kali-ctf-machine-setup

This repo contains Ansible playbooks to install extra tools on top of Kali Linux for CTF (Capture The Flag) and pentest activities.

These tools are useful when playing CTF in platforms such as Hack The Box, TryHackMe, etc.

Howto?

0. Setup Kali Linux

It is assummed that you have a plain vanilla installation of Kali Linux. This README is tailored for Kali virtual machine images

1. Upgrade packages

This step is optional as the ansible playbook takes care of this. But it is highly recommended you upgrade all the installed packges at this stage to avoid issues later.

sudo apt update
sudo apt full-upgrade -y

2. Install git and ansible-core

sudo apt update
sudo apt install git ansible-core -y

# install the additional ansible collections (do not use `sudo` here)
ansible-galaxy collection install ansible.posix \
  community.general \
  community.docker \
  community.crypto

3. Clone this repo

git clone https://github.com/fazlearefin/kali-ctf-machine-setup.git
cd kali-ctf-machine-setup

4. Run the ansible playbook to install the extra tools

Enter the password for the user (kali) when asked for a password (your user ID might be different if it is a custom installation).

Run one of the commands below depending on whether you want the vulnerable docker images to be pulled or not.

Install WITHOUT docker vulnerable images

ansible-playbook -vv -i localhost, -e "{ setup_vuln_docker_images: false }" -e "local_username=$(id -un)" -K main.yml

Install WITH docker vulnerable images

ansible-playbook -vv -i localhost, -e "{ setup_vuln_docker_images: true }" -e "local_username=$(id -un)" -K main.yml

5. Further customizations (optional)

Further customizations to the installation can be done by running the command below:

kali-tweaks

---

Bundled docker vulnerable images

Docker vulnerable images are docker containers to running deliverately vulnerable services. The following vulnerable images are installed so that you can practice within your own Kali installation:

• OWASP Juice Shop
• OWASP WebGoat

Running the vulnerable docker images

OWASP Juice Shop

docker run --rm -d -p 3000:3000 --name juice-shop bkimminich/juice-shop
# use web browser to go to http://localhost:3000 in Kali host

OWASP WebGoat

docker run --rm -it -p 127.0.0.1:8080:8080 -p 127.0.0.1:9090:9090 -e TZ=UTC --name webgoat webgoat/webgoat
# use web browsser to go to http://127.0.0.1:8080/WebGoat in Kali host

DVWA (Damn Vulenerable Web Application)

sudo systemctl start dvwa
# navigate to http://localhost:42001
# default creds are admin:password
# Security Level can be changed in `/etc/dvwa/config/config.inc.php`

---

Additional Git Repos

Additional git repos cloned locally at these locations:

• /opt/GitTools: A repository with 3 tools for pwn'ing websites with .git repositories available
• /opt/zphisher: An automated phishing tool with 30+ templates
• /opt/vulhub: Pre-Built Vulnerable Environments Based on Docker-Compose
• /opt/privesc-scripts/LinEnum: Scripted Local Linux Enumeration & Privilege Escalation Checks
• /opt/privesc-scripts/linux-exploit-suggester: Linux privilege escalation auditing tool
• /opt/privesc-scripts/linux-smart-enumeration: Linux enumeration tool for pentesting and CTFs with verbosity levels Topics
• /opt/privesc-scripts/PEASS-ng: PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)
• /opt/WEF: Wi-Fi Exploitation Framework

---

Kali Linux Useful Links

• Kali Tools
• Kali Linux Metapackages
• Kali's Default Credentials

Other Useful Links

• HackTricks ⭐
• HackTricks Cloud ⭐
• OWASP Cheat Sheet Series
• OWASP Web Security Testing Guide
• Payloads All The Things
• GTFOBins
• CyberChef - Encode/decode data
• CrackStation - Hash Rainbow List
• Reverse Shell Generator
• CI/CD Goat
• h4cker
• PortSwigger Web Security Academy
• Recommended WiFi Adapters for Kali Linux

---

Donations

If you think my work helped you in some way saving you time and effort, I am happy to receive any amount of donation. However, the code in this repo is completely free.

Bitcoin (BTC): bc1qzlhpm94vtk2ht67etdutzcy2g5an5v6g36tp0m