⚠️ Malware / Trojaner / VirenGuardBreaker: Derailing AI-assisted malware analysis with a code comment(10.09.2026 um 11:00 Uhr)
⚠️ Malware / Trojaner / VirenAttack hides malware in PNGs and drops custom reverse tunnel on victims' machines(31.08.2026 um 20:26 Uhr)
⚠️ Malware / Trojaner / Viren33-hour BGP hijack of Softaculous traffic prompts security scramble(01.09.2026 um 14:04 Uhr)
🕵️ SicherheitslückenProlific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC(03.09.2026 um 20:08 Uhr)
🔧 AI Nachrichten OpenAI commits $1B in AI credits to frontline cyber defenders(04.09.2026 um 01:47 Uhr)
⚠️ Malware / Trojaner / VirenGuardBreaker: Derailing AI-assisted malware analysis with a code comment(10.09.2026 um 11:00 Uhr)
⚠️ Malware / Trojaner / VirenAttack hides malware in PNGs and drops custom reverse tunnel on victims' machines(31.08.2026 um 20:26 Uhr)
⚠️ Malware / Trojaner / Viren33-hour BGP hijack of Softaculous traffic prompts security scramble(01.09.2026 um 14:04 Uhr)
🕵️ SicherheitslückenProlific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC(03.09.2026 um 20:08 Uhr)
🔧 AI Nachrichten OpenAI commits $1B in AI credits to frontline cyber defenders(04.09.2026 um 01:47 Uhr)

💾 Tools 🕛 vor 4 Jahren 19 Min Lesezeit
0

Secure Kali Pi (2022)

↗ Quelle (kali.org)
🗣️ Stimme:
📑 Inhaltsübersicht

This is the first part of a 3 part series of blog posts surrounding Kali usage on Raspberry Pi devices. This first post will cover enabling Full Disk Encryption (FDE) on a Raspberry Pi, part two will cover remotely connecting to it, and finally, part three will cover debugging issues we ran into while making these posts, so others can learn how to do so as well.



With everything that has been going on in the world in the last few years, more people are working remotely. We are no exception to this, and today, we are going to be revisiting our “drop box” machine, which has been encrypted thus making it harder to identify if discovered.


The goal is to create a stand-alone “leave behind” headless device that, that if/when discovered, does not make it easy to figure out what we were doing as our data is secure at all times. To accomplish this, we will use Full Disk Encryption (FDE), and allow for it to be remotely unlocked (should the device get restarted for any reason). There will be the option as well to use , but it also has been tested on a part of this before. This time we include additional developments, with some community contributions thrown in. We would like to give a shout-out to Richard Nelson (. We will touch on this after going through the manual method, as we always recommend you understand what is going on under the hood.



Higher-level overview


Before we dive into the lower-levels of technical details of what we are going to accomplish, let’s take a quick look at our goals that we want to achieve, and break it down:


  • (henceforth called “RPi”)

  • to allow the remote unlock to occur (using initramfs and Dropbear)

  • the encrypted partitions

  • the .
    We have also chosen the 64-bit image, as we have more than 4GB of RAM, and are not using any



As a reminder, we are using the RPi4, 64-bit image. So we would need Re4son-v8l+. Please make sure you adjust to your device.
So now we know what kernel name to use, we now need to find what kernel version. This will alter from device to device, and it will also change as and when Kali gets updates At the time of writing, it is 5.15.44 for our RPi:


Keep in mind the kernel versions may change, however the name will not:


CONSOLE
┌──(root㉿kali)-[/]
└─# ls -l /lib/modules/ | awk -F" " '{print $9}'
5.15.44-Re4son+
5.15.44-Re4son-v7+
5.15.44-Re4son-v7l+
5.15.44-Re4son-v8+
5.15.44-Re4son-v8l+
┌──(root㉿kali)-[/]
└─# echo "initramfs initramfs.gz followkernel" >> /boot/config.txt



Keep in mind the kernel versions (5.15.44) may change, however the kernel name (Re4son-v8l+) will not.




Now we need to create the initramfs. This is where the kernel version comes into play:


CONSOLE
┌──(root㉿kali)-[/]
└─# mkinitramfs -o /boot/initramfs.gz 5.15.44-Re4son-v8l+


Now we want to ensure that we created the initramfs correctly. If there is no result, then something went wrong:


