screetsec / TheFatRat

Thefatrat a massive exploiting tool : Easy tool to generate backdoor and easy tool to post exploitation attack like browser attack and etc . This tool compiles a malware with popular payload and then the compiled malware can be execute on windows, android, mac . The malware that created with this tool also have an ability to bypass most AV software protection .
GNU General Public License v3.0
9.45k stars 2.26k forks source link

Failed to recompile original project with backdoor #313

Closed windson1 closed 6 years ago

windson1 commented 6 years ago

Set LHOST IP: 192.168.15.7

Set LPORT: 4444

Enter the path to your android app/game .(ex: /root/downloads/myapp.apk)

Path : /root/Portugues.apk

+-------------------------------------------+ | [ 1 ] android/meterpreter/reverse_http | | [ 2 ] android/meterpreter/reverse_https | | [ 3 ] android/meterpreter/reverse_tcp | | [ 4 ] android/shell/reverse_http | | [ 5 ] android/shell/reverse_https | | [ 6 ] android/shell/reverse_tcp | +-------------------------------------------+

Choose Payload : 3

[ ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ] +------------------------------+ | [ 1 ] Use Backdoor-apk 0.2.2 | | [ 2 ] Use old Fatrat method | +------------------------------+

Select Tool to create apk : 1

[ ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ]$ Generate Backdoor +------------++-------------------------++-----------------------+ | Name || Descript || Your Input +------------++-------------------------++-----------------------+ | LHOST || The Listen Addres || 192.168.15.7 | LPORT || The Listen Ports || 4444 | OUTPUTNAME || The Filename output || app_backdoor.apk | PAYLOAD || Payload To Be Used || android/meterpreter/reverse_tcp +------------++-------------------------++-----------------------+

[*] Creating RAT Apk File...done.

[*] Decompiling RAT APK file...done.

[*] Decompiling original APK file...done.

[*] Merging permissions of original and payload projects...done.

[*] Running proguard on RAT APK file...done.

[*] Decompiling obfuscated RAT APK file...done.

[*] Creating new directories in original project for RAT smali files...done.

[*] Copying RAT smali files to new directories in original project...done.

[*] Fixing RAT smali files...done.

[*] Obfuscating const-string values in RAT smali files...done.

[*] Locating smali file to hook in original project...done.

[*] Adding hook in original smali file... done.

[*] Adding persistence hook in original project...done.

[*] Recompiling original project with backdoor...done. [!] Failed to recompile original project with backdoor

