In a recent article, How To install NetHunter Rootless Edition, we examined installing a version of Kali Linux on non-rooted Nexus devices. Whilst this provided many penetration testing tools, there were certain limitations.
We are going to look at installing Kali Linux NetHunter Lite which provides us with a more dedicated mobile pentesting platform and the following additional functionality:
- Metasploit with database
- NetHunter App
- WiFi Injection
- HID attacks
For details on the differences check out the ‘1.0 NetHunter Editions’ section within the NetHunter Documentation.
The instructions and screenshots during this How To will be from an Ubuntu 20.10 computer. An upcoming article will cover differences when performing this How To using Mac and Windows computers.
The steps covered in this article involve unlocking a device and flashing the ROM (Read-Only Memory) with new software. This comes with inherent risk in that if it fails then the device ‘can’ be rendered unusable or unrecoverable.
Warning: Proceed with caution and at your own risk!
NetHunter Lite on a Nexus 7
We are going to install Kali Linux NetHunter Lite on a 32 Gb Nexus 7 (2012 – WiFi only). These steps should be similar if installing on a different device e.g. Nexus 4 / 5 / 6 / 9 / 10 or OnePlus One.
Here are the main steps to be carried out:
- Download pre-built image
- Rooting the device
- Verify device is Rooted
- Install NetHunter Lite
- Run NetHunter
Advisory: We strongly suggest reading through the whole of this article prior to performing any actions.
In this article, part 1, we will cover Steps 1-4 then the remaining Steps will be covered in part 2.
Step 1 – Prerequisites
There are a number of possible configurations for our Nexus device when starting this installation:
- Stock device – running Android V4.1 (Jelly Bean) or V5.1.1 (Lollipop) with a Locked Bootloader.
- Upgraded device – running a later or modified operating system with an Unlocked Bootloader & Custom Recovery tool installed e.g Android 8.1.0 (Oreo – LineageOS 15.1) with TWRP.
If you have a ‘stock device’ then you will need to perform Steps 1-6 in our article How To upgrade Android for NetHunter from Linux (part 1) in order to get to the point of having a device that is backed up, has an Unlocked Bootloader, and TWRP (Team Win Recovery Project) installed. You do not need to upgrade to Android 8.1.1 (Step 7).
Step 2 – Download pre-built image
Gathering device information
In order to download the correct image for a specific device it is necessary to obtain certain information. To do this a terminal window is needed if not already installed on your device e.g. Termux:
- Open https://store.nethunter.com on the device’s web browser.
- Click on the ‘DOWNLOAD STORE APP’ button.
- Go to the ‘Downloads’ folder and click on the ‘NetHunterStore.apk’ file. If prompted open ‘Settings’ and allow ‘Unknown sources’.
- Start the installation. There may be a prompt regarding the permissions that will be accessible so read and click ‘INSTALL’.
- After the installation completes, open the NetHunter Store via the new icon and search for ‘Termux’ then download and install.
Open the Termux app and run the following commands:
getprop ro.product.device getprop ro.product.model getprop ro.product.name
Another piece of information we need is the Android version and associated nickname (in brackets). There are some earlier and later versions but these are the main ones we are concerned with:
|Android version||Version name|
In certain cases the year of the device may also be relevant e.g. Nexus 7 has the 1st Generation from 2012 and 2nd Generation from 2013. Click here and visit Step 2 within the article to find out more.
Finding a pre-built NetHunter image
Now we need to visit these pages to see if we can find a pre-built match for the details we have about our device:
- Official NetHunter Images
- NetHunter Kernel Statistics
- Official NetHunter Kernels
- Kali Linux NetHunter Downloads
Using our Nexus 7 details (grouper, nakasi, Android 8.x / Oreo or LineageOS 15.1) we had these results:
- #1 – no match.
- #2 – implied there are 18 potential matches on Oreo.
- #3 – gave the following:
- Model = Nexus 7 2012 … match 🙂
- Kernel ID = grouper … match 🙂
- Android version = kitkat (Android 4.4) … mismatch 🙁
- #4 – match on Generic ARMhf e.g. file nethunter-2020.4-generic-armhf-kalifs-full.zip
#3 is a close match apart from the Android version so we opt for #4.
The ZIP file (~1.6Gb) was downloaded then copied to the Downloads folder on our device via the USB cable.
Step 3 – Rooting the device
As mentioned in the Prerequisites (Step 1) our device needs an Unlocked Bootloader and a Custom Recovery tool (TWRP) installed.