CONSOLE
┌──(root㉿kali)-[/]
└─# lsinitramfs /boot/initramfs.gz | grep cryptsetup
usr/lib/aarch64-linux-gnu/libcryptsetup.so.12
usr/lib/aarch64-linux-gnu/libcryptsetup.so.12.7.0
usr/lib/cryptsetup
usr/lib/cryptsetup-nuke-password
usr/lib/cryptsetup-nuke-password/crypt
usr/lib/cryptsetup/askpass
usr/lib/cryptsetup/askpass.cryptsetup
usr/lib/cryptsetup/functions
usr/sbin/cryptsetup
┌──(root㉿kali)-[/]
└─# lsinitramfs /boot/initramfs.gz | grep authorized
root-Q2iWOODUwk/.ssh/authorized_keys
┌──(root㉿kali)-[/]
└─# lsinitramfs /boot/initramfs.gz | grep unlock.sh
etc/unlock.sh


Disable services


Before we can backup, we have to ensure that rpi-resizerootfs is disabled. This is a service we typically run on all of our ARM devices that resizes the root filesystem partition to increase the size of the partition to the full size of the storage device it is on. Since we are doing this step manually, we want to disable it, so it doesn’t potentially delete our root filesystem and re-make it.


CONSOLE
┌──(root㉿kali)-[/]
└─# systemctl disable rpi-resizerootfs

Backup any existing data


Now we can ensure that all the changes are written, then we can encrypt the disk:


CONSOLE
┌──(root㉿kali)-[/]
└─# sync
┌──(root㉿kali)-[/]
└─# exit
$ sudo umount /mnt/chroot/{boot,sys,proc,dev/pts,dev}
$ sudo mkdir -vp /mnt/{backup,encrypted}
$ sudo rsync -avh /mnt/chroot/* /mnt/backup/
$ sudo cryptsetup luksClose crypt
$ sudo umount /mnt/chroot
$ echo -e "d\n2\nw" | sudo fdisk /dev/sdX
$ echo -e "n\np\n2\n\n\nw" | sudo fdisk /dev/sdX

Configure the encrypted partitions


Depending on what device you are using you will have to use one of two commands. If you are using a RPi4 with 4GB or more, use this command:


CONSOLE
$ sudo cryptsetup -v -y --cipher aes-cbc-essiv:sha256 --key-size 256 luksFormat /dev/sdX2

Otherwise you will want to use the following which uses an older version of LUKS:


CONSOLE
$ sudo cryptsetup -v -y --pbkdf pbkdf2 --cipher aes-cbc-essiv:sha256 --key-size 256 luksFormat /dev/sdX2

Restore our data


Afterwards you can finish restoring data back to the now encrypted partition:


CONSOLE
$ sudo cryptsetup -v luksOpen /dev/sdX2 crypt
$ sudo mkfs.ext4 /dev/mapper/crypt
$ sudo mount /dev/mapper/crypt /mnt/encrypted/
$ sudo rsync -avh /mnt/backup/* /mnt/encrypted/
$ sync


The final steps that we have to make are to fix up the /etc/fstab file for the new LUKS UUID, or you can leave it as /dev/mapper/crypt and replace the UUID in our unlock script and remake the initramfs file, this step is important as it will not properly boot if not done, because it won’t have the information to use the encrypted filesystem! Remember to put the information in from YOUR system, as the UUID will be different for every system:


CONSOLE
$ sudo mount /dev/sdX1 /mnt/encrypted/boot/
$ sudo mount -t proc none /mnt/encrypted/proc
$ sudo mount -t sysfs none /mnt/encrypted/sys
$ sudo mount -o bind /dev /mnt/encrypted/dev
$ sudo mount -o bind /dev/pts /mnt/encrypted/dev/pts
$ sudo env LANG=C chroot /mnt/encrypted
┌──(root㉿kali)-[/]
└─# blkid /dev/sdX2
/dev/sdX2: UUID="173e2de4-0501-4d8e-9039-a4923bfa5ee7" TYPE="crypto_LUKS" PARTUUID="e1750e08-02"
┌──(root㉿kali)-[/]
└─# cat /etc/fstab
# <file system> <mount point> <type> <options> <dump> <pass>
proc /proc proc defaults 0 0
UUID=173e2de4-0501-4d8e-9039-a4923bfa5ee7 / ext4 errors=remount-ro 0 1
LABEL=BOOT /boot vfat defaults 0 2
┌──(root㉿kali)-[/]
└─# vim /etc/initramfs-tools/unlock.sh
┌──(root㉿kali)-[/]
└─# cat /etc/initramfs-tools/unlock.sh
#!/bin/sh
export PATH='/sbin:/bin:/usr/sbin:/usr/bin'
while true; do
test -e /dev/mapper/crypt && break || cryptsetup luksOpen /dev/disk/by-uuid/173e2de4-0501-4d8e-9039-a4923bfa5ee7 crypt
done
/scripts/local-top/cryptroot
for i in $(ps aux | grep 'cryptroot' | grep -v 'grep' | awk '{print $1}'); do kill -9 $i; done
for i in $(ps aux | grep 'askpass' | grep -v 'grep' | awk '{print $1}'); do kill -9 $i; done
for i in $(ps aux | grep 'ask-for-password' | grep -v 'grep' | awk '{print $1}'); do kill -9 $i; done
for i in $(ps aux | grep '\\-sh' | grep -v 'grep' | awk '{print $1}'); do kill -9 $i; done
exit 0
┌──(root㉿kali)-[/]
└─# vim /etc/crypttab
┌──(root㉿kali)-[/]
└─# cat /etc/crypttab
crypt PARTUUID=e1750e08-02 none luks
┌──(root㉿kali)-[/]
└─# mkinitramfs -o /boot/initramfs.gz 5.15.44-Re4son-v8l+



