amadeuskonopko / ratsnake

an android debug bridge remote command execution tool

what is rat snake?

-execute commands against android devices using the android debug bridge protocol
-support for proxychains, traffic can be routed through tor network
-support for threading, can target many devices at once
-support for saving command output to file
-support for shell and exec command execution
-supports targeting ipv4 networks or reading targets from a list
-ipv6 not supported
-adb authorization not supported

-how to get device name, model, and features
cat output/results.json | jq -s '.[] | if(has("device_header")) then . else empty end | {ip,device:.device_header|@base64d|split(";")}|{ip,name:.device[0],model:.device[1],device:.device[2],features:.device[3]}'

-how to get results from commands
cat output/results.json | jq -cs '.[] | if(has("cmds")) then . else empty end | {ip,command:.cmds[],device:.device_header|@base64d|split(";")}|{ip,cmd:.command.cmd,output:.command.data|@base64d,name:.device[0],model:.device[1],device:.device[2],features:.device[3]}' | jq -s '.'

-find devices that are secured
cat output/results.json | jq 'if(.secured) then . else empty end'

-look at unique list of packages
cat output/online-packages.json | jq -c '{ip,cmd:.cmds[]} | {ip,cmd:.cmd.cmd,output:.cmd.data|@base64d}| if(.output|test("^Error")) then empty else . end | {ip,package:.output|split("package:")[]} | if(.package|test("^/")) then .package=(.package|split("=")[1]) else . end | {ip,package:.package|rtrimstr("\n")|rtrimstr("\r")}|.package' | sort | uniq -c | sort -n

-format results into csv
cat output/results.json | jq -cs '.[] | if(has("device_header") and has("cmds")) then . else empty end | {ip,cmds,device:.device_header|@base64d|split(";")}|{ip,cmds,name:.device[0],model:.device[1],device:.device[2],features:.device[3]} | {ip:(.ip|rtrimstr("\n")),device,model,features,cmd:(.cmds[]|.cmd),output:(.cmds[]|.data|@base64d)}|[.ip,.device,.model,.features,.cmd,.output]' | jq -c '.'