Original subtitles

Hey guys, thank you for joining the live stream. As you can see from the title, this video

is going to be about embedding payloads in Android APKs. This is a video that has been

requested for quite some time. So I'm going to be showing you that in this particular video. So

again, the whole idea was to do it manually. So that's primarily what I'm going to be doing. So

by default, I already have downloaded an APK here, I'm going to be using the Bitcoin wallet

to be demonstrating this. So I'll be taking you through the overall process of doing it. So the

first thing that we're going to be doing is generating the payload with MSF Venom. So no

obfuscation yet. So after we generate the payload, we're then going to decompile the payload with

APK tool. And then we'll also use our particular APK of choice and also decompile it and I'll

show you how to embed the payload or inject the payload into a particular application or APK file.

All right. So let us get started here. So the first thing of course, we are going to need to do

is we are going to need to generate our payload with MSF Venom. Alright, so let's do that right

now. So MSF Venom P, and that's our payload. And of course, with meterpreter, there are various

modules that you can use. So for example, you can use the reverse TCP reverse HTTPS, etc. So

reverse Android, meterpreter, and reverse TCP, I'll be stopping during the video to answer your

questions. So yeah, you can just post them right over there. And I'll be answering them. So

meterpreter, reverse TCP. And then of course, you can set your Lhost to 192.168.1.108. And your Lport,

I'll set that to just 1234. And again, you then you then move on to set to actually outputting

the file. So we'll just call this a payload.apk. And I'm on my I'm on my desktop. But in any way,

I'll just copy that file there. So I will generate the payload. And then we can then also we'll start

decompiling the payload first, I'll show you how to do that with APK tool. So that's the first thing

we'll be doing. And then we can start, we can actually start decompiling the the other Android

application. So there are many applications that you can use. So yeah, I'm going to be answering

the questions as the video essentially takes its time during the process. Apologies if my machine

is a bit slow here, I'm using a virtual machine with very stringent resources. So there we are,

the payload has been generated. And we can actually get started now. Alright, so I'm just

going to copy the payload from this directory into our desktop here. And we'll move into our

desktop now. And we have our APK right over here. So to actually decompile an application with APK

tool, we can, we can type in APK tool here. And then of course, we decompile, which is denoted by

the D command, and we use the F command, and then we specify the application. So payload.apk,

that is if it is in the working, if it is in the working directories, or otherwise,

you need to specify the the directory of the application. So then we then move on to the

output where we want to output the file. So I'm just going to say root desktop, the decompiled

information, and I'll just call it payload into the payload folder and hit Enter. And that is

going to start the the decompiling the application. Alright, so we will then move on. And let me try

and answer some questions here. So does sys internals have a decompiler? sys internals is

more focused on Windows and Windows management. I'll be making a video on that as well. This

payload only works in local network, or you can set up port forwarding. That is if you have static

IP, so that it does work. Unless if you have a dynamic IP, then if it's going to keep on changing,

then you might not have a persistent session. So it's always good to have a static IP for that.

Alright, so the decompilation is completed. So I'm just going to list the files in here. And you

can see that we have the payload folder right over here. Now the interesting thing that you can

actually do with with the payload. So if I switch into the payload directory here, we have the

Android manifest dot XML, we have the APK tool dot the YAML file here, which are not working with

working with the small e folder, which is the assembler, which can be considered an assembler

for Android. So if we go into the small e folder, this is where we will have our com meta exploit

and the stage directory. Alright, so if I change into the com, right over here, and we have the

meta exploit, and then you'll find the payload file within the meta exploit folder, and within

the the stage. So if I just hit enter, there we are. So we have the payload, the payload dot

small e file right over here. So general editing of the payload application is very, very simple.

So if I was to just go back into my previous directories here, sorry about that. Let me just

take you a step back. So we can actually take a look at the Android manifest. So the Android

manifest is where you can essentially edit the permissions for your payload. But of course,

we'll be looking at that in a second. So if I just browse onto my desktop here, let me just

open that up. Apologies, this is taking a while desktop. And we go into our payload here. And

Android manifest dot XML. And yeah, there we are. So we have our permissions in here. And what we'll

be looking for, and we'll be decompiling our other application in which we'll be embedding

the particular payload is we're looking for the main activity. Alright, now this is going to be

very important. But of course, this application has no other activity. So the default one will

be the on create for the main activity if you've ever done Android programming. Alright, so we're

looking particularly for these two lines of code, we're looking for the Android intent action main,

that is the most important one right over here. And from that, you'll get the application source.