If you get a cryptsetup error here, similar to cryptsetup: ERROR: Couldn't resolve device PARTUUID=ed889dad-02 that means that you did not edit the /etc/crypttab file and put the correct PARTUUID in. The warning about no fsck.luks existing can be ignored, as there is no such thing.




Now we can unmount and close up everything:


CONSOLE
┌──(root㉿kali)-[/]
└─# exit
$ sudo umount /mnt/encrypted/{boot,sys,proc,dev/pts,dev}
$ sudo umount /mnt/encrypted
$ sudo cryptsetup luksClose crypt


Earlier, we mentioned the LUKS Nuke capability. If you plan to use it, while booted on your freshly encrypted RPi rootfs, simply run the following command to add the Nuke password and follow the prompt:



CONSOLE
kali@kali:~$ sudo dpkg-reconfigure cryptsetup-nuke-password


Stay tuned for part two where we cover remotely connecting to the Raspberry Pi as a dropbox device!


Automate!


Now how about we get this automated? Thanks to script:


CONSOLE
$ git clone https://github.com/unixabg/cryptmypi.git
$ cd cryptmypi/

There are a number of things we want to do before we can run the build scripts however. Let’s go through those together now:


CONSOLE
$ cp cryptmypi.conf config/.
$ cat ~/.ssh/id_rsa.pub >> config/authorized_keys

Now we need to edit cryptmypi.conf to change some settings in stage-2. These settings will be personal, but let’s just give you all an example:


CONSOLE
$ vim config/cryptmypi.conf
$ cat config/cryptmypi.conf
##################
## cryptmypi settings
##################
# export prefix for hooks
export _VER="2.2-beta"
# base and build
export _BASEDIR=$(pwd)
export _BUILDDIR=${_BASEDIR}/cryptmypi-build
##################
## Stage-1
##################
_IMAGEURL=https://kali.download/arm-images/kali-2022.2/kali-linux-2022.2-raspberry-pi-arm64.img.xz
# compose package actions
export _PKGSPURGE=""
export _PKGSINSTALL=""
# iodine settings
_IODINE_PASSWORD="your iodine password goes here"
_IODINE_DOMAIN="your iodine domain goes here"
# final package actions
export _FINALPKGPURGE=""
export _FINALPKGINSTALL="telnet dsniff bettercap"
##################
## Stage-2
##################
# block device
_BLKDEV="/dev/sdb"
# luks encryption cipher
_LUKSCIPHER="aes-cbc-essiv:sha256"
# luks encryption password
_LUKSPASSWD="toor"
# root password
export _ROOTPASSWD="toor"

What we changed here is the block device, LUKS encryption password, and the root password. The image URL can be changed if you would like to use a different image file, so be sure to do that now if need be.


Now the only thing left to do is run both stages’ scripts and follow the instructions. By the end of it, you’ll have a fully encrypted file-system with Dropbear SSH access!

Vollständiger Original-Bericht
Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf kali.org.
↗ Original-Artikel auf kali.org lesen
Wie bewertest du diesen Beitrag?
1 Klick Feedback
Teilen mit Netzwerk & Team:

Community-Analysen & Experten-Meinungen 0

Verfasse deine eigene Analyse, teile Workarounds oder diskutiere diesen Vorfall im Blog.
Noch keine Community-Analyse verfasst. Markiere einen Textabschnitt oder klicke oben auf Eigene Analyse verfassen“!
Community Pulse: Relevanz-Einschätzung
1 Klick Experten-Votum
🔴 Akute Relevanz 0%
🟡 In Evaluierung 0%
🟢 Keine Auswirkung 0%
Spannende Innovation 0%
Verwandte Story-Cluster & Quellen (Vektor-KI)
Port 8095 Engine
1 Quelle
GuardBreaker: Derailing AI-assisted malware analysis with a code comment
1 Quelle
Attack hides malware in PNGs and drops custom reverse tunnel on victims' machines
1 Quelle
33-hour BGP hijack of Softaculous traffic prompts security scramble
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Secure Kali Pi (2022)

Thematisch verwandte Begriffe: Secure, Kali, 2022 · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...