Vault7: CIA Hacking Tools Revealed
Navigation: » Latest version
AngerManagement - Under Construction
What is AngerManagerment?
AngerManagement is a collection of Hamr plugins for Android remote exploitation framework.
How to get the AngerManagement project
- In Stash, go to angermanagement_manifest project and copy the link from "Clone" (on the left hand side).
- ie. SSH: ssh://git@stash.devlan.net:7999/droid/angermanagement_manifest.git
- In your desired repo directory:
- repo init -u ssh://stash/droid/angermanagement_manifest.git --no-repo-verify
- repo sync
- source angermanagement/env.sh
**NOTE: AngerMangement repo project contains multiple git projects
Components of AngerManagement
('image' missing)
AngerManagement repo project contains multiple git projects where the goal is to output an executable that builds the necessary plugins for Mission Control (MC) to target a particular Android mobile device. This executable is a python zip file called angerquake, but in the future, it will be renamed to angermanagement to fit with the naming convention of all the plugins. The reason why it's called angerquake is because the first plugin incorporated was Dugtrio, and as a Pokemon, Dugtrio's ability is to quake; therefore, it is named angerquake.
To build a Mission Control Server based on the output of AngerManagement, please see the section "How to Build Mission Control Server using AngerManagement."
To understand what exploits we integrate with AngerManagement (remote exploit, privilege escalation, information leak, etc), please see Android Exploits and Techniques
Plugins / Components:
Enumeration Stage Plugins
- Androidua - A plugin that produces a device enumeration by parsing the browser user agent (UA) to include the device and build info, OS, platform, webkit version, and browser name and version. Written in Python.
-
Information Leak Stage Plugins - To do: define!
- Dugtrio info leak
- Spearow
-
Access Stage Plugins / Remote Execution Exploits (RCE) - To do: define!
-
Remote Code Execution (RCE) Exploits - Helios
- Barracuda - a RCE for Chrome.
- Dragonfly - a RCE for Chrome.
- Orion - a webkit exploit for Android 4.0, 4.1, and 4.2.
- Sparta - a RCE for Chrome.
- Starmie
- Dugtrio access plugin
-
Remote Code Execution (RCE) Exploits - Helios
-
Resource (Hamr) Plugins
-
Privilege Escalation
- Chronos - exploits a vulnerability that affects Android devices running 4.0 and greater using a Qualcomm Snapdragon chipset. A privesc for Samsung GrandPrime and Mini4 devices. Written in C.
- Chronos Suckerpunch
- Flameskimmer - exploits devices which use a Broadcom WiFi chipset. A privesc for Broadcom wifi chipset devices such as Galaxy Note 4. Written in C.
- Flameskimmer Suckerpunch
- Hyperion - covers devices using a Samsung Exynos (version 4212 and greater) chipset.
- Hyperion Suckerpunch
-
Terminal Payloads (aka implants) - To do: define
- Bowtie
- Downloader-client
- Roid Rage installer (supports persistence)
- Suckerpunch-client
-
Long Term Payloads - To do: define!
- Downloader Server
- Suckerpunch Server
- sporker
-
How to build AngerManagement
From your Angermanagement repo directory:
- "make -j all runtests"
- To display verbose, use "V=1" flag ("make V=1 -j all runtests")
Plugins/ Components
- Angry - Written in C.
- Bleak - An infoleak. Written in C.
- Bowtie - A payload survey tool. Written in Java. Non-persitent.
- Debug_log
- Downloader - a Java program that is used to fetch a RoidRage download or an arbitrary payload.
- Dropper - Dropper is a library that adds drop and execute support to those privs that include/need it, such as Bowtie.
- Dugtrio - A plugin --> Part of AM?
- Freedroid - --> Part of AM?
- Googletest - a simple wrapper to get Googletest libs built using NDK.
- Hamdroid - To do!
- Hamrtest - A set of testing resources for hamr plugins
- Hamrtime - a tool to test interactions with all the various Hamr plugins. Its for development/testing purposes and **not** to be released.
- Helios - a family of RCEs that provides the remote access via JavaScript. See above for a list of the RCEs that are part of Helios.
- Hyperion - --> Part of ?
- Legba - a 3rd party utility to wrap elf binaries with a bit shellcode to be run from a browser.
- Makederps - To do!
- Quafflehamr - replaced Mission Control. Hamr is a new framework for packaging and throwing browser exploits and payloads. It includes a set of tools to create HTTPHypertext Transfer Protocol serves used to throw RCEs and a
- RoidRage installer - To do!
- SELinux - To do!
- Sepol_thirdparty - a subproject under the SELinux Project on github.com. It has been slightly modified for AM framework. SEPol is necessary for enumerating, reading, and injecting new rules into an SELinux policy on a device.
- Stringobfuscation - To do!
- Stubbydroid - provides supports utilities for shared objects found on devices such as Libcutils.
- Webutils - To do!
How to deploy AngerManagement
Deployment Notes
On Linux (various flavors), you need to enable UDPUser Datagram Protocol logging for rsyslog.
# enable udp logging in /etc/rsyslog.conf
$ModLoad imuxsock # provides support for local system logging
$ModLoad imklog # provides kernel logging support
# provides UDPUser Datagram Protocol syslog reception
$ModLoad imudp
$UDPServerRun 514
# if on systemd,
*.*; /etc/var/log/messages