Open ADB on the network → device shell

§ Context

Assumed environment: a network-connected Android device (Fire TV, dev tablet, Android Auto unit, kiosk) with adb-over-wifi enabled. Attacker is on the same network.

§ Steps

1. 01
   adb shell + getprop / pm list packagesDiscovery

   T1087— Account Discovery
2. 02
   Recover tokens / DB / keychainCredential Access

   T1552— Unsecured Credentials
3. 03
   nmap for TCP/5555Discovery

   N-NMAP-INTERNAL— Internal Nmap Sweep
4. 04
   adb backup -all → unpack with abeCollection

   MOB-BACKUP-EXTRACT— ADB Backup Extraction
5. 05
   adb connect <device>Initial Access

   MOB-ADB-OPEN— ADB Open on Network

§ References

• T1087Account Discovery
• T1552Unsecured Credentials

§ Frequently asked

What is the "Open ADB on the network → device shell" attack path?

An IoT / dev device left adbd listening on TCP/5555 — anyone on the LAN runs `adb connect` and gets a shell as the shell user, including pulling user data. It chains 5 steps drawn from real-world offensive-security techniques.

What starting position does this attack require?

The first step is adb shell + getprop / pm list packages (T1087) — a discovery primitive. Assumed environment: a network-connected Android device (Fire TV, dev tablet, Android Auto unit, kiosk) with adb-over-wifi enabled.

What is the final impact of this kill-chain?

The final step lands on adb connect <device> (MOB-ADB-OPEN), which falls under Initial Access. From here, an operator typically pivots into post-exploitation or maintains persistence.

How can defenders detect or prevent this attack?

Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

• Shared techniques2

  Unauth DICOM PACS → mass medical-image exfil

  PACS server accepts unauthenticated C-FIND / C-MOVE on port 104 / 11112. Query for every study, pull every image — exfil hundreds of thousands of patient scans + DICOM metadata (PII).

• Shared techniques2

  BACnet HVAC → disrupt building operations

  BACnet on UDP/47808 is unauthenticated. From a foothold in corporate IT, write to HVAC controllers — over-cool a data centre, disable smoke evacuation, mess with elevators.

• Shared techniques2

  z/OS TN3270 → RACF userID brute → mainframe shell

  Internet-/intranet-exposed TN3270 mainframe terminal. Userids follow predictable HR scheme. Brute-force passwords; many environments allow short / dictionary passwords for legacy reasons.

• Shared techniques2

  Reachable Modbus PLC → direct register override

  Modbus has no authentication. From a foothold on a reachable OT network, write to coils / holding registers directly with pymodbus.

• Shared techniques2

  TCC bypass → access Photos / Camera without consent

  Inject into a process that already has Full Disk Access (e.g. backup utility, Terminal). Inherited TCC entitlement lets the attacker code read TCC-gated data — Photos, iMessage DB, Documents.

• Shared techniques2

  npm typosquat → developer workstation → corporate VPN

  Publish a typosquat npm package; the developer's `npm install` runs the postinstall script, exfils SSH keys + VPN profile, then connects to the corporate network.