[ROM] [Unofficial] NetHunter [OnePlus 8T] [Android 11 & 12] [26.08.21]

[flypatriot]

Kali NetHunter for OnePlus 8 series​

Description​

Kali NetHunter is an Android ROM overlay that turns an ordinary phone into the ultimate Mobile Penetration Testing Platform.
The overlay includes a custom kernel, a Kali Linux chroot, an accompanying Android application, which allows for easier interaction with various security tools and attacks, as well as a client to the Kali NetHunter App Store.
Beyond the penetration testing tools arsenal within Kali Linux and the Kali NetHunter App Store, NetHunter also supports several additional classes, such as HID Keyboard Attacks, BadUSB attacks, Evil AP MANA attacks, and much more. For more information about the moving parts that make up NetHunter, check out NetHunter Components page.
NetHunter is an open-source project developed by Offensive Security and the community.​

Disclaimer​

Your warranty is now void.
I am not responsible for anything that may happen to your phone by installing any custom ROMs and/or kernels.
You do it at your own risk and take the responsibility upon yourself and you are not to blame me or XDA and its respected developers.​

Features​

• WiFi injection​
• Internal WiFi monitor mode​
• AirSpy / HackRF (RTL-SDR)​
• Bluetooth (RFCOMM)​
• USB Arsenal​
• External WiFi adapters from NetHunter's support list​
• HID attacks​
• RFID platform support​
• A11 version based on Neutrino's kernel with CAF 4.19 and linux-stable merged in​
• A12 version based on crDroid kernel with CAF 4.19 and linux-stable merged in​
• Disabled Android Paranoid Network mode to allow access to all networking features for PostgreSQL, apt, ping and other commands​

Prerequisites​

• Clean A11 OxygenOS or custom ROM​
• Custom A12 ROM​
• Unlocked bootloader​
• TWRP​
• Magisk​
• Universal Mount System read write R/W​

How to Install​

Spoiler: OxygenOS

1. Copy twrp, magisk, System_RW_sript, NetHunter kernel & NetHunter zip to external USB-C drive​
2. Flash TWRP​
3. Reboot into recovery, format data & reboot back to recovery​
4. Reboot to system, finish Android setup, launch Magisk app & apply post install requirements​
5. Copy systemrw_1.32 folder to /data/local/tmp & make script systemrw.sh executable (chmod +x)​
6. Reboot into TWRP, launch terminal & run command /data/local/tmp/systemrw_1.32/systemrw.sh size=100​
7. Reboot to system & check the ability to write into system folder (e.g. create empty folder)​
8. Install NetHunter zip through Magisk​
9. Flash NetHunter kernel using kernel manager or twrp recovery​
10. Reboot to system & run NetHunter app​
11. Update NetHunter app from NetHunter Store​

Spoiler: Custom ROM

1. Copy twrp, magisk, NetHunter kernel & NetHunter zip to external USB-C drive​
2. Flash TWRP​
3. Reboot into recovery, format data & reboot back to recovery​
4. Install Magisk​
5. Reboot to system, finish Android setup, launch Magisk app & apply post install requirements​
6. Install NetHunter zip through Magisk​
7. Flash NetHunter kernel using kernel manager or twrp recovery​
8. Reboot to system & run NetHunter app​
9. Update NetHunter app from NetHunter Store​

Downloads​

• A11 NetHunter Magisk Installer
• A11 NetHunter Kernel
• A12 NetHunter Magisk Installer
• A12 NetHunter Kernel

Known issues​

• Switching internal wlan0 to monitor mode and back to managed mode freezes device for about 15 seconds (A11 kernel only)​
• Run chown -R postgres:postgres /var/lib/postgresql/14/main in case of postgresql service start fail​

Credits​

The Offensive Security Team and the NetHunter community​

My huge thanks to:

• kimocoder
• 0ctobot
• Re4son
• @lebigmac
• @Invincible-Man
• @Zackptg5
• RfidResearchGroup
• iceman1001

Thanks for your great work, support, help and development!
Without you there would be nothing here!​

Contributors
flyP@TR!0T

Source​

Official Source Code:
Official NetHunter Project
Source code for OnePlus 8 series:
flyP@TR!0T/NetHunter Project
flyP@TR!0T/NetHunter Devices
Kernel Source:
A11 kernel
A12 kernel

Notes & Updates​

Status: Testing
Current Kernels Versions:

• 4.19.205 for A11
• 4.19.226 for A12

Created 2021-08-26
Last Updated 2022-03-27

 

[flypatriot]

Navigation in terminal doesn't work. Just install fzf package to repair.
Will recompile installer soon.

