v1.0-beta.5a

AhMyth v1.0-beta.5a

This release is a Revision of v1.0-beta.5 which contained breaking bugs, these bugs have since been fixed, and a few new other updates were added to. This uses the same update information as the v1.0-beta.5 release, with the only changes to the info being where the bugs have been fixed.

See the Changelog below for more Update Information on this release.

Changelog

Server Updates

• Changed On Boot & On Launch checkbox names in the UI when binding is enabled, to Boot Method & Activity Method.

• Renamed the "$appCtrl.copyPermissions" function to "$appCtrl.modifyManifest" and Completely rewrote the function to utilise the "xml2js" library when copying over permissions, it also now handles the injection of the payload service and receiver for the Activity and Boot methods for binding. This contains a lot more useful features than the legacy "$appCtrl.copyPermissions" function. Click the dropdown tab below to see what the rewrite of this function does.

What Does This new Update do

1. Defines the function "$appCtrl.copyPermissions".
2. The function takes two parameters: data and callback.
3. Retrieves the checkboxes for Camera, Storage, Mic, Location, Contacts, SMS, and Call Logs.
4. Sets the default permissions array using CONSTANTS.permissions.
5. Creates an empty array selectedPermissions to store selected permissions.
6. Checks each checkbox and add the corresponding permission to selectedPermissions array.
7. If all checkboxes are checked, set selectedPermissions to default permissions array.
8. If all checkboxes are unchecked, set selectedPermissions to default permissions array.
9. Outputs a log message stating that the Android Manifest XML Data is being parsed.
10. Converts data to a string if it's not already a string.
11. Parses the XML data using xml2js.parseString.
12. If there's an error during parsing, call callback with an error message.
13. Gets the manifest object from the parsed XML result.
14. Checks if manifestObj.application.receiver is an array and convert it to an array if necessary.
15. Checks if manifestObj.application.service is an array and convert it to an array if necessary.
16. Creates a Set called existingPermissions to store existing permissions.
17. Checks if permissions already exist in the manifest and add them to existingPermissions set.
18. Checks if features already exist in the manifest and add them to existingPermissions set.
19. Filters selectedPermissions array to exclude duplicates and existing permissions.
20. Outputs a log message indicating that AhMyth Payload Permissions are being injected.
21. Adds new permissions and features to the manifest based on filtered selectedPermissions.
22. Creates receiver and service tags using constants.
23. Adds receiver and service tags to manifestObj.application.receiver and manifestObj.application.service arrays.
24. Creates an XML string using xml2js.Builder and modified manifest object.
25. Modifies the XML string to add indentation before closing </application> tag.
26. Replaces the closing </manifest> tag with a new closing tag without extra newline.
27. Calls callback with null (no error) and the final modified XML as the result.

• Rewrote the "GetLauncherActivity" function utilised by the "$appCtrl.BindOnLauncher" function to make use of the "xml2js" library to help in finding a suitable main class file for hooking from the manifest file data, this aids in solving Binding problems for Issue #315 When using the On Launch method for binding. Click the dropdown tab below for a step by step explanation of what the rewrite for this function does:

What Does This new Update do?

1. It attempts to extract the <application> tag from the manifest object by accessing manifest['manifest']['application'][0]. This assumes that the manifest object has a structure where manifest contains a manifest property, which contains an application property that is an array (hence the [0] index).

2. It then checks if the extracted application object exists and if it has an android:name attribute (application['$']['android:name']). The android:name attribute typically specifies the fully qualified class name of the main application class in the AndroidManifest.xml file.

3. If the android:name attribute exists and the class name doesn't start with "android.app", it performs some manipulation on the class name. It splits the class name by the dot (.) separator and takes the last part (i.e., the class name without the package). If the class name starts with a dot (.), it removes the dot. Then it logs a message indicating that it has scoped the main application class for hooking and returns the manipulated class name appended with the ".smali" extension.

4. If the previous step doesn't find the main application class, the function proceeds to search for the launcher activity. It looks for an activity object within the application object that contains an intent filter with the action "android.intent.action.MAIN" and category "android.intent.category.LAUNCHER" or "android.intent.category.DEFAULT".

5. It iterates over the activity objects in the manifest using the Array.prototype.find() method and checks if any of them have an intent filter that matches the launcher conditions mentioned in the previous step. If it finds a matching activity, it retrieves the android:name attribute of that activity.

6. Similar to step 3, if the retrieved activity class name doesn't start with "android.app", it performs the same manipulation to get the class name without the package. If the class name starts with a dot (.), it removes the dot. Then it logs a message indicating that it has scoped the main launcher activity class for hooking and returns the manipulated class name with the ".smali" extension.

