Tryhackme vulnversity walkthrough

Hey guys, It's Mr.Ethical Yt and welcome to my blog. In this post I will be discussing about creating RAT that it bypass google play protection and the making of "Fully Undetectable" (FUD) payloads, for Android devices , An important point to i want to make is that this information provided strictly is only for educational purposes. The techniques described in this should only be used in ethical hacking scenarios, such as those pertaining to penetration testing with explicit permission from the owner of the device or trying to check the security of your device. Any kind of unauthorized use could end up in being illegal, and the consequences are generally there.

Ok now let's  focus on the attempt of getting the payloads to run under the noses of antivirus and security detection software (google play protect) The idea here is that a so-called FUD payload would slip by for the deeper security measure testing, I will demonstrate many of the concepts we'll be  using a RAT called Lemon Rat. 

The Lemon Rat is again another RAT for gaining access to an Android system and does, of course, give good understanding for security professionals on vulnerabilities of Android systems if used ethically. Non-ethical use is when this tool is being used altogether without being granted acceptance to do so.

Before going any further, I should stress again that this information is aimed only at educational and security testing purposes. I strongly do advise nobody to use these techniques for malicious purposes. So on that note, let's now delve into how some try to generate FUD payloads".

Installation

First of all you need to install the termux application from F-droid if you haven't installed it already. If you are using playstore version uninstall it and install from F-Droid

Open the Termux Application ,Then update and upgrade it's repositories by running the command given below.

apt-get update && apt-get upgrade 

This may take couple of minutes depending upon internet connection speed .

Grant the storage permission to termux by running the command given below. And click on allow to grant permission.

termux-setup-storage

Download apkmod .deb file and Lemon rat .deb file.

After downloading these two files copy both of them to the termux home directory.

Copy lemon rat Deb file by this command.

cp /sdcard/Download/lemon_2.1-2_all.deb $HOME 

Copy apkmod2 Deb file by this command. 

cp apkmod2_1.3-4_aarch64.deb $HOME 

Now Install the lemon rat and apkmod2 by  running these two commands one by one.

lemon.

dpkg -i lemon_2.1-2_all.deb

Apkmod2

dpkg -i apkmod2_1.3-4_aarch64.deb

That's it you have successfully installed lemonrat in termux.

Now let's set the password. Go to this site Md5hash generator enter password the which you want to set to lemon then click on generate.It will generate the MD5 hash of your password . Copy the hash of your password

Open termux and go the directory /data/data/com.termux/files/usr/share/lemon/server.

cd /data/data/com.termux/files/usr/share/lemon/server

Type ls you will see a file with name maindb.json

ls

We have to edit this file inorder to set the password with command nano.

nano maindb.json 

Paste the hash you have copied in the line password it have to be look like this 

"password": "your hash",

After pasting the hash save the file by clicking the CTRL+S the CTRL+X to exit

That's it we had set the password

Creating the payload with lemon

Run lemonrat by executing the command lemon

open your browser and navigate to the url localhost:22553

localhost:22553 

I will ask you to login after logging in 

Go to build section and enter the ip 127.0.0.1 (since we will be making a payload for demonstration purposes Iam just using localhost you may want to do portforwarding to access devices outside of your local area network ) then click on build wait until the payload gets builded

After payload get builded open termux and go to the directory lemonrat there you will the find the payload with name L3MON.apk copy it to your internal storage 

cp L3MON.apk /sdcard

Let's test the payload whether it is undetectable or not 

When we try to install the payload it is easily detected by the Google Play Protect.                       

Let's make the payload undetectable

Making the payload undetectable

Open playstore and search for apksigner Download the app

Then Open it.At bottom right side you will see two options they are sign a live app and sign a file you have to  click on sign a file then select the payload we generated as we want to make it undetectable 

It will sign the apk after signing was completed you can find the signed apk with name L3MON.signed.apk 

Try to install it .We can see that it was not detected by Google Play Protect

That's it we have bypassed google play protect from detecting out RAT .I hope you have learnt something new let's meet in another post until the keep reading other posts in this blog. Also try to subscribe my YouTube channel for video tutorials