[KERNEL] [KALI-NETHUNTER] Burgerhunter/Dumplinghunter [OOS]

[Arka1n]

Here's Burgerhunter/Dumplinghunter, a nethunter kernel for the oneplus 5/5T !

You know why you are here...

• Burgerhunter kernel aim to port Kali Nethunter to the OP5, Kali nethunter is the entire Kali Linux operating system in a chroot on your phone.
  In short Kali nethunter allows (nearly) any kali tool you love to run from your device and more !
  For more information, RTFM --> https://github.com/offensive-security/kali-nethunter/wiki

About the kernel:

• This kernel is built based on Official OOS kernel, franco kernel, or ElementalX.
• This kernel is available for Official OOS ROM!
• Selinux is always set to permissive mode.
  [*]HID patch, some wifi packet injection patches, also enable the ECM protocol which allows you to share your device's network on Mac OS directly without any rndis driver installed. Added some drivers for external usb devices, like HackRF, proxmark3, serial adapters, etc.
• Wireguard is patched.
• Compile toolchain: gcc-arm-8.3-2019.03-x86_64-aarch64-elf & gcc-arm-8.3-2019.03-x86_64-arm-eabi
• Nethunter kernel for OP5/5T is constantly updated.
• Internal wifi monitor mode is supported now with latest nethunter kernel(OOS 9.0.11), but no packet injection ATM, however PMKID can still be catched. Details here: https://twitter.com/kimocoder/status/1243314073464377344

Source references:

• arter97 knerel for OP5/5T - https://github.com/arter97/android_kernel_oneplus_msm8998
• Official Kali Nethunter - https://gitlab.com/kalilinux/nethunter

Things you can play with this nethunter kernel:

• Wifi penetration as long as you got a working dongle, or just use internal wifi monitor mode to capture the PMKID.
• Perform HID attack with mouse & keyboard on all OS.
• CDROM & Mass storage simulation supported with latest nethunter app or Drivedroid.
• RNDIS & ECM simulation against Windows, Linux & Mac OS. Using RNDIS on Windows/Linux, and ECM on Linux/Mac OS(without any rndis driver installed on Mac OS).
• Working macchanger.
• The usual utilities you used to play with Kali OS(limited to armhf and arm64).

Recommendations

Things you'll need for wifi penetration test:

• A usb c otg adapter. (you can also buy another otg with additional ethernet port.)
• A usb wifi dongle capable of monitor mode, you can try some with realtek/ralink/atheros chipset. AWUS036H / AWUS036NEH works great !

Please read through those words highlighted in RED!! DON'T ASK FOR HELP if you didn't follow the exact steps from the instruction, because I CAN'T help if you do it on your own way!!

↓↓↓↓ INSTALLATION SECTION ↓↓↓↓​

[[[[[ Things you need before start flashing ]]]]]

1. Make sure you enable the USB debugging in developer option and confirm ADB is working.
2. A working twrp recovery, I recommend the "codeworkx" version, just search the latest updated one on XDA for downloads.
3. Latest magisk installer zip.
4. Nethunter kernel zip.
   [*]Optional: A chroot tarball file if you choose to install the chroot by restore method, it can be downloaded from the Download section below.
5. Push all of them in the root of your /sdcard folder.

[[[[[ Before going any further, please check the following things below ]]]]]

1. Make a full nandroid backup. (always recommended in case you want to roll back the previous state) But for the data in /sdcard, you better make them a copy to other places as well.
   [*]If you have kali chroot installed before, and you want to clean install the nethunter kernel, so please try to remove the chroot folder in twrp recovery first, just remove the whole directory: "/data/local/nhsystem" in twrp. But if you failed deleting the chroot folder, please format your data partition, and format it with ext2 format, and then format it again back to ext4.

** For those who are switching ROM from between STABLE and OPENBETA, please do go for CLEAN INSTALLATION **

[[[[[ CLEAN INSTALLATION ]]]]]

1. Boot into twrp recovery.
2. Follow these steps:
   ---wipe partitions including dalvik cache, cache, system, data & internal storage.
   ---Swipe to factory reset.
   ---Select "Format data", then type "yes".
   These three steps should clear all your data in /sdcard and all the encrypted or unencrypted partition as well. Then proceed to next step.
3. Place all the needed files in /sdcard through MTP or adb from your PC.
4. Flash official oos stock ota ROM zip, then reboot to bootloader.
5. Flash twrp recovery again, and reboot to recovery. (because the stock ota ROM zip will overwrite the recovery.)
6. Flash nethunter kernel.
7. Flash official magisk installer zip.
8. Reboot into system.
   [*]Download my nethunter-tribute app(see "Download" section below), open it and navigate to Chroot Manager fragment, and choose the way you want to install the chroot.(more info on "Chroot installation and trouble shooting" section below)
9. Download and install official nethunter app store apk, and then install the latest version of nethunter app and nethunter terminal app. And finally install the Kali Chroot in nethunter app's Chroot Manager.
10. Open magisk manager -> Downloads, search for "Wireless Firmware for Nethunter" by rithvikvibhu, download and install it, reboot again. (This step is trying to install a magisk module which includes the wireless firmware required by some external usb WiFi dongle)
11. Happy Hunting.

