Installing Kali NetHunter on HTC Nexus 9 - Pentest Geek

Installing Kali NetHunter on HTC Nexus 9

Everything you need to begin installing Kali NetHunter can be purchased on Amazon. The only real requirement is of course a supported Android device however this guide also makes use of the keyboard folio which should be considered a necessity if you plan to do any real work on the tablet as well as an OTG cable for plugging in an external WiFi card.
The card used in this article is verified by the Kali NetHunter team and listed in their documentation as a supported device.

Required Hardware

Shopping List
Prices will obviously change. This is what they were at the time the article was published.

Component Price Link To Purchase
Google Nexus 9 Tablet: HTC 32GB WiFi $229.95 Amazon
TP-Link 300Mbps WN822N Card $15.99 Amazon
HTC Nexus 9 Keyboard Folio $100.00 Amazon
Micro USB 2.0 OTG Cable $6.99 Amazon
Total $352.93

Rooting The HTC Nexus 9

DISCLAIMER: Do not blame me if you brick your tablet. Installing Kali Nethunter should be attempted at your own risk.

I’m starting off with a fresh tablet, just taken out of the packaging and during the initial setup process I skip the add account step and say no to all the prompts. The idea is to have as close to a stock un-touched tablet to begin with. Admittedly I have know technical knowledge as to why I’m suggesting this, only that I tried and failed at this 3 or 4 times before finally succeeding and on the final try that worked the only thing I did differently was skip the account setup process.

As rooting mobile devices in gernal is an expansive topic we’re going to limit the scope of this article to the method which worked for me and that is to use the Nexus Root Toolkit from WugFresh to unlock the bootloader and then to manually install SuperSU from TWRP. The latest version of NRT can be obtained using the above link. Download it and install it on a Windows machine.

Preparing To Use the Nexus Root Toolkit

Before installing Kali NetHunter, first you’ll need to enable USB Debugging on your Nexus tablet which requires access to the Developer options. Open up the Nexus Settings, scroll to the bottom and select “About tablet” Tap on the “Build number” seven (7) times until you see the status message at the bottom saying you are now a developer.

Next you can go back into Settings and choose the newly available “Developer options“. Make sure that OEM unlocking and USB debugging are enabled.

Installing Google Drivers

Open up the Nexus Root Toolkit on your Windows machine and click on the “Full Driver Installation Guide” button under the Initial Setup area. This will bring up a wizard that will download all of the correct drivers which will be needed to push/pull files to/from your tablet during the rooting process. If you’ve never attached your tablet to the Windows machine you can probably skip straight to Step 3. If you have you’ll need to follow the driver unistall process outlined in Step 1 and Step 2 on your NRT.

Unlock The Bootloader On Your Nexus 9

Now its time to connect your Nexus 9 tablet to your Windows machine via a micro USB cable. Since this is hopefully the first time you’ve done this your Nexus 9 tablet will ask you to accept the unique RSA fingerprint for your computer. Its fine to check the “Always allow from this computer” box here so as not to be bothered with this pop-up more than once.

Although MTP is enabled by default (at least it was on mine). I still had to specify within the tablet that I wanted to transfer files from my PC. To do this swipe down on your tablet to bring up the quick settings menu. You should see a notification that says “USB charging this device”. Tap that notification and select “Transfer files”.

WARNING: This step will wipe your Nexus 9 Tablet
Using NRT:

  • Click on the “Unlock” button to unlock the bootloader of your Nexus 9 tablet.
  • Click “OK” at the prompt
  • Your Nexus 9 Tablet will reboot itself
  • When prompted, press the Volume Up button for “Yes
  • Once finished you should receive a status message from NRT, click “OK
  • Use the Volume buttons on your Nexus 9 tablet to select the “REBOOT” option
Nexus Root Toolkit v2.1.9

- LatestToolkitFiles.ini	3135
- AndroidDeviceListFull.ini	3135
- AndroidDeviceListFlash.ini	3135

VOLANTIS-FLOUNDER: Android *.*.* - Any Build

Live log initiated [2018-04-04]:

adb devices
HT4B6JT03418	device
fastboot devices

Checking OEM Unlockable Status:
 + Status: Allowed
Checking ADB/FASTBOOT Connectivity
adb devices
HT4B6JT03418	device
fastboot devices

 + ADB Device Connected

Rebooting your device into bootloader mode...
adb reboot bootloader

Checking Fastboot Connectivity
fastboot devices
HT4B6JT03418	fastboot
 + Fastboot Device Connected

 + Confirmed: Bootloader Unlocked.
Bootloader Already Unlocked.  Rebooting your device.

