Hey Folks, today in this tutorial we are going to share with you a cloud based remote android management suite called “L3MON”. L3MON is an cloud based remote android management suite but for now we’ll configure it on localhost in our kali linux operating system. L3MON android management suite is designed in NodeJS language. If seen, it is a type of android management tool that creates a fully undetectable payload for the android operating system and has access to the entire device.
Features of L3MON
- GPS Logging
- Microphone Recording
- View Contacts
- SMS Logs
- Send SMS
- Call Logs
- View Installed Apps
- View Stub Permissions
- Live Clipboard Logging
- Live Notification Logging
- View WiFi Networks (logs previously seen)
- File Explorer & Downloader
- Command Queuing
- Built-In APK Builde
Let’s take a look 😛 !!
Install Dependencies – NodeJs
As we know that the entire project is coded in nodejs, so we have to install nodejs in our system in order to operate it. In addition, we have to install NPM package manager to publish Nodejs projects.
apt install nodejs npm
Basically pm2 allows us to handle application deployments and keep applications alive forever. So you need to install it by using the following command.
npm install pm2 -g
Download the entire tool from github with git command, go to the directory and then its server directory and execute the “npm” command.
git clone https://github.com/D3VL/L3MON.git
Opps 😛 !! After executing the command you will get an error which we have highlighted which you need to execute to fix the issues.
npm audit fix
Now start and daemonize the application by using the following command.
pm2 start index.js
Make pm2 auto-boot at server restart by using the following command.
Hmm 😛 !! We followed all the above instructions to check if it worked. Everything is fine, So we need to shut it down again to do some required configuration in the server.
pm2 stop index
We need to change the password to MD5 hash encryption and put it in the configuration file to secure the admin panel. You can change the password according to the command below.
Usage 😛 !! echo -n “Your Password” | md5sum
echo -n "12345" | md5sum
Good 😛 !! Now here you can keep the username and password as per your choice but only add MD5 hash value to the password.
BOOT 😛 !! Everything is done and now we need to restart all the servers again.
Nice 😛 !! In just one attempt we have successfully configured this tool on our localhost. Just use the following location, execute it on our browser, enter the username “admin” and password “12345″ and that’s it you will redirect to the admin panel.
Without wasting time, just go to the APK Builder section and give the localhost IP address and enter the port according to you.
Good 😛 !! It only takes 10 to 20 seconds to create android trojan. Once the payload is created, just download it and share it to the victim as per you.
BOOM 😛 !! It is very important whether the payload is detectable or not ? But in this case our payload is completely undetectable as you can see in the image below.
Great 😛 !! Once the victim has installed it and enabled the necessary permissions then you will get full access to the android phone. As you can see in the image below, we have got more information about the victim’s phone such as his IP address, device name and more.
Once you enter the manage button, you will get all these options to manage the victim phone.
You can track the exact location of the victim mobile.
It has dumped all saved contacts on the victim mobile.
You can see recent and previous calls on the victim’s mobile.
Through this facility you can view all the messages as well as send the message to another person through the victim mobile.
You can get the details of the previously connected wifi network.
You can also monitor what kind of applications are already installed into the victim’s mobile.
The main feature came at the end from where you can control the entire file manager of the victim mobile.
It’s an truly Full Undetectable Payload (FUD) for Android Operating System.
A keen learner and passionate IT student. He has done Web designing, CCNA, RedHat, Ethical hacking, Network & web penetration testing. Currently, he is completing his graduation and learning about Red teaming, CTF challenges & Blue teaming.