[[[[[ DIRTY INSTALLATION ]]]]]
* For devices that have magisk installed already.

1. Make sure your devices have magisk installed already, and using a working twrp recovery(codeworkx or bluespluk).
2. Place all the needed files in /sdcard.
3. Reboot into twrp recovery.
4. Flash nethunter kernel.
5. Flash official magisk installer zip.
6. Reboot into system.
   [*]Download my nethunter-tribute app(see "Download" section below), open it and navigate to Chroot Manager fragment, and choose the way you want to install the chroot.(more info on "Chroot installation and trouble shooting" section below)
7. Download and install official nethunter app store apk, and then install the latest version of nethunter app and nethunter terminal app. And finally install the Kali Chroot in nethunter app's Chroot Manager.
8. Open magisk manager -> Downloads, search for "Wireless Firmware for Nethunter" by rithvikvibhu, download and install it, reboot again. (This step is trying to install a magisk module which includes the wireless firmware required by some external usb WiFi dongle)
9. Happy Hunting.

[[[[[ How to dirty update OOS ROM without losing any data?]]]]]

1. Make NANDROID backup as always.
2. Make sure you have downloaded the official full stock rom zip(not ota, size should be larger than 1.5g).
   [*]Reboot into twrp recovery, and wipe dalvik cache & cache partitions.
3. Flash official stock ota zip, then reboot into bootloader and re-flash the twrp recovery again.
4. Re-flash nethunter kernel.
5. Re-flash magisk installer zip
6. Reboot into system.
7. Now all data in /data partition should remain unchanged which means all your files are still there, but the OOS version is upgraded.

↓↓ Chroot installation and trouble shooting ↓↓​

[*]Install the official nethunter app via official nethunter app store first, and install the kali chroot via Chroot Manager in nethunter app.
[*]If you are trying to remove the chroot and encounter some permission issue that not allowing your to delete the folder, your /data partition may possibly corrupt already, and the only way to solve it is to format the /data partition, or wipe out the whole phone. sometimes you won't be even able to format it, then you will need to proceed "change the filesystem" of /data to ext2 first, it can force format the /data partition and make it to ext2, then change it back to ext4. Now you can re-install the ROM zip and start it all over again.

↓↓↓↓ USB ARMY ↓↓↓↓​

How to bring up HID ?? (For OnePlus5/5T only)

• 
  Now you can do it from my latest modded nethunter app called nhtribute in the USB Army fragment.

Or, you can do it manually following the guide below:

• Make sure you have the kernel flashed properly, and confirmed wifi is working.
• Now, you can switch the usb to different status, currently you have the options belows:
  

  setprop sys.usb.config reset
  setprop sys.usb.config win,hid
  setprop sys.usb.config win,mass_storage
  setprop sys.usb.config win,rndis
  setprop sys.usb.config win,hid,mass_storage
  setprop sys.usb.config win,rndis,hid
  setprop sys.usb.config win,rndis,mass_storage
  setprop sys.usb.config win,rndis,hid,mass_storage
  setprop sys.usb.config mac,hid
  setprop sys.usb.config mac,mass_storage
  setprop sys.usb.config mac,ecm
  setprop sys.usb.config mac,hid,mass_storage
  setprop sys.usb.config mac,ecm,hid
  setprop sys.usb.config mac,ecm,mass_storage
  setprop sys.usb.config mac,ecm,hid,mass_storage

• [reset] -> reset the usb state to [mtp] or [mtp,adb]
• [win] -> target on Windows or Linux
• [mac] -> target on Mac OS
• [hid] -> enable HID
• [rndis] -> enable RNDIS if your target is Windows or Linux.
• [ecm] -> enable ECM if your target is Mac OS.
• [mass_storage] -> enable MASS_STORAGE
• Alternatively you can append ",adb" to the end of each command above that enables adb as well.
• So you can bring up the HID, RNDIS/ECM and mass_storage at the same time, it would be useful if you don't have any keyboard or bootable usb or network at that moment.
  [*]Also, for HID attack, I have added the code to "bootkali" for checking if the target PC has your HID drives installed before executing the ducky script.
  [*]The usb interface is actually setup and described in init.nethunter.rc file at your android root folder, please take a look.

How can I share my device's network after switching the usb state to RNDIS/ECM ??

• First, make sure your usb state is on RNDIS or ECM, please note that these is no network assigned to your RNDIS(rndis0) or ECM(usb0) interface every time you switch to them.
• All these jobs can be done in the nethunter app or by executing the "auto_network_sharing.sh", place that script into "/sdcard/nh_files/punkscripts/"
• Feel free to modify or add up your code and share your idea to improve the script.

