urbanadventurer/android-pin-bruteforce안드로이드 휴대폰(또는 기기)의 잠금 화면 PIN을 무차별 대입(bruteforce)하여 잠금 해제하세요. Kali Nethunter 휴대폰을 안드로이드 기기용 무차별 PIN 크래킹 도구로 변환하세요! (루트 권한 불필요, ADB 불필요)
잠금 화면 PIN을 무차별 대입하여 Android 휴대폰(또는 기기)을 잠금 해제하세요.
Kali Nethunter 휴대폰을 Android 기기용 무차별 PIN 크래커로 바꿔보세요!
USB OTG 케이블을 사용하여 잠긴 휴대폰을 Nethunter 기기에 연결합니다. 키보드를 에뮬레이션하여 자동으로 PIN을 시도하고, 너무 많은 잘못된 추측 후에 대기합니다.
[Nethunter phone] <--> [USB cable] <--> [USB OTG adaptor] <--> [Locked Android phone]
USB HID Gadget 드라이버는 USB 휴먼 인터페이스 장치(HID)의 에뮬레이션을 제공합니다. 이를 통해 Android Nethunter 기기가 잠긴 휴대폰에 키보드 입력을 에뮬레이션할 수 있습니다. 마치 잠긴 휴대폰에 키보드를 연결하고 키를 누르는 것과 같습니다.
⏱ Samsung S5로 4자리 PIN을 모두 시도하는 데 약 16.6시간이 걸리지만, 최적화된 PIN 목록을 사용하면 훨씬 적은 시간이 소요됩니다.
TBC
스크립트를 /sdcard/에 설치한 경우, 다음 명령어로 실행할 수 있습니다.bash ./android-pin-bruteforce
Note that Android mounts /sdcard with the noexec flag. You can verify this with mount.
Android-PIN-Bruteforce (0.2)는 잠금 화면 PIN을 브루트포싱하여 안드로이드 폰(또는 기기)의 잠금을 해제하는 데 사용됩니다.
자세한 정보: https://github.com/urbanadventurer/Android-PIN-Bruteforce
명령어:
crack PIN 크래킹 시작
resume 선택한 PIN부터 재개
rewind 선택한 PIN부터 역순으로 PIN 크래킹
diag 진단 정보 표시
version 버전 정보를 표시하고 종료
옵션:
-f, --from PIN 이 PIN부터 재개
-a, --attempts 잘못된 시도 횟수 NUM부터 시작
-m, --mask REGEX PIN의 알려진 자릿수에 마스크 사용
-t, --type TYPE PIN 또는 패턴 크래킹 선택
-l, --length NUM NUM 길이의 PIN 크래킹
-c, --config FILE 로드할 설정 파일 지정
-p, --pinlist FILE 사용자 정의 PIN 목록 지정
-d, --dry-run 테스트용 시뮬레이션 실행. 키를 전송하지 않음.
-v, --verbose 상세 로그 출력
사용법:
android-pin-bruteforce <명령어> [옵션]```
## Supported Android Phones/Devices
This has been successfully tested with various phones including the Samsung S5, S7, Motorola G4 Plus and G5 Plus.
It can unlock Android versions 6.0.1 through to 10.0. The ability to perform a bruteforce attack doesn't depend on the Android version in use. It depends on how the device vendor developed their own lockscreen.
Check the Phone Database for more details
https://github.com/urbanadventurer/Android-PIN-Bruteforce/wiki/Phone-Database
## 🎳 PIN Lists
Optimised PIN lists are used by default unless the user selects a custom PIN list.
### Cracking PINs of different lengths
Use the `--length` commandline option.
Use this command to crack a 3 digit PIN,
`./android-pin-bruteforce crack --length 3`
Use this command to crack a 6 digit PIN
`./android-pin-bruteforce crack --length 6`
### Where did the optimised PIN lists come from?
The optimised PIN lists were generated by extracting numeric passwords from database leaks then sorting by frequency. All PINs that did not appear in the password leaks were appended to the list.
The optimised PIN lists were generated from *Ga$$Pacc DB Leak* (21GB decompressed, 688M Accounts, 243 Databases, 138920 numeric passwords).
#### The 4 digit PIN list
The reason that the 4 digit PIN list is used from a different source is because it gives better results than the generated list from *Ga$$Pacc DB Leak*.
`optimised-pin-length-4.txt` is an optimised list of all possible 4 digit PINs, sorted by order of likelihood.
It can be found with the filename `pinlist.txt` at https://github.com/mandatoryprogrammer/droidbrute
This list is used with permission from Justin Engler & Paul Vines from Senior Security Engineer, iSEC Partners,
and was used in their Defcon talk, [Electromechanical PIN Cracking with Robotic Reconfigurable Button Basher (and C3BO)](https://www.defcon.org/html/defcon-21/dc-21-speakers.html#Engler)
### Cracking with Masks
Masks use regular expressions with the standard grep extended format.
`./android-pin-bruteforce crack --mask "...[45]" --dry-run`
- To try all years from 1900 to 1999, use a mask of `19..`
- To try PINs that have a 1 in the first digit, and a 1 in the last digit, use a mask of `1..1`
- To try PINs that end in 4 or 5, use `...[45]`
## 📱 Configuration for different phones
Device manufacturers create their own lock screens that are different to the default or stock Android.
To find out what keys your phone needs, plug a keyboard into the phone and try out different combinations.
Load a different configuration file, with the `--config FILE` commandline parameter.
Example:
`./android-pin-bruteforce --config ./config.samsung.s5 crack`
You can also edit the `config` file by customising the timing and keys sent.
The following configuration variables can be used to support a different phone's lockscreen.
DELAY_BETWEEN_KEYS=0.25
PROGRESSIVE_ARRAY_ATTEMPT_COUNT__________=(1 11 41) PROGRESSIVE_ARRAY_ATTEMPTS_UNTIL_COOLDOWN=(5 1 1) PROGRESSIVE_ARRAY_COOLDOWN_IN_SECONDS____=(30 30 60)
SEND_KEYS_DISMISS_POPUPS_N_SECONDS_BEFORE_COOLDOWN_END=5
SEND_KEYS_DISMISS_POPUPS_AT_COOLDOWN_END="enter enter enter"
KEYS_BEFORE_EACH_PIN="escape enter"
KEYS_STAY_AWAKE_DURING_COOLDOWN="enter"
SEND_KEYS_STAY_AWAKE_DURING_COOLDOWN_EVERY_N_SECONDS=5
DELAY_BEFORE_STARTING=2
KEYS_BEFORE_STARTING="enter"```
We send keys before the end of the cooldown period, or optionally during the cooldown period. This is to keep the lockscreen app active and to dismiss any popups about the number of incorrect PIN attempts or a low battery warning.
Use ssh from your laptop to the NetHunter phone, and use this command to test sending keys:
In this example, the enter key is sent.
echo "enter" | /system/xbin/hid-keyboard /dev/hidg0 keyboard
In this example, ctrl-escape is sent.
echo "left-ctrl escape" | /system/xbin/hid-keyboard /dev/hidg0 keyboard
Note: Sending combinations of keys in config file variables is different. Currently only ctrl_escape is supported.
In this example, keys a, b, c are sent.
echo a b c | /system/xbin/hid-keyboard /dev/hidg0 keyboard
This Android app is a virtual USB Keyboard that you can use to test sending keys.
https://store.nethunter.com/en/packages/remote.hid.keyboard.client/
Use this list for the following variables:
To send special keys use the following labels. This list can be found in the hid_gadget_test source code.