es file explorer open port CVE-2019-6447

[h00die]

This module exploits CVE-2019-6447, where Android app ES File Explorer before version 4.1.9.7.5 ran an HTTP server while the app was open, which accepted commands commands to do things like get device info, download files, list apps/files.

Verification

• Install vulnerable app
• Start msfconsole
• use modules/auxiliary/scanner/http/es_file_explorer_open_port
• set rhost
• run
• Verify the action completes as expected (see docs)
• Document no spelling/grammar/syntax bugs

[busterb]

Nice work! With features like these, who needs bugs!

[wvu]

Please add a DisclosureDate.

[wvu]

Btw, when we discussed this in work chat in January, I found this: https://translate.google.com/translate?sl=auto&tl=en&u=https%3A%2F%2Fwww.ms509.com%2F2016%2F03%2F01%2Fes-explorer-vul%2F.

Mar 1, 2016

Independent discovery? cc @fs0c131y

[h00die]

Interesting, 3yr timespan. I'll update references, credit should be given as it references all the same things

[fs0c131y]

Hi,

Yes I found this issue 2 months ago. The PoC I made is available here: https://github.com/fs0c131y/ESFileExplorerOpenPortVuln

Regards

[wvu]

Yes, credit all discoverers, please. Thanks!

[busterb]

Verified locally yesterday, LGTM.

[busterb]

Release Notes

The ES File Explorer Open Port module exploits CVE-2019-6447. The Android app "ES File Explorer," version 4.1.9.7.5 and earlier, runs an HTTP server while the app is open, accepts commands to perform operations such as getting device info, downloading files, and listing apps and files.