Upload new installer with fzf package included.

 

[flypatriot]

New kernel release​

• Updated kernel to last commits from Neutrino
• Current kernel version - 4.19.205
• Fixed some compile warnings

 

[firdoshakir]

New kernel release​

• Updated kernel to last commits from Neutrino
• Current kernel version - 4.19.205
• Fixed some compile warnings

Will this kernel supports external adapter for monitor mode???

 

[flypatriot]

Will this kernel supports external adapter for monitor mode???

Yes! It supports external wifi adapters with monitor mode and injection and internal wifi adapter in monitor mode only.

 

[ottoskyer]

But there is no TWRP applicable to OnePlus 8 android11, is it available?

 

[flypatriot]

But there is no TWRP applicable to OnePlus 8 android11, is it available?

Unfortunately, I didn't test this build on non custom recovery devices.
But you can try Ex Kernel Manager or Franko Kernel Manager to install kernel.
SystemRW script need more steps to do. You can reed about it in SystemRW thread.

 

[Develectron 666]

i cannot get the internal wifi in monitor mode this rom and kernel.
I tried it with wifite and then every number from 1 to 6
even tried it with just airmon-ng start wlan0
but i cannot get it into monitor mode.
Is there maybe al solution ?
With external wifi card it does work

 

[AiM2LeaRn]

i noticed the title says "Oneplus 8 Series" ... does this mean it works with the regular Oneplus 8 5G variant?

 

[flypatriot]

i cannot get the internal wifi in monitor mode this rom and kernel.
I tried it with wifite and then every number from 1 to 6
even tried it with just airmon-ng start wlan0
but i cannot get it into monitor mode.
Is there maybe al solution ?
With external wifi card it does work

Can you describe you problem with more details, please?
1. What's your device (model).
2. What's your ROM (OxygenOS or custom)
3. Did you try to turn off wifi before switching wlan0 to monitor mode?
4. Do you use commands from NetHunter App menu or you just launch wifite and choose wlan from wifite's menu?
You always need to switch off wifi and then run commands from NetHunter App.

 

[flypatriot]

i noticed the title says "Oneplus 8 Series" ... does this mean it works with the regular Oneplus 8 5G variant?

Yes. It should works. But don't forget to backup you current kernel in case of some unexpected situations.

 

[firdoshakir]

i cannot get the internal wifi in monitor mode this rom and kernel.
I tried it with wifite and then every number from 1 to 6
even tried it with just airmon-ng start wlan0
but i cannot get it into monitor mode.
Is there maybe al solution ?
With external wifi card it does work

only monitor mode is working on internal wifi. if you want to inject packets you have to
use external wifi recommended adapter. this rom is working on both custom and oos with
twrp recovery. i have personally tested. working good. if its not working then you are doing
some sort of mistake in installing nethunter.

 

[deigo775]

Kali NetHunter for OnePlus 8 series​

View attachment 5394073

Description​

Kali NetHunter is an Android ROM overlay that turns an ordinary phone into the ultimate Mobile Penetration Testing Platform.
The overlay includes a custom kernel, a Kali Linux chroot, an accompanying Android application, which allows for easier interaction with various security tools and attacks, as well as a client to the Kali NetHunter App Store.
Beyond the penetration testing tools arsenal within Kali Linux and the Kali NetHunter App Store, NetHunter also supports several additional classes, such as HID Keyboard Attacks, BadUSB attacks, Evil AP MANA attacks, and much more. For more information about the moving parts that make up NetHunter, check out NetHunter Components page.
NetHunter is an open-source project developed by Offensive Security and the community.​

Disclaimer​

Your warranty is now void.
I am not responsible for anything that may happen to your phone by installing any custom ROMs and/or kernels.
You do it at your own risk and take the responsibility upon yourself and you are not to blame me or XDA and its respected developers.​

Features​

• WiFi injection​
• Internal WiFi monitor mode​
• AirSpy / HackRF (RTL-SDR)​
• Bluetooth (RFCOMM)​
• USB Arsenal​
• External WiFi adapters from NetHunter's support list​
• HID attacks​
• RFID platform support​
• Based on Neutrino's kernel with CAF 4.19 and linux-stable merged in​
• Preinstalled Oh-My-Zsh with theme adapted to android terminal and useful navigation plugins​
• Preinstalled RRG / Iceman - Proxmark3 client for Generic Proxmark3 Easy platform​
• Disabled Android Paranoid Network mode to allow access to all networking features for PostgreSQL, apt, ping and other commands​

