Skip to content

Commit 8417945

Browse files
carlospolopcarlospolop
authored
Merge pull request #1097 from HackTricks-wiki/update_Hijacker_on_the_Samsung_Galaxy_S10_with_wireless_i_20250711_123906
Hijacker on the Samsung Galaxy S10 with wireless injection
2 parents 10bf791 + 4920915 commit 8417945

File tree

3 files changed

+140
-0
lines changed

3 files changed

+140
-0
lines changed

‎src/SUMMARY.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
- [Spoofing LLMNR, NBT-NS, mDNS/DNS and WPAD and Relay Attacks](generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md)
2626
- [Spoofing SSDP and UPnP Devices with EvilSSDP](generic-methodologies-and-resources/pentesting-network/spoofing-ssdp-and-upnp-devices.md)
2727
- [Pentesting Wifi](generic-methodologies-and-resources/pentesting-wifi/README.md)
28+
- [Enable Nexmon Monitor And Injection On Android](generic-methodologies-and-resources/pentesting-wifi/enable-nexmon-monitor-and-injection-on-android.md)
2829
- [Evil Twin EAP-TLS](generic-methodologies-and-resources/pentesting-wifi/evil-twin-eap-tls.md)
2930
- [Phishing Methodology](generic-methodologies-and-resources/phishing-methodology/README.md)
3031
- [Clone a Website](generic-methodologies-and-resources/phishing-methodology/clone-a-website.md)

‎src/generic-methodologies-and-resources/pentesting-wifi/README.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,12 @@ iwlist wlan0 scan #Scan available wifis
2121

2222
## Tools
2323

24+
### Hijacker & NexMon (Android internal Wi-Fi)
25+
26+
{{#ref}}
27+
enable-nexmon-monitor-and-injection-on-android.md
28+
{{#endref}}
29+
2430
### EAPHammer
2531

