☢️☣️ NOT PROPERLY MAINTAINED ANYMORE. It has become such a pain to properly maintain this repository (every new Kali release very likely breaks some dependencies for at least one of the million listed tools), so a smooth installation process is not guaranteed. Now I treat WeaponizeKali.sh not as an automation script, but as a collection of useful tools (resources) to be installed (looked up) manually. ☣️☢️
WeaponizeKali.sh is a Bash script aimed at automating the process of downloading and installing extra tools for internal penetration tests with Kali Linux.
Basic principles behind this project are:
- Use bleeding-edge versions of offensive toolkits to possess their latest features and fixes.
- When installing 3rd party software, use isolated environments to minimize potential dependency hell.
- Keep Windows exploitation scripts and binaries on hand in case you find yourself in an "offline situation".
The script will create two directories within CWD: tools
and www
. The first one contains all the tools that will be installed on Kali. The second one contains all the scripts and binaries that will be downloaded and may be delivered onto the victim host later.
DISCLAIMER. All information contained in this repository is provided for educational and research purposes only. The owner is not responsible for any illegal use of this tool.
WeaponizeKali.sh heavily relies on Python virtual environments and uses pipx and poetry to orchestra venvs.
In order to launch the bleeding-edge version of a tool installed with pipx and not the version that is already shipped with Kali, you should modify the PATH
variables:
- Modify
PATH
for a normal user with any method you want (.bashrc
/.profile
/.zshrc
/ etc.):export PATH="$HOME/.local/bin:$PATH"
. - Modify
PATH
for the superuser by modifyingsecure_path
within sudoers (sudo visudo
):
Now you can download WeaponizeKali.sh and run it from your home directory (pip may prompt for unlocking the keyring during the process). When it's done, you can check the results in ~/tools
and ~/www
:
<TOKEN>
with it for WeaponizeKali.sh to git clone itself locally in the beginning of the installation process.
~$ cd
~$ bash <(curl -sL https://github.com/snovvcrash/WeaponizeKali.sh/raw/main/WeaponizeKali.sh) -cidtw
~$ ls -la tools www
-i
switch, existing ./tools
and ./www
directories will be deleted.
If you only want to get the deliverable scripts and binaries (i.e., www
directory), you can do it like this:
~$ mkdir www
~$ go install github.com/zyedidia/eget@latest
~$ bash <(curl -sL https://github.com/snovvcrash/WeaponizeKali.sh/raw/main/WeaponizeKali.sh) -w
~$ ls -la www
It's recommended to run WeaponizeKali.sh once on a clean installation of Kali Linux.
To execute WeaponizeKali.sh with full set of arguments again after it has already been ran once, remove the existent virtual environments first and then run the script:
~$ cd
~$ pipx uninstall-all
~$ sudo rm -rf ~/{.local/pipx,tools,www}
~$ ./WeaponizeKali.sh -cidtw
)
( ( ( /( ( )
)\))( ' ( ) ( ( )\()) ) )\ ( ( /(
((_)()\ ) ))\ ( /( ` ) ( ( )\ ( ))\ ((_)\ ( /( ((_))\ ( )\())
_(())\_)() /((_))(_)) /(/( )\ )\ )((_) )\ /((_) _ ((_))(_)) _ ((_) )\ ((_)\
\ \((_)/ /(_)) ((_)_ ((_)_\ ((_) _(_/( (_)((_)(_)) | |/ /((_)_ | | (_) ((_)| |(_
\ \/\/ / / -_)/ _` || '_ \)/ _ \| ' \))| ||_ // -_) | ' < / _` || | | | _ (_-<| ' \
\_/\_/ \___|\__,_|| .__/ \___/|_||_| |_|/__|\___| |_|\_\\__,_||_| |_|(_)/__/|_||_|
|_|
"the more tools you install, the more you are able to PWN"
{ https://github.com/snovvcrash/WeaponizeKali.sh } { vX.Y.Z }
usage: WeaponizeKali.sh [-h] [-i] [-d] [-t] [w]
optional arguments:
-c use Docker when installing tools if possible
-h show this help message and exit
-i initialize filesystem (re-create ./tools and ./www directories)
-d resolve dependencies
-t download and install tools on Kali Linux
-w download scripts and binaries for delivering onto the victim host
Install the laster version of Evil-WinRM using rbenv
:
~$ zsh <(curl -sSL https://github.com/snovvcrash/WeaponizeKali.sh/raw/main/sh/evil-winrm.sh)
Create armored .ps1
scripts containing all the PowerShell tools you want with PowerShellArmoury:
PS > git clone https://github.com/cfalta/PowerShellArmoury
PS > cd PowerShellArmoury
PS > curl https://github.com/snovvcrash/WeaponizeKali.sh/raw/main/conf/PSArmoury.json -o PSArmoury.json