Prerequisites​

• Clean OxygenOS 11 ROM or any custom ROM based on Android 11​
• Unlocked bootloader​
• TWRP​
• Magisk​
• Universal ForceEncrypt Disabler​
• Universal Mount System read write R/W​

How to Install​

Spoiler: OxygenOS

1. Copy twrp, magisk, Disable_Dm-Verity_ForceEncrypt, System_RW_sript, NetHunter kernel & NetHunter zip to external USB-C drive​
2. Flash TWRP​
3. Reboot to bootloader & flash empty vbmeta with command fastboot --disable-verity --disable-verification flash vbmeta <path to vbmeta.img>​
4. Reboot into recovery, format data & reboot back to recovery​
5. Install Magisk & “Disable_Dm-Verity_ForceEncrypt”​
6. Reboot to system, finish Android setup, launch Magisk app & apply post install requirements​
7. Copy systemrw_1.32 folder to /data/local/tmp & make script systemrw.sh executable (chmod +x)​
8. Reboot into TWRP, launch terminal & run command /data/local/tmp/systemrw_1.32/systemrw.sh size=100​
9. Reboot to system & check the ability to write into system folder (e.g. create empty folder)​
10. Install NetHunter zip through Magisk​
11. Reboot to recovery & install NetHunter kernel​
12. Reboot to system & run NetHunter app​
13. Update NetHunter app from NetHunter Store​

Spoiler: Custom ROM

1. Copy twrp, magisk, Disable_Dm-Verity_ForceEncrypt, NetHunter kernel & NetHunter zip to external USB-C drive​
2. Flash TWRP​
3. Reboot into recovery, format data & reboot back to recovery​
4. Install Magisk & “Disable_Dm-Verity_ForceEncrypt”​
5. Reboot to system, finish Android setup, launch Magisk app & apply post install requirements​
6. Install NetHunter zip through Magisk​
7. Reboot to recovery & install NetHunter kernel​
8. Reboot to system & run NetHunter app​
9. Update NetHunter app from NetHunter Store​

Downloads​

• NetHunter Magisk Installer
• NetHunter Kernel
• Empty vbmeta && instructions

Known issues​

• Switching internal wlan0 to monitor mode and back to managed mode freezes device for about 15 seconds​
• Before doing any updates run service postgresql start && msfdb init commands to exclude any issues with database initiation after updates​

Credits​

The Offensive Security Team and the NetHunter community​

My huge thanks to:

• kimocoder
• 0ctobot
• Re4son
• @lebigmac
• @Invincible-Man
• @Zackptg5
• RfidResearchGroup
• iceman1001

Thanks for your great work, support, help and development!
Without you there would be nothing here!​

Contributors
flyP@TR!0T

Source​

Source Code: https://gitlab.com/kalilinux/nethunter/
Kernel Source: https://github.com/flypatriot/neutrino_kernel_oneplus_sm8250.git

Notes & Updates​

Status: Testing
Current Kernel Version: 4.19.205
Created 2021-08-26
Last Updated 2021-08-30

Thank You For Your Hard Works Just a Question Did the Realtk RTL8812AU external adapter supported Hope You Tell me

 

[flypatriot]

Thank You For Your Hard Works Just a Question Did the Realtk RTL8812AU external adapter supported Hope You Tell me

Yes. Kernel patched for RTL8812AU monitor and injection support.

 

[flypatriot]

New kernel release​

• Updated kernel to last commits from Neutrino
• Current kernel version - 4.19.205
• Updated nethunter_defconfig

 

[stang1818]

Hello everybody,

First thanks for your work. I'm having a problem regarding internal WiFi monitor mode.

First my config : Oneplus 8T EU version (kebab kb2003). Airmon-ng reports QC6390for the chip. I'm actually using Lineage OS 18.1 but had the exact same problem on stock oxygen O.S. (fully updated).

The problem : I follow your installation procedure, everything works fine. I shut down WiFi by clicking on the WiFi icon. Then I use Nethunter custom commands to start monitor mode on Wlan0.

Then a terminal windows open showing the command running to set monitor mode. The phone will freeze for 15 to 30 seconds then the window closes. The internal WiFi is then in monitor mode, I can start airodump or wifite but the refresh is extra slow and no data at all is captured. I only see from time to time beacons increasing but extra slowly. It's just as if the capture was lagging and there is no captured data.

Any idea to solve this problem ? I read a lot and I saw on the net docs stating that monitor mode is not supported on QC6390.

Thanks for reading and have a good day.

