Module 52 (Smartphone Pentest Framework)

Size: px

Start display at page:

Download "Module 52 (Smartphone Pentest Framework)"

Erick Armstrong
6 years ago
Views:

1 (Smartphone Pentest Framework) At the end of this Module, students should understand the purpose of the Smartphone Pentest Framework (SPF). They should understand legal/ethical issues distinguishing smartphone pen testing from other types of pen tests. They should understand how to create and use Android Virtual Device (AVD) emulators using the Android SDK. They should be able to use an AVD(or actual smartphone) as an SPF modem for launching SMS attacks against other smartphones. 1/22

2 Purpose of the Smartphone Pentest Framework Employees use smartphones for their work. Security of smartphones is at risk Remote Vulnerabilities (allow rooting) Client-side Vulnerabilities (browser vulnerabilities) Social Engineering (direct users to pages that exploit vulnerabilities) Local Vulnerabilities (user rootkit or jailbreak) Development was carried out under the DARPA CyberFast program. Goal: make smartphone pen testing easier to do. 2/22

3 Smartphone Special Ethical Legal Issues Do you have permission to hack the device? Get list of phone numbers in scope. Do you have permission to anything you find on the device? Contacts, SMS text, passwords? Is the grantor of the permission legally authorized to give it? What disclosures/disclaimers were given/required of employees? 3/22

4 Architecture Server provides framework functionality from a PC Web server (to exchange information) Mysql database FrameworkAndroidApp.apk can be used to provide (some) functionality from an attached smartphone used as a modem. Vulnerable smartphones are used as targets for the server and framework modem. 4/22

5 The Smart Phones The Smartphone Pentest Framework can be used with actual phones, but that's tricky to demonstrate. Instead of using multiple smartphones, we will use android smartphone emulators and restrict our communications to SMS and Internet (no voice communications. Need to know how to download and install the Android SDK and configure emulators. 5/22

6 Downloading the Android SDK Get the most current version: Google for android sdk Currently get to this page: To run on kali, download linux 32-bit x86 bundle. 6/22

7 Downloading Android SDK 7/22

8 What do I do with the SDK? Unzip it to some reasonable location (perhaps the Desktop) You will likely need to apt-get install libgl1-mesa-swx11 in order to get libgl.so Also, you may need to ln -s /usr/lib/i386-linux-gnu/libgl.so.1 /usr/lib/libgl.so Then you can run the following: cd sdk/tools./android 8/22

9 Configure Android Virtual Devices Select Tools Manage AVDs 9/22

10 Add New AVDs for the Framework Modem and the Vuln Phone Select the New Button 10/22

11 Choose A Device (I'm using 2.2) Increase Storage/Memory/SD Options 11/22

12 Dealing with the Android SDK Manager To list available devices android list To close an Android SDK Manager subwindow Right click on the TitleBar and select Close 12/22

13 Start the Smartphone Pentest Framework Cranky response parsing Use selection 0 for back (even if not listed) 13/22

14 We want to create an Agent inside our Framework Phone Use an Android phone (or emulator) as a modem for you computer to send SMS messages. From main menu in SPA: 4.) Attach Framework to a Mobile Modem 3.) Generate smartphone based app 1.) Android App (Android 1.6) Phone number of agent: All Android Emulators start with Control key for the agent: SPAKEY1 Any seven letter key (security measure) Webserver control path for agent: /control Subdirectory of /var/www This creates FrameworkAndroidApp.apk in the framework console subdirectory of the SPA directory Copy the FrameworkAndroidApp.apk to /var/www for transfer to your modem smartphone. 14/22

15 Download the Framework App to your Modem Smartphone Use the web browser to browse to your control server 15/22

16 Attach or SPF to the Modem From the SPF Main Menu: 4.) Attach Framework to a Mobile Modem 2.) Attach to a smartphone based app Phone Number: Control Key: SPAKEY1 App URL Path: /control On phone, run the Framework App 16/22

17 Enter the Appropriate Information (Order is different) 17/22

18 Mount a Social Engineering Attack In SPF Main Menu: 6.) Run a social engineering or client side attack 1.) Direct Download Agent Deliver Android Agent or Android Meterpreter (Agent/meterpreter:) Agent Platform(Android/iPhone/Blackberry): Android Hosting Path: /agentpath Filename: /coolapp.apk Delivery Method:(SMS or NFC): SMS Phone Number to Attack: Custom text(y/n)? n Select a modem to interact with 18/22

19 Target Phone Receives SMS 19/22

20 Message includes URL to SPF server 20/22

21 And Finally I was unable to get the payloads to function with the AVD versions I was using. 21/22

22 Application Downloads Install/Run 22/22

Advanced Ethical Hacking & Penetration Testing. Ethical Hacking

Advanced Ethical Hacking & Penetration Testing. Ethical Hacking Summer Training Internship Program 2017 (STIP - 2017) is a practical oriented & industrial level training program for all students who have aspiration to work in the core technical industry domain. This