‫Instructor: Hi, now we are ready actually.
‫I have sent those links to the victim
‫and I have my ngrok working on my Kali Linux.
‫I am listening for incoming connections
‫with Metasploit 2,
‫and I believe we are ready to test this.
‫So all you have to do is just send a link
‫to your Android device.
‫And again, if you don't have any Android device
‫to test this on, wait for the next next section
‫where you will learn how to use Android emulator.
‫So here we go.
‫In my own Android tablets,
‫I'm downloading this APK as you can see.
‫And once it's ready
‫it will be ready on the downloads folder like this.
‫So if I click on the ngroktest.apk,
‫it will ask me for some kind of permissions
‫and I'm going to say install, okay?
‫So this will install the application on my tablet.
‫And if I say open, then it'll open the application.
‫And at the Kali Linux, as you can see,
‫the Meterpreter session one opened for me.
‫Now I don't see anything on my tablet right now.
‫So if I was a victim I would've thought, yeah,
‫this app doesn't work.
‫But in fact, we managed to hack into that Android device.
‫As you can see, we have the session over here in Kali Linux.
‫So if you hit enter, now the session is opened.
‫In order to reach those sessions you should run sessions.l.
‫So this will list the sessions.
‫As you can see, we have only one and it's an Android device.
‫And you can see the connection is coming to my local host.
‫So if you say sessions -1,
‫so this is the idea of the session,
‫it will go into the Meterpreter session.
‫As you know by now,
‫Meterpreter is the session handler for us.
‫So if I run sysinfo, it will display the information
‫of the victim system like this.
‫So this is an Android device, it runs on 4.4.4 version.
‫And if you run help, it will display the available commands
‫for you to run.
‫And in fact, you have a lot of commands,
‫a lot of options on Meterpreter sessions.
‫So this is the beauty of the Meterpreter.
‫You get to see what are the options
‫and you get to just run them
‫and see the result back in an instant, okay?
‫So you can actually browse through this help documentation
‫of the Meterpreter, so that you can understand
‫what's going on and you can read the descriptions like this.
‫So I'm going to show you some of the most popular ones
‫and you will see there is a section dedicated
‫to Android commands over here.
‫Like you can dump the call logs,
‫you can dump the SMS messages,
‫you can try to send an SMS actually.
‫You can just set the audio mode.
‫You can just set the wake lock or something.
‫And you can actually run ls
‫and browse through the file system
‫of the Android device as well.
‫For example, let me go to cd ..
‫and cd .. one more time.
‫And I believe we are inside of data/data folder right now.
‫If you're in someplace else
‫you can browse through the data/data as well, right?
‫And let me run pwd. Yep, I'm inside of data/data.
‫So let me go to some other command,
‫some other folder over here.
‫Let me go to root folder and run ls to see my options first.
‫Yep, here you go.
‫We have a lot of files and folders over here.
‫I can try to find some sensitive folders and files
‫by just browsing through this file and folder system
‫of the Android device over here.
‫I can download anything I want.
‫I can try to upload new files to the system
‫using this Meterpreter session.
‫And the commands are very basic.
‫You just gonna have to read the description,
‫but it's upload and it's download
‫followed by the file name, okay?
‫So once you get the session
‫it's very easy to move on from here.
‫For example, let me go into SD card, cd sdcard, okay?
‫And if I run ls, I will see the contents of the SD card.
‫Like you can actually reach the music, downloads, movies.
‫Like you can go to downloads for example, or pictures,
‫and try to see the pictures of the user.
‫So let me run a list to see if I have any.
‫Yeah, I have something called IKScreenshots, I believe.
‫Yeah, let me try to download this
‫and you will see what I mean.
‫So download IKScreenshots.
‫And it will download this file for me
‫and save it to my root folder, okay?
‫And you can try to display this
‫within inside your file folder system
‫inside of Kali Linux, obviously.
‫Then let me go back a little bit
‫and let me go into some other folder, like downloads.
