KALI SETUP // weaponize a clean Kali

quick_start

root@kali: ~

what it is

kali-setup automates the setup and upkeep of a Kali pentest box. Instead of configuring every machine by hand, you declare it once (tool lists + scripts): clone, run one command, and get the exact same environment - clean, with every tool up to date.

Instead of remembering by hand what you installed, where and with which package manager, you declare it once in this repo. From there, any Kali becomes identical with one command - and stays that way over time.

clone → setup.sh → ready attacker box. Every week update-all and everything is fresh. Add a tool once, it shows up on every Kali.

the problem

A Kali used in the field degrades fast:

kali-decay.log

✗ PATH polluted by pipx venvs → wrong commands, broken imports
✗ impacket installed 3 times (apt + pip + pipx), duplicate scripts
✗ obsolete tools from old versions (crackmapexec, wfuzz…)
✗ /opt binaries downloaded by hand months ago, never updated
✗ 3 different Kali boxes (VM, laptop, VPS) configured differently
✗ redoing everything from scratch on each reinstall

This repo solves all of these automatically and in a versioned way.

the 3 pillars

🧹 setup.sh

cleans up + configures a Kali (PATH, duplicates, impacket, deps, tools). Once, on a new machine.

🔄 update-all

updates everything (system + tools + the repo itself) in one command. Weekly / pre-engagement.

📦 tools-sync

manages /opt/pentest-tools from declarative manifests. Inside update-all, or by hand.

⚙ philosophy

declarative · idempotent · single source of truth · multi-host · non-destructive by default.

setup.sh --steps

AUDIT - initial state: PATH, pipx, apt pentest tools

FIX PATH - removes venvs from PATH · ~/.local/bin before /usr/bin

PURGE - crackmapexec · dirbuster · zenmap · wfuzz (obsolete apt)

IMPACKET - cleans real scripts · reinstalls via pipx from fortra/impacket

LEGACY - removes old bloodhound pipx

DEPS - libyaml-dev (fixes gem psych)

TOOLS - creates /opt/pentest-tools · installs tools from manifests · scaffolds local lists

ARM - wires update-all into ~/.zshrc (source-based auto-sync)

update-all()

One command. Updates everything. It even updates itself.

#	target	what
1	`kali-setup`	git pull of the config repo itself → multi-host auto-sync
2	`tools-sync`	/opt/pentest-tools from manifests (git + release, shared + local)
3	`apt`	system packages + full-upgrade · recovers kept-back · purges old kernels · reboot notice
4	`pipx`	Python tools (impacket, netexec, bloodyad, dploot, git-dumper)
5	`gem`	Ruby tools (evil-winrm)
6	`npm`	global Node.js tools (from local npm.list)
7	`pip --user`	Python libraries (from local pip.list)
8	`/opt`	manual clones in /opt/pentest-tools/ (not in the manifests)

tool manager /opt/pentest-tools

Declarative management of external tools: you declare what you want in a manifest, tools-sync.sh rebuilds it identically on every Kali. No fragile scans, no copying by hand.

manifest	format	update
`tools/git.list`	name \| git_url	git clone → then git pull
`tools/release.list`	name \| owner/repo \| glob	latest GitHub release (only if the tag changes)

shared

tools/*.list in the repo → commit + push. Propagates to all Kali boxes on the next update-all.

local (this box only)

~/.config/kali-setup/local.*.list. Stays on this machine, outside git.

tools-sync.sh

bin/tools-sync.sh                 # full sync (git + release)
bin/tools-sync.sh --import        # suggests found tools (moves nothing)
bin/tools-sync.sh --dedup         # scattered copies → keep/backup/trash/delete (asks)
bin/tools-sync.sh --prune         # removes undeclared tools (opt-in, asks confirmation)

multi-host sync [strategy B]

   ┌─────────────┐      git push      ┌───────────────────┐
   │   KALI #1   │ ─────────────────▶ │     github.com    │
   │   (edit)    │                    │  SysK69/kali-setup │
   └─────────────┘                    └───────────────────┘
                                               │
                  update-all → git pull        │
         ┌──────────────┬─────────────────────┤
         ▼              ▼                       ▼
    ┌─────────┐    ┌─────────┐            ┌─────────┐
    │ KALI #2 │    │ KALI #3 │    ...     │ KALI #n │
    └─────────┘    └─────────┘            └─────────┘

You edit update-all.zsh on one machine → push → every other Kali receives it on the next update-all. Zero manual copying.

rules_of_engagement

apt

system dependencies, tools with no pipx alternative

pipx

Python CLI tools (impacket, netexec, bloodyad, dploot, git-dumper)

gem

Ruby tools (evil-winrm)

npm install -g

global Node.js tools - --include=optional + --allow-scripts on npm ≥11

/opt/pentest-tools/

manual / git / release tools, managed by tools-sync

canonical PATH

~/.local/bin → ~/.npm-global/bin → /usr/local/bin → /usr/bin
never venvs/*/bin in PATH