有没有办法使用curl或wget从命令行下载MMS? [英] Is there a way to download an MMS from command line using curl or wget?

查看：99 发布时间：2020/6/20 19:46:26 android sqlite security mms apn

本文介绍了有没有办法使用curl或wget从命令行下载MMS?的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！

问题描述

我正在针对基于MMS的攻击进行一些Android恶意软件研究.我正在寻找一种手动方式来检索或下载收到的MMS消息.我希望找到一些curl或wget行能够做到这一点，但是还没有发现任何有用的东西.

I'm doing some Android malware research for MMS based attacks. And I'm looking for a manual way to retrieve or download a received MMS message. I was hoping to find some curl or wget lines to be able to do so, but have not found anything useful.

到目前为止，我已经从内部数据库中获得了一些彩信信息，这些信息是通过以下方式找到的:

So far I have got some MMS info from the internal databases, found by:

# find / -iname "*.db" |grep -iE "mms|sms"
...
/data/data/com.android.providers.telephony/databases/mmssms.db
/data/data/com.google.android.gms/databases/icing_mmssms.db
/data/data/com.android.mms/databases/message.db
/data/data/com.android.mms/databases/message_glance.db

# cd /data/data/com.android.providers.telephony/databases/
# echo "select * from pdu;" | sqlite3 -header mmssms.db
...
# echo "select date,sub,ct_l,tr_id from pdu;" | sqlite3 -header mmssms.db

  date|sub|ct_l|tr_id
  1495xxxxxx|Download this message|http://mmsc32:10021/mmsc/3_2?Ae_xxxx_xxxxx-xxx|Ae_xxxx_xxxxx-xxx

如何解释mmsc32:10021部分?

然后在MMSC，Proxy和port的消息设置中查找，我想构建一个可运行的CLI单行或浏览器请求，以下载文件进行检查.

Then looking in the message settings for the MMSC, Proxy and port, I want to build a working CLI one-liner or browser request, to download the file for inspection.

在电话设置设置中，我们可以通过以下方式找到MMSC:

In the phone settings settings we can find the MMSC via:

Settings > More > Mobile network > Access Point Names > MMS: <your operator>

MMSC:       http://mms.company.net:8002/
MMS Proxy:  194.xx.xx.xx
MMS Port:   8080

如何从Shell命令行(或外部浏览器)下载MMS文件?

PS.显然，手机已经扎根，并且同时安装了busybox和sqlite3，并且可能还安装了curl或wget. AOS是5.0+.

PS. Obviously the phone is rooted and have both busybox and sqlite3, and perhaps also curl or wget installed. The AOS is 5.0+.

附录: 2017-11-09

从此处:

使用以下方式发送
MMS(多媒体消息服务)消息 SMS和WAP技术的结合.发送彩信后，移动设备通过SMS接收MMS通知消息.什么时候该MMS通知消息是由移动设备接收的，移动设备会自动启动与之的WAP网关连接下载彩信的内容.

MMS (Multimedia Messaging Service) messages are sent using a combination of SMS and WAP technologies. When an MMS message is sent, a mobile device receives an MMS notification message via SMS. When this MMS notification message is received by the mobile device, the mobile device automatically initiates a WAP gateway connection to download the content of the MMS message.

要发送MMS消息，必须首先创建一个MMS消息文件.这 MMS封装中记录了MMS消息文件的格式开放移动联盟发布的协议规范 ( http://www.openmobilealliance.org )和/或WAP论坛 ( http://www.wapforum.org ). MMS消息文件格式包含 MMS邮件二进制标头，后跟多段MIME邮件，其中多部分消息以二进制多部分格式编码为由WAP无线会话协议(WSP)规范定义.这二进制MMS消息文件使用MIME类型存储在Web服务器上 application/vnd.wap.mms-message和MMS消息类型为 m-retrieve-conf.二进制MMS标头的子集作为MMS发送通过SMS发送通知消息(MMS消息类型为m-notification-ind) 移动设备以及指向该位置的URL指针完整的消息.

To send an MMS message, you must first create an MMS message file. The format of an MMS message file is documented in the MMS Encapsulation Protocol specification published by the Open Mobile Alliance (http://www.openmobilealliance.org) and/or the WAP Forum (http://www.wapforum.org). The MMS message file format consists of an MMS message binary header, followed by a multipart MIME message where the multipart message is encoded in a binary multipart format as defined by the WAP Wireless Session Protocol (WSP) specification. This binary MMS message file is stored on a web server using a MIME type of application/vnd.wap.mms-message and an MMS message type of m-retrieve-conf. A subset of the binary MMS header is sent as an MMS notification message (MMS message type m-notification-ind) via SMS to the mobile device together with a URL pointer to the location of the complete message.

此外，智能手机不再将MMS或SMS内容下载到SIM.这就是功能"手机过去的做法.

Also, smartphones does not download the MMS or SMS content to SIM any more. That is how "feature" phones used to do it.

附录: 2017-11-13

查看，因此我们可以在此处进行搜索.简要总结一下我们的发现:

Looking at the API-23 (M) sources for the SQLite3 tables shown in Telephony.java, we find that CONTENT_LOCATION = "ct_l";, so we can search for its other uses here. To briefly summarize our findings:

date    # The message delivery time.
sub     # The subject of the message, if present.
ct_l    # The Content-Location of the message. A field in interface:Telephony.BaseMmsColumns 
tr_id   # The transaction-id of the message.

因此，我们可能希望ct_l中的URI可以解释如下:

Thus we might expect that the URI in ct_l can be interpreted as follows:

http://mmsc32:10021是上面的MMS代理(如图所示)所掩盖的服务器(IP:PORT)
/mmsc/3_2是消息处理器的WAP URL
?Ae_xxxx_xxxxx-xxx告诉消息处理器检索交易ID"给出的消息: Ae_xxxx_xxxxx-xxx`

http://mmsc32:10021 is the server (IP:PORT) masked by the MMS proxy (shown) above
/mmsc/3_2 is the WAP URL to the message processor
?Ae_xxxx_xxxxx-xxx is telling the message processor to retrieve the message given by the "transaction id": Ae_xxxx_xxxxx-xxx`

因此，使用代理(APN)设置，并使用从消息数据库中提取的URL( mmssms.db )，人们应该能够使用以下方法检索和下载MMS的内容:精心制作的curl语句. 也许像这样:

Therefore, using the proxy (APN) settings, and using the URL extracted from the message DB (mmssms.db), one should be able to retrieve and download the content of the MMS, using a carefully crafted curl statement. Perhaps something like:

# curl -x http://proxy_server:proxy_port --proxy-user username:password -L http://url
curl -v -x http://194.xx.xx.xx:8080 -L http://mmsc32:10021/mmsc/3_2?Ae_xxxx_xxxxx-xxx
# Or from outside local net:
curl -v -x http://mms.company.net:8002 -L http://mmsc32:10021/mmsc/3_2?Ae_xxxx_xxxxx-xxx

第一个显然不能在电话环境之外使用，因为它引用IP类C，仅在移动设备分配的IP中可见.

The first one obviously wouldn't work from outside the phone environment as it refers to an IP class C, only visible within the mobile assigned IP.

有没有办法使用curl或wget从命令行下载MMS? [英] Is there a way to download an MMS from command line using curl or wget?

问题描述

推荐答案

相关文章

移动开发最新文章

热门教程

热门工具

登录关闭

有没有办法使用curl或wget从命令行下载MMS? [英] Is there a way to download an MMS from command line using curl or wget?

问题描述

推荐答案

相关文章

移动开发最新文章

热门教程

热门工具

登录 关闭

登录关闭