All language subtitles for 9. Backdooring a Legitimate Android App

In this video, I'd like to show you how to embed evil code into Android apps.

So that when the app is executed on an Android device, the user will see a normal app or normal game

that they can use but at the same time our backdoor will run at the background

and will have full control over that Android device, whether it's a phone, a tablet

or anything that runs Android.

Now doing this is actually not very hard and the first step is you want to go

and download the application that you want the target person to see,

so you want to social engineer them to install that application.

You can use any application you want, so you can just use an application for a restaurant, for example,

and then social engineer your target to install that app to get a certain offer

or you can just backdoor a game and then pretend to be the target person's friend

and send them that game saying, "Oh, look at my new app or new game."

I'm going to go to this website which is called apkmirror.com to download my apk.

Now there's a lot of websites that allow you to do that, but I choose to use this one

and I'm gonna look for a very simple game called Flappy Bird and you've probably heard of it.

You can see I have the game in here, I'm gonna click on it

and then I'm gonna scroll down and download the apk.

I'm going to click OK to save it and that's it it's saved for me.

So, I'm gonna close this

and if I go to my files, you'll see I'm in my Downloads already and I can see the file right here.

Now I'm going to rename this and I'm just gonna call it 'flappy bird'.

Okay, now this is all good.

Now we can go ahead and generate our backdoor.

We can use TheFatRat to do that and we seen how to install and use TheFatRat before,

but before I do that you need to configure Kali to use Java 8 by default

because by default Kali will use the latest version of Java available

and the latest version cannot be used to recompile the backdoor that we're going to create.

So to change the default version of Java used by Kali you need to type 'update alternatives'

and we're going to say I want to 'config' the 'java' version,

so I'm gonna hit Enter

and as you can see it can list all the Java versions available in Kali Linux

and as you can see we have a star beside the auto mode which we'll choose Java 10 by default.

So what I want to do is I'm going to enter number two to set Kali to use Java 8 by default.

So, all we're gonna do is just enter number 2 and hit Enter.

This will configure Kali to use Java 8 by default

and this way we'll be able to use Kali to decompile the existing apk that we just downloaded

and then inject a backdoor into it and recompile it to an 'apk' again.

Now TheFatRat is going to do all of this for us, like I said.

So, I'm going to navigate to the directory where I have it installed, which is an opt, TheFatRat

and then we're gonna run it as usual by doing ./fatrat.

Now, I want to generate an Android backdoor, so that's going to be number five here

and the first thing it's asking me for my IP address as you can see it's automatically suggesting

that my IP address is this, which is correct.

If you're not sure about your IP address, you can split the screen, run 'ifconfig' and see the IP

and we've seen this before.

And you can probably notice that my IP right now is different than the NAT network IP.

This is because I'm going to be targeting an android device connected to my Wi-Fi network.

Therefore, I set my network settings, so if we go here, go to devices go to network

and click on network settings, you'll see I have the network settings set to use a bridged adapter.

So, basically what I have right now is my host machine and my target Android device

connected both the same Wi-Fi network and this virtual machine Kali is said to use a bridged adapter.

That's why it's getting an IP that is within the subnet of the Wi-Fi network

and this way I'll be able to hack any computer connected to my Wi-Fi network.

Now, you can also run this attack and all the other attacks that you seen so far

on computers connected to different networks,

but we're going to talk about that later on in the course.

For now, we're just gonna focus on hacking computers connected to the same network

or to the NAT network.

So I'm gonna put the IP as shown in here, which is 192.168.0.38,

then it's asking me for the port that I want to use on my payload and I'm gonna set this to '8080'.

Now, it's asking me for the app or the game that I want to backdoor

and as we seen before this is in my Downloads and it's called flappybird.apk

So we're gonna set the path root/Downloads/flappybird.apk.

