Kali Linux running on a Raspberry Pi.
Oh my goodness.
When I first heard about this possibility of running Kali
Linux on a Raspberry Pi, a computer that's small enough
to fit in your pocket, I was blown away.
And I'm so excited about sharing my findings with you
and the success I've had in using Kali Linux on a
Raspberry Pi.
Let's begin.
I'd like you to imagine that you and I have decided we want
to have a dedicated system for our pen testing.
And to do that, we have a couple options.
Number one, we could just take a laptop that we aren't using
for any other purposes and just load Kali or Backtrack on
top of that and use that.
That would work.
We can also take our existing laptop that we're using for
our operating system like Windows or
Linux, whatever it is.
And we could dual partition the hard drive and then boot
to one or the other based on our need.
But you know what?
There's another really great option, and that is to use
this little gem called a Raspberry Pi.
Now, the Raspberry Pi has been around for a few years, and
it's starting to make a lot more traction as people are
getting very, very creative with applications they can use
a Raspberry Pi for.
What is it?
Well, effectively it's a computer.
Now take a look at these ports.
These are two USB ports right here.
And there's one on top of the other.
And so there's two USB ports.
This is an RJ45 connector for an ethernet cable to connect
your Local Area Network.
This is the HDMI for video output.
Here's a micro-B USB connector.
And that's how it's powered, by the way.
And if you have an old phone charger with the micro-B
connector for USB, and that, my friends is
how you power it.
There is no power supply that comes with it.
This computer that we're looking at right here is
powered by that micro-B USB connector.
So you plug that into your computer or USB hub, or even a
typical phone charger with a micro-B connector very likely
has enough power to support this entire system.
When I first discovered that there is an image of Kali
Linux written for the Raspberry Pi, I thought to
myself, oh my gosh.
I'm going to buy one.
And if it works, I'm going to go ahead and make a
Nugget out of this.
This is too good to be true.
Because we can create one of these things like under $50
and have these little penetration systems lying
around the network wherever we want to plug them in.
So if you wanted to have them specifically in a wiring
closet or some other area of a network, they are fairly small
and all they need is USB micro-B connector to power the
entire thing.
So the next challenge is, OK Keith, I'm interested.
What exactly does it take to put this all together?
And that's our next challenge, is what are the ingredients to
make it work?
Well, I like amazon.com.
I'm in the US, and they've been very, very good customer
service to me.
I like Amazon Web Services.
I like a lot of things about Amazon.
So I went down I bought one at Amazon.
And I got this flavor right here.
I put the details in case you want to replicate.
It it's a Raspberry Pi.
That's the dimensions of it.
It's Model B, revision 2.0, 512 megabytes of RAM.
And I have never worked with a Raspberry Pi before.
I've seen them at the CBT Nuggets office.
They have a competition on clever ways of
using Raspberry Pis.
But I'd never actually touched one before.
So I ordered it.
It came in.
I opened it up.
And here's what I ordered along with it--
I ordered a wireless adapter.
And I've also put the details for which
wireless adapter I got.
Now, why did I buy this specific wireless adapter?
It was less than $12 US for the wireless adapter.
And the reason I got this was because at Amazon, when I
purchased the Raspberry Pi it said, by the way, people who
usually buy this usually buy this, too.
So I bought this 8 gigabyte, class 10 SD card.
And I also put the model number there for you in case
you want to mirror this exactly.
And these are the three items I bought.
I also purchased a case for my Raspberry Pi.
So with the case, it looks something like this.
So here's the HDMI cable plugged in.
There is a micro USB.
There's the ethernet card.
And there is one of the USB connectors.
And there's another USB below it.
So that's the four items I purchased-- the case, the
Raspberry Pi, the wireless, and the card.
I also had another 32 gig SD card lying around.
It tried it with that, but I had terrible results.
And so I wanted to share with you the exact details of what
got working to help me save you the hours and hours of
time that I had in my attempt.
So the ingredients included a Raspberry Pi, an SD card--
and this is the exact one I got--
a keyboard mouse.
I simply had a couple lying around.
So I'm using USB keyboard, USB mouse.
I didn't have to buy those.
I also had the micro-B table.
So what I'm using--
I'm using a telephone charger.
The actual specifications are 700 milliamps at 5 volts.
And that's what it says it needs.
So if you have any adaptor that really does perform at
that level-- for example, the little dongle that charges an
iPad and a lot of other USB adapters are
going to have that.
Just look at the actual case to see whether or not it will
output at least that much.
But this is the actual minimum that's required to provide
power supply.
I also had-- as I tested this, I also hooked up another
passive USB hub and plugged in three additional devices, just
to verify that it would all work.
And my goodness, it did.
I also added the USB wireless.
Now, the USB wireless I have that I've been using in this
series for the actual backtrack--
that also works.
But I also have this one, because I wanted to have my
Backtrack with its wireless and the Raspberry Pi with its
wireless at the same time.
And these had both been successful in my testing.
You also need to get the image that works with
the Raspberry Pi.
And this part was a little bit interesting in the fact that
the first download I got, which I thought I got exactly
the right image, it wasn't correct.
It didn't work successfully.
So let me take a moment right now and share with you exactly
which image I got from kelly.org's website and the
one that's working for me right now.
So here's the URL that I discovered that had the image
that worked for me.
So the URL is cdimage.kali.org.
And the image that I downloaded that worked was
this guy right here.
kali-linux-1.0-a rmel-raspberrypi.img.gz.
And then I extracted that compressed file.
You can do that either on a Macintosh or a Linux using
traditional commands.
Or if you have a win unzip program on Windows, that'll do
it as well.
And I simply used that file as my image for my Raspberry.
Now the next question is Keith, once you have that
image, how do you actually tell the Raspberry to use it?
Well, you see this beautiful SD card right here?
Here's what I did.
On my Windows machine-- and there's probably other
ways of doing it.
So on Windows, I use this tool called Win 32 Disk Imager.
I did have to download and install it to do it.
And I browsed for the location of that image file that I just
expanded or decompressed.
And then I specified here the logical drive letter that
represented my SD card.
Now I'd triple checked just to make sure I was pointing to
the right drive letter for this guy and not one of my
other external hard drives.
Because once you click on Write and it goes for it, it's
going to wipe out the target and put that
image on that device.
I then clicked on Write and I wrote it.
It took like four or five minutes to complete.
Once it was done, I simply took this SD card and I
plugged it into the Raspberry Pi.
So then with my keyboard and mouse connected with two
connections there, my ethernet cable, the HDMI, I did not yet
connect the actual power supply, which is the micro-B
USB connector.
Because I didn't want to have it powered on when I put the
hardware effectively in.
And I took this SD card.
And on the bottom of the side, there's a slot for it.
I simply inserted it.
Made sure it was seated.
And then I plugged in the power supply,
the micro USB connector.
And it powered up.
And I was absolutely pleasantly
surprised when it did work.
Now, why do I say when it did work?
The very first time I tried this, it did not work for me.
I had a comedy of errors.
I want to help you avoid those.
What I would strongly recommend you do if you want
to do Kali Linux on a Raspberry, is I would first go
up to the actual Raspberry site and I would download
Wheezy, which is their official, basically beginners
operating system for the Raspberry.
And I would try that first.
Because if it works with Wheezy on this SD card, that
would help you verify that OK, the video's working.
My connections are working.
Everything's good.
My Pi isn't DOA or anything else like that.
What I had happen to me was I actually tried this first with
a higher capacity card that I had lying around.
And for whatever reason, it didn't work.
So initially, I had a SD card that wasn't working at all.
So all my attempts to put the actual Kali Linux on that SD
card and have it boot, I thought, do I
have a video problem?
Do I have my video adapters?
Is it not correct?
