Sheep Shellcode

The hackery blog of Vincent Moscatello.

Nmap on Android

This weekend, I got my first smart phone an Android LGLS740. What I love about android is that it is a Linux based operating system at its core. The very first application I went to download on it was Terminal Emulator for Android (https://play.google.com/store/apps/details?id=jackpal.androidterm&hl=en). This effectively makes the phone a low spec computer you can carry in your pocket.

Although most of applications for android are written in java, It seemed logical that an ELF file should still be able to run so long as I compiled it for the right processor. I explored android’s settings for cpu info but eventually gave up. I was a bit surprised I wasn’t able to find this information under the “Hardware information” setting. I figured it would be much faster to just cat the cpuinfo file in the file system using the terminal app.

1
cat /proc/cpuinfo

Looks like its running ARMv7 rev 3.

Now that I knew which architecture I needed, I actually had to compile the software. This is where I started to encounter a few issues. Turns out cross compiling is signifigantly more invloved than I anticipated. I was very tempted to simply download and run the binaries found here: http://ftp.linux.hr/android/nmap/nmap-6.46-android-arm-bin.tar.bz2

Yet… this was a community donated program that isn’t located in official repositories. The author didn’t even provide an md5 hash. This was also for nmap 6.46 instead of 6.47. Furthermore given the “.hr” domain the binary appeared to be hosted somewhere in croatia? This risk of the program being back doored seemed to be a little out of my comfort zone so I went off and downloaded the nmap sourcecode.

To solve the cross compiling issue I ended up using the android NDK found here: https://developer.android.com/tools/sdk/ndk/index.html

I did a bit more exploring to see if somone had used the NDK to compile nmap before. Turns out they had. https://github.com/kost/nmap-android/Makefile After I read through the Makefile so I had a full understanding of what it was doing, I noticed that there were several issues with it and this was confirmed by other comments on the issues tab. These were issues from 2 years ago which unfortunately were unresolved. Rather than rewriting the make file from scratch I decided to modify the existing make file so it actually worked. You can find it here: https://github.com/quantumvm/AndroidNmap/blob/master/android/Makefile

After running the make file as “make doit” I encountered another issue but this time with the actual NDK itself. Turns out there was an issue caused by bash that was making the script make-standalone-toolchain.sh fail. I located the syntax error at line 723 and changed:

OLD

1
for ABI in $(tr ',' ' ' <<< $ABIS); do

NEW

1
for ABI in $(echo "$ABIS" | tr ',' ' '); do

I then once again ran the make file but this time with the havendk argument: make havendk

SUCCESS the screen filled with a bunch of ascii art that appears when you compile nmap manually. :‘)

I didn’t feel like rooting my phone to get the binary to run. Instead I just copied the binary from my sd card’s Download folder into the Terminal apps home directory located at /data/data/jackpal.androidterm Before the binary could actaully be run it was necissary to run chmod on it. Nmap does have a few dependencies which need to be copied onto the sdcard. Based on our makefile they must be located in /sdcard/opt/nmap-6.47 most notable is the nmap-services file. This has to be located at /sdcard/opt/nmap-6.47/share/nmap