So right over here is where you can edit your, your permissions. But these are going to be

important, especially when embedding the Metasploit payload into your into your other Android

application. So let's get, let's actually get started on that right now. So what I'm going to

do is I'm just going to take a step back here. And I'll just copy the application, which is the

Bitcoin wallet, I believe. Sorry, that is in my downloads folder. My downloads folder, like so.

And that is in calm, I believe. What is the application name? Not sure it's telling me

what my application name is. Did I actually download the application? Let me just check.

I should have got it right over here. Yeah, there we are. It is the the Shellbat wallet. So let me

just copy it here directly. So we can actually speed this up. Alright, so we can get started

with the decompilation. Alright, so in here, we can start decompiling this APK tool again,

APK tool, decompile F, and then we specify the application here. Sorry, this is on my Android.

Yeah, sorry about that. The application here, we output this, I'll just call this desktop,

and we will call this the original, the original APK and hit Enter.

Alright, let me take a look at the questions here that we're getting.

Um, Ryan, no, that's, that's not a question for me. How to get a static IP. That'll depend on your

ISP and how many and what IPs they've given you. Max Fire says noob. Yeah, if you say so.

Good, Hassan. How's everyone doing? Alright, the decompilation is complete. We can actually move on.

Alright, so now we need to go into the original folder here. And this is where we'll be doing

most of the editing. So again, the first thing you want to do is you want to actually create

the Metasploit stage folder within the Smally folder. So I'll show you how to do that under

comm. So Smally, we enter here. So we want to go into the comm directory, we hit Enter.

And in here, we need to create the Metasploit. So we just we create the Metasploit stage folder. So

mkdir Metasploit, CD Metasploit and make directory. We'll just call this stage and

we'll change our directory into stage. So now what we need to do is we need to copy that initial

payload from the Metasploit stage folder into the the Smally comm Metasploit stage folder as well.

So that's the first thing we need to transfer the payload. And then I'll show you how to

actually add that line of code after we do during the main activity.

So what I'll be doing for this video, because I have a few minutes left that I can actually

live stream, I'll be actually recording follow up videos for this showing you how to sign the APKs

and how to obfuscate them. So let's do that first. So what I'm going to do is I'm just going to say

copy root desktop, and we are looking for the payload. So payload, what are the directories

we have in here? So payload, there we are, we have the Smally folder, and we want to go into

comm Metasploit and we want the payload, the we actually get the stage and the payload dot Smally

file right over here. And we will copy that again from that directory root desktop. And we are

moving into the original. So original, Smally, Smally, comm Metasploit stage, and enter,

and we should have the file in there. Alright, so that is the payload right over here. Before

we actually move on. exploit, will this video be accessible after the stream? Yes, it will be.

That's primarily was making this video because it was just

Narayan Mahato asks me what I'm doing in a very obscure way. But anyway,

I'll just I'll just forget that ever happened. So now that we have the payload dot Smally file

within the Metasploit stage folder created under the original APK file, we can actually get started

with editing with editing the the Android manifest file. However, the first thing as I mentioned we

need to do is we need to look for the the main activity that is going to be launched when the

application starts off first. So what happens is when we start that the application first for the

first time as you do with Android for any of you have done Android programming, the main activity

is what is started. So we are primarily looking for that. So we're going to go into original

Android manifest open with text editor. And now this is where the exciting stuff is. So you can

go ahead and take a look at the minimum SDK requirements. And again, what we're looking

for is the Android intent action dot main, and the activity will be just listed as a as the top

right over here. So this these two go under the the activity alias, which is listed as well over

here. So we're looking for de shield batch wallet, UI wallet, wallet activity. Alright,

so we're going to look for that directory right now. So that is de and that is under smally again,

so smally, de, shield batch wallet, and we're looking for the UI. So we're going to look for

the UI folder here. And we're looking for the wallet activity. Alright, so we can

a wallet activity there we are, and we can open that up with text editor. And now we're looking

for the on create function. Alright, so the on create again is very important, because

we are looking for the Android OS bundle. So we can add the line right over here. Now,

many of you will be wondering, we'll actually end it, we'll add it up below the invoke super.

So this is we're going to be invoking a static one. And that again is going to be launching the

payload on during an on create function, which again is going to utilize the land right, right

over here. Alright, so now we can actually get started here. So the first thing, as I mentioned,

we're going to get started with is we need to start copying those particular files. So before

we actually be before we actually move ahead with this video, let me just explain what's going on.

