Kali/Nethunter

Main Nethunter documentation is here: https://github.com/offensive-security/kali-nethunter/wiki

Notes

Nexus 7

We installed NetHunter on a Nexus 7.

Nexus 7 2013 (flo)
Android version:
5.1.1 or 6.0.1
CM 13.0

Installation

Following instructions here: To install, need to use the NetHunter rootkit: https://github.com/offensive-security/nethunter-LRT

The installation procedure looks like this:

• Get tooling
• Get stock image for Nexus from Google
• Install NetHunter rootkit
• Use the NetHunter rootkit to install NetHunter on the device
• Flash device with stock image
• "Recover" into Kali NetHunter

Tooling

Will need adb and fastboot utilities installed.

Plug the tablet into the computer with a USB cable and turn on USB debugging.

Mac

brew cask install android-platform-tools

Debian

$ apt-get install android-tools-adb
$ apt-get install android-tools-fastboot

Stock Image from Nexus

The table here (https://github.com/offensive-security/kali-nethunter/wiki) lists hardware and corresponding android software version numbers.

• Get the factory image corresponding to the phone from here (https://developers.google.com/android/images?hl=en) and pick out the version number that matches. The version I got was "razor".

• Get twrp file for asus nexus 7 here (https://twrp.me/Devices/), I used the 2013 "flo" Nexus file (https://dl.twrp.me/flo/twrp-3.2.1-0-flo.img.html)

• Get the latest SuperSU sudo app for rooting the tablet (http://www.supersu.com/download), use the recovery flashable zip file.

Now you're ready to install nethunter-LRT, so these should go in appropriate folders.

Listing folders in the nethunter-LRT folder shows:

LICENSE
README.md
common.sh
kaliNethunter
oemUnlock.sh
stockImage
stockNexusFlash.sh
stockOpoFlash.sh
superSu
turtleme
twrpFlash.sh
twrpImage

The stock factory image should go in the stockImage folder, the twrp file should go in the twrpImage folder, the SuperSU image should go in the superSu folder, like so:

$ ls -R stockImage/ superSu/ twrpImage/
stockImage/:
razor-mob30x-factory-52684dff.zip

superSu/:
SuperSU-v2.82-201705271822.zip

twrpImage/:
twrp-3.2.1-0-flo.img

old notes

enable developer mode

enable developer options by going to Settings > About Tablet > scroll down to the very bottom to Build Number and tap it 7 times. This will unlock develoepr options. This is really dumb, but welcome to Android, where you will die of cleverness.

oem unlock

Next:

root@basilisk:~/codes/nethunter-LRT# adb devices
List of devices attached 
015d46d908641608	device

root@basilisk:~/codes/nethunter-LRT# ./oemUnlock.sh

This reboots the phone, and gets your confirmation that you want to modify the boot loader. Use volume up/down to select an option, then push the power button.

You should see the computer printing some steps. When it is done, the tablet will begin to boot up. be patient, it can take a while.

old notes

resources

notes on kali nethunter here: https://github.com/offensive-security/kali-nethunter/wiki

to install, need to use the nethunter rootkit: https://github.com/offensive-security/nethunter-LRT

for that, need to install prerequisites (android tools mainly)

procedure

you need a nexus 7 tablet, rooted or not

prereqs

start by installing prereqs for nethunter rootkit

$ apt-get install android-tools-adb
$ apt-get install android-tools-fastboot

assembling materials

for nexus 7 tablet, get factory image from here: https://developers.google.com/android/nexus/images?hl=en

get twrp file for asus nexus 7 here: https://twrp.me/Devices/ (got both the 2012 and 2013 files, not sure which one to use)

get latest superuser app for rooting your tablet: http://forum.xda-developers.com/showpost.php?p=64161125&postcount=3

put each of these in the appropriate folders: https://github.com/offensive-security/nethunter-LRT

enable developer mode

enable developer options by going to Settings > About Tablet > scroll down to the very bottom to Build Number and tap it 7 times. This will unlock develoepr options. This is really dumb, but welcome to Android, where you will die of cleverness.

oem unlock

Next:

root@basilisk:~/codes/nethunter-LRT# adb devices
List of devices attached 
015d46d908641608	device

root@basilisk:~/codes/nethunter-LRT# ./oemUnlock.sh

This reboots the phone, and gets your confirmation that you want to modify the boot loader. Use volume up/down to select an option, then push the power button.

You should see the computer printing some steps. When it is done, the tablet will begin to boot up. be patient, it can take a while.