windson1 commented 6 years ago

invoke-static {p0}, Lorg/5/server/a;->a(Landroid/content/Context;)V The smali file was hooked successfully I: Using Apktool 2.2.2 I: Checking whether sources has changed... I: Smaling smali folder into classes.dex... I: Checking whether resources has changed... I: Building resources... Exception in thread "main" brut.androlib.AndrolibException: brut.androlib.AndrolibException: brut.common.BrutException: could not exec (exit code = 2): [aapt, p, --forced-package-id, 127, --min-sdk-version, 14, --target-sdk-version, 25, --version-code, 151, --version-name, 1.5.1, --no-version-vectors, -F, /tmp/APKTOOL8489718399986004321.tmp, -0, arsc, -0, arsc, -I, /root/.local/share/apktool/framework/1.apk, -S, /root/TheFatRat/temp/original/res, -M, /root/TheFatRat/temp/original/AndroidManifest.xml] at brut.androlib.Androlib.buildResourcesFull(Androlib.java:477) at brut.androlib.Androlib.buildResources(Androlib.java:411) at brut.androlib.Androlib.build(Androlib.java:310) at brut.androlib.Androlib.build(Androlib.java:263) at brut.apktool.Main.cmdBuild(Main.java:227) at brut.apktool.Main.main(Main.java:84) Caused by: brut.androlib.AndrolibException: brut.common.BrutException: could not exec (exit code = 2): [aapt, p, --forced-package-id, 127, --min-sdk-version, 14, --target-sdk-version, 25, --version-code, 151, --version-name, 1.5.1, --no-version-vectors, -F, /tmp/APKTOOL8489718399986004321.tmp, -0, arsc, -0, arsc, -I, /root/.local/share/apktool/framework/1.apk, -S, /root/TheFatRat/temp/original/res, -M, /root/TheFatRat/temp/original/AndroidManifest.xml] at brut.androlib.res.AndrolibResources.aaptPackage(AndrolibResources.java:440) at brut.androlib.Androlib.buildResourcesFull(Androlib.java:463) ... 5 more Caused by: brut.common.BrutException: could not exec (exit code = 2): [aapt, p, --forced-package-id, 127, --min-sdk-version, 14, --target-sdk-version, 25, --version-code, 151, --version-name, 1.5.1, --no-version-vectors, -F, /tmp/APKTOOL8489718399986004321.tmp, -0, arsc, -0, arsc, -I, /root/.local/share/apktool/framework/1.apk, -S, /root/TheFatRat/temp/original/res, -M, /root/TheFatRat/temp/original/AndroidManifest.xml] at brut.util.OS.exec(OS.java:95) at brut.androlib.res.AndrolibResources.aaptPackage(AndrolibResources.java:434) ... 6 more W: ERROR: Unknown option '--forced-package-id' W: Android Asset Packaging Tool W: W: Usage: W: aapt l[ist] [-v] [-a] file.{zip,jar,apk} W: List contents of Zip-compatible archive. W: W: aapt d[ump] [--values] [--include-meta-data] WHAT file.{apk} [asset [asset ...]] W: strings Print the contents of the resource table string pool in the APK. W: badging Print the label and icon for the app declared in APK. W: permissions Print the permissions from the APK. W: resources Print the resource table from the APK. W: configurations Print the configurations in the APK. W: xmltree Print the compiled xmls in the given assets. W: xmlstrings Print the strings of the given compiled xml assets. W: W: aapt p[ackage] [-d][-f][-m][-u][-v][-x][-z][-M AndroidManifest.xml] \ W: [-0 extension [-0 extension ...]] [-g tolerance] [-j jarfile] \ W: [--debug-mode] [--min-sdk-version VAL] [--target-sdk-version VAL] \ W: [--app-version VAL] [--app-version-name TEXT] [--custom-package VAL] \ W: [--rename-manifest-package PACKAGE] \ W: [--rename-instrumentation-target-package PACKAGE] \ W: [--utf16] [--auto-add-overlay] \ W: [--max-res-version VAL] \ W: [-I base-package [-I base-package ...]] \ W: [-A asset-source-dir] [-G class-list-file] [-P public-definitions-file] \ W: [-D main-dex-class-list-file] \ W: [-S resource-sources [-S resource-sources ...]] \ W: [-F apk-file] [-J R-file-dir] \ W: [--product product1,product2,...] \ W: [-c CONFIGS] [--preferred-density DENSITY] \ W: [--split CONFIGS [--split CONFIGS]] \ W: [--feature-of package [--feature-after package]] \ W: [raw-files-dir [raw-files-dir] ...] \ W: [--output-text-symbols DIR] W: W: Package the android resources. It will read assets and resources that are W: supplied with the -M -A -S or raw-files-dir arguments. The -J -P -F and -R W: options control which files are output. W: W: aapt r[emove] [-v] file.{zip,jar,apk} file1 [file2 ...] W: Delete specified files from Zip-compatible archive. W: W: aapt a[dd] [-v] file.{zip,jar,apk} file1 [file2 ...] W: Add specified files to Zip-compatible archive. W: W: aapt c[runch] [-v] -S resource-sources ... -C output-folder ... W: Do PNG preprocessing on one or several resource folders W: and store the results in the output folder. W: W: aapt s[ingleCrunch] [-v] -i input-file -o outputfile W: Do PNG preprocessing on a single file. W: W: aapt v[ersion] W: Print program version. W: W: Modifiers: W: -a print Android-specific data (resources, manifest) when listing W: -c specify which configurations to include. The default is all W: configurations. The value of the parameter should be a comma W: separated list of configuration values. Locales should be specified W: as either a language or language-region pair. Some examples: W: en W: port,en W: port,land,en_US W: -d one or more device assets to include, separated by commas W: -f force overwrite of existing files W: -g specify a pixel tolerance to force images to grayscale, default 