7. If no launcher activity is found in the activities, the function checks for activity aliases (activity-alias objects) that have the same intent filter conditions as in step 4.

8. It iterates over the activity-alias objects in the manifest and checks if any of them have an intent filter that matches the launcher conditions. If it finds a matching activity alias, it retrieves the android:targetActivity attribute, which specifies the target activity of the alias.

9. The target activity name is then manipulated in the same way as before (without the package and without a leading dot), logged as a message indicating that it has scoped the main launcher activity class in an alias for hooking, and returned with the .smali extension.

10. If none of the above conditions match (no main application class, no launcher activity, and no launcher activity alias), the function returns -1 to indicate that the launcher activity couldn't be found.

• Fixed Permissions problem with Linux AhMyth binaries by editing the postins script, they should work properly now.

• Removed the Config folder and the AhMyth.desktop file for Linux as it could only work on Kali & Parrot.

• Added Boot Persistence to payloads bound using the On Launch method for binding, payloads bound using the On Launch method for binding will now start to connect back faster after a device has restarted.

• Bumped Apktool version from v2.6.1 up to v2.8.1, while this aids in building backdoored original APK files, AhMyth users running a 32bit OS Architecture will be upset to know that Apktool will drop support for 32bit OS architecture once it reaches v3.0.0, which means that AhMyth will officially dropped support for 32bit OS Architecture when this happens as well.

• Upgraded the "autoinstall" file used for installing AhMyth from source on Linux so it correctly installs the needed dependencies, if they're already installed then the script will do nothing, the "autoinstall" file for Linux has also been renamed from "autoinstall" to "autoinstall_linux", the file has also been upgraded to correctly install AhMyth and its needed dependencies for Debian & APT Based Linux Distro's as well as Arch Linux & pacman based Linux Distro's

• Renamed the "install.bat" file for installing electron v11 for AhMyth on Windows to "autoinstall_win.bat"

• Added a "start_linux" script for Linux Users that starts AhMyth correctly based on the users Privilege Level (i.e root | non-root)

• Updated the "start.bat" file for starting AhMyth on Windows, to start and then minimize, so that the command prompt can start AhMyth in the background, the file has also been renamed from "start.bat" to "start_win.bat"

• Rewrote the checkbox code responsible for allowing users to customize what permissions are used in both a bound and standalone APK payload, this incorporates permissions mapping used in the Constants.js file.

• Updated the AhMyth receiver, AhMyth service and original permissions array, which are all exported from the Constants.js file, to work with the "xml2js" library.

• Corrected the height of the black message box in the main AhMyth GUI as well as the Victim's Lab, it now fits evenly in both the Main window and Victim's Lab window.

• Fixed the green Maximize & Restore button in the main AhMyth GUI, it now restores the window back to its original window size after being maximized.

• Rewrote the entire "GetLauncherPath" function utilized by the "$appCtrl.BindOnLauncher" function to use readdirp, a cross platform recursive version of nodeJS's fs.readdir(), this allows AhMyth to recursively search an entire APK for a hookable class file ...

AhMyth v1.0-beta.4

AhMyth v1.0-beta.4

This release contains major updates, bug fixes, stability improvements, and more.

This release was promised to be released a long time ago, but a lot of things came up, so I apologize to everyone for how long this took to do.

See the Changelog below for more Update Information on this release.

Changelog

Server Updates

1. Fixed a limitation in the Bind On Launch feature, where AhMyth was only capable of searching through smali directories for launcher activities when backdooring original APK files. AhMyth can now search any smali or smali_classes directory recursively for the launcher activity when backdooring APKs using this method.

2. Updated the APK Browser Dialog to only allow the selection of APK files to avoid misselection of other files.

3. Updated code for rendering HTML pages in the main.js file to allow AhMyth to upgrade from electron@9.4.1 to electron@11.5.0 for Windows and electron@11.0.0 for Linux and macOS.

4. Added a new, simpler, static hook method for backdooring APK files when using the On Launch binding method. This supersedes the old onCreate hook method used before. This integration was borrowed from Metasploit-Framework's androidpayload files, which work in conjunction with Client Update No. 1 seen further down this list.

5. Fixed building problems with Windows by integrating a child process to empty the Apktool framework directory before building a standalone or bound APK payload. This was done because Windows users required doing this manually to allow AhMyth's building process to work properly. It's now done automatically before building each payload APK.