I'm gonna hit Enter and it's going to ask me what payload do I want to use,

we're going to use android/meterpreter/reverse_http, so I'm gonna put number 1,

then it's gonna ask me for the method that it should use to backdoor the apk

and we're going to use number one for the latest method

and now TheFatRat is going to first of all create an 'apk' backdoor, decompile the app,

decompile the backdoor, inject the app into the backdoor, sign the new backdoored app

and then generate an apk that when executed it'll run the apps that we selected,

but at the same time it'll run our backdoor in the background.

So now the backdoor is generated and as you can see it's giving us the path where the backdoor is stored.

So I'm gonna copy this and then it's asking me if I want to start the listener

and I'm gonna say no because I'm gonna do this manually.

So, that's it we're done.

I'm gonna hit Enter and I'm gonna enter '17' to exit TheFatRat.

Now, I want to copy the backdoor that we just generated to my evil files directory,

but I also want to rename it so we know we can use the 'cp' command to copy,

but we can use the 'mv' command to move, so we're going to move a file to another place

and rename it in the process.

So the file that I want to move is stored in here and it's called app_backdoor.apk

and first of all I want to move this to my var/www/html/evil-files

and I want to call it flappybird.apk.

So, the syntax of this command is very similar to the 'cp' command.

First, you give it the file that you want to move

and second you give it the location where you want to move the file to, follow it by the new file name.

So now when I move this file the app_backdoor.apk, when it goes into my var/www/evil-files,

it'll actually be renamed to flappybird.apk.

So I'm gonna hit Enter and that's moved there and now we're ready to go and test the backdoor,

but before we run it as you know, because we're using a reverse connection,

we need to listen for incoming connections and I spent a full lecture

showing you how to do that using Meatasploit's multi handler.

So, first I'm gonna do 'msfconsole' to run Metasploit

and I've already configured my handler to use the right options.

If you don't remember how to do this,

please go back and refer to the lecture where I show how to use it.

So, right now I'm only gonna do show options to show you the right options,

so like we did before you can see that I'm using an exploit multi handler to listen for incoming connections

and I set my payload to android/meterpreter/reverse_http,

the same payload that I picked when I generated the back door

and this is always the same idea, we always pick in the handler the same payload that we pick

when we generate the back door.

You can also see that I set my LHOST to 192.168.0.38 and the port to '8080',

again, the same options that I said when I created my backdoor.

So I'm just going to exploit to listen for incoming connections now

and that's it we're good to go.

Now let's go to the Android device, download the backdoor and see if it works.

Now, right here I have my HTC One device, it's a real Android device, this is not a virtual machine

and this device is connected to my network.

So I'm gonna go to my browser

and I'm just going to download the file, so I want to go to 192.168.0.38

and I want to download the file from evil-files/flappybird.apk.

Now as you can see the file is downloaded so I'm gonna go from here

and install the file, so I'm just gonna click it to install it

then it's going to show me all the permissions that the file is asking for,

so I'm just going to scroll down and click on install.

Now as you can see we have a normal icon for Flappy Bird and if the now the app is installed.

So you can open it from here or click on done, I'm just going to do done

and then I'm just going to go on all my applications

and you can see I have the app installed here and it's called Flappy Bird.

So, I'm just gonna tap that to run the app

and you see that I'm gonna just gonna get a normal game, that I can play.

Okay, but if we go back to the Kali machine, you'll see that we got a 'meterpreter' session

from the target device, from the target Android device and I can just do 'sysinfo' to confirm that

and as you can see now I managed to gain full access to this Android device.

Now I can access the camera access the mics and messages, access the files

and do anything I want on that device and we managed to do this using a legitimate app

and we injected our code in that app.

So this opens a huge number of attack strategies you can pretend to be a friend

and send an app to the person, you can pretend to be Facebook for example until the person

there is a new update and download it, you can pretend to be a local restaurant

and send the flyer into the house and ask the person to download a file using a QR code.

There is a huge number of ways to use this to hack into your target.

For now we're not talking about delivery methods,

so yeah I just want to show you the whole technique behind it

and as you can see we can hack into any Android phone using any app that we want.