So we are going to be going into the wallet activity, which is going to be launched during

the beat when the application is launched. And so during that application, we're going to use

the on create as well here, to essentially load up the payload dot smaller file that we actually

copied. Alright, so let us actually get started. So what I'm going to do is let me just go through

your questions, or I'll actually go through them after this. So the first thing we're going to do

is we're going to go to line, we will go right over here, we need to have it below the on create

land right of that user utilizes the OS bundle here. So we're going to say, sorry, there we are,

there it is. So I'm just going to indent appropriately. So invoke static. And again,

we're going to use a P zero. So P zero here in curly braces, so P zero. And I'll explain what

all of this is, I'm planning on making a separate video for this, because again, I'm going to be

start confusing people if I go on with that. So invoke static, and then we're going to use the

LCOM, which is the the com folder. So LCOM, and then the Metasploit folder, Metasploit,

and then you have your stage. And you have your payload here, which again is in payload,

you don't need to specify that it is a smaller file, so you can leave the extension. So then that

is going to bring us up into the on create function. So on, on create, and then now we're

utilizing Landroid again. So Landroid, the content and then the context. So it will launch every

time the the the wallet activity is started up, which is the main activity when the application

starts up. So yeah, there we are. So that will essentially launch the payload. And if you have

created the payload appropriately, you set up your your exploit multi handler, and you're pretty

good right over there to get started. So on create, and then we're using the we're using Landroid,

or L Android, whatever you want to call it, for those of you content, and then context, context,

and then we close that up, and we use the capital V. And we can then save this file.

Alright, now that we're done with that, you now need to start copying the permissions you require.

And this is unique for every application, because as you can see, the Bitcoin wallet application

allows for these permissions, okay, they allows the camera to be used, it allows a wake lock,

which is very, very good, allows Bluetooth NFC, the network state allows you to access the network

state. So it has many of the important ones that we have here. So what we're going to do is we are

going to copy the important ones. And those are going to be are going to do with the the course

location, the file location, the phone state send SMS receive SMS record audio, call phone read

contacts, write contacts, record audio camera, write external storage, we don't need the wallpaper,

we'll just get rid of it from there. So we'll copy these will copy the the Android permissions here.

And we will paste it in and delete the duplicates from here. So again, I will delete the the

duplicates. So let me just look for one of them that I know we did have here. That was the wake

lock, which I'm sure was up right over here. Write call log, set wallpaper, we don't need that one.

So let's get rid of that first. Receive boot completed. camera settings, right settings.

Yeah, that's fine. I believe I saw wake lock here. But I think, yeah, that that should be it. So

yeah, we don't have any duplicates. So that's excellent. So we're going to save that manifest

file here. And we are ready to go, we're ready to compile the application. So what we've done

essentially till now, let me answer some questions before we actually recompile. So what we've done

till now is we have we have essentially embedded the the MSF Venom payload. Now one thing to take

into consideration is we have not particularly obfuscated the Android application, which means

there is going to be some detection some level of detection, I'll probably be making another video

on this, where I'll actually show you how to perform the obfuscation on a particular Android

application. And if you want to perform obfuscation, I believe I have one of these

links here that we used to use before and that is APK wash. APK wash allows you to essentially

obfuscate or generate, as you can see right over Android APK antivirus evasion for MSF

Venom generated payload. So this allows you to obfuscate various MSM MSM Venom payloads.

And of course, I know that embedding or injecting a payload with MSF Venom already exists. And yeah,

someone has just pointed out that the camera is a duplicate permission. So let me just check that

out right now. Looks like we have we also have read contacts. Now there's read and write contacts.

Let me check this right over here. I can see camera right here. Let's see if we can find there

we are. Thank you very much for pointing that out. Thanks for pointing that out. I really

appreciate that. I was probably looking for wake lock as well. But it really shouldn't cause an

issue. So let me just save this right now and we can get started with the recompilation.

Alright, so we want to recompile the original APK here. And we can do that right now. So what

we can do is we can essentially recompile from any directory. So APK tool, and I'll say build,

and then we can specify the directory again. So root desktop, and then we specify the original

folder here. Now this is where things get very, very important. When you talk about using

applications like the or scripts like the fat rat, for example, the fat rat is a tool that generates

most likely to do a to great success, a signed payload, apart from embedding applications,

which we know is very, very difficult to do automatically, because you usually get errors.