 

[flypatriot]

Hello everybody,

First thanks for your work. I'm having a problem regarding internal WiFi monitor mode.

First my config : Oneplus 8T EU version (kebab kb2003). Airmon-ng reports QC6390for the chip. I'm actually using Lineage OS 18.1 but had the exact same problem on stock oxygen O.S. (fully updated).

The problem : I follow your installation procedure, everything works fine. I shut down WiFi by clicking on the WiFi icon. Then I use Nethunter custom commands to start monitor mode on Wlan0.

Then a terminal windows open showing the command running to set monitor mode. The phone will freeze for 15 to 30 seconds then the window closes. The internal WiFi is then in monitor mode, I can start airodump or wifite but the refresh is extra slow and no data at all is captured. I only see from time to time beacons increasing but extra slowly. It's just as if the capture was lagging and there is no captured data.

Any idea to solve this problem ? I read a lot and I saw on the net docs stating that monitor mode is not supported on QC6390.

Thanks for reading and have a good day.

Hello!
Thanks for your detailed question!
It's a bit strange, you know.
Can you try lspci -k command and check the output?
I've attached my result to this post.
Monitor mode is supported in QCA6390 chipsets by using QCACLD drivers. I switched on monitor mode feature in qca6390_defconfig (see attached picture).
I've also attached pictures with my wifite and airodump-ng commands results.
You need to know that with QCACLD drivers and NetHunter custom command wlan0 doesn't rename to wlan0mon and keeps staying in wlan0 device name. So airodump-ng command should always run with wlan0 device name.
You also should try dmesg | grep qca6390 after running start wlan0 in monitor mode custom command and see if there are any issues with firmware loading.

 

[stang1818]

Hello!
Thanks for your detailed question!
It's a bit strange, you know.
Can you try lspci -k command and check the output?
I've attached my result to this post.
Monitor mode is supported in QCA6390 chipsets by using QCACLD drivers. I switched on monitor mode feature in qca6390_defconfig (see attached picture).
I've also attached pictures with my wifite and airodump-ng commands results.
You need to know that with QCACLD drivers and NetHunter custom command wlan0 doesn't rename to wlan0mon and keeps staying in wlan0 device name. So airodump-ng command should always run with wlan0 device name.
You also should try dmesg | grep qca6390 after running start wlan0 in monitor mode custom command and see if there are any issues with firmware loading.

Hello @flypatriot and thanks for your quick answer.

Silly me, how could I forget to run a dmesg . You were right it's crippled with error saying that it can't find / open the firmware Dir / files (copy attached) .

The problem is how can I correct this ? I swear I thoroughly followed the install procedure and even made sure that the whole filesystem was R/W so that files could be written anywhere by nethunter install through Magisk

Any idea what to do to correct the install and put the files back in place ???

Thanks a million for your help I started to go nuts .

E.g of error :
12.126845] ueventd: firmware: could not find firmware for qca6390/regdb.bin
[ 12.126853] ueventd: firmware: attempted /etc/firmware/qca6390/regdb.bin, open failed: No such file or directory
[ 12.126856] ueventd: firmware: attempted /odm/firmware/qca6390/regdb.bin, open failed: No such file or directory
[ 12.126859] ueventd: firmware: attempted /vendor/firmware/qca6390/regdb.bin, open failed: No such file or directory
[ 12.126861] ueventd: firmware: attempted /firmware/image/qca6390/regdb.bin, open failed: No such file or directory
[ 12.126866] ueventd: firmware: attempted /vendor/firmware_mnt/image/qca6390/regdb.bin, open failed: No such file or directory

 

[stang1818]

Nobody knows the solution ??

 

[flypatriot]

Nobody knows the solution ??

Sorry for delay. i've just checked my dmesg log:

