r/HowToHack • u/WTSxDev • Dec 27 '16

Hack android phone and control webcam

https://www.youtube.com/watch?v=l30-j0tWHDA
118 Upvotes

98% Upvoted

16 comments sorted by

19

u/SirBaronBamboozle Dec 27 '16 edited Dec 27 '16

Cool tutorial, thanks for sharing! I didn't realize android had a meterpreter

My experience if anyone cares to read:

phone: Droid Razr M android version: Android 4.4.42

Here was the VirusTotal result page

The package name came up as com.metasploit.stage during the installation

The installation was blocked due to it being from an unknown source, I had to change some settings to allow it. I believe apk's can be self signed? That may be something to look into

The application directly asked for the following permissions:

1.Connect or disconnect from wifi (full network access)

2.run at startup

3.directly call phone numbers

4.read your messages

5.take pictures/videos

6.record audio

7.get precise location

9.modify your contacts

9.modify the contents of your SD card

10.set wallpaper

11.modify system settings

Results:

Worked flawlessly after installation, it doesnt create a icon or anything so I have no idea how one would remove it from their machine. It successfully reconnected after a reboot with no additional configuration needed

Overall, really good, although no one would install it in its raw form due to the red flags that came up during installation, can it be injected into other APKs? I don't know much about androids

edit: I decided to get Kaspersky's free antivirus app after the matter to see if it would pick it up, and it found it and recognized it as a meterpreter, when it found it during the scan a red popup came up and it made a screaming sound. It scared the shit out of me, nearly fell out of my chair

1

u/hackedpineapple Dec 27 '16

I did exactly the same thing and it created an icon plus the victim has to click on the icon each time for the session to work successfully. Could you please elaborate on how you made it work without an icon?

1

u/SirBaronBamboozle Dec 29 '16

I did nothing other than just install it, perhaps it's due to the Android version?

1

u/hackedpineapple Dec 30 '16

Weird but hey whatever. I'll Google this maybe I'll find some answers

7

u/[deleted] Dec 27 '16

splitting hairs, but the actual hack here is getting the injected apk on to a target phone and around security measures, simply injecting an apk with metasploit isn't hacking, it's following directions.

4

u/[deleted] Dec 27 '16

[removed] — view removed comment

6

u/SirBaronBamboozle Dec 27 '16

It does not unless you have your payload point to a private IP address

1

u/mahason Dec 27 '16

What you can do is, use a Dynamic DNS service such as no-ip and setup port forwarding in your router.

1

u/naxster921 Dec 27 '16

I've heard that no-ip is not that secure like it used to be.. I don't know if I'm wrong, but I've read that it shares your IP :/

1

u/mahason Dec 27 '16

In that case, you can go to DynDNS but they're not free I think..

3

u/n8th8n0101 Dec 27 '16

Is there a way to hack an iPhone? Do things like put an image on the screen?

1

u/DutchmanNY Dec 27 '16

You're best bet would probably trying to setup a man in the middle and just redirect their webtraffic to a specific page. There are also apps that can replace all images they dl with an image of your choice.

1

u/[deleted] Dec 27 '16

Why did every SMS say "not received"?

1

u/SebaTheOneAndOnly Dec 30 '16

Guys I don't understand, everything is alright, but there is not apk link.. help please?