So if you do get an error here, if we do get an error, then I probably have to take a deeper look

at the application. So I'm just going to try and compile it once to recompile it once if it doesn't

compile, then I'll probably have to find another application. But I just wanted to make a quick

live stream for this video. So let me just answer a few questions before we carry on.

Use t marks on a rooted Android device. Yes, more Android videos are coming. That's primarily why

I've started with this right now. Termex hacking. Excellent. Yes, it is very, very good. Very,

good application. Yeah, we have a good question here telling us I've tried the fat rat it failed

with signing. Yes, that's probably because it uses zip align. And I'm not sure if we'll get an error

right now, we probably will. But let's see what error we get. I'll probably try and and understand

what's going on. Now this is where real skill comes into play. Because if you're going to manually

embed, if you're going to manually embed these, these payloads into applications, it also gives

you an opportunity to test which applications allow you to embed these various payloads,

because some applications will not recompile at all. So it's very, very important to take

that into consideration. So I've, I've essentially started the recompilation process. And this looks

like it's going to work. And again, it tells us that it failed right over here. So let's take a

look at what actually caused the error. And immediately we get the AAPT error, which I'm

not going to explain what it is right now. So if we take so Alright, so if we take a look at this

right over here, you can see that by default, yes, I'll be uploading the video after you can see that

we've got an error and it's giving us an error in the Android manifest file first. But the main

issue is with the AAPT, which means we probably need the Android SDK installed, because of the

various requirements. So what we can do is we can just try and download another application here,

probably a simpler application, let me just find one that's very, that's again, very, very simple.

I'll just let me see if I can find another application. What if the main activity is

hidden? There must be a main activity. That's a very, very good question. In fact, I'll just

answer a question. I'll make a separate video on this. What is the main activities? Yeah,

that's a very good question. So every application will be designed differently. And usually what

again, what you're looking for is the Android dot intent dot main, if you can find those two lines,

where it actually specifies the intent dot main, and it also specifies the icon,

or the drawable icon, if it's right over there, then you essentially know that the one of the

top group right over there that contains the activity is going to be the main activity.

So your job is to look for that a within the smallie is to look with for that within the smallie

compiler. Alright, so also the fat rat does not provide obfuscation. Yes, that's a very good

question. The fat rat does not provide obfuscation, it simply signs the application. So if I was to

compile this application, I remember the Google Now launcher did work

with the recompilation. So I'll do that for you guys once more time once again,

so I'll download this here. And I'll do it again with you guys. This this did work,

what you will find is, after I have recompiled the application, I need to sign it. And that's

where probably I can use the fat rat or I'll actually be making a separate video showing

you how to do this. So I have downloaded the application, let me just wait for that to complete.

Let me see if that is downloading a probably Yeah, anyway, I'll just wait for that to complete.

So in the meantime, what I'll do is, I will just go back to my desktop here, we'll keep the payload,

I'll get rid of the the Bitcoin wallet application here. And I will get rid of the original folder,

which contained our our decompiled application. So we have the payload dot apk here,

which we decompiled. And if we just list the files in here, sorry about that. If we list the files,

we have the payload folder, which contains the payload itself, which is the most important bit

once we start was once we start embedding. So again, I hopefully this just finishes downloading

for some reason, it did not start downloading apologies for that. Let me just try and save

my internet does not seem to be working right now. Or has it downloaded? My browser is unresponsive,

sadly. So let me just read. Let me just list. Let me just list my downloads folder here.

Looks like we do have the the application has completed downloading. So

if I can just check the size of this looks like one of them is eight megabytes. Yeah,

so so that looks like it's completed. So I'll just copy that com. I'll just copy the

downloads. Let me just get rid of that there. And we'll just copy the we'll just copy the

application to the desktop and we can decompile that immediately. Alright, so copy downloads,

and we'll copy the com Android launcher, desktop and on it enter. And for some reason

looks like the files looks like the downloads did not complete. Sorry,

root downloads keep keep getting confused with that. Let me just check the downloads. It looks

like they haven't completed yet. But for some reason, my my my browser isn't working. Let's

see if it does prompt us to actually download that. In any case, I'll just copy I'll just

delete the the duplicate one right over here. And hopefully we can actually copy them now.

So I'll just copy this. All right, I love to speed through this process now.

So that I can actually show you that the compilation does work. So what we'll do now is

we will use the APK tool, APK tool, decompile, and we'll com.google right over here.