‫Okay, I believe it's named Download. Yep.
‫So Download and let me run ls.
‫Here you go, we see our own file, ngroktest.apk.
‫So these are files that our user has been downloading
‫all the way through, right?
‫So as you can see, we managed to hack in
‫and we are browsing through the file and folder system.
‫This is very cool.
‫So there are actually other commands,
‫like sending SMS, or getting the calls,
‫but I don't have any kind of sim card inside of my tablet.
‫It's not even a phone, it's a tablet, like an iPad, okay?
‫So I'm not going to be demonstrating those examples,
‫but if you're doing this for a phone,
‫of course you're more than welcome to test this
‫on your own time.
‫Just sending SMS
‫or trying to get the call logs or something.
‫But as you can see, we have something called webcam_stream.
‫And this is one of the most popular commands.
‫Like you can use this webcam_stream
‫to open actual webcams on computers,
‫but in the devices, mobile devices,
‫it actually opens the camera of the related device.
‫Like if you're on a phone,
‫you can actually see what's going on around the user,
‫around the victim by using this comment.
‫So let me display this.
‫Obviously, I have a camera on my tablet
‫so let me run webcam_stream, with only one M.
‫Okay, let me delete this and hit enter.
‫So this will start a service for me
‫and it will give me some kind of a web link or something,
‫some HTML file for me and I will have to open it.
‫So don't close this and don't hit on any other word
‫or any other key from your keyboard.
‫So this should be running on its own, okay?
‫And copy this selection.
‫So as you can see, this is running some kind of HTML file
‫on my root folder.
‫And if you go to your root folder with your file manager
‫you will see that HTML file.
‫But rather than seeing it, if you open any Firefox tab
‫you can just paste it, okay?
‫And you can just open that HTML file on your own machine.
‫And now I see my tablet phone, or tablet camera,
‫or my phone's camera.
‫As you can see, this is my garden.
‫I'm just holding up the tablet
‫so that you can see what's going on.
‫And let me try to go into the image as well,
‫but I believe...
‫Yeah, it is kind of shady so you cannot see me clearly.
‫But obviously, we managed to hack into,
‫and obviously, we managed to get the phone
‫or tablet camera stream as well.
‫So after you are done with it
‫you can hit Control + C to stop this from streaming, okay?
‫So it'll go back into your session
‫and you can continue whatever you want to do
‫with the Meterpreter session over here.
‫And remember, it actually puts the files on your root,
‫so you can reach those files that you have downloaded
‫or that you have streamed from your root folder later on.
‫So this is kind of cool, right?
‫We managed to hack into the device,
‫we managed to browse all the information,
‫we managed to download whatever we want,
‫and we managed to actually open the camera
‫of the phone as well.
‫So you can try to go into the data of the related apps,
‫like WhatsApp and other apps as well,
‫try to find the logs
‫and try to see if you have anything useful over there.
‫And it's very easy to hack into devices using MSF Linux
‫if you can come up with a good strategy.
‫So beware of the hackers, obviously.
‫So if somebody sends you some APK,
‫don't open it if you don't know them.
‫If you even know them, if you get suspicious,
‫don't open them,
‫because it's very easy to get hacked as you can see.
‫So it's not even easy to hack into the Windows machines
‫because of the defender and other antiviruses.
‫But in Android, in real life,
‫they won't even get detected, okay?
‫So if you send them and if they click on it,
‫it'll just pop open and you will get hacked.
‫So just keep that in mind, if somebody sends you APKs,
‫just don't open them.
‫I suggest you stick to the Play Store.
‫So of course, somebody could have uploaded this
‫to the Play Store as well, but it will get down eventually.
‫It'll be taken down eventually.
‫They generally understand it in a couple of days,
‫so you won't have that kind of risk over there,
‫at least a very high risk.
‫But if somebody sends you some APK through WhatsApp
‫or some other platform, just beware of it.
‫So that's it.
‫We're going to stop here and we are going to start learning
‫about Android development within the next section.