Original subtitles

1

Hey, guys, welcome back to another episode on How to Hack.

2

So my name is Young and I'll be your trainer and facilitator today.

3

So over here on the screen, as you can see on the left side, we have an mobile device running.

4

And on the right side, we have colonics running.

5

So colonics will be our hacker's box and the mobile device will be the targeted computer at a target,

6

a device that will be going after to pull out all of those text messages.

7

So what we are going to do now is on the right side, we have to create the payload.

8

We have to create the app CAFO.

9

So what you can see over here is that I have already created a command for you.

10

So we just got to zoom in a little and I'll explain to you what all this means.

11

So we're using MSF.

12

Varnum So this is part of the battle supply framework and of course Desh stands for a platform.

13

So we're using Android Media Preeta Reverse on a scale TCP.

14

So a reverse made a British shell for us to get a reverse connection into the mobile device.

15

And of course we have low.

16

So Elmos is actually the IP address of the listener.

17

So in this case, if I enter IP space ADR and I hit enter on that, I will be presented with the IP

18

address of the colonics machine.

19

So in this case we have one two one six eight zero one zero six.

20

And of course for our case, we are going to create the APK file based on Delaporte all four four four

21

four.

22

So of course we will output the fall into dot hacker apk.

23

So once you have this instruction ready, paste it onto your code, Linux box and the command problem

24

or in the terminal and go ahead and hit enter on that.

25

So I'll go ahead and enter on that.

26

And of course I'll be prompted with the password because I'm using Sudo for super user so he'd enter

27

on that and this would create epic payload.

28

So what we are going to do is that we need to have this install into the device one installation onto

29

the device, either as a corporate issue or a company issued device or two.

30

It is true social engineering attacks or you could embed it as part of a different APK file, like your

31

different kind of applications that you can then present it to the user in a user could download it,

32

and from there on you will be able to get it running and you can have the reverse connection back to

33

the device.

34

So over here, as we can see, we have the payload size of ten thousand one hundred and eighty five

35

bytes.

36

So all you got to do is transfer to file so you can actually do a pseudo move, for example, and we

37

can move the DOT hacker ABQ file Devar doped up HTML.

38

So what we are doing this and why we're doing this is because we need a location to service to file

39

so that people can access it so that a target computers can access it, they can download it and they

40

can install it from there on.

41

So in this case, we can go ahead and run the Apache Web server.

42

So all you got to do is enter System CTL.

43

So this is part of Linux system administration.

44

So this is a good command, a good item to learn so that you can understand how you can control different

45

kind of services, insight your different Linux boxes.

46

So this is a highly sought after scale Linux administration.

47

So we enter a system CTL followed by space and we can actually enter the status of Apache so we can

48

go ahead and hit enter on debt.

49

So it says that it is already running.

50

So we have our Web application server running and on the left side we have the mobile device.

51

So of course the app can be downloaded for many places.

52

And I just created a YouTube post about the importance of social engineering.

53

So social engineering is a domain that is usually overlooked.

54

So there are a lot of importance for it because I've seen a lot of demonstration as well as real life

55

cases where the hackers provide a macro Excel file like an Excel sheet or a wood document, and a user

56

enable the macro scripts and continue running and debt took over the entire device very, very quickly.

57

So those were the kind of attacks that we're seeing regularly do penetrate into very large companies.

58

So this are the kind of tricks coupled with technological advancement in cyber attacks to actually launch

59

those attacks against certain entities.

60

All right.

61

So now all we got to do is enter the IP address.

62

So in this case, we have one two one six eight zero one zero six, followed by Hacker.

63

And of course, we name our device over here from the output, as Hacker told APK so we can enter Heckel

64

not a hit enter on debt.

65

So it would say that we can download a false will be.

66

Go ahead and download a file click.

67

OK, so once the phone has been downloaded you can open it up and you can install it.

68

So what I'm going to do now on the right side is I'm going to start up Matus white console.

69

So again, if you think about some of the use cases for us to install.

70

A software into the device, what a hackers are doing is that they're installing a lot of such software

71

onto the mobile device before they actually ship it to the consumers, before they actually sell it

72

to a different kind of platforms in order for users to use that phone.

