MOB-ADB-OPENInitial Access

ADB Open on Network

adbd accepting unauthenticated TCP/5555 — `adb connect` from anywhere on the network grants shell as the shell user.

§ Where this technique fits

MOB-ADB-OPEN is catalogued under the Initial Access tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 2 on average.

§ Dossiers chaining this technique

Open ADB on the network → device shell
An IoT / dev device left adbd listening on TCP/5555 — anyone on the LAN runs `adb connect` and gets a shell as the shell user, including pulling user data.
step 2 / 5

§ What commonly comes next

01
Account Discovery
T1087 · Discovery
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Open ADB on the network → device shell

§ What commonly comes next