Announcing Mercury v2.1

Installing Modules

In Mercury v2.0, everything became a ‘module’. This allowed us to present a unified interface to all of Mercury’s functionality. This change also allowed you to install new Mercury modules.

As of v2.1, you can now install modules from our online repository, directly within Mercury.

Say, for instance, you are testing a Motorola Xoom FE and you know it may have a root privilege escalation through the cmdclient executable… There’s a Mercury module for that:

mercury> module search cmdclient
metall0id.root.cmdclient
mercury> module install metall0id.root.cmdclient
Processing metall0id.root.cmdclient... Installed.
Successfully installed 1 module, 0 already installed.
mercury> ls cmdclient
exploit.root.cmdclient    Obtain a root shell on an Acer Iconia and various  Motorola devices.

You now have the root exploit available.

Secure Pwning*

In Mercury v2.0 we made it very easy to establish a Mercury session across the Internet (with Infrastructure Mode). The trouble was that Mercury used a clear-text protocol. When communicating with, what is essentially, a back-door on your device, this was not good practice.

In Mercury v2.1 we’ve added two features to address this:

1. all Mercury connections can now be wrapped in SSL This allows you to protect the communication channel between your console and device from interception and tampering.
2. the Mercury Agent can require a password before accepting a connection This prevents unauthorised clients from connecting to your device.

We still recommend disabling Mercury when you are no longer using it.

Turbo-Charged*

We have made a few tweaks to how Mercury handles active network connections. By making it more efficient we have achieved a noticeable improvement in the Agent’s performance. As a result, it is not only faster, but also less liable to be stopped by the Android platform if it is running low on resources.

How do I get it?

You can download it now, from the downloads page.

Please send us your feedback, questions and comments on the new version via Twitter and Github. That way we can get any fixes into Mercury v2.2.

Remember, the more feedback you can let us have the quicker we can compile it into cool new features, functionality and modules for Mercury.

Mercury is the leading Android Security Assessment Framework. It allows security researchers and developers to interact with Android apps as if they were an app on the device, to search for security vulnerabilities, develop exploits and test fixes.

To get these new features you must install the updated Mercury Agent on your Android device or emulator.