Hi and welcome back to our members only exclusive video.
So today we're discussing about very simple trick on how you could actually hide the mobile application,
true matter supply framework.
So we will create a file and once we have created a picture file or install it to a delivery mechanism
from a Web application server into the mobile device, and from there we'll actually issue a command
to actually highlight the mobile app from the user.
And the only way to see that will be to look into the settings of the applications and see what are
some of the running services or running apps that are inside the mobile device.
So without further ado, let us get started on today's tutorial.
So on the left of the screen of colonics running and we can actually go into terminal and once again
terminal, we can zoom in a little and we can enter IP ADR.
So if this we can actually see the IP address of one or two one six eight dot one 11.
So this is the IP address of the attacker server.
So this is also the server where we'll be hosting the listening services coming from Matus blight.
And of course, on the right side of the screen, I actually have an Android mobile device running.
So this is running on the Oracle virtual box.
So this is an android.
It is running over here.
And of course, we were able to surf into the net and we can actually open up browsers and we can actually
go into the Internet and be able to search up on information, say, for example, enter LILIANNA and
we can see the website, a YouTube channel and so on.
So there is Internet connection.
So moving back into colonics, we actually have to use MSN Venom so you can actually enter MSA venom.
Then of course, we would tell you all the parameters and options.
And it's really important, especially when you're learning about cyber security, to try all the tools,
trail all the different parameters and options like the changes in ANOP Slap, for example, over here
that you can see on the length of the slap.
And again, all these are actually being used to help you bypass a lot of these security mechanisms
coming from the antivirus servers and so on.
So really important way for you to really think about cybersecurity in a more advanced level.
And a lot of the advanced level actually requires a lot of trying out tests and aerials, especially
on the fly, trying to find out new ways of bypassing many of these security fences.
So, of course, moving forward, what we'll do is we actually enter terms venom.
And we actually ended up followed by Android Meter Preeta, followed by reverse underscore TCP.
So this would be a reverse shell into the colonics listening server.
And of course we can go into almost equal one or two one six eight one dot 11.
So this is the listening server IP address to be using for mobile port so we can say nine nine nine
nine and of course we can also do a R and we have output to fall into, say, for example, that we
can actually put it in and call a mobile app dot apk and hit enter on that.
So this would generate a fall.
So as you can see on the left side, the file is being generated by mouther venom.
So once you have the file you have to service it and release it over into the mobile application.
And a lot of times a lot of this payloads are actually being really using Web application servers,
using social engineering attacks, using malicious emails and so on.
So a lot of times all this payloads and deliveries are actually used using social engineering to mass
email sending and so on.
So usually that's the case in a lot of the attacks that are happening in the industry and in fact in
the industry.
Most of the time, 99 percent of the time, the attacks are going after vulnerabilities that are really
being available for the past many years instead of the zero day attacks.
And of course, zero day attacks are highly novel, but a generation and a creation of zero day vulnerabilities
and exploits are very challenging.
So anyway, moving forward.
So what we'll do is we can actually go ahead and go into MSF console.
So this was start up to a supply framework.
And once we are in the supply framework, what we'll do is we have to start up the server.
So, of course, once we start up the server, this is the part where we will actually host the listening
server.
And once we hold, the listening server will be able to get ready for any connections coming in.
And what we can do is we can actually enter, use, exploit, multi handler.
So once you do that, all you got to do is move forward and look at show options so you can see what
are the options available.
So you can also specify the kind of payload that we'll be using in this case.
So we can actually go ahead and say that we'll be using the payload so we can enter set payload as Android
meter reader, reverse underscore TCP and we can show options and we have to set the elbow, says one
two one six eight one dot 11.
So this is the Colonics IP address and once you have all this information being set up, you can actually
go and enter exploit.
So this would actually start hosting the server so we can open a terminal again.
So now what we got to do is transfer the file that we've created over here near mobile app ABQ and we
get to transfer it into the mobile application.
So, of course, one of the easiest ways actually stop your own Web application server or you can post
it on like Google Cloud, Microsoft 01 Drive and so on.
So those are other ways of actually sharing those malicious payloads over the Internet.
So these are what hackers are doing right now, because there are a lot of ways that you can actually
do the delivery of it.
So what we do is go into if you see anybody followed by Apache and of course we get Apache to and we
can enter, start, make sure to service it started and of course, would be prompted for the password
of the demonstrators to go ahead and keep that in mind.
So now we have the Web application server running.
We can actually move the fall over so we can enter move mobile app to var html.
So this would actually move the fall, so we got to do so.
So super user or pseudo.
So of course we got to keep the password for the user that is currently login as an administrator.
So this would move the file so we can see the Davoren of the demo enter Shell so we can see that we
got the mobile app apk that's been created and is being hosted.
So with that in mind, can actually go into the we can actually go into the mobile application that
we have over here.
So we've got to go into the link and from the liying, we can actually enter one or two one six eight
one dot 11 followed by mobile app dot apk hit enter.
And that that was started.
And once the dollar completes, we can actually open up the epic file.
And of course over here we have the following.
Download it so we can go ahead and open it up.
So of course a lot of times you can actually disguise and do a lot of changes to the epic file that
we discuss later on on other tutorials, how you can actually and beta payload or you can change some
of the settings and configuration so that it mask its identities, Moscow's intention as part of the
installation into the mobile device.
So once we have all this information, go ahead and click install.
And of course, it was installed the main activity into your mobile application.
So, again, the mobile application can be any Android devices.
And if we have the opportunity, we also discuss about some of the Iaw that we have a vulnerability
on and how we can install all those applications.
I do.
I was so glad I hit open on that.
And of course, once you hit open on that, going back into colonics, we can actually see that we can
go back into the mobile app.
And over here we can see the main activity that's been created.
So we can go in and click on that.
So we said it incorrectly, so we have to set Elbel correctly, so set it this nine nine nine nine hit
enter and that go ahead and exploit.
So we have the immediate predecessor and open up now because it's open up on the mobile application.
So, of course, once we have the information, we can enter this info so we can actually see the computer,
the operating system type and so on.
So one really cool trick is actually to look at main activity.
So over here on the mobile device, we can see main activity and all you got to do is actually enter
height at underscore icon.
And once you do that, the activity would actually try to hide the mobile application from appearing
on your catalog.
So over here, what happens is that when we go back here, we can actually see the mobile app being
hidden.
And what happened is that you can actually go under settings and once you're in settings, you can go
on for applications or apps, and then you will be able to see the apps that are running in your environment.
And of course, if you look at erotic services, we can see main activity being running.
So of course, this is the only way the user could detect that the mobile application is running.
So in subsequent members only tutorial, we'll be looking at how you could actually configure the epic
file, change the app icon, change the title postscripts directly alongside installation of the mobile
application and do a lot of automation on top of that.
So, again, I hope you've learned something valuable in today's tutorial.
If you have any questions, feel free to leave a comment below and I'll try my best to answer any of
those questions.
And thank you so much once again for watching.