View attachment 5212297
I present to you: Kali NetHunter for the Huawei Nexus 6P LOS17.1
Kali NetHunter is an Android ROM overlay that turns an ordinary phone into the ultimate Mobile Penetration Testing Platform.
The overlay includes a custom kernel, a Kali Linux chroot, an accompanying Android application, which allows for easier interaction with various security tools and attacks, as well as a client to the Kali NetHunter App Store.
Beyond the penetration testing tools arsenal within Kali Linux and the Kali NetHunter App Store, NetHunter also supports several additional classes, such as HID Keyboard Attacks, BadUSB attacks, Evil AP MANA attacks, and much more. For more information about the moving parts that make up NetHunter, check out our NetHunter Components page.
NetHunter is an open-source project developed by Offensive Security and the community.
~ Prerequisites ~
- TWRP -
https://drive.google.com/open?id=1axm3GVbTKypUdQAuYubNknJX4wKRFIec
- Stock components - vendor, radio, & bootloader img's from the stock oreo 8.1 OPM7.181205.001 Dec 2018 factory image -
https://androidfilehost.com/?w=files&flid=286833
- Magisk –
https://forum.xda-developers.com/apps/magisk
~~ Downloads ~~
- NetHunter installer (find the latest release for Nexus 6P):
https://www.kali.org/get-kali/#kali-mobile
- fstab with disabled forceencrpyt -
https://www.androidfilehost.com/?fid=4349826312261764572
- vendor image with patched fw for nexmon -
https://www.androidfilehost.com/?fid=8889791610682949885
- nexmon zip with nexutil and libs -
https://www.androidfilehost.com/?fid=8889791610682951480
- Bootanimation TWRP flasher -
https://www.androidfilehost.com/?fid=10763459528675571003
~~ How to Install ~~
- Assuming you have flashed stock radio, vendor, bootloader, TWRP, and Lineage 17.1 (using the steps from
https://forum.xda-developers.com/ne...t/rom-lineageos-17-0-nexus-6p-angler-t4012099)
- Plug in to PC if you haven't done that yet
- Reboot into TWRP
- Format data
- Copy Magisk, NetHunter image, and fstab to USB-C drive or adb push to /sdcard
- Reboot into bootloader and flash vendor which was unzipped from zip
Code:
fastboot flash vendor vendor.squashfs
- Reboot into TWRP
- Copy fstab to /system_root/
Code:
adb push fstab.angler /sdcard/
adb shell "twrp mount /system_root && twrp remountrw /system_root && cp /sdcard/fstab.angler /system_root/"
- Format data
- Reboot to system & do Android setup
- Reboot into TWRP
- Install Nexmon files through adb, from the zip above
Code:
twrp mount /system_root && twrp remountrw /system_root && cp /sdcard/libnexmonkali.so /system_root/system/lib64/kalilibnexmon.so && cp /sdcard/libnexmon.so /system_root/system/lib64/ && cp /sdcard/nexutil /system_root/system/xbin/ && chmod a+x /system_root/system/xbin/nexutil
- Flash NetHunter image
- Flash Magisk
- Reboot
- Run NetHunter app, update from NH Store
- Reboot
~~~ Notes & Updates ~~~
Nexmon is finally working with injection in Kali Chroot , although EAPOL data is still not (or malformed) in the captures.
- copy Nexmon libs over to /system/lib64/ from the nexmon.zip (not in TWRP):
Code:
adb push libnexmon* /sdcard/ && adb push nexutil /sdcard/
- and copy using androidsu terminal:
Code:
mount -o rw,remount / && cp /sdcard/libnexmonkali.so /system/lib64/kalilibnexmon.so && cp /sdcard/libnexmon.so /system/lib64/ && cp /sdcard/nexutil /system/xbin/ && chmod a+x /system/xbin/nexutil
For devices which have no space left on system: you need to copy those files before flashing NetHunter. I didn't have this problem, maybe due to GApps pico. Then use the following commands in TWRP:
Code:
twrp mount /system_root && twrp remountrw /system_root && cp /sdcard/libnexmonkali.so /system_root/system/lib64/kalilibnexmon.so && cp /sdcard/libnexmon.so /system_root/system/lib64/ && cp /sdcard/nexutil /system_root/system/xbin/ && chmod a+x /system_root/system/xbin/nexutil
Thanks
@JaK3sT for discovering this!
You have to make sure that wifi is on but you're not connected to an AP.
Enable in AndroidSU terminal, I created a custom command with
Export LD_PRELOAD for faking ioctl
in every Kali Chroot terminal window you open
Code:
export LD_PRELOAD=/system/lib64/kalilibnexmon.so
Hijacker is not fully supported as I've built one with aarch64 tools, but it randomly stops airodump although it's working. Will give it a shot in the future.
- Mana is being replaced, for the time being you can downgrade iptables in chroot with the following :
Code:
wget http://old.kali.org/kali/pool/main/i/iptables/iptables_1.6.2-1.1_arm64.deb
wget http://old.kali.org/kali/pool/main/i/iptables/libip4tc0_1.6.2-1.1_arm64.deb
wget http://old.kali.org/kali/pool/main/i/iptables/libip6tc0_1.6.2-1.1_arm64.deb
wget http://old.kali.org/kali/pool/main/i/iptables/libiptc0_1.6.2-1.1_arm64.deb
wget http://old.kali.org/kali/pool/main/i/iptables/libxtables12_1.6.2-1.1_arm64.deb
dpkg -i *.deb
apt-mark hold iptables
apt-mark hold libip4tc0
apt-mark hold libip6tc0
apt-mark hold libiptc0
apt-mark hold libxtables12
Credits: The Offensive Security Team and the NetHunter community, huge thanks to Re4son & kimocoder for patching the wlan1 insert reboot issue! Long time mystery.
Another extremely big thanks for
@draco42 for patching libnexmon and kalilibnexmon!
Android Version: 10.0
XDA: DevDB Information
Kali Nethunter, Kernel & ROM for the Huawei Nexus 6P
Contributors
@Re4son,
@kimocoder,
@yesimxev,
@draco42
Source Code:
https://gitlab.com/kalilinux/nethunter/
Kernel Source:
https://github.com/Re4son/android_kernel_huawei_angler
forum.xda-developers.com
. I literally used TWRP's file manager and copied them manually.
