Manually inject a meterpreter payload.

Cristian R. says:

Hi,

Try this: set the <uses-sdk> tag as shown below when tampering the application:

<uses-sdk android:minSdkVersion="22" android:targetSdkVersion="22" />

More details in a below comment started by Rehman and followed up by Mubarak.

Regards,
Cristian

Cristian R. says:

Hi,

Well, you could create and execute a small script that uses the am (activity manager) to constantly start the main activity in the app, which will spawn new meterpreter sessions. However, that will stop working after a shutdown/restart, to really persist control over the device, you would be first required to gain root access; so that you can write a similar script into system/etc/init.d and register the script to start at boot time.

Thanks,
Cristian

Cristian R. says:

Hello Alex,

Since we are tampering the application, you will need to use your own key for signing the resulting application. If you don’t have a key, then you can create it using keytool, with a command similar to this:

keytool -genkey -v -keystore key.keystore -alias alias -keyalg RSA -keysize 2048 -validity 10000

Regards,
Cristian

Cristian R. says:

Hello,

Please check the logs with logcat to check for a more specific error message, the “Not Responding” message is not specific enough to troubleshoot.

Regards,
Cristian

Cristian R. says:

Hi Rehman,

I’m not sure I follow, but, I’ll try to respond. In short, yes, the victim user needs to approve the permissions during installation of the application, this is just how the system works. Now, the delivery method of this attack relies more on the fact that some users just don’t pay attention to what they are accepting to while installing an application. To the keen user, having an application asking for too many or unnecessary permissions should be a red flag.

Regards,
Cristian

Cristian R. says:

Hello Mubarak,

I see, thanks for clarifying, that’s a good question! I think that depends on the API level you are targeting, runtime permissions are required when targeting API 24 and above.

One approach would be to use only the permissions that are strictly required for an attack and add code for requesting runtime permissions for only those (not the entire list we used in the above post).

Now, I was also experimenting with this and might have found a workaround (but it is kind of ugly): when tampering the application, also set the SDK version within the AndroidManifext.xml as follows:

<uses-sdk android:minSdkVersion="23" android:targetSdkVersion="23" />

This will make the application target an API level below API 23 (since we are already tampering the application permissions, why not add our own tag as well?).

This is what I did for an application targeting API level 23 or above:
1. Tampered the application and included the required Android permissions.
2. Re-built the application.
3. After installing and running the application I get the meterpreter session.
4. Try to take photo (webcam_snap).
5. Got Operation failed error message.
6. Checking logcat, this is due to a Permission Denial: can’t use camera (since no runtime permissions were asked).

Now, I do the following for the same application:
1. Tamper the application, include the required Android permissions AND the <uses-sdk> tag as described above.
2. Re-built the application.
3. After installing and running the application I get the meterpreter session.
4. Try to take photo (webcam_snap).
5. Got frame (success).

Regards,
Cristian

Cristian R. says:

Hi,

I’m not sure about this one, I’ve seen similar problems that are related either to AV, network or even when using an old version of metasploit. I’d suggest taking a look at the metasploit logs and see if there is something useful in there (Metasploit Logs).

Regards,
Cristian

Cristian R. says:

Hi,

It looks like your comment got mangled a little bit, I don’t think all the details got through. In any case, with the uses-sdk tag, the idea is that permissions are sort of “auto-allowed” when the application is installing, this is because later SDK versions will also require the application to request permissions at runtime (not only at installation time), which makes the approval of permissions a little more complicated from the attacker’s point of view.

Regards,
Cristian

Cristian R. says:

Hello Shehan,

Difficult to say with only that information. I suggest reviewing the logs with logcat to see what you can find, you can also try generating and installing a pure msfvenom apk payload and check if that works.

Regards,
Cristian

Cristian R. says:

Exactly what the error you are seeing? Please share more details.

Regards,
Cristian

Cristian R. says:

Hi Ahmed,

I read somewhere that youtube was tightening up their policies around hacking material, but not sure exactly what the reasoning behind what to remove or not remove is.

Regards,
Cristian