Description
This module exploits an unsafe intent URI scheme and directory traversal found in Android Mercury Browser version 3.2.3. The intent allows the attacker to invoke a private wifi manager activity, which starts a web server for Mercury on port 8888. The webserver also suffers a directory traversal that allows remote access to sensitive files.
By default, this module will go after webviewCookiesChromium.db, webviewCookiesChromiumPrivate.db, webview.db, and bookmarks.db. But if this isn't enough, you can also specify the ADDITIONAL_FILES datastore option to collect more files.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use auxiliary/server/android/mercury_parseurimsf undefined(mercury_parseuri) > show actions ...actions...msf undefined(mercury_parseuri) > set ACTION < action-name >msf undefined(mercury_parseuri) > show options ...show and set options...msf undefined(mercury_parseuri) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub