USB Persistence & Encrypted Persistence
In this workshop, we will examine the various features available to us when booting Kali Linux from USB devices. We will explore features such as persistence, creating LUKS encrypted persistence stores, and even dabble in “LUKS Nuking” our USB drive. The default Kali Linux ISOs (from 1.0.7 onwards) support USB encrypted persistence.
0x01 – Start by imaging the Kali ISO onto your USB stick (ours was /dev/sdb). Once done, you can inspect the USB partition structure using parted /dev/sdb print.
0x02 – Create and format an additional partition on the USB stick. In our example, we create a persistent partition of about 7 GB in size:
GNU Parted 2.3
Using /dev/sda
Welcome to GNU Parted! Type ‘help’ to view a list of commands.
(parted) print devices
/dev/sda (480GB)
/dev/sdb (31.6GB)
(parted) select /dev/sdb
Using /dev/sdb
(parted) print
Model: SanDisk SanDisk Ultra (scsi)
Disk /dev/sdb: 31.6GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Number Start End Size Type File system Flags
1 32.8kB 2988MB 2988MB primary boot, hidden
2 2988MB 3050MB 64.9MB primary fat16
(parted) mkpart primary 3050 10000
(parted) quit
Information: You may need to update /etc/fstab.
0x04 – Encrypt the partition with LUKS:
0x05 – Open the encrypted partition:
0x06 – Create an ext3 filesystem and label it.
e2label /dev/mapper/my_usb persistence
0x07 – Mount the partition and create your persistence.conf so changes persist across reboots:
mount /dev/mapper/my_usb /mnt/my_usb
echo “/ union” > /mnt/my_usb/persistence.conf
umount /dev/mapper/my_usb
cryptsetup luksClose /dev/mapper/my_usb
Now your USB stick is ready to plug in and reboot into Live USB Encrypted Persistence mode.
Multiple Persistence Stores
At this point we should have the following partition structure:
We can add additional persistence stores to the USB drive, both encrypted or not…and choose which persistence store we want to load, at boot time. Let’s create one more additional non-encrypted store. We’ll label and call it “work”.
0x01 – Create an additional, 4th partition which will hold the “work” data. We’ll give it another 5GB of space.
GNU Parted 2.3
Using /dev/sdb
Welcome to GNU Parted! Type ‘help’ to view a list of commands.
(parted) print
Model: SanDisk SanDisk Ultra (scsi)
Disk /dev/sdb: 31.6GB
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Number Start End Size Type File system Flags
1 32.8kB 2988MB 2988MB primary boot, hidden
2 2988MB 3050MB 64.9MB primary fat16
3 3050MB 10.0GB 6947MB primary
(parted) mkpart primary 10000 15000
(parted) quit
Information: You may need to update /etc/fstab.
0x02 – Format the fourth partition, label it “work”.
e2label /dev/sdb4 work
0x03 – Mount this new partition and create a persistence.conf in it:
mount /dev/sdb4 /mnt/usb
echo “/ union” > /mnt/usb/persistence.conf
umount /mnt/usb
Boot the computer, and set it to boot from USB. When the boot menu appears, edit the persistence-label parameter to point to your preferred persistence store!
Emergency Self Destruction of Data in Kali
As penetration testers, we often need to travel with sensitive data stored on our laptops. Of course, we use full disk encryption wherever possible, including our Kali Linux machines, which tend to contain the most sensitive materials.
Enter any existing passphrase:
Enter new passphrase for key slot:
Now dump the keyslots to see the changes:
Device /dev/sda5 doesn‘t exist or access denied.
root@kali:~# cryptsetup luksDump /dev/sdb3
LUKS header information for /dev/sdb3
Version: 1
Cipher name: aes
Cipher mode: xts-plain64
Hash spec: sha1
Payload offset: 4096
MK bits: 256
MK digest: f7 17 b9 a7 9f 7f 9b 21 f2 b9 40 78 c2 97 f5 f0 c2 bb 28 8b
MK salt: f5 a4 80 02 e7 21 0d 7e 5a 64 f4 96 78 a3 15 3c
09 7b 3f 41 80 2b 5c bf c5 de 92 70 69 bb 34 b2
MK iterations: 64500
UUID: 96793acb-c2d3-45b7-aed9-1af952386556
Key Slot 0: ENABLED
Iterations: 258064
Salt: df 3c d6 03 4a 78 ce ef 62 fd f1 56 25 d4 c5 96
2a 12 bb 94 4b d7 cf c1 0a b5 27 47 09 ae 31 46
Key material offset: 8
AF stripes: 4000
Key Slot 1: ENABLED
Iterations: 259108
Salt: 30 07 ff ef fc f5 74 65 04 f7 66 87 77 f1 74 4f
7d 2f 76 e2 71 e7 6a 9c 6d c1 c1 7b 80 53 cb c1
Key material offset: 264
AF stripes: 4000
Key Slot 2: DISABLED
Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED
root@kali:~#
Backup you LUKS keyslots and encrypt them:
openssl enc -d -aes-256-cbc -in luksheader.back.enc -out luksheader.back
Now boot into your encrypted store, and give the Nuke password, rather than the real decryption password. This will render any info on the encrypted store useless. Once this is done, verify that the data is indeed inacessible.
Lets restore the data now. We’ll decrypt our backup of the LUKS keyslots, and restore them to the encrypted partition:
cryptsetup luksHeaderRestore –header-backup-file luksheader.back /dev/sdb3
Our slots are now restored. All we have to do is simply reboot and provide our normal LUKS password and the system is back to its original state.
Kali Linux - Tutorial 