairXX]

https://www.exploit-db.com/platform/?p=android

Check this link there are bunch of Android vulnerabilities with source code available (some might not have source code)

[OJ]

Did you just say "can I have some exploits please?"

[AlistairXX]

I just said Android is left out and if possible make some new updates l

[OJ]

When people get time I'm sure they'll get to it. If you're in a rush, feel free to pick one and create a module for it.

[AlistairXX]

But is integrating a exploit...that is already available that difficult?

[OJ]

Hard or not isn't the point. It's a question of time. If it's easy, submit a PR!

[AlistairXX]

Let's see

[wwebb-r7]

There are a few good reasons a lot of the PoC's you see in public repositories never make it past the PoC stage:

• many aren't exploitable in the first place
• the ones that are require a significant time investment, else someone would have done it already
• there is money to be made porting n-day PoC's to fully functional exploits, so I can't fault people for not being generous with their hard work

As mentioned, feel free to submit PR's if you like

[sempervictus]

Regarding the portage from poc to working sploit, its a time consuming and often fruitless endeavor. However, if client engagement permits such activity, starting the port as a PR will get you help with it and get the framework a new module. Its one of the aspects of this community which is overlooked when people think that framework is a product - its not, its an open source project used by a product. That said, the people who work on it range from the freshly initiated to (soon to be) gray ( but already 3ft long) beards. Learning to fish this way yields better long term results than asking for modules to be added as though its a commercial platform. The networking done through this procrss and relationships built can often provide the catalyst of success in later work (some people reading this have pointed me to vectors which led us to success on engagement before, even if they don't know they did). To paraphrase the borg, join us and be assimilated, resistance is counterproductive ;-).

[busterb]

Great discussion guys! I'm going to close this though, since it's not really a specific issue!