Spoiler: dmesg.log

[ 9998.706496] cnss_pci 0000:01:00.0: Falling back to syfs fallback for: qca6390/amss20.bin
[ 9998.717074] ueventd: firmware: loading 'qca6390/amss20.bin' for '/devices/platform/soc/1c00000.qcom,pcie/pci0000:00/0000:00:00.0/0000:01:00.0/firmware/qca6390!amss20.bin'
[ 9998.724436] ueventd: loading /devices/platform/soc/1c00000.qcom,pcie/pci0000:00/0000:00:00.0/0000:01:00.0/firmware/qca6390!amss20.bin took 7ms
[ 9999.337453] cnss: FW name added with prefix: qca6390/regdb.bin
[ 9999.337506] cnss2 b0000000.qcom,cnss-qca6390: Falling back to syfs fallback for: qca6390/regdb.bin
[ 9999.344640] ueventd: firmware: loading 'qca6390/regdb.bin' for '/devices/platform/soc/b0000000.qcom,cnss-qca6390/firmware/qca6390!regdb.bin'
[ 9999.344790] ueventd: firmware: could not find firmware for qca6390/regdb.bin
[ 9999.344799] ueventd: firmware: attempted /etc/firmware/qca6390/regdb.bin, open failed: No such file or directory
[ 9999.344804] ueventd: firmware: attempted /odm/firmware/qca6390/regdb.bin, open failed: No such file or directory
[ 9999.344808] ueventd: firmware: attempted /vendor/firmware/qca6390/regdb.bin, open failed: No such file or directory
[ 9999.344812] ueventd: firmware: attempted /firmware/image/qca6390/regdb.bin, open failed: No such file or directory
[ 9999.344821] ueventd: firmware: attempted /vendor/firmware_mnt/image/qca6390/regdb.bin, open failed: No such file or directory
[ 9999.344852] ueventd: loading /devices/platform/soc/b0000000.qcom,cnss-qca6390/firmware/qca6390!regdb.bin took 0ms
[ 9999.345024] cnss: Failed to load BDF: qca6390/regdb.bin
[ 9999.345072] cnss2 b0000000.qcom,cnss-qca6390: Falling back to syfs fallback for: 14wlan.b0c
[ 9999.349328] ueventd: firmware: loading '14wlan.b0c' for '/devices/platform/soc/b0000000.qcom,cnss-qca6390/firmware/14wlan.b0c'
[ 9999.351247] ueventd: loading /devices/platform/soc/b0000000.qcom,cnss-qca6390/firmware/14wlan.b0c took 1ms
[10143.865458] cnss_pci 0000:01:00.0: Falling back to syfs fallback for: qca6390/amss20.bin
[10143.875459] ueventd: firmware: loading 'qca6390/amss20.bin' for '/devices/platform/soc/1c00000.qcom,pcie/pci0000:00/0000:00:00.0/0000:01:00.0/firmware/qca6390!amss20.bin'
[10143.878906] ueventd: loading /devices/platform/soc/1c00000.qcom,pcie/pci0000:00/0000:00:00.0/0000:01:00.0/firmware/qca6390!amss20.bin took 3ms
[10144.494126] cnss: FW name added with prefix: qca6390/regdb.bin
[10144.494184] cnss2 b0000000.qcom,cnss-qca6390: Falling back to syfs fallback for: qca6390/regdb.bin
[10144.501617] ueventd: firmware: loading 'qca6390/regdb.bin' for '/devices/platform/soc/b0000000.qcom,cnss-qca6390/firmware/qca6390!regdb.bin'
[10144.501853] ueventd: firmware: could not find firmware for qca6390/regdb.bin
[10144.501868] ueventd: firmware: attempted /etc/firmware/qca6390/regdb.bin, open failed: No such file or directory
[10144.501873] ueventd: firmware: attempted /odm/firmware/qca6390/regdb.bin, open failed: No such file or directory
[10144.501878] ueventd: firmware: attempted /vendor/firmware/qca6390/regdb.bin, open failed: No such file or directory
[10144.501882] ueventd: firmware: attempted /firmware/image/qca6390/regdb.bin, open failed: No such file or directory
[10144.501897] ueventd: firmware: attempted /vendor/firmware_mnt/image/qca6390/regdb.bin, open failed: No such file or directory
[10144.501948] ueventd: loading /devices/platform/soc/b0000000.qcom,cnss-qca6390/firmware/qca6390!regdb.bin took 0ms
[10144.502265] cnss: Failed to load BDF: qca6390/regdb.bin
[10144.502334] cnss2 b0000000.qcom,cnss-qca6390: Falling back to syfs fallback for: 14wlan.b0c
[10144.506635] ueventd: firmware: loading '14wlan.b0c' for '/devices/platform/soc/b0000000.qcom,cnss-qca6390/firmware/14wlan.b0c'
[10144.506833] ueventd: loading /devices/platform/soc/b0000000.qcom,cnss-qca6390/firmware/14wlan.b0c took 0ms

I have the same errors with firmware regdb.bin for cnss mode. But as I can understand it doesn't affect monitor mode. I also don't have this file in my firmware folders.
But there is another error in your log that is very weird. It seems to be a reason of your problem. Pay attention to WCNSS_qcom_cfg.ini open error. This file should be placed in /vendor/etc/wifi/qca6390 and link to /vendor/firmware/wlan/qca_cld/qca6390.
You need to check if this file exists.