And we'll call this original hit enter. For some reason, oh, sorry, I forgot the output file,

that is the output parameter right over here. And we're just gonna wait for this to decompile. So

let me just answer some of the questions. Yes, I have duplicates. Just saw that downloaded the

file twice. So yeah, we've decompiled the application. Let me just try and answer

one more question. Let me just see if we have any other questions before I continue.

What is this for? This video is focused on how to manually embed payloads,

MSF Venom payloads in Android APKs. At least I got to see you brother salam. Hello, Naheed

thank you for joining the stream. Yeah, that looks to be like the only questions there. All right,

so we can get started now. So I'm just going to change the directory into the original folder here.

And again, we're going to go into the smally folder again, smally list the files in their CD

com. And we will create our Metasploit directory again. Metasploit CD Metasploit again here.

Stage. And, and we can just leave the stage in there. So what we're going to do is we're going

to say CD root desktop or sorry, we're going to copy the payload file here. So copy root desktop

payload, smally, and we're looking for the Metasploit is that the com Metasploit sorry,

and the stage and the payload dot smally file into the root desktop original. And we're looking

for the smally com Metasploit stage directory hit enter if we list the files in there sorry stage

list the files in here we have the payload file. Alright, so now we can move on into the Android

manifest file once more to actually explore what's going on. So we'll go to the original

Android manifest file. Let me just close the previous ones here. Because I don't want to

get confused with the other ones that we had for the other application. And we'll get I will get

rid of this as well because we're not working with that activity file. So Android manifest dot xml.

And now you can see with a simple application again, all we're looking for is we're looking

for the action right over here. So the Android intent dot action main. And just above this,

you will get the Android name right over here. So you have com Google Android launcher stub app.

Alright, so that is the activity that we are primarily looking for. Okay, so we need to look

for that activity and the directories listed right over here. So you have com Google. So if

you go to smally com, Google, Android launcher, and we're looking for the stub app. Alright,

so again, you can simply just find it right over here stub app. And we can open that up with a

text editor. And we are looking for on create, sorry, on create. And there we are, we have the

on create right over here. So again, we're going to create our invoke static. So let me just do

that really, really quickly. Invoke static. And we're looking for P zero curly braces always when

specifying arguments with Android, sorry. And then we're looking for the land right.

And of course, with the land right now you can with with this I need to also explain something

something important. If you do want to if you have created a payload that does use an activity,

this is a great place of doing it. Alright, I just wanted to make sure that you guys understood

that before we continue. Alright, so land right metasploit stage. So again, metasploit metasploit

stage, let me just get that right. Yep, stage metasploit stage payload. And we're looking for

this particular on create method. So on on create land right. And we are using the content and the

context here. So content, based on the content, and the context, context is always in capital.

And we'll close that up capital V, and we'll save that. Alright, now we can deal with the

the original Android manifest, and I'm going to open up the Android manifest for the payload

application. Because this particular Google launcher does not have any, any useful,

any useful permissions. So we only have read settings and write settings. So what I'll do is,

we can essentially just copy everything. So we do need internet, we need the Wi Fi state,

we'll just copy everything here, we'll get we'll get rid of the right settings option as well.

And the we can also do that right here, we don't want to mock with the original application

permission, otherwise that can affect its functionality. So again, we'll get rid of

write settings here. I will get rid of write settings. And now we can save this file. And

hopefully we should be able to compile this application now without any errors. As far as

I remember, this was the only one working. So again, before we do that, let me just try and

answer some questions. Harsh Dinani. I love your videos. I'm a commerce student said I practice

that's excellent. That's primarily why these videos are there. So go ahead just enjoy practicing.

That's what it's all about. So again, we'll use the APK tool. And we will build so build a root

desktop and we'll use the original folder in it and to hopefully now the application.

There we are, the application was successfully compiled, we did get the AAPT error, but that

was very, very, very small error. And if we just take a look at the sorry, if we just take a look

at the we just list the files here, sorry, let me just list the files. You can see that under the

dist folder. Under the dist folder, we have the compiled application here. And now that is not

signed, that is something to take into consideration. But we have successfully embedded the payload

within the Android application. So now that we've embedded it, whenever we launch this application,

and because it is a launcher, it will constantly be active. And whenever the main activity is

triggered, we will get our payload session. Now, the other videos that I want to make is we need

to obfuscate, we need to focus on obfuscation, because that is primarily going to be how you

get the application on a particular device. And then the other one is persistence through either

creating a script. And of course, that's going to depend on on on creating a persistent script,

essentially getting the application to run. And then finally, the video I'll be making last is

how to hide the application from the application drawer. Alright, so that's pretty much what I'm

going to be covering for this live stream. I know you guys wanted me to cover quite a bit more,

but that's all I have time for. And I'll be making the other videos following up. So my next video

on Android will be signing the application, then making it fully undetectable as best as possible.

