[Tutorial] Setting up Dendroid - RAT for Android

Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />I bring you a tutorial so you can learn how to configure the Android RAT called Dendroid.<br />Download: http://malwares.underc0de.org/?dir=Troyanos/Otros/DenDroid.zip<br /><br />REQUIREMENTS BEFORE STARTING<br /><br />Have a Web Server with PHP and MySQL<br />phpmyadmin<br />OpenJDK JRE x64<br />Java JDK<br /><br />CREATE THE ADMINISTRATION PANEL<br /><br />I have created a subdomain on this website to make the tutorial, called dendroid.hackpuntes.com<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />This subdomain redirects to a folder I set up in public_html/dendroid, the place where we will upload our files.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />I will dedicate the first part of the tutorial to showing you how to create the administration panel of our DENDROID, from which we will be able to control all the devices we have infected.<br /><br />If we decompress our .rar file with the DENDROID source code, we will find 3 folders and one file; we can take a look before starting to set up the panel at the readme.md file, where it explains how to carry out the whole process, albeit in English.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />In the Dendroid Panel folder, we can see the following files:<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Once again we have a readme, this time more specific to help us set up the panel on the web server; first we focus on the Panel folder, which has these files.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />We have to edit, with some text editor, the following files:<br /><br />applysettings.php<br />blockbot.php<br />clearawaiting.php<br />clearmessages.php<br />deletebot.php<br />deletefile.php<br />deletepics.php<br />functions.php<br />table.php<br /><br /><br />and change the value of the variable $url which by default is "Los enlaces son solo para miembros. Registrate o iniciá sesión" to the name of our domain where we will store the control panel, in my case "Los enlaces son solo para miembros. Registrate o iniciá sesión", like this.<br /><br />Before<br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />After<br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />This step must be performed in all the files I described earlier and make sure that all files start with <?php.<br /><br />In addition, in the reg.php file we will change the value of $allowebDomains respecting the www.<br /><br />Before<br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />After<br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br /> Now it's time to modify the following files to set a password:<br /><br />get.php<br />get-functions.php<br />new-upload.php<br />upload-pictures.php<br /><br />We look for the value "keylimepie" and replace it with our password:<br /><br />Before<br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />After<br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />It's time to move to the web server; we need to create a database, with a user with all privileges. We must remember the database name, user, etc. because we will need it later.<br /><br />Depending on the server you use, it is possible that the following steps may change; my web server uses CPanel, in case yours is different and you don't know how to create a database with a user with privileges, contact your hosting's support.<br /><br />Creating the database.<br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Adding a user to the database.<br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Assigning it all privileges.<br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Alright, we already have the database and the user. Now we must create the tables within the database. To create them we'll do the following: inside the "Other Files" folder we have a file called SQL.sql, we open it with the editor and copy everything it contains.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Now we need to go to phpmyadmin, and in the database we created earlier, we have a tab that says SQL, we paste the previous code and execute it.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />The result will be the following tables created.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />It's time to upload all the files we modified earlier via FTP to the server; we can use a program like Filezilla for this, we simply drag the files to the public_html/dendroid folder and it would look like this:<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />We go to the address of our server where we have the folders stored, in my case as I told you earlier I created a subdomain.<br /><br />Therefore we access dendroid.hackpuntes.com where the panel configuration screen will appear, like this:<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />It tells us that it is the first time we access, that we have to create an account for login, enter the database name, the user of said database, and it also tells us that it is optimized to work on Google Chrome, but I have tested it on Mozilla Firefox with no problems.<br /><br />If we click on Begin Setup, we will encounter what is possibly the most important step when creating the administration panel, its configuration.<br /><br />You can leave it as you see in the image, it's what comes by default, and add in the corresponding fields the data it asks us for; luckily we still remember the name we gave the database, the user and the password :).<br /><br />On the right side, you can see with a yellow background the Username and Password fields; this will be the login to be able to access the control panel, nothing to do with the user and pass we created for the database. In addition, it is recommended not to use the same passwords.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Once the fields are filled in, click on the Continue button.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />And it will tell us that everything is complete, click on Finish Setup and the login will appear, we will enter the User and Pass we set in the yellow fields of the configuration step.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />And finally, we are already inside our administration panel, fully configured and ready to create the trojan and manage devices from it.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />COMPILING THE MALICIOUS APK<br /><br />For this part of the tutorial, we will need to have Eclipse + Android SDK installed and have the JDK installed on the system; if you have any kind of problem installing it, you can search on Google, there are thousands of tutorials on how to prepare Eclipse for Android application development.<br /><br />Once we have everything installed on the system, we open our Eclipse and we must import the project, we go to File –> Import.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />The project we have to import is inside the Dendroid APK folder; remember that we have already used the Dendroid Panel folder and we would still need to use one last folder called APKBinder, which is the one needed to "camouflage" our Malicious APK.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Once we click on Import, we must tell Eclipse that it is an existing project, in the Android category.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />In Root Directory we look for the path of the Dendroid APK folder.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />We must make sure that the Copy projects into workspace box is checked, otherwise the Dendroid APK folder will disappear and we will not be able to use it again.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Click on Finish and the Dendroid APK project will appear on the left side of our Eclipse, ready to modify and compile.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />It is good practice to rename projects, I will call it DendroidAPK.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />We are going to modify only the value of 3 variables in the project; these variables are found in the DroidianService.java class, inside the com.connect package and in the src folder.<br /><br />They are called encodedURL, backupURL and encodedPassword; if we look closely, we will see that their value is encoded in Base64.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />We must delete the value of these variables, and leave them empty, as in the following image.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />And what should we put if we left them empty? First we will visit the following website, CRYPO is an online tool to encrypt and decrypt in a multitude of numbering systems; the one we will use will be BASE64, and we must enter the address at which our control panel was installed, remember mine was Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Once we have it entered, we click on the encrypt button and something like this will appear:<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />That String is what we will have to put as the value for the variables encodedURL and backupURL.<br /><br />For the encodedPassword variable we will repeat the same step, but this time we must encrypt the password we set when creating our control panel (the one for which we changed the keylimepie value).<br /><br />It would look like this (obviously with the password added)<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />We already have the project modified, now we must compile it and generate the APK, we go to the File –> Export tab.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />And we tell it that we want an Android Application (APK).<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />We click on Next and in the next window we look for our project.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />The first time, it will ask us for a key; if we already have it we check the Use existing keystore option, otherwise we will create it, we must indicate the location where the key will be saved and set a password (another one different from those used so far).<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />We fill in the fields.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />And finally it will ask us to mark the path where the APK will be generated.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Click on Finish and we already have our malicious APK, ready to infect devices.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión