title: Is there a way to download an MMS from command line using curl or wget?
body: <p>I'm doing some Android malware research for MMS based attacks. And I'm looking for a manual way to retrieve or download a received MMS message. I was hoping to find some <code>curl</code> or <code>wget</code> lines to be able to do so, but have not found anything useful. </p>
  
  <p>So far I have got some MMS info from the internal databases, found by:</p>
  
  <pre><code># find / -iname "*.db" |grep -iE "mms|sms"
  ...
  /data/data/com.android.providers.telephony/databases/mmssms.db
  /data/data/com.google.android.gms/databases/icing_mmssms.db
  /data/data/com.android.mms/databases/message.db
  /data/data/com.android.mms/databases/message_glance.db
  
  # cd /data/data/com.android.providers.telephony/databases/
  # echo "select * from pdu;" | sqlite3 -header mmssms.db
  ...
  # echo "select date,sub,ct_l,tr_id from pdu;" | sqlite3 -header mmssms.db
  
    date|sub|ct_l|tr_id
    1495xxxxxx|Download this message|http://mmsc32:10021/mmsc/3_2?Ae_xxxx_xxxxx-xxx|Ae_xxxx_xxxxx-xxx
  </code></pre>
  
  <p>How to interpret the <code>mmsc32:10021</code> part? </p>
  
  <p>Then looking in the message settings for the <code>MMSC</code>, <code>Proxy</code> and <code>port</code>, I want to build a working CLI one-liner or browser request, to download the file for inspection. </p>
  
  <p>In the phone settings settings we can find the MMSC via:</p>
  
  <p><code>Settings &gt; More &gt; Mobile network &gt; Access Point Names &gt; MMS: &lt;your operator&gt;</code></p>
  
  <pre><code>MMSC:       http://mms.company.net:8002/
  MMS Proxy:  194.xx.xx.xx
  MMS Port:   8080
  </code></pre>
  
  <p><strong>How can I download the MMS file from shell command line (or an external browser)?</strong></p>
  
  <p>PS. Obviously the phone is rooted and have both <code>busybox</code> and <code>sqlite3</code>, and perhaps also <code>curl</code> or <code>wget</code> installed. The AOS is 5.0+. </p>
  
  <hr>
  
  <p>Addendum: <strong>2017-11-09</strong></p>
  
  <p>From <a href="https://www.nowsms.com/doc/submitting-sms-messages/sending-mms-notifications-and-content" rel="noreferrer">here</a>: </p>
  
  <blockquote>
    <p>MMS (Multimedia Messaging Service) messages are sent using a
    combination of SMS and WAP technologies. When an MMS message is sent,
    a mobile device receives an MMS notification message via SMS. When
    this MMS notification message is received by the mobile device, the
    mobile device automatically initiates a WAP gateway connection to
    download the content of the MMS message.</p>
    
    <p>To send an MMS message, you must first create an MMS message file. The
    format of an MMS message file is documented in the MMS Encapsulation
    Protocol specification published by the Open Mobile Alliance
    (<a href="http://www.openmobilealliance.org" rel="noreferrer">http://www.openmobilealliance.org</a>) and/or the WAP Forum
    (<a href="http://www.wapforum.org" rel="noreferrer">http://www.wapforum.org</a>). The MMS message file format consists of an
    MMS message binary header, followed by a multipart MIME message where
    the multipart message is encoded in a binary multipart format as
    defined by the WAP Wireless Session Protocol (WSP) specification. This
    binary MMS message file is stored on a web server using a MIME type of
    application/vnd.wap.mms-message and an MMS message type of
    m-retrieve-conf. A subset of the binary MMS header is sent as an MMS
    notification message (MMS message type m-notification-ind) via SMS to
    the mobile device together with a URL pointer to the location of the
    complete message.</p>
  </blockquote>
  
  <p>Also, smartphones does not download the MMS or SMS content to SIM any more. That is how "feature" phones used to do it. </p>
  
  <hr>
  
  <p>Addendum: <strong>2017-11-13</strong></p>
  
  <p>Looking at the API-23 (M) sources for the SQLite3 tables shown in <a href="http://androidxref.com/6.0.1_r10/xref/frameworks/opt/telephony/src/java/android/provider/Telephony.java#1191" rel="noreferrer">Telephony.java</a>, we find that
  <code>CONTENT_LOCATION = "ct_l";</code>, so we can search for its other uses <a href="http://androidxref.com/6.0.1_r10/s?refs=CONTENT_LOCATION&amp;project=frameworks" rel="noreferrer">here</a>. To briefly summarize our findings: </p>
  
  <pre><code>date    # The message delivery time.
  sub     # The subject of the message, if present.
  ct_l    # The Content-Location of the message. A field in interface:Telephony.BaseMmsColumns 
  tr_id   # The transaction-id of the message. 
  </code></pre>
  
  <p>Thus we might expect that the URI in <code>ct_l</code> can be interpreted as follows:</p>
  
  <ul>
  <li><code>http://mmsc32:10021</code> is the server (IP:PORT) masked by the MMS proxy (shown) above</li>
  <li><code>/mmsc/3_2</code> is the WAP URL to the message processor   </li>
  <li><code>?Ae_xxxx_xxxxx-xxx</code> is telling the message processor to retrieve the message given by the "transaction id": <strong>Ae_xxxx_xxxxx-xxx`</strong></li>
  </ul>
  
  <p>Therefore, using the proxy (APN) settings, and using the URL extracted from the message DB (<em>mmssms.db</em>), one should be able to retrieve and download the content of the MMS, using a carefully crafted <code>curl</code> statement.
  Perhaps something like: </p>
  
  <pre class="lang-sh prettyprint-override"><code># curl -x http://proxy_server:proxy_port --proxy-user username:password -L http://url
  curl -v -x http://194.xx.xx.xx:8080 -L http://mmsc32:10021/mmsc/3_2?Ae_xxxx_xxxxx-xxx
  # Or from outside local net:
  curl -v -x http://mms.company.net:8002 -L http://mmsc32:10021/mmsc/3_2?Ae_xxxx_xxxxx-xxx
  </code></pre>
  
  <p>The first one obviously wouldn't work from outside the phone environment as it refers to an IP class C, only visible within the mobile assigned IP. </p>