But for those of you who are curious, you can also use the backwash apk, the backwash script.

So yeah, I know Mike telling me to change my ISP. Yes, I am working on that.

Thanks, bro, for this video. Yes, this video will be available after the stream.

Can we do it to any apps above 10 megabytes? Yes, you can do it to most of the applications.

But again, it's all about how the application was developed. If the application was developed

differently than in the sense that they have various renaming for the activities for the

main activities, then you pretty much will be will have some errors.

We have a message from photo slash Hey, no wait, want to see it in action, you'll see it in action

in the next video, I'll use the exact same application. And I'll show you what happens

when you try and install it directly on the latest version of Android, which is Android nine,

what will happen on Android nine is it'll actually warn you that the application is malicious.

And that's primarily because we're using the reverse TCP payload, if we were using

the reverse HTTP or HTTPS, and we with port 443, then that should should potentially avoid detection.

But again, obfuscation will be quite important. Alright, so I'll answer a few more questions.

And end the stream here. So again, I really, really appreciate you guys watching the stream.

Are you from Kenya? Yes, I am in Kenya majority of the time for work.

Let's see, how do I feel about the use of ADB shell? ADB is very, very powerful. I'm guessing

you're talking about forensics, right? Not too sure. Just give me a bit of give me a bit more

information. No more questions. You can use the hackersploit tag so I can see your message a bit

more clearly. Yes, I've heard of West Parklands. I'm not sure West Parklands, but I know about

Parklands. Let's see. What's my career? I mentioned this previously, I'm a network penetration tester.

Yeah, we'll also cover sharing methods. Um, yeah, I will do. I'm guessing you're talking

about social engineering. What are my qualifications? Well, I am a penetration

tester. So I have network plus Linux plus, and OSCP. Those are my professional certifications.

Yeah, per and I, Kalita, how make it how to make it fully undetectable. Yes, I will be making a

video on that. That is a very, again, very, very tricky. And it does involve a bit of manual work.

So the scripts really don't work nowadays. Thanks for enjoy your day. Love your channel.

From Ethiopia. Thank you very much. Love to Ethiopia. I appreciate your support.

The videos are going to come daily as I mentioned.

You can go over port forwarding. Yes, I am going to make a video on port forwarding,

manual port forwarding. Do I have a course on Udemy? Yes, I have one. As I said, we are

migrating our courses onto the Hackersploit Academy, which is at hackersploit.io.

I've been doing my CH certification. What is my best scope? I am guessing your best

opportunities. That's what you mean. Are there very many opportunities you can become?

You can become a penetration tester. You can work in in forensics. You can do a lot of stuff with CH.

Have you tried Ghidra? Yes, I did try it. I had my one of my friends,

who is a malware analysis and reverse engineer,

make the video on the channel. I pretty much I think you've checked it.

Is OSCP a bit hard? OSCP is all about practice, as far as I know. You should pretty much just

practice Volnub. I'll be also making a series on the OSCP press, the prep machines for Volnub.

Do I use Termax? Yes, I do use Termax. Greetings to Russia.

Thank you very much for joining the stream, even though I'm pretty much going to be ending it in a

few minutes. We'll be releasing our courses on Hackersploit Academy this weekend. Apologies for

that. Let me just re let me just open up my virtual machine right over here.

Here's malware analysis stuff. I wouldn't say it's tough. I think it's just really exciting

and very, very different for each piece of malware you start working with.

Ford Mustafa, thank you so much from Canada. Thank you. Glad you enjoyed the video.

Greetings from Poland. Love from India. Thank you very much. I appreciate it.

You guys can post any other questions you have left because I'm really

strapped for time at the moment. So if you have any important questions, go ahead.

Let's see. How many ears do you have? I have two ears.

Yes, I have videos on Ops spoofing. You can check my channel just search for

Hackersploit Ops spoofing. You should find the video.

What do I think of Ghidra? It's a very good tool.

Ghidra I think is just very different than what anyone has ever used before. So again,

it's just about it's just about getting used to it.

