[ONE Android Development] c2python-coding:
Ok so after fighting about this for a week, I have the full steps on getting Nethunter to Work on OnePlusOne in case anyone comes across this post. I have confirmed that wifi injection is working with AWUS036NEH, without a Y cable, and USB based attacks also work. Haven't tested with other devices or bluetooth yet.

These instructions assumes you know your way around adb/fastboot and TWRP.

Get all your ADB and Fastboot to work (enable it on your phone, drivers, e.t.c). Plenty of tutorials on this out there, not going to put them there.

Download the TeamWinRecoveryProject file twrp-3.5.0_9-0-bacon.img from here. If the link is broken, just google for the file.

Reboot into fastboot, fastboot flash recovery twrp-3.5.0_9-0-bacon.img

From TWRP, wipe data/system/cache/dalvik

Download the lineage-18.1-20220113-nightly-bacon-signed.zip from https://download.lineageos.org/bacon

Download Magisk-v23.0.apk from https://github.com/topjohnwu/Magisk/releases

Download nethunter-2021.3-oneplus1-eleven-kalifs-full.zip from https://kali.download/nethunter-images/kali-2021.3/

Push the Lineage rom /sdcard/ with adb (adb works in TWRP)

Flash the Lineage rom. Reboot device, go through setup.

Install the Magisks apk (you can use adb install)

Make a copy of the Magisk-v23.0.apk and name it Magisk-v23.0.zip

Reboot recovery, push the Magisk-v23.0.zip file to /sdcard/ flash it. This will give you root

Reboot into system, go into Magisks app, verify that you have root.

!!!! IMPORTANT !!!! in the Magisks app scroll down and set it to grant root automatically without asking. If you don't do this, the Kali Nethunter app doesn't play well with asking for all the permissions on first start.

Reboot into recovery, push the nethunter-2021.3-oneplus1-eleven-kalifs-full.zip. Flash the nethunter zip

Reboot into system, make sure the Nethunter app starts up (grant it all permissions, should get root automatically from step 14). Make sure that your chroot path is /data/local/nhsystem/kali-armhf and your chroot starts up fine

Doing these steps got Nethunter working, but the device kernel included in the 2021.3 release seems to not have the right drivers for the AWUS036NEH device (and possibly others). On mine, I could not bring the interface up.

So to fix this, you need to recompile the full kernel. You need a linux system for this (WSL2 under Windows 10 works)

git clone https://gitlab.com/kalilinux/nethunter/build-scripts/kali-nethunter-project
cd kali-nethunter-project/nethunter-installer
./bootstrap.sh
python3 build.py -d oneplus1 --eleven -k

this will build the latest kernel file.

Reboot recovery, flash the kernel, and reflash the Magisk-v23.0.zip, reboot and you are done.

Extras:

On the principle of this being a security oriented platform, if you capture traffic from the phone with the above, you will notice that it phones home to google. com and connectivitycheck.gstatic.com, as well as time.android.com, as part of the default android os on which Lineage was built. I don't particularly like this, so here is how you disable it.

In root shell, run the following commands

pm disable com.android.captiveportallogin
settings put global captive_portal_detection_enabled 0
settings put global captive_portal_server localhost
settings put global captive_portal_mode 0
settings put global auto_time 0
settings put global auto_time_zone 0

Then, in your /system/etc/hosts file on the device, add the following 2 lines

0.0.0.0 time.android.com
0.0.0.0 connectivitycheck.gstatic.com

Now, when you boot, the only traffic from the device should be the starting DHCP/ARP traffic from your wifi router. After that the device should be silent.

Happy Hunting!