Turn your Kali NetHunter phone into a brute-force PIN cracker for screen locked Android devices
GPL-3.0 License
β β β β β β β β
To learn about the commands and other usage details Click Here.
It uses a USB OTG cable to connect the locked phone to the Nethunter device.
It emulates a keyboard, automatically tries PINs, and waits after trying too many wrong guesses.
[Nethunter phone] β [USB cable] β [USB OTG adaptor] β [Locked Android phone]
The USB HID Gadget driver provides emulation of USB Human Interface Devices (HID). This enables an Android Nethunter device to emulate keyboard input to the locked phone. It's just like plugging a keyboard into the locked phone and pressing keys.
β³ This takes a bit over 16.6 hours to try all possible 4 digit PINs, but with the optimised PIN list it should take you much less time.
Android-PIN-Bruteforce is used to unlock an Android phone (or device) by bruteforcing the lockscreen PIN.
Find more information at: https://github.com/utsanjan/Android-Pin-Bruteforce
Commands:
crack Begin cracking PINs
resume Resume from a chosen PIN
rewind Crack PINs in reverse from a chosen PIN
diag Display diagnostic information
Options:
-f, --from PIN Resume from this PIN
-m, --mask REGEX Use a mask for known digits in the PIN
-t, --type TYPE Select PIN or PATTERN cracking
-l, --length NUM Crack PINs of NUM length
-d, --dry-run Dry run for testing. Doesn't send any keys.
-v, --verbose Output verbose logs.
Usage:
android-pin-bruteforce <command> [options]
pinlist.txt
is an optimised list of all possible 4 digit PINs,
sorted by order of likelihood. pinlist.txt is from the following:
https://github.com/mandatoryprogrammer/droidbrute
This list is used with permission from Justin Engler & Paul Vines from Senior Security Engineer, iSEC Partners, and was used in their Defcon talk, Electromechanical PIN Cracking with Robotic Reconfigurable Button Basher (and C3BO)
Masks use regular expressions with the standard grep extended format.
./android-pin-bruteforce crack --mask "...[45]" --dry-run
19..
1..1
...[45]
If you installed the script to /sdcard/, you can execute it with the following command.
bash ./android-pin-bruteforce
Note that Android mounts /sdcard with the noexec flag. You can verify this with mount
.
The OTG cable should be connected to the locked Android phone. The regular USB cable should be connected to the Nethunter phone.
Use the diagnostic command.
bash ./android-pin-bruteforce diag
Note that Nethunter USB HID support was inconsistent during testing and development. However after it starts working, it should continue working until you crack the PIN.
If you receive this message when the USB cable is plugged in then try taking the battery out of the locked Android phone and power cycling it.
[FAIL] HID USB device not ready. Return code from /system/xbin/hid-keyboard was 5.
Device not Found
messagesThis works from an Android phone because the USB ports are not bidirectional, unlike the ports on a laptop.
Keys are sent using /system/xbin/hid-keyboard
.
To test this and send the key 1 you can use the following:
echo 1 | /system/xbin/hid-keyboard dev/hidg0 keyboard
Before each PIN, we send the escape and enter keys. This is to keep the Android responsive and dismiss any popups about the number of incorrect PIN attempts or a low battery warning. My original motivation to develop this was to unlock a Samsung S5 Android phone. It had belonged to someone who had passed away, and their family needed access to the data on it. As I didn't have a USB Rubber Ducky or any other hardware handy, I tried using a variety of methods, and eventually realised I had to develop something new.
Work: Andrew Horton designed the Bruteforce tool which helped me a lot to design my piece of Bash Script Click here to visit his Bruteforce Bash Script Repository.
Work: The optimised PIN list is from Justin Engler & Paul Vines from Senior Security Engineer, iSEC Partners and was used in their Defcon talk, Electromechanical PIN Cracking with Robotic Reconfigurable Button Basher and C3BO.
For Queries: My Instagram Profile Check Out My YouTube Channel