- Hello all, and welcome to the new video of Android Security and Exploitation,
training course by PentesterAcademy. My name is Aditya and I'm your course
instructor for this entire training series. So, in this particular video, we
are going to have a look at how we can exploit webview-based vulnerabilities with
Metasploit. So, in case we have a device, and, maybe, an application which is
vulnerable to webview, we can set up a web server, using Metasploit, which,
basically, intercepts the response and adds some malicious component, which gives
you a reverse Meterpreter session (sp). Now, in case you are not familiar with
Metasploit, it's an exploitation framework, by Rapid7. It has a bunch of
different modules, which you can use for exploitation, so you can exploit, maybe,
networks, web applications, or any other component. So, in this case, we're going
to exploit Android applications. Let's start up the Kali VM. In this particular
video, we are going to switch to another VM, which is known as Kali. So, once you
have downloaded and installed the Kali VM, you then simply go and start up
Metasploit, by typing msfconsole. It might take a bit of time for Metasploit to load
up, so let's just wait for a while. I'll just pause the video and start it back
again. Okay, so now that Metasploit has been loaded, we can go ahead and use the
exploit. So, the exploit module, in this case, is
exploit/android/browser/webview_ addjavascriptinterface. We'll just do use
exploit/android/browser/webview_ addjavascriptinterface. Each module
has different options, which you can see by typing show options, right.
in this case, we see that it has several options, like srvhost, srvport, ssl,
uripath, localhost, and localport. So, first of all, let's go ahead and add the
local host, which is our local IP address, which you can find out by typing ifconfig.
So IP address, for us is 192.168.161.134. I'll just do set lhost this particular IP
address, and let's also go ahead and set up a uripath, which is the path of the web
server, to host a malicious content. So let's give it a name vulnerable, right.
Now, let's start up the exploit. So it says that the server has started, at this
particular URL. Let's, first of all, remove the proxy, so that the connection
doesn't get disconnected in the middle. So, I'll just remove the proxy. And now
I'll start a browser, and go to this particular IP address. So it should be
192.168.161.134:8080/vulnerable, right. If you look over here, there will be a
Metasploit Meterpreter session being open. So it sends the payload, and then we have
the final Meterpreter session opened. Now, Meterpreter is one of most amazing
payloads for Metasploit. So, once the session gets open, we can then interact
with the sessions by giving the session id, which, in this case, is 1. So,
once we are into the Meterpreter, we can execute a bunch of different commands. So,
if you just do a ps, it will show you a list of all the running processes, on the
Android device. Right. So, you have the vulnerable.attify.webviewapp and all these
all other applications. You can also type in a question mark, to give you all the
other commands, which you can use. Also, you can type in shell, to get into the
Android shell, and execute commands over there. So, if you type in id now, it will
give you the id, when being run from the Android shell. So, if you also do a su,
which gives you the root privileges, and then do id, you see that you're now a
root, right. And now, you can basically go to any location of any application. So,
let's for this case, go to vulnerable.attify.webview, which is
located at /data/data. And... So it should be webviewapp, let's fix this, right. So,
we have all the files and folders over here. And I can see any information I want
to. Right? So, this is what you can do with webview-based vulnerabilities. Let's
terminate the channel. If the device is vulnerable, you can also dump all this
information. So, if you simply run this, it says, "No contacts found." See.
If any of these actually work. Do I, actually, have contacts on my device? See.
Phone. Contacts. Let's add a contact. And see, if this one actually works. Any
random number. So, it says that the contacts have been dumped. And
ls. Exit. Exit. Sorry. See, and if you do contacts_dump, you'll have the contact
information here. Right. So, this is how you can play around with Metasploit, and
do a lot of different things. Right. So, that's all for this video, and that's all
for webview-based vulnerabilities. It's one of the most critical vulnerabilities,
which you can try to identify and exploit in a lot of new different
Android applications. So, in case if you have any feedback or queries, feel free to
reach out to me @adi1391 on Twitter, or you can mail me at adi@attify.com.
Thanks for watching the video.