All language subtitles for 037 Bind a Payload in a Regular APK-subtitle-en

We saw you in a previous lecture how we can create a fake app that includes a payload and how to send

the victim.

And once the victim is told this fake app to his Android device we're going to get.

We will get full access to his device.

Now the only problem with this technique that zap is doing nothing is useless.

So if the victim received such an install it and it's not doing anything most probably he would remove

it even if he's not suspecting that this is a malicious and so what we'll be doing in this picture.

I'm going to show you how to bind a real app with a fake.

Does that include the payload or actually how to include a payload inside it really at all.

Step does that allow you to do that.

I wrote them in a fine which include the lecture so you can download this file.

That explains it step by step how to do it.

Now in general you'll see that there is a different script that allows you to do that and you can use

the scripts that I choose.

Or you can search online for a script but you'll find many scripts that is doing that.

So first what we need to do we need to get a real app.

So to be able to do that you just can't Google it.

Or if you are aware of any website from where you can download the real app you can do that as well.

So I'm going to try to download Noach took a piquet or any games or anything.

You'll find many website that allow you to download a free app.

This is one of them.

Those are regular app which you can really download like a computer to big websites that are free to

download

free a wiki and you can choose the one or search for any renegade.

So this will be the app where we will include the

we will include the militias.

So I click on download.

So it will include the payload inside.

And this is happening when you click on.

And once the app has been downloaded it would show inside's Downloads folder.

Let's go to and that's to download and the app should be here.

Nauts Yeah this is on now now I'm going to copy it and I need to create a folder I'm going to create

a new folder and I'm going to name it anything like on city where I will add this site you.

Now for simplicity because we will be using the command line for doing that.

For simplicity it's better to rename it to an easier instead of having all this fun than you can Gibbs

and him or you can rename it.

It will not change anything.

So I rename it and I'm going to name this app notes

notes again and click on rename.

Now go and put me on it because my terminal and let's go to the folders that we just created 1 2 3.

And unless it's trick the app is it isn't

so sorry.

Then the next step would be to download the script that we would need to use for binding.

The app has a payload.

Now the script name is meet us below it.

A key embed in the payload.

So if you take set and search on Google for this specific script you just in these screen

you can go.

And let's paste it here.

Beatty's

and usually this specific script or most of those clip are located in a folder or in a Web site called

getup.

So get the hub is from where you can get many script that help you see a big library actually for doing

different kinds of attack.

So this is a script as you can see and you can go and download it it and once the script it's downloaded

and it could be downloaded to the same location.

So let's get back to downloads folder.

Getting back to the downloads folder you go.

And this is the script as you can see I'm going to also copy it and add it to my home folder inside

so on to see where I would be paste.

Excellent now.

So getting to the command line that's trigs that's the file is that.

In general this is actually a compressed fine because it's like a zip file like Windows engine or to

be able to uncompress any zip file you just use a common unzip and the filename will unzip and the file

name.

You don't need to read the full name Simitis plate.

And here you go and it has been unzipped it leave my screen and the nets and as soon as you can see

I have to find I have a folder now going back to going into the folders that you just created meta upload.

And lest you find another folder under the name of V-2 going inside this folder because this is where

the program that you can need to embed.

Or I'm sorry to bind the payload inside the application so if you check an s.

Yes this is a fine AP kindled in Bend the pillow and it uses a specific fine now to be able to do the

binding feature.

What I need to do is I need to move this note inside the same folder instead of using the copy command.

And you know using a lot of syntax lets do that manually I'm sorry issues.

Graphically so going here home.

One two three.

Let's take a copy from this one and two we're going to put it inside Simitis ploy 0 2.

And let's end it here.

So now I have a program and the findings are simple.

It doesn't matter where the point is you should have a program and a file inside the simple.

Now let's run the program now for any fine set up.

RB That's mean.

It's a ruby file Ruby is a language.

So to be able to launch to run transit program you need to start by typing groupy and the file name

Ruby and the file name is a B.

And if you put it it continues then you put the aptonym notes took a picture then you typed minus B

minus b.

Man I need for inside this file to bind bedo.

And you put the payload the payload that you'll be using could be Android.

It's the same payload payloads that we used in the lecture where we created the fake payload Android

slash Mr. rate.

Slash really verse those core you see the

oh Sodhi so.

So let me clear the screen because the sims are accidentally free.

And let me repeat the comment one more time blowby.

And then a b that Zenza filename which is no it isn't that and then minus B mean.

I need to bind a payload inside this fight and I need and I will use the payloads that I used in the

previous scenario.

Android meeter

Retha

reverse

is on that score.

The fool comment R-rating insides of files that will attach to the electorate so you don't need to memorize

anything.

TCAP then minus.

And where in minus end do you need to put.

I'm sorry Madison.

And host

and host.

You need to type Z IP obstacle the Linux machine which in my case is 1 and 2 and 6 8 to 1

on my keep doing this mystique I'm so sorry and I'm look is closed.

So that's why whenever I click on any number to return to the previous column.

Ruby Dee Dee Dee and Zen is a fine name notes.

Ricky Martin is the android

and me the

early birds

the birds C C D.

Then we need to the IP so in holes in most school

one mine to look at 1 6 8 1 8 1 0 3 and in poor 1 4 4 1 2 3 years.

Now feel free to choose any party controls for 4:4 you can choose for 4C or for whatever you want you

can use because this port will be open on your colonics machine to accept the connection.

So this is IP of my machine and this is the part of my machine as well.

And then you click on enter.

And as you can see he would bind those two files.

This may take a few minutes so let me like pose the video until everything is set and then I'm going

to show you that the application has been binded with a payload.

I received an error.

It seems that the payloads that I choose was not right.

So you know it's better to take it from here.

Let me repeat it one more time.

So it seems that the panel itself it's it's not right.

Yeah that's it.

Because I choose I forget to put slash Android at the printer and let's do it again.

And let's pause one more time.

As you can see has been created with a different name.

It snowed under is called embedded a key and it should be on the same location.

So let me just use it.

And here is a new app and if I take this app and copy it to the Android device and run it you can see

that it's a regular app but it has a payload inside.

So let me copy it here.

If you don't know how to drag and drop files between Linux and Windows I already explained that in the

previous picture.

So let me just open this.

Android device and B.

And this is the file.

I mean to put it here.

And it says Moby's in.

So let's see.

Who this is.

And it's not bad but notice that when I try to install this application on my device it's asking me

to get permission to get access to my file my documents my pictures everything.

And this is not minute by minute to install the regular run.

He will not request for all those permission.

So by doing that once you install it it will X's your next machine but do not forget to run the handler

as we did on the previous take.