There are two methods of rooting a device:
- Stock device – that runs an original version of Android. For rooting this device, Magisk Manager can be used.
- Upgraded device – that runs a custom ROM (e.g. LineageOS) that was upgraded by flashing the ROM. For rooting this device the ‘LineageOS addonsu’ can be used. Magisk can be problematic.
Follow the relevant sub-section below based on your device (A or B):
A) Rooting with Magisk Manager
In order to ‘root’ our device we need to perform the following:
- Start the device and boot into Android.
- Open the web browser and download the latest version of Magisk Manager. Alternatively download the file via your desktop computer and copy it to the Download folder on your device.
- Open the File Manager* on your device, navigate to the Download folder and click on the Magisk .apk file to install. There may be a prompt to Allow an install from this source.
* If not installed then this can be downloaded from the Play Store or the .apk file can be downloaded from here then installed.
- Open the Magisk Manager app and you should see this screen:
- Magisk Manager is the latest version installed but the Magisk image is not yet so click ‘Install’.
- Click NEXT for Options.
- Select ‘Download Zip Only’ under Method then LET’S GO.
- Within the Download folder on your device there will be a new file e.g. Magisk-21.4(21400).zip
- Reboot your device into the Unlocked Bootloader by issuing this command from your computer:
adb reboot bootloader
- Start TWRP by selecting the ‘Recovery mode’ pressing the Volume Down button within the Bootloader screen then Power button.
- Once in TWRP click ‘Install’, navigate to the Download folder and select the file Magisk-21.4(21400).zip and Swipe right to flash.
- Once complete the click Reboot System.
- Restart Magisk Manager app and Magisk should now be Installed.
For further details check out the XDA article:
B) Rooting with SuperSU
First of all SuperSU needs to be downloaded:
To install SuperSU:
- Boot into TWRP and click ‘Install’.
- Select ZIP file in the Download folder e.g. SR5-SuperSU-v2.82-SR5-20171001224502.zip
- Swipe right to confirm Flash.
- Once complete click ‘Reboot System’.
- Go to ‘Developer options’ within Settings.
- Change ‘Root access’ to ‘ADB’ if desired. A pop-up warning may appear about enabling root access.
Enable ‘Advanced restart’, and ‘Android debugging’ if desired, within ‘Developer options’:
Whilst upgrading our version of Android in the article How To upgrade Android for NetHunter from Linux (part 1) we used Android Debug Bridge (adb) to unlock and boot our device into the Bootloader. Unfortunately following the upgrade to Android 8.1.1 (LineageOS 15.1) this no longer worked via USB and gave an error:
adb reboot bootloader error: no devices/emulators found
Note: Having tried many suggestions online without success it must be down to a Linux driver issue for the new operating system. Additionally the backup taken via TWRP would not work in a restore so the device could not be returned to Android 5.1.1!
Fortunately enabling ‘Advanced restart’ still allows us to start the Bootloader via the Power button and hence TWRP or jump straight into TWRP via the Recovery option.
Alternatively hold down the Power & Volume Down buttons then release the Power button when the device first shows signs of powering up. Continue to hold the Volume Down button until the device has entered the Bootloader.
Another method to use adb, instead of USB, is over the network:
- Go into Settings -> System -> Developer Options on the device.
- Enable option ‘ADB over network’.
- Issue the following commands via Terminal window on your Linux computer (change IP to that specified under ‘ADB over network’):
adb connect 192.168.1.137:5555 adb devices
Now you can issue any adb commands needed.
Step 4 – Verify device is Rooted
Once Step 3 is complete, whether option A or B was carried out, we now need to verify that the device was in fact rooted:
- Boot the device into Android or LineageOS.
- Install Root Checker Basic by one of these methods:
- Run the Root Checker app and click ‘Verify Root’.
- You should now be prompted with a pop-up as follows then click ‘GRANT’ before the DENY timer expires:
- If GRANT was not clicked in time then uninstall the Root Checker app via Settings -> Apps -> Uninstall. Reinstall the Root Checker app, then repeat 3-4 above.
If rooting was successful then you should see a screen similar to this:
If root was unsuccessful then you should see a screen like this:
If rooting your device did not work then go back to Step 3 and try again observing any error messages or hints as to what caused the problem.
Please look out for Part 2 of this article which will continue with the installation of NetHunter Lite.
Do you have experience of Rooting an Android-based device? Do you have any comments or suggestions? If so please share your thoughts in the comments below.