By using the Wheezy first, just a simple test, that will
give you a baseline that your Raspberry Pi is functional,
operational, video works, and everything else.
And then you can take that same SD card, put the Kali
Linux image on it, plug it in, put the power back in, and
boot up to that.
So that's my strong recommendation on the order of
operations to do that in.
Try it with Wheezy first.
And after it works, then go ahead and take
that SD card out.
Re-image it with Kali.
And then boot with Kali and you're off to the races.
Now, a couple of things you definitely deserve to know.
When you power this up, the default username is root--
I'll put that in lowercase there.
And the password is toor.
Isn't that great?
If you boot to Wheezy, the default username is pi and the
password is raspberry.
But that's all at the raspberry site.
They have all that documented for you as well.
But for Kali Linux, it's root and toor-- lowercase root and
lowercase t-o-o-r to login.
And the other thing you want to be aware of is that this
guy is ready to go out of the box.
With this ethernet cable connected, he's going to be a
DHCP client.
So he'll get an IP address if you have
DHCP services available.
And he is ready.
Another thing that is also on by default on this Raspberry
Pi with Kali Linux is that it's also got SSH ready to go.
So that means if we do an ifconfig and we simply look at
what the IP address is, we could then remotely access
this via SSH.
Earlier in this series, there was a
video called CDP flooding.
And in that video, I walked you through how we could set
up the details for remote Graphical User Interface to a
system using X11.
So if you want to revisit that, you can in that video.
But we could do the same thing here.
So we can connect with SSH, train this connection via SSH
that we want to have our server, our PC, as a remote X
Windows Server, and still have a Graphical User Interface and
command line interface to a device, even though we're not
directly connected to it.
So this guy might be sitting in the data center-- of
course, with authorization.
We don't want to leave these around anywhere they're not
allowed to be used.
And we can go ahead and manage those devices
right from our desk.
So here we are with an SSH session over to this Raspberry
Pi running Kali Linux.
As a quick review of that, we've got our Windows 7
machine here.
I've got Putty running with SSH over to the Pi.
And that Pi is turning Kali.
And I've also got this Putty session set up for remote X11
support, so that any graphical output from this device will
be redirected back to this box.
And we have Xming running also as an X Windows server
on the Windows 7.
So we have the GUI as well.
The details for that are in the CDP flooding video in this
series if you wanted to refer back to that.
So let's have some fun with this.
We use some more traditional commands, like ifconfig, to
take a look at the details there.
Now, I don't see my wireless adapter.
Let's do an iwconfig and press Enter.
And there we go.
So there's a wireless LAN zero sitting right there.
Have no fear.
So we could enable him, and it looks like he's available to
be used, which is great.
And we could also do things like arp-a to take a look at
the arp cache on this device.
And it shows us that it knows about this guy, 192.168.1.19--
that's actually my Windows 7 machine, because of my SSH
connection I have to him.
I'm not sure why it's in there twice, but I'm OK with that.
He knows the layer 3, layer 2 mapping.
If we did a ping, for example, out to the internet--
which we should be able to do.
We'll do a ping out to www.google.com If this works,
it verifies the default gateway is OK.
It verifies that name resolution's OK, and a whole
bunch of things.
So I'm going to stop that.
Now, if we do an arp-a again, we should have that other
entry as well.
Which we do.
So the default gateway's 192.168.1.1, I'm presuming due
to how the arp cache ended up.
And there's the MAC address of that device.
I'd like to share with you one other tool while we're here.
And that is what if we're trying to ping somebody, we're
doing a ping sweep, and they don't respond.
Now with Nmap, we can say, do a ping sweep.
And then go ahead and start doing port scans on everybody,
even those address that didn't respond.
Let's go ahead and do a port scan and see if there's
something sitting there.
If we did a ping, for example, of 192.168.1.23, as an
example, and we had no response, does that mean that
no one is sitting there?
No, not necessarily.