PS > . .\New-PSArmoury.ps1
PS > New-PSArmoury -ValidateOnly -Config PSArmoury.json
PS > New-PSArmoury -Path armored.ps1 -Config PSArmoury.json
PS > cat -raw .\armored.ps1 | iex
Get a random name of a .exe
or .dll
binary:
~$ EXE="`curl -sL https://github.com/snovvcrash/WeaponizeKali.sh/raw/main/misc/binaries.txt | shuf -n1`.exe"
~$ DLL="`curl -sL https://github.com/snovvcrash/WeaponizeKali.sh/raw/main/misc/system32-dlls.txt | shuf -n1`.dll"
- APIHashReplace
- AutoBlue-MS17-010
- Amsi-Bypass-Powershell
- BloodHound · FORK
- BloodHound.py
- CVE-2019-1040-scanner
- CVE-2020-1472-checker
- CVE-2021-1675 (MS-RPRN) · CVE-2021-1675 (MS-PAR) · CVE-2021-1675 · SharpPrintNightmare
- Certipy
- Coercer
- Covenant · Stageless_Covenant_HTTP.cs
- CrackMapExec
- DFSCoerce
- DLLsForHackers
- DivideAndScan
- DonPAPI
- Ebowla
- Empire
- GetFGPP
- InvisibilityCloak
- ItWasAllADream
- LDAPPER
- LDAPmonitor
- LdapRelayScan
- LightMe
- MS17-010
- MANSPIDER
- Masky
- Max
- MeterPwrShell
- Neo-reGeorg
- Nim · choosenim
- Nimcrypt2
- Obsidian
- PCredz
- PEzor
- PKINITtools
- PetitPotam
- PetitPotam-Ext
- Physmem2profit
- PoshC2
- PrivExchange
- Responder
- RustScan
- SCShell
- ScareCrow
- ShadowCoerce
- SharpGen
- ShellPop
- Shhhloader
- SilentHound
- Sliver
- TrustVisualizer
- Villain
- WebclientServiceScanner
- Windows-Exploit-Suggester
- ZeroTier
- aced
- ack3
- aclpwn.py
- adidnsdump
- aquatone
- arsenal
- bettercap
- bloodhound-import
- bloodhound-quickwin
- bloodyAD
- certi
- chisel · SharpChisel · EXE
- cliws
- crowbar
- cypherhound
- dementor.py
- dnsx
- donut
- dsniff
- eavesarp
- enum4linux-ng
- evil-winrm
- feroxbuster
- ffuf
- gMSADumper
- gateway-finder-imp
- go-windapsearch
- gobuster
- goshs
- hashcat-utils
- hoaxshell
- http-server
- httpx
- impacket · impacket-ThePorgs
- iCULeak.py
- ipmitool
- kerbrute
- krbrelayx
- ldap_shell
- ldapdomaindump
- ldapnomnom
- ldapsearch-ad
- ldeep
- ligolo-proxy
- lsassy
- mapcidr
- masscan
- mitm6
- mscache
- nac_bypass
- nextnet
- nishang
- noPac
- ntlm-scanner
- ntlm_challenger
- ntlm_theft
- ntlmv1-multi
- nullinux
- odat
- orpheus
- paperify
- payloadGenerator
- powerview.py
- pretender
- pywsus
- pyGPOAbuse
- pyKerbrute
- pypykatz
- pywerview
- pywhisker
- rbcd-attack
- rbcd_permissions
- rdp-tunnel
- ritm
- rtfm
- sRDI
- seclists
- sgn
- shrunner
- smartbrute
- snmpwn
- spraykatz
- ssb
- sshspray
- sshuttle
- targetedKerberoast
- ticket_converter
- traitor
- transfer.sh
- updog
- vnum
- webpage2html
- wesng
- windapsearch
- wmiexec-RegOut
- xc
- yersina
- ADRecon.ps1
- ADSearch · EXE
- ASREPRoast.ps1
- AccessChk (Sysinternals) · AccessChk (accepteula)
- Certify · EXE
- DDexec
- DefenderStop
- Discover-PSMSExchangeServers
- Discover-PSMSSQLServers
- Divert
- DomainPasswordSpray.ps1
- Get-RdpLogonEvent.ps1
- Grouper2
- HandleKatz · PS1
- HiveNightmare · ShadowSteal · EXE
- Intercept-NG
- Inveigh · PS1 · EXE
- Invoke-ACLPwn.ps1
- Invoke-ConPtyShell.ps1
- Invoke-ImpersonateUser-PTH.ps1
- Invoke-PSInject.ps1
- Invoke-Portscan.ps1
- Invoke-RunasCs.ps1
- Invoke-SMBClient.ps1
- Invoke-SMBEnum.ps1
- Invoke-SMBExec.ps1
- Invoke-WMIExec.ps1
- Invoke-noPac.ps1
- JAWS
- JuicyPotato64 · JuicyPotato32
- JuicyPotatoNG
- KSC-Console
- KeeThief
- KrbRelay · EXE
- KrbRelayUp · EXE
- LaZagne
- OffensivePythonPipeline
- PEASS
- PSTools
- PingCastle
- PowerShellArmoury · PSArmoury.json
- PowerUp.ps1
- PowerUpSQL.ps1
- PowerView2.ps1
- PowerView3.ps1 (New-GPOImmediateTask)
- PowerView3.ps1
- PowerView4.ps1 (by @exploitph)
- Powermad.ps1
- PrivescCheck.ps1
- PrintSpoofer
- PwnKit
- Python 2.7.18
- Pyramid
- RawCopy
- RemotePotato0
- RoguePotato
- Rubeus · EXE
- SandboxDefender
- Seatbelt · EXE
- SessionGopher.ps1
- SharpChrome · EXE
- SharpDPAPI · EXE
- SharpGPOAbuse · EXE
- SharpHandler · EXE
- SharpHound
- SharpLAPS
- SharpNamedPipePTH · EXE
- SharpRDP · EXE
- SharpRelay
- SharpSecDump · EXE
- SharpStrike
- SharpView · EXE
- SharpWMI · EXE
- SharpWebServer
- Sherlock.ps1
- Snaffler
- SpoolSample · EXE
- StandIn · EXE
- WerTrigger
- WinPwn · PowerSharpPack · Creds
- Wireshark
- arpfox
- exfiltrate
- les.sh
- lse.sh
- mimikatz
- netcat for Windows
- pamspy
- plink
- powercat.ps1
- pspy
- rdp-tunnel · rdp2tcp.exe
- revsocks
- static-binaries
- suid3num.py