Exegol : A Kali Light Base With Few Useful Additional Tools

Exegol is a fully configured kali light base with a few useful additional tools (~50), a few useful resources (scripts and binaries for privesc, credential theft etc.) and some configuration (oh-my-zsh, history, aliases, colourized output for some tools).

It can be used in pentest engagements and BugBounty. Exegol’s original fate was to be a ready-to-hack docker in case of emergencies during engagements. It is now an environment my team and I use in day to day engagements.

Quick Start

The project is on Docker Hub, you don’t need to clone this git.

• First set the following aliases in your bashrc/zshrc/whateverrc.

alias exegol-update=’docker pull nwodtuhs/exegol’
alias exegol-build=’docker build –tag nwodtuhs/exegol /PATH/TO/Exegol/’
alias exegol-run=’docker run –interactive –tty –detach –network host –volume /PATH/TO/Exegol/shared-volume:/share –name exegol nwodtuhs/exegol’
alias exegol-shell=’docker exec -it exegol zsh’
alias exegol-stop=’docker stop exegol && docker rm exegol’

• Then pull : docker pull nwodtuhs/exegol
• Then run the docker and get a shell : exegol-run && exegol-shell
• Stop it when you’re done : exegol-stop

Also Read – Invoker : Penetration Testing Utility

Pre-requisites

Docker is needed here if you want to run Exegol in a docker (intended). You can also use the install.sh in order to deploy Exegol elsewhere but I don’t guarantee it’ll work. (That being said I don’t guarantee anything bro)

Need a quick install of docker & docker-compose? Check this out (intended for kali users but I guess it could work on any other Debian based system)

sudo apt-get install apt-transport-https ca-certificates curl gnupg-agent software-properties-common
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add –
echo ‘deb [arch=amd64] https://download.docker.com/linux/debian buster stable’ | sudo tee /etc/apt/sources.list.d/docker.list
sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io
sudo curl -L “https://github.com/docker/compose/releases/download/1.25.3/docker-compose-$(uname -s)-$(uname -m)” -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose
sudo ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose
sudo curl -L https://raw.githubusercontent.com/docker/compose/1.25.3/contrib/completion/bash/docker-compose -o /etc/bash_completion.d/docker-compose
sudo groupadd docker
sudo usermod -aG docker $USER

Install (from Docker Hub)

It can be long, pull exegol before needing it.

docker pull nwodtuhs/exegol

Install (from GitHub)

The build can be long, build exegol before needing it.

git clone https://github.com/ShutdownRepo/Exegol
cd Exegol
docker build –tag exegol

Usage

I personnaly use these aliases to go fast (very fast)

alias exegol-update=’docker pull nwodtuhs/exegol’
alias exegol-build=’docker build –tag nwodtuhs/exegol /PATH/TO/Exegol/’
alias exegol-run=’docker run –interactive –tty –detach –network host –volume /PATH/TO/Exegol/shared-volume:/share –name exegol nwodtuhs/exegol’
alias exegol-shell=’docker exec -it exegol zsh’
alias exegol-stop=’docker stop exegol && docker rm exegol’

• Update the docker : exegol-update
• Run the docker : exegol-run
• Get a shell when exegol is up and running (it is possible to pop multiple shells) : exegol-shell
• Stop exegol : exegol-stop

Tools

The tools installed in Exegol are mostly installed from sources in order to have the latest version when deploying Exegol. Some of the tools can be found in a complete kali install though. Some installs are made with go, pip, apt, gem etc. The installs are not perfect but hey, it works! You will find most of the tools in /opt/tools. Some of the tools:

• Responder (https://github.com/lgandx/Responder)
• CrackMapExec (https://github.com/mpgn/CrackMapExec)
• lsassy (https://github.com/Hackndo/lsassy)
• sprayhound (https://github.com/Hackndo/sprayhound)
• Impacket (https://github.com/SecureAuthCorp/impacket)
• BloodHound.py (https://github.com/fox-it/BloodHound.py)
• mitm6 (https://github.com/fox-it/mitm6)
• dementor (https://gist.github.com/3xocyte/cfaf8a34f76569a8251bde65fe69dccc)
• aclwpn (https://github.com/fox-it/aclpwn.py)
• icebreaker (https://github.com/DanMcInerney/icebreaker)
• Powershell Empire (https://github.com/BC-SECURITY/Empire)
• DeathStar (https://github.com/byt3bl33d3r/DeathStar)
• AutoRecon (https://github.com/Tib3rius/AutoRecon)
• Sn1per (https://github.com/1N3/Sn1per)
• Sublist3r (https://github.com/aboul3la/Sublist3r)
• ReconDog (https://github.com/s0md3v/ReconDog)
• CloudFail (https://github.com/m0rtem/CloudFail)
• OneForAll (https://github.com/shmilylty/OneForAll)
• EyeWitness (https://github.com/FortyNorthSecurity/EyeWitness)
• wafw00f (https://github.com/EnableSecurity/wafw00f)
• JSParser (https://github.com/nahamsec/JSParser)
• LinkFinder (https://github.com/GerbenJavado/LinkFinder)
• SSRFmap (https://github.com/swisskyrepo/SSRFmap)
• fuxploider (https://github.com/almandin/fuxploider)
• CORScanner (https://github.com/chenjj/CORScanner)
• Blazy (https://github.com/UltimateHackers/Blazy)
• XSStrike (https://github.com/UltimateHackers/Blazy)
• Bolt (https://github.com/s0md3v/Bolt)
• subjack (https://github.com/haccer/subjack)
• assetfinder (https://github.com/tomnomnom/assetfinder)
• subfinder (https://github.com/projectdiscovery/subfinder/cmd/subfinder)
• gobuster (https://github.com/OJ/gobuster)
• amass (https://github.com/OWASP/Amass)
• ffuf (https://github.com/ffuf/ffuf)
• gitrob (https://github.com/michenriksen/gitrob)
• shhgit (https://github.com/eth0izzle/shhgit)
• waybackurls (https://github.com/tomnomnom/waybackurls)
• subzy (https://github.com/lukasikic/subzy)
• findomain (https://github.com/Edu4rdSHL/findomain)
• timing attack (https://github.com/ffleming/timing_attack)
• updog (https://github.com/sc0tfree/updog)
• grc (https://github.com/garabik/grc)
• gron (https://github.com/tomnomnom/gron)
• pwndbg (https://github.com/pwndbg/pwndbg)
• darkarmour (https://github.com/bats3c/darkarmour)
• bat (https://github.com/sharkdp/bat)
• shellerator (https://github.com/ShutdownRepo/shellerator)
• mdcat (https://github.com/lunaryorn/mdcat)
• kadimus (https://github.com/P0cL4bs/Kadimus)
• XSRFProbe (https://github.com/0xInfection/XSRFProbe)
• NoSQLMap (https://github.com/codingo/NoSQLMap)
• krbrelayx (https://github.com/dirkjanm/krbrelayx)
• hakrawler (https://github.com/hakluke/hakrawler)
• JWT tool (https://github.com/ticarpi/jwt_tool)
• JWT cracker (https://github.com/lmammino/jwt-cracker)

Useful Resources

In addition to the many tools pre-installed and configured for some, you will find many useful pre-fetched resources like scripts and binaries in /opt/resources. There some pre-EoP enumeration scripts (EoP: Escalation of Privileges) and other useful binaries like Rubeus or mimikatz.

• LinEnum (https://github.com/rebootuser/LinEnum)
• WinEnum (https://github.com/mattiareggiani/WinEnum)
• Linux Smart Enumeration (https://github.com/diego-treitos/linux-smart-enumeration)
• Linux Exploit Suggester (https://github.com/mzet-/linux-exploit-suggester)
• mimikatz (https://github.com/gentilkiwi/mimikatz)
• linPEAS & winPEAS (https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite)
• pspy (https://github.com/DominicBreuker/pspy)
• sysinternals (https://docs.microsoft.com/en-us/sysinternals/downloads/)
• PowerSploit (https://github.com/PowerShellMafia/PowerSploit)
• PrivescCheck (https://github.com/itm4n/PrivescCheck)
• Inveigh (https://github.com/Kevin-Robertson/Inveigh)
• Rubeus (https://github.com/GhostPack/Rubeus) (pre-compiled binary)