Tips on OSCP learn post exploitation learn file transfers between Linux,

Linux boxes and Linux and Windows boxes. Learn about exploit modification. That's very,

very important. binary CTF Yeah, a lot of CTF videos come coming up. I have a few of the CTF

challenges. I'm also going to be doing hack the box live. The next hosting for Metasploit with

all ports open. I'm as I said, I'm going to do manual port forwarding. I'll also show you

how to use the no IP port forwarding. Live in Kenya also you like you in Great Wall Garden. I'm

not sure what that means. Is it necessary to be grad or self learned or to be a graduate of

self learned? Have a good scope. I think just having experience in what and being good in

what you do really good really goes a long way. You can reach me life of a hacker you can reach

me via my email. My email is always linked in the community section of the channel or

hackersploit at gmail.com. That's my public gmail, gmail address that I use. Am I an Avenger,

an Avenger fan? No, sadly, I'm not. I really haven't been watching any of the latest movies.

So apologies. Davide Carlissof. Hi from Italy. Hello. You sound like Mufti Menk. Yes, I've got

that a lot. I actually do watch some of his videos. Sometimes on Facebook, when I do get sent those

videos telling me that I do sound like him. So yeah, I guess so. ng rock. Yeah, I've made a video

on ng rock. You can check that out as well. That's very, very good. Eugene Lihasi. Hi from Kenya.

Hello. Did I use PowerShell? No, I did not use PowerShell. I'm just have a different theme for

my terminal. Hello from Morocco. Hello. Any video about Empire? Yes, I'm making videos about

Android first, then I'll move on to using Cobalt Strike and Empire.

Sorry, many of you guys want me to look at the camera when answering the questions. I'll do

that again. Who writes my articles? I write them personally at the moment. Hi from Hungary. Hello.

Mubasher Assad. Yes, there isn't a course yet. We are releasing this weekend, as I mentioned,

our first courses. What version of Linux are you using? I'm using Linux, Kali Linux 2019.1.

Any tips to follow before scoring well in the CH exam? I guess just read up on your notes or read

up on the handbook. It should be a multiple choice question. CH was pretty simple for me.

It shouldn't be a difficult exam at all. Have a good day. God bless. God bless you too.

Can you make more videos on Vail? Yes, I will make more videos on Vail evasion. I believe I have

before, but I will follow them up. The problem with Vail is whether you're using, for example,

if I use an encoder with MSF Venom like Chicago, Ghana for Windows. Most of the time,

if you're working with Windows 10, because they have Windows Defender constantly updated with the

latest signatures, it pretty much will not work or will be detected. My ISP doesn't support port

forwarding. Why is that? Hands asking for hosting with all ports or particular ports. Do you have

access to your main router? Love from South Korea. Same here. Love to South Korea.

Have I hacked anyone? No, I haven't hacked anyone. Do bug bounty? Do you do bug? Yes,

I do do some bug bounty on bug crowd. What will I do today? I've already recorded or I've already

live streamed the recording of what I wanted to do. We have a good question from James Moreno.

Advice, please. I have a bachelor of science in information systems. That's a good start,

a very good start. And I want to get into pen testing. Where should I go from here? I would

recommend taking the network plus certification as always do. If you don't want to, that's fine. It

just gives you great information to begin with before you go into anything like OSCP. I definitely

recommend going for OSCP security plus and pen test plus as well, which is the one of the

latest certifications. ch is also very, very good if you want an introduction into cyber security.

I can make a detailed video on OSCP tips and bug bounty videos. Yes, I'm going to be showing

you guys what environment I've set up for bug bounty videos. Have I got paid for any bugs? Yes,

I've got paid for three bugs in my lifetime. I think the total to about maybe $800. So not

any big bugs particularly. But again, it's just that I don't have the time for bug bounty. But

when I do, I usually try it out. Greetings to Ukraine. Wismaster got it correct in many of

the issues with port forwarding are because of NAT, NAT configurations. And if your ISP is

particularly doing it connected internet to your entire building, that is a common syndrome.

What's the best way to get your payloads undetectable by Windows Defender? Well,

I've been working or I've been taking a look at one of these scripts here. I don't know if I can

just show you this. I was planning to make a video on it. It is the Phantom evasion tool.

Phantom evasion tool allows you here if I can just launch it. Yeah, let me let me just launch it.