6. Fixed a bug in the function for modifying Launcher Activity files when using the Bind on Launch method. This bug would cause the package name of a legit APK file to be the absolute path of the Launcher Activity, which was not good. The newer cross-platform Bind On Launch feature has since fixed thanks to the use of RegExp.

7. Fixed a bug in the Bind On Launch feature where the function for the extraction of the launcher activity from the android:targetActivity attribute was not the full converted launcher activity string. Apparently, the code wasn't finished by the creator because it was not having its instances of XML periods (.) converted to path separating slashes (/ - \\). This used to cause a major freeze in binding with some APKs, but it has now been fixed and will no longer happen anymore.

8. Added new functions to modify an original APK's SDK version number when binding on launch to aid in allowing permissions of the payload to be granted after installing a bound payload. This works with most APKs tested, but there were a few exceptions, so don't expect this to work on every APK you try it with.

9. Corrected returned picture size from the camera snap feature. Major thank you to GitHub user HiddenPirates for doing this.

Internal Node Module Updates

1. angular v1.8.0 >> angular v1.8.3
2. angular-route v1.8.0 >> angular-route v1.8.3
3. fs-extra v1.0.0 >> fs-extra v11.1.0
4. geoip-lite v1.1.8 >> geoip-lite v1.4.6
5. socket.io v1.4.5 >> socket.io v2.4.1

Internal Node Module Migrations

1. semantic-ui v2.2.6 >> fomantic-ui v2.8.8
2. homedir v0.6.0 >> node-homedir v1.1.1

Client Updates

1. Implemented Java code responsible for starting the new static hook function explained in the Server Updates above.
2. Added better boot persistence.

Repository Updates

1. Updated repository README.md with badges and easy-to-read content.
2. Created an AhMyth wiki that covers detailed information about AhMyth and its payload, as well as installation instructions, a troubleshooting manual for known AhMyth errors, and a full user manual for newer users of AhMyth.
3. Added Issues Templates to further assist myself and other AhMyth users in determining where problems are with either the Server, the Client, or with Binding.
4. Fixed binary setup installers.

What's New?

1. Built-in a new Payload URL Masker to slightly assist users with remote payload installation. A big thank you to YagamiLight17 for modifying and building this into AhMyth, and a big thank you to its original creator yogeshwaran01! This is currently unusable.
2. Added a new updated splash screen with a new background and a new AhMyth logo.
3. New custom permissions selection for building standalone or bound APK payloads. A MAJOR thank you to YagamiLight17 for working tirelessly on this.
4. Integrated error logging for decompiling, building, signing, and other errors.
5. Updated auto installers. They've been moved into one "autoinstall" file and work for Kali and Parrot.

AhMyth v1.0-beta.3b

AhMyth v1.0-beta.3b

Some Small but Major updates to the AhMyth Server, fixing some very major bugs with client installation and with binding.

See the Changelog below for more Update Information on this release.

Changelog

Server Updates

• Migrated AhMyth's original APK Signer from Sign by Appium Boneyard to Uber APK Signer by Patrick Fav Fixing parsing package errors & other errors with installing AhMyth payload APK's, the new Signer for AhMyth also handles zipaligning as well which was not present in the old Signer

• Fixed typo's in AppCtrl.js that were causing problems with Binding with both On Launch & On Boot, Binding is now more stable than the previous versions, for both binding methods.

AhMyth v1.0-beta.3a

AhMyth v1.0-beta.3a

See the Changelog below for more Update Information on this Release.

Changelog

Server Updates

• Updated Socket.io version to fix Slow Victim Connections
• Updated AhMyth buffer method fixing the deprecation warning;

buffer() is deprecated please use buffer.alloc() buffer.from() or buffer.allocUnsafe() instead

• Fixed autoinstallers for Kali and Parrot OS - had to seperate the autoinstaller into two seperate autoinstallers, there is one for Kali & one for Parrot

• Upgraded the black AhMyth UI Terminal font colors

AhMyth v1.0-beta.2

AhMyth v1.0-beta.2

See the Changelog below for more Update Information on this release.

Changelog

Server Updates

• Fixed broken APK Browser by updating the electron Browser Dialog in AppCtrl.js
• Added JDK 11 support for the following actions below by rebuilding the Signer and Apktool with JDK 11 & JRE 11
  • Decompiling
  • Building
  • Signing

AhMyth v1.0-beta.1

Released July 7 2017

The birth of AhMyth Android RAT

Released by GitHub user and AhMyth-RAT creator, Ahmed Al 'AhMyth' Hajri on July 7, 2017