It means that they're not responding to
an ICMP ping request.
How can we verify that a device is there?
Well, one way of tricking a device into revealing itself
is to do an ARP request for it.
So I'm going to hit Control C to stop that.
You might be thinking, Keith, wait a sec.
If we do a ping for that IP address, behind the scenes
it's doing an ARP request.
And then based on that information, it's going to go
ahead and complete the actual paint with ICMP.
So it's quite possible that the ARP request happened in
the background.
Very likely it did.
And it may have even worked, except we're not looking at
that information.
So let's do an arp-a one more time.
And check this out.
Here we have the layer 3, layer 2 mapping.
That means we have a device sitting there.
And that's why tools like Nmap that can just do a port scan
across all the ports on that IP address are very likely to
reveal the services are sitting there, even though a
ping by itself didn't respond.
So here's another command line tool that I think you might
find would come in handy.
It's called arping--
A-R-P-I-N-G.
It's basically a ping that's basing the results based on
responses to ARP requests.
So it's not even bothering sending in ICMP packet.
Instead it's doing ARP request, getting ARP
responses, and says yup, there's somebody right there.
Which is pretty darn cool.
So if we want to type arping and then 192.168.1.23, arping
says yeah, check that out.
I'm going to do a Control C to stop that.
But it says, yeah, we got results from that guy.
So it actually sent out the ARP request.
It never actually sent out an ICMP ping request.
It didn't need to.
It simply says, yup, I know he's there.
He's responding to my ARP requests
Now, if you're sitting right at the Raspberry Pi--
you have a keyword connected, your mouse is connected, you
got a monitor connected, that's great.
You can type in start x, just like we would on typical
Backtrack or Kali, and get the graphical X Windows interface.
If you are remote--
as we are right now with an SSH session--
and part of that issue is that I am physically running this
on a physical Raspberry.
I'm not doing it in emulation inside of my host machine.
We can still have that graphical interface by using
the X11 and the Xming server.
To demonstrate that, let's go ahead and
take a look at Wireshark.
So we simply launch Wireshark on this device.
And it brings up the Graphical User
Interface for a Wireshark.
And here it is.
If you're not remote from that device, you can certainly do
this with a direct connected monitor attached, no problem.
But effectively, what I've got is a headless horseman.
It's got the USB power supply.
It's got the ethernet connection.
And it's also got the wireless dongle that I plugged into it,
and that's it.
I don't have to have any keyboards or mice attached to
that device.
And it makes it very convenient.
So as an example, we're going to take ethernet zero.
So if we want to start capturing, we simply highlight
the interface that we want to listen on
and we click on Start.
And it's going to start the capture of that traffic.
So this is going to include our traffic as well.
So that includes the SSH session that I have going to
this and all the other traffic that's going through that
ethernet zero interface.
So I'll go ahead and click on pause.
So then we can scroll through these and take a more detailed
look at virtually any one of these packets
that we wanted to.
And the fun thing is, if we take a look at just one--
I'm just going to double click on this one packet.
It's going to open up a separate window just for that.
So the source address for this one is 192.168.1.55.
That's the Raspberry Pi.
And check it out.
Based on them MAC address it has, the source MAC address,
Wireshark identified that based on those first six
characters of the MAC address, or first 24 bits.
Those have been allocated for the Raspberry Pi.
And that's how it knew it was Raspberry.
And these are the last six characters or the last 24 bits
of the MAC address.
And are the benefits of using SSH, of course, is that
everything is encrypted.
So even if an eavesdropper gets a hold of these packets,
the actual payload of what's actually happening-- the
screen images, the text I'm typing, and so forth--
it's all encrypted and protected based on SSH.
In this video, you and I have taken a look at just how darn
fun it can be to work with a Raspberry Pi with the Kali
Linux distribution as a penetration testing tool.
I've had a lot of fun, and I'm so glad you joined me.
I hope this has been informative for you.
And I'd like to thank you for viewing.