73

And when the users use the phone, they're clueless.

74

You have no idea to this phone already has a virus or a backdoor install into the device.

75

So this is the kind of tricks that hackers are really using.

76

So like I mentioned earlier, coupling social engineering, as well as all this technical know house

77

for these hackers to gain access to your credentials.

78

All right.

79

So moving forward, all I got to do is enter, use, exploit, multi handler and we can actually set

80

the payload as Android meter reader reverse on a score.

81

All right.

82

And we can enter show options so we can SBL Hoess one two one six eight zero one zero six.

83

So this is the IP address of the listener.

84

This is the IP address of colonics in this case.

85

So hit enter on that.

86

And we have the airport as four four four four.

87

So everything is set properly.

88

So all we got to do right now is enter exploit to run the listener.

89

So we're listening right now and we actually already have the software installed.

90

So if I click onto the hacker apk and you can see that this is an installation update to the desisting

91

application.

92

So we have already installed the application.

93

So all I got to do is go back into the mobile device and if I go into the application page, all I got

94

to do is search for a main activity.

95

So again, to naming the logos, the way the look and feel of the application can be modified.

96

And we will discuss about how we can innovate such payloads into different kind of ABQ or different

97

kind of applications.

98

All right.

99

So here I'm just going to go ahead and click on main activity and immediately we would have access into

100

recession.

101

And what you're seeing right now is that you would not be able to visually see any kind of differences

102

on the phone.

103

So the phone is still able to run normal and you can do stuff.

104

The Internet you can do go to Google Maps.

105

You can use many different of the features and functions as though your phone is as it is.

106

But it has really been hacked by the hackers and hackers on the right side.

107

Clinics have full control and access to the device.

108

And why is that a case?

109

So let us explain a little more about why this is the case.

110

So if I actually go on to settings and I click onto the applications, so let us go into the application

111

that has been installed in the device so we can review the mobile application permissions.

112

So if I click on apps and over here we can see all the applications.

113

So let us go into the application that we just installed.

114

So it is called main activity and lets it enter and debt and we can look under permissions.

115

So permissions is on a roll.

116

So go ahead and click on that and we can see that this application has all these different accesses

117

into the phone.

118

So it has the camera access, it has the context access, location, microphone, phone, SMS and storage.

119

So immense that even for mobile applications to install into your phone right now, the user, all the

120

owner of the application, if they have all this app permissions, they will be able to see all of your

121

data.

122

They'll be able to pull out your contacts or SMS and all this important information.

123

So going back into the hackers box, we can enter help and this will list out all the commands available

124

for us to control or to execute into the mobile device.

125

So in my case, for example, I can enter at on a score list.

126

So this will show us all the applications that are already installed inside the device.

127

And we can see, for example, if you manage to break into one of the Kopra devices owned by a an enterprise,

128

then you realize that such application could be mirrored across all those different devices.

129

And many large enterprises run thousands, tens of thousands of devices.

130

So not just in terms of security controls and policies for your mobile devices, but what about your

131

laptops?

132

What your servers, what about your network devices and so on.

133

So all these different kind of security policies have to have a strong effect across and across all

134

these different devices that you run in order to secure them against many of these potential hack.

135

So, of course, the main topic for today is dump on the score SMS.

136

So with a very simple command, all you got to do is hit enter on that.

137

And immediately you see that we have a file created onto our desktop over here on the left site and

138

immediately we can just open it up and we can see all of the text messages.

139

So go ahead and open it up.

140

And over here we can see.

141

Can transfer five hundred thousand US dollars for a cybersecurity project and let's go back into the

142

mobile device and we can click under these messages and immediately you can see that there was a text

143

message and outgoing text message can transfer five hundred thousand US dollars here for our cybersecurity

144

project.

145

So there are a lot more instructions.

146

There's a lot more commands that we can do as part of this Android hacking series.

147

So I'll do what I'll do.

148

Stay tuned for more tutorials for you.

149

So if you have learned something valuable in today's tutorial, we're going to like sharing.

150

Subscribe to a channel so that you can be kept abreast of the latest cybersecurity.

151

Thank you so much once again for watching.