0 W: -j specify a jar or zip file containing classes to include W: -k junk path of file(s) added W: -m make package directories under location specified by -J W: -u update existing packages (add new, replace older, remove deleted files) W: -v verbose output W: -x create extending (non-application) resource IDs W: -z require localization of resource attributes marked with W: localization="suggested" W: -A additional directory in which to find raw asset files W: -G A file to output proguard options into. W: -D A file to output proguard options for the main dex into. W: -F specify the apk file to output W: -I add an existing package to base include set W: -J specify where to output R.java resource constant definitions W: -M specify full path to AndroidManifest.xml to include in zip W: -P specify where to output public resource definitions W: -S directory in which to find resources. Multiple directories will be scanned W: and the first match found (left to right) will take precedence. W: -0 specifies an additional extension for which such files will not W: be stored compressed in the .apk. An empty string means to not W: compress any files at all. W: --debug-mode W: inserts android:debuggable="true" in to the application node of the W: manifest, making the application debuggable even on production devices. W: --include-meta-data W: when used with "dump badging" also includes meta-data tags. W: --pseudo-localize W: generate resources for pseudo-locales (en-XA and ar-XB). W: --min-sdk-version W: inserts android:minSdkVersion in to manifest. If the version is 7 or W: higher, the default encoding for resources will be in UTF-8. W: --target-sdk-version W: inserts android:targetSdkVersion in to manifest. W: --max-res-version W: ignores versioned resource directories above the given value. W: --values W: when used with "dump resources" also includes resource values. W: --version-code W: inserts android:versionCode in to manifest. W: --version-name W: inserts android:versionName in to manifest. W: --replace-version W: If --version-code and/or --version-name are specified, these W: values will replace any value already in the manifest. By W: default, nothing is changed if the manifest already defines W: these attributes. W: --custom-package W: generates R.java into a different package. W: --extra-packages W: generate R.java for libraries. Separate libraries with ':'. W: --generate-dependencies W: generate dependency files in the same directories for R.java and resource package W: --auto-add-overlay W: Automatically add resources that are only in overlays. W: --preferred-density W: Specifies a preference for a particular density. Resources that do not W: match this density and have variants that are a closer match are removed. W: --split W: Builds a separate split APK for the configurations listed. This can W: be loaded alongside the base APK at runtime. W: --feature-of W: Builds a split APK that is a feature of the apk specified here. Resources W: in the base APK can be referenced from the the feature APK. W: --feature-after W: An app can have multiple Feature Split APKs which must be totally ordered. W: If --feature-of is specified, this flag specifies which Feature Split APK W: comes before this one. The first Feature Split APK should not define W: anything here. W: --rename-manifest-package W: Rewrite the manifest so that its package name is the package name W: given here. Relative class names (for example .Foo) will be W: changed to absolute names with the old package so that the code W: does not need to change. W: --rename-instrumentation-target-package W: Rewrite the manifest so that all of its instrumentation W: components target the given package. Useful when used in W: conjunction with --rename-manifest-package to fix tests against W: a package that has been renamed. W: --product W: Specifies which variant to choose for strings that have W: product variants W: --utf16 W: changes default encoding for resources to UTF-16. Only useful when API W: level is set to 7 or higher where the default encoding is UTF-8. W: --non-constant-id W: Make the resources ID non constant. This is required to make an R java class W: that does not contain the final value but is used to make reusable compiled W: libraries that need to access resources. W: --shared-lib W: Make a shared library resource package that can be loaded by an application W: at runtime to access the libraries resources. Implies --non-constant-id. W: --app-as-shared-lib W: Make an app resource package that also can be loaded as shared library at runtime. W: Implies --non-constant-id. W: --error-on-failed-insert W: Forces aapt to return an error if it fails to insert values into the manifest W: with --debug-mode, --min-sdk-version, --target-sdk-version --version-code W: and --version-name. W: Insertion typically fails if the manifest already defines the attribute. W: --error-on-missing-config-entry W: Forces aapt to return an error if it fails to find an entry for a configuration. W: --output-text-symbols W: Generates a text file containing the resource symbols of the R class in the W: specified folder. W: --ignore-assets W: Assets to be ignored. Default pattern is: W: !.svn:!.git:!.dsstore:!.scc:.:

:!CVS:!thumbs.db:!picasa.ini:!~ W: --skip-symbols-without-default-localization W: Prevents symbols from being generated for strings that do not have a default W: localization W: --no-version-vectors W: Do not automatically generate versioned copies of vector XML resources. W: --no-version-transitions W: Do not automatically generate versioned copies of transition XML resources. W: --private-symbols W: Java package name to use when generating R.java for private resources.

benedettidev commented 6 years ago

Have the same issue did you find a solution?

sanjeevpk commented 6 years ago

Hi, Even when I try to embed backdoor into some sample apk is throwing error like below. Could you please let us know how to resolve this issue.

*] Creating RAT Apk File...done.

[*] Decompiling RAT APK file...done.

[*] Decompiling original APK file...done.

[*] Merging permissions of original and payload projects...done.

[*] Running proguard on RAT APK file...done.

[*] Decompiling obfuscated RAT APK file...done.

[*] Creating new directories in original project for RAT smali files...done.

[*] Copying RAT smali files to new directories in original project...done.

[*] Fixing RAT smali files...done.

[*] Obfuscating const-string values in RAT smali files...done.

[*] Locating smali file to hook in original project...done.

[*] Adding hook in original smali file... done.

[*] Adding persistence hook in original project...done.

[*] Recompiling original project with backdoor...done. [!] Failed to recompile original project with backdoor

Press [ENTER] key to continue to return to fatrat menu

DakotaCodes00 commented 6 years ago

Hey guys you have to set Kali's java default to java 8 not 10 as java 10 cannot be used to recompile the backdoor

use update-alternatives --config java and select the option that contains "java-8-openjdk-amd64" this is usually option 2

I hope this helps :)

benedettidev commented 6 years ago

Not worked for me unfortunatly

sanjeevpk commented 6 years ago

@r00t-3xploit3r Thanks a lot. After the java downgrade, I was able to generate the backdoored apk. Appreciate your response.

SphiwokuhleS commented 6 years ago

@r00t-3xploit3r you're than man bro!!!!

SphiwokuhleS commented 6 years ago

It re compiles but it doesn't work

italiangrubber commented 6 years ago

It doesn't work for me too. Hope this will be fixed soon. There is no alternative at this moment.

SphiwokuhleS commented 6 years ago

:thinking:

FirstClickin commented 5 years ago

🛑🛑🛑 Here is The FIX 2019.. https://youtu.be/QfyYWioLEk4 Full Video by FirstClickin. 🐒🐒🐒🐒🐒

justMSARahat commented 5 years ago

hey.i have same problem. But I notice That My linux Doesn't have installed lib32ncrses5. And I am unable to install that, when i type : apt-get install lib23ncrses5 the i found this: e unable to locate this package. and this is the main problem of that. if anyone can solve that problem??? and maybe this is your problem!

mikhaelalsayyed commented 4 years ago

its lib23ncrses6 now the other one is old

andreicadar commented 4 years ago

Issue still remains after everything listed above. There is a problem with apktool, even if I try to manually decompile and compile it doesn t work and Evil-Droid doesn t work too, hope that this gets fixed is so annoying becase every method is based on apktool.

peterpt commented 4 years ago

if apktool is unable to decompile the apk then you should post an issue in : https://github.com/iBotPeaches/Apktool and upload there your apk , so they can check the issue and fix it .

shanky2113 commented 4 years ago

hey.i have same problem. But I notice That My linux Doesn't have installed lib32ncrses5. And I am unable to install that, when i type : apt-get install lib23ncrses5 the i found this: e unable to locate this package. and this is the main problem of that. if anyone can solve that problem??? and maybe this is your problem!

Ans to install these libraries in kali linux just remove 32 from name and then install it worked for me

peterpt commented 4 years ago

Kali is a debian linux distribution , so all you have to do is to go to debian website and look for the package , and it will show you in witch repositories exist . https://packages.debian.org/search?keywords=lib32ncurses5

and the name is lib32ncurses5 and not : lib32ncrses5 or even lib23ncrses5

lodhibhupendra commented 6 months ago

Testing your apk before next step ...Error Apktool in unable to decompile this apk

Press [ENTER] key to return to menu

DakotaCodes00 commented 6 months ago

Testing your apk before next step ...Error Apktool in unable to decompile this apk

Press [ENTER] key to return to menu

It's been 2 years since the last commit to this project, go use ChatGPT, Copilot/Bing, Phind or any other AI search engine or chat bot to help you fix the issue you are facing.

Have a great day :)