Python, phantom evasion.py. So let me just start this up here. Phantom evasion allows you to

generate various stages here. So I'll show you this right now. So you have your C,

meterpreter stager. I'll get to that. So in your Windows modules,

you have your shellcode injection, you have your stages. So if you're looking for stages,

which I'm guessing you are, you can find them right over here. So if you're on your 64 bit stages,

you have your reverse TCP virtual unlock, which works great if you are looking particularly to

essentially prevent detection by Windows Defender. I would recommend these stages modules here.

What is my opinion about Elan security? I haven't I haven't consumed any of their courses yet,

but I'll definitely try them out. They look like they have very, very good courses.

How do you let the terminal continue suggestions? I think you're talking about auto completion.

That is the tab based on the current file structure, or whether or not you have the

file in that particular directory. So just use your tab key, and that should auto complete for

you to the nearest approximation. Yes, you can and I do recommend using reverse HTTP on Android,

because you can actually make it you can make it sort of undetectable by by essentially monitoring

the traffic coming from the application because everything will be going to and from port 443.

Graham Hughes, good day from Australia. Same to you, sir. How are you guys doing over there?

How to start malware analysis? That's a good question. A lot of things to cover. I'll probably

have to make an introduction video to that as well because

Rakesh Sharma asks me are the courses by Pentest Academy? I believe you're talking about Vivek.

Yes, they're really good courses. Apologies, one of my Android devices here is giving me

notifications. Sorry about that. Hello, Imran. It's good seeing you as well. It's been a long

time. How are you? How are you doing? Oh, nice. Sorry about that, Hughes. I didn't see that at

623 am. Yep, that that's definitely Australia.

Eric risco, I liked your recent collab with it career questions. Yes, I just made the video

yesterday. Very, very good questions. You can check that out as well. I have about one minute

left to ask you questions. So go ahead and shoot. Do you know any rat with eternal blue exploit? I'm

not sure what you mean by that remote access tool, usually as the payload and then which you install

on the client and then you have the server sitting on the server really. So I'm guessing

you're talking about the exploit, the actual exploit is getting the payload installed. So

you can consider the eternal blue exploit a form of a remote access tool. However,

remote access tool does give you more functionality.

Wi Fi pen test. Yes, I have videos on that you can check out my the playlist. I have

the WPA2 penetration testing videos.

Life of a hacker. I think I'm going to send a notification on your phone. Let me check

Um, I don't think it got any other emails here. Anyway, that's that's that.

Antoine, you from India? No, I'm not from India.

Although India is a pretty cool place. I would love to visit one,

one one time. It looks like a really really interesting place culturally.

Do I earn from YouTube? Yes, the channel is monetized to a certain extent. But again,

because of the limitations in regards to the videos that I can monetize, I don't earn a lot

are really just goes into the hosting and stuff like that. Yeah, I'll definitely check on your

message out a life of a hacker. Thank you very much, Krishna. I appreciate it.

It found bugs in which I believe I found a bug in. Well, that was actually a free bug bounty,

or actually got I think the community score that was the first site that I got a bounty

on was humble bundle, which, as you already know, is a site that has all of these bundles,

which I am to do a giveaway on by the way, I then I believe it was a startup company that a video

platform that I found the second bug, it was remote code execution, I believe I'll have to

actually post all of these, these exact details in regards to the bounties.

Now this channel been on YouTube for about three years now. The the exploit application has been

inactive now because it was kicked off the Google Play Store, sadly, because of the content that it

has. Google is really really strict community guidelines now. I would recommend getting the

CH first if you are interested in it and then get the OSCP. You have security plus that's pretty cool.

Also, my hacking machine setup, I don't have a dedicated setup, but I do have an environment

that I do create with. I do have a collection of tools that I do use constantly. So I'll probably

make a video on that. Yes, the video will be uploaded when the broadcast is complete.

All right, I'll just be here for a few more seconds now.

Yeah, I think I'll pretty much end the video here.

Thank you very much, guys, for joining me on the stream. I really, really appreciate it.

Let me just answer one more question. How to act the same network without using payload.

I'm not sure what you mean and what devices you're talking about. Car hacking videos. Yes,

I am working on a large project on that, but that is going to involve OBD,

the OBD connection to the vehicle, because that is the most common connector.

Yeah. So thank you so much for watching the stream, guys. I really, really appreciate it.

You can post any of your other questions on my on my social networks, or you can actually contact

me on my forum, hackersplay.org. And yeah, I'll be seeing you guys later. So thank you so much.

And yeah, peace.