You have now unlocked your boot-loader. Go through the initial setup on your tablet but again, avoid entering your Gmail account just yet. Make sure to repeat the above steps for enabling Developer options, USB Debugging, OEM Unlocking and File Transfers.

Rooting Your Nexus 9

Now its time to finally root your Nexus 9 tablet and begin installing Kali NetHunter. The “Root” button on NRT never worked for me. There are several YoutTube videos and blog articles available with a Google search that you can try if you want to go that route. Below is a set of steps that worked for me.

  • Download SuperSU zip file from this link.
  • move the ZIP file to the root of your tablet.
  • Click the “Root” button on NRT (We’re just doing this to boot our tablet into TWRP)
  • Click “OK” on the prompt. When tablet reboots into fastboot. don’t touch anything
  • Let tablet boot into TWRP. Don’t touch anything, watch the NRT Live Log as it pushes files to your Nexus 9
  • Tablet reboots again into Fastboot mode
  • Tablet boots into TWRP a second time. This time you may be asked to swipe right.
  • Ignore red “Unable to mount storage” error.
  • Click Install on TWRP menu
  • Select SuperSU zip file and swipe right
  • click reboot system

If all went well you should be able to access SuperSU and elevate applications. Congratulations, your tablet has been rooted. Now we can begin installing Kali NetHunter.

Installing Kali NetHunter Via TWRP

Before installing Kalil NetHunter you’ll need to get a couple of Apps from the Google Play Store. Search for and install “BusyBox” and “Official TWRP App” from the Google Play Store.

Next, open up BusyBox and grant the application root permissions from the SuperSU prompt. Run through the install process within BusyBox. Its easy, just wait for it to configure everything and click the “Install” button.

Next you’ll need to download the Kali NetHunter installation ZIP file. If you are running Anroid Nougat you can get your copy here. I chose the file named ““. Place this file on the root of your Nexus 9 tablet.

Open up the TWRP App and agree to their terms and select “Run with root permissions”. Tap the “TWRP Flash” button then tap the pancake menu in the upper left corner. Select “Reboot” and then tap “Reboot Recovery”

This will reboot into the TWRP recovery mode you should be familiar with from the previous rooting procedure. Click the “Install” button. Scroll down and select the Kali NetHunter ZIP file. Swipe right to begin installing Kali NetHunter. This will take a good 10-20 minutes so sit tight and don’t touch anything on your Nexus 9 tablet.

After the installation tap the “Reboot System” button and marvel at your sexy new Kali NetHunter boot graphics. Word of caution: After a fresh install you may get stuck in what looks like a continual boot loop, don’t panic. I think my tablet rebooted and asked me for my PIN a good 3 or 4 times and then eventually it booted into Android.

Good luck and seriously, don’t blame me if you brick your tablet!

EDIT: NetHunter Terminal Auto-closes

If you are experiencing issues with the NetHunter terminal App which was installed along with Kali NetHunter then simply uninstall the app. Download the latest APK file from the Offensive Security Github page and install it. This should solve your problems. Post a comment below if it doesn’t!

Share this article

  • I got the “No command” message when rebooting via the TWRP app. As a workaround, I used the NRT to reboot into TWRP instead, as per the “Rooting your Nexus 9” section. You can then click on the Install button in TWRP and select the nethunter zip.

  • peter pentest 2018/11/22 at 2:31 PM

    Hi,when i start the TWRP and choose install and select the downloaded nethunter zip, the device reboots, and then i see the android robot on his back and the message “No command”/

    Any idea what goes wrong here?

  • for the nethunter-terminal for auto close. go to settings -> battery optimization then set it to “Don’t Optimize” close it and thats it.

  • Leave a Reply

    Your email address will not be published. Required fields are marked *

    This site uses Akismet to reduce spam. Learn how your comment data is processed.

    Share This

    Recent Posts

    Subscribe To Our Mailing List

    The Ultimate Burp Suite Training Program

    Learn Network Penetration Testing

    Penetration Testing



    Web Application Hacking

    Copyright 2024


    Are You Using the Top 5 Pentest Tools?

    Enter your email address to download your copy of our FREE e-book and find out now!

    Thank you, now go check your email!!