2632
```

‎src/generic-methodologies-and-resources/pentesting-wifi/enable-nexmon-monitor-and-injection-on-android.md

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
# Enable NexMon Monitor Mode & Packet Injection on Android (Broadcom chips)
2+
3+
{{#include ../../banners/hacktricks-training.md}}
4+
5+
## Overview
6+
Most modern Android phones embed a Broadcom/Cypress Wi-Fi chipset that ships without 802.11 monitor mode or frame-injection capabilities. The open-source NexMon framework patches the proprietary firmware to add those features and exposes them through a shared library (`libnexmon.so`) and a CLI helper (`nexutil`). By pre-loading that library into the stock Wi-Fi driver, a rooted device can capture raw 802.11 traffic and inject arbitrary frames – eliminating the need for an external USB adapter.
7+
8+
This page documents a fast workflow that takes a fully-patched Samsung Galaxy S10 (BCM4375B1) as an example, using:
9+
10+
* NexMon Magisk module containing the patched firmware + `libnexmon.so`
11+
* Hijacker Android application to automate monitor-mode toggling
12+
* Optional Kali NetHunter chroot to run classic wireless tools (aircrack-ng, wifite, mdk4 …) directly against the internal interface
13+
14+
The same technique applies to any handset that has a publicly available NexMon patch (Pixel 1, Nexus 6P, Galaxy S7/S8, etc.).
15+
16+
---
17+
18+
## Prerequisites
19+
* Android handset with a supported Broadcom/Cypress chipset (e.g. BCM4358/59/43596/4375B1)
20+
* Root with Magisk ≥ 24
21+
* BusyBox (most ROMs/NetHunter already include it)
22+
* NexMon Magisk ZIP or self-compiled patch providing:
23+
* `/system/lib*/libnexmon.so`
24+
* `/system/xbin/nexutil`
25+
* Hijacker ≥ 1.7 (arm/arm64) – https://github.com/chrisk44/Hijacker
26+
* (Optional) Kali NetHunter or any Linux chroot where you intend to run wireless tools
27+
28+
---
29+
30+
## Flashing the NexMon patch (Magisk)
31+
1. Download the ZIP for your exact device/firmware (example: `nexmon-s10.zip`).
32+
2. Open Magisk -> Modules -> Install from storage -> select the ZIP and reboot.
33+
The module copies `libnexmon.so` into `/data/adb/modules/<module>/lib*/` and ensures SELinux labels are correct.
34+
3. Verify installation:
35+
```bash
36+
ls -lZ $(find / -name libnexmon.so 2>/dev/null)
37+
sha1sum $(which nexutil)
38+
```
39+
40+
---
41+
42+
## Configuring Hijacker
43+
Hijacker can toggle monitor mode automatically before running `airodump`, `wifite`, etc. In **Settings -> Advanced** add the following entries (edit the library path if your module differs):
44+
45+
```
46+
Prefix:
47+
LD_PRELOAD=/data/user/0/com.hijacker/files/lib/libnexmon.so
48+
49+
Enable monitor mode:
50+
svc wifi disable; ifconfig wlan0 up; nexutil -s0x613 -i -v2
51+
52+
Disable monitor mode:
53+
nexutil -m0; svc wifi enable
54+
```
55+
56+
Enable “Start monitor mode on airodump start” so every Hijacker scan happens in native monitor mode (`wlan0` instead of `wlan0mon`).
57+
58+
If Hijacker shows errors at launch, create the required directory on shared storage and reopen the app:
59+
```bash
60+
mkdir -p /storage/emulated/0/Hijacker
61+
```
62+
63+
### What do those `nexutil` flags mean?
64+
* **`-s0x613`** Write firmware variable 0x613 (FCAP_FRAME_INJECTION) → `1` (enable TX of arbitrary frames).
65+
* **`-i`** Put interface in monitor mode (radiotap header will be prepended).
66+
* **`-v2`** Set verbose level; `2` prints confirmation and firmware version.
67+
* **`-m0`** Restore managed mode (used in the *disable* command).
68+
69+
After running *Enable monitor mode* you should see the interface in monitor state and be able to capture raw frames with:
70+
```bash
71+
airodump-ng --band abg wlan0
72+
```
73+
74+
---
75+
76+
## Manual one-liner (without Hijacker)
77+
```bash
78+
# Enable monitor + injection
79+
svc wifi disable && ifconfig wlan0 up && nexutil -s0x613 -i -v2
80+
81+
# Disable and return to normal Wi-Fi
82+
nexutil -m0 && svc wifi enable
83+
```
84+
85+
If you only need passive sniffing, omit the `-s0x613` flag.
86+
87+
---
88+
89+
## Using `libnexmon` inside Kali NetHunter / chroot
90+
Stock user-space tools in Kali do not know about NexMon, but you can force them to use it via `LD_PRELOAD`:
91+
92+
1. Copy the pre-built shared object into the chroot:
93+
```bash
94+
cp /sdcard/Download/kalilibnexmon.so <chroot>/lib/
95+
```
96+
2. Enable monitor mode from the **Android host** (command above or through Hijacker).
97+
3. Launch any wireless tool inside Kali with the preload:
98+
```bash
99+
sudo su
100+
export LD_PRELOAD=/lib/kalilibnexmon.so
101+
wifite -i wlan0 # or aircrack-ng, mdk4 …
102+
```
103+
4. When finished, disable monitor mode as usual on Android.
104+
105+
Because the firmware already handles radiotap injection, user-space tools behave just like on an external Atheros adapter.
106+
107+
---
108+
109+
## Typical Attacks Possible
110+
Once monitor + TX is active you can:
111+
* Capture WPA(2/3-SAE) handshakes or PMKID with `wifite`, `hcxdumptool`, `airodump-ng`.
112+
* Inject deauthentication / disassociation frames to force clients to reconnect.
113+
* Craft arbitrary management/data frames with `mdk4`, `aireplay-ng`, Scapy, etc.
114+
* Build rogue APs or perform KARMA/MANA attacks directly from the phone.
115+
116+
Performance on the Galaxy S10 is comparable to external USB NICs (~20 dBm TX, 2-3 M pps RX).
117+
118+
---
119+
120+
## Troubleshooting
121+
* `Device or resource busy` – make sure **Android Wi-Fi service is disabled** (`svc wifi disable`) before enabling monitor mode.
122+
* `nexutil: ioctl(PRIV_MAGIC) failed` – the library is not pre-loaded; double-check `LD_PRELOAD` path.
123+
* Frame injection works but no packets captured – some ROMs hard-block channels; try `nexutil -c <channel>` or `iwconfig wlan0 channel <n>`.
124+
* SELinux blocking library – set device to *Permissive* or fix module context: `chcon u:object_r:system_lib_file:s0 libnexmon.so`.
125+
126+
---
127+
128+
## References
129+
* [Hijacker on the Samsung Galaxy S10 with wireless injection](https://forums.kali.org/t/hijacker-on-the-samsung-galaxy-s10-with-wireless-injection/10305)
130+
* [NexMon – firmware patching framework](https://github.com/seemoo-lab/nexmon)
131+
* [Hijacker (aircrack-ng GUI for Android)](https://github.com/chrisk44/Hijacker)
132+
133+
{{#include ../../banners/hacktricks-training.md}}

0 commit comments

Comments
 (0)