Thanks to:

The Kali NetHunter team, arter97(op5/5t kernel source), nikhil18, adinkwok, flar2(ElementalX kernel), Atarii(Magisk module for nethunter) and many more !!!

My github source

Nethunter kernel source for OP5/5T:
https://gitlab.com/simonpunk/op5_arter97_nethunter_kernel/-/tree/op5-nethunter-pie
Nethunter kernel zip for OP5/5T:
https://gitlab.com/simonpunk/OP5_Anykernel3_Nethunter/-/tree/master/release
Modded anykernel3 build script:
https://gitlab.com/simonpunk/OP5_Anykernel3_Nethunter
Modded nethunter app for OnePlus5/5T(old repo, no longer maintained.):
https://github.com/simonpunk/nethunter-app
Official nethunter terminal:
https://gitlab.com/kalilinux/nethunter/apps/kali-nethunter-term/-/tree/nethunter

↓↓↓↓ DOWNLOAD SECTION ↓↓↓↓​

Nethunter Kernel for OP5/5T：
https://gitlab.com/simonpunk/OP5_Anykernel3_Nethunter/-/tree/master/release
Magisk wireless firmware module zip for nethunter:
Please search for "wireless firmware for nethunter" by rithvikvibhuin and install it in the magisk manager app.
Nethunter app:
Official nethunter app can be installed via official nethunter store app.
Nethunter terminal app:
Official nethunter terminal app can be installed via official nethunter store app.
Kali Chroot:
Kali Chroot can be installed and configured via latest version of official Nethunter app.

Last updated: [2020-03-27]
1. Updated instruction guide.

XDA:DevDB Information
Burgerhunter/Dumplinghunter, Kernel for the OnePlus 5

Contributors
Arka1n, simonpunk2013
Kernel Special Features:

Version Information
Status: Nightly

Created 2017-07-18
Last Updated 2020-04-21

 

[Arka1n]

Reserved

 

[Kaigen]

Thank you very much (Really)

 

[stefjoe]

Wow! You are my hero. Thanks man!!!!

 

[vtec_screamer]

Does it work on encrypted devices?

 

[Arka1n]

Both encrypted or decrypted works fine for OOS but right now your device has to be decrypted if you want to use it with any LOS based rom.

 

[vtec_screamer]

Both encrypted or decrypted works fine for OOS but right now your device has to be decrypted if you want to use it with any LOS based rom.

Great! I'll try it tomorrow... Thanks a lot!

 

[aydinbahadir88]

Work this Kernel on Carbon ROM ?

 

[gouthamgoumi]

Work this Kernel on Carbon ROM ?

Los version should work

 

[aydinbahadir88]

Los version should work

Thanks but Carbon ROM based on AOSP

 

[gouthamgoumi]

Thanks but Carbon ROM based on AOSP

Los is forked from aosp...It should work...Take a backup and try it out

 

[turbotorsten]

Can you put the internal wireless card in monitor mode?

 

[Arka1n]

Just need to know which wifi chipset the oneplus 5 is rocking, maybe it's the one integrated in the Snapdragon 835, need to do some searching but it seems quite unlikely...

 

[Arka1n]

[UPDATE]

Updated Burgerhunter-LOS to V4.5

 

[vtec_screamer]

Not working for me. OOS encrypted. Picture attached.

 

[Arka1n]

[UPDATE]
Updated Burgerhunter-LOS to V5

 

[Arka1n]

Not working for me. OOS encrypted. Picture attached.

Could you send a screenshot of your "home" tab and the chroot manager tab on the nethunter app ?

 

[vtec_screamer]

Could you send a screenshot of your "home" tab and the chroot manager tab on the nethunter app ?

Let me know if you need any other...

 

[turbotorsten]

Just need to know which wifi chipset the oneplus 5 is rocking, maybe it's the one integrated in the Snapdragon 835, need to do some searching but it seems quite unlikely...

I didn't find out either, didn't find anything for the OnePlus 3 too. Maybe you know better, cause I'm just an amateur Dev.

---------- Post added at 12:25 PM ---------- Previous post was at 12:22 PM ----------

Can I install something like Xserver XDSL so I have a gui?
If you know GNU root Debian, you know what I mean

 

[Arka1n]

Fine, busybox seems to be installed along with the kernel...

Do you have a menu (see my screenshot) when you open the kali terminal ?
If so you must select "kali" in order to access the chroot.
If you don't have that menu try to reflash the nethunter zip then the kernel and wait for the nethunter app to update your chroot (it was still updating on your first screenshot).

If none of this did the trick you can try to run this in (any) terminal app :

su
sh /data/data/com.offsec.nethunter/files/scripts/bootkali_bash

You should now be able to access your kali chroot