\n\nThis page has been machine-translated from the original page.
\n
I study programming and security as a hobby.
\nLately, I’ve been spending a lot of time on penetration-testing learning platforms like “Hack The Box” and “Try Hack Me”, as well as on CTFs.
\nThis time, I decided to rebuild the ParrotOS environment I usually use for “Hack The Box” and CTFs, so I wrote this article to summarize the setup steps as a personal memo.
\nThis article covers the following.
\nThis article is not intended to encourage acts that go against public order.
\nPlease note that attempting attacks against environments you do not own or are not authorized to access may violate laws that prohibit unauthorized computer access.
\nAlso, everything written here reflects my personal views, not those of any organization I belong to.
\n\nIt is a Debian-based Linux distribution developed by Parrot Security.
\nIt is a distribution for pentesting and reverse engineering, and it is very similar to Kali Linux.
\nA variety of penetration-testing tools are included by default.
\nParrotOS is also developed in collaboration with Hack The Box.
\nReference: HTB News | Hack The Box + Parrot OS
\nI’ve been using Parrot for just under a year, and the hassle of upgrading feels about 100 times lower than on Kali.\n(It doesn’t leave the OS unbootable.)
\nYou could say that this one point alone—fewer troubles and less work during upgrades—is why I use Parrot.
\nI also think it has a beautiful UI and is simply fun to use.
\nBecause the window control buttons are on the upper left, Mac users may find Parrot easier to use.
\nI’m a die-hard Windows user, but Parrot still feels very comfortable to use, so I recommend it.
\nSeveral other popups will appear as well, but just choose whatever fits your environment.
\nNext, configure the network.
\nIn my environment, I set up two NICs on Parrot: one for external connections and one for the internal environment.
\nIt is convenient to leave the external connection network on DHCP instead of using a fixed IP, and to assign a static IP to the internal network used for RDP from the host. That way, even if the host’s network environment changes, I can keep using it the same way.
\nYou can easily configure each NIC by using [Advanced Network Configuration].
\nOnce the network IP is fixed, set up RDP so you can comfortably operate the virtual machine from Windows.
\nFirst, install the required packages.
\nsudo apt install -y xrdp\nsudo systemctl enable xrdp\nsudo systemctl start xrdpWhen you use XRDP, nobody should already be logged into the virtual machine.
\nSo reboot or log off the virtual machine once, and then connect over RDP.
\nInstall the packages I personally use often ahead of time.
\nI will not explain the details of each package here.
\nsudo apt install \\\n vim \\\n make \\\n git \\\n python3.9 \\\n python3-pip \\\n python3.9-dev \\\n unzip \\\n zip \\\n build-essential \\\n gdb \\\n radare2 \\\n ltrace \\\n strace \\\n xdotool \\\n pngcheck \\\n xdotool \\\n fcitx-mozc \\\n tweak \\\n feroxbuster \\\n openvpn \\\n bloodhound \\\n neo4j \\\n cmake \\\n -yNext, make Parrot support Japanese input.
\nFirst, install this.
\nsudo apt install fcitx-mozcNext, open [Fcitx Configuration] from [System] > [Preferences] > [Other].
\nHere, after adding Mozc under [Input Method], set [Trigger Input Method] to [Zenkakuhankaku] on the [Global Config] tab.
\nBy default, right-click the menu bar at the bottom and click [Properties] to open the settings window. Here, changing the [Orientation] item will change the menu bar position. I usually set it to the left. The update confirmation window popping up on every startup is annoying, so I disable automatic updates. Open [Synaptic Package Manager] from [System] at the top. Now no popup will appear when the system starts. Click the clock in the upper right to open [Location], then click [Edit]. Add Japan under [Locations]. Next, click the [Set …] button next to [Tokyo] to change the time zone. This applies the time setting. In Parrot, the default terminal is MATE. This is a matter of preference, but I tweak these settings a little. Open the settings list from [Edit] > [Profiles] in the terminal, and edit the profile there. For now, I changed the color scheme to System theme and adjusted the background transparency as well. You can also change shortcut assignments from [Keyboard Shortcuts]. I edit them to suit my taste. By default, the shortcut for launching the terminal is different from Ubuntu and a bit awkward to use, so I open [Keyboard Shortcuts] and add a shortcut for [terminal]. Register the public key created by For details, see Connecting to GitHub with SSH - GitHub Docs. Open [Power Management Preferences] and disable automatic sleep for the display. By default, it is set to 30 minutes. Here is a summary of the tools I personally install. It is not a problem if you skip them. I will update the list of tools as needed. Download the deb package from Google Chrome - Download the Fast, Secure Browser from Google. You can install Chrome with the Download the deb package from Visual Studio Code - Code Editor | Microsoft Azure. You can install it with the Install whatever extensions you like. I think it is a good idea to disable the Symlinks setting, because it helps prevent CPU resources from being consumed at odd times. There are also several other settings that can affect computer resource usage, such as You can install it in almost the same way as on Ubuntu. Refer to Install Docker Engine on Ubuntu | Docker Documentation. However, the command for obtaining the release version does not work correctly on Parrot, so this time I specify After Docker is installed, run the following commands so that you can use it without That completes the setup. I will describe the Docker images and commands I use often later. Place the extracted files in an appropriate directory. Next, add it to The familiar powerhouse tool. These days, everyone seems to use Ghidra in Rev write-ups. Download and extract Ghidra from Ghidra. Place the extracted files in a suitable folder. To be able to launch it from anywhere, I think it is a good idea to add the folder containing By the way, with Ghidra there are cases where you may want to use the debugger feature, which has not yet been implemented in the major release version. In that case, build it yourself from the source code on Ghidra’s Debugger branch. I will explain how to build it later, so please refer to that if you want to try it. This is something I occasionally use when doing Misc or Rev challenges. Create a virtual environment in an appropriate directory. A god-tier tool for Rev challenges. I wrote about how to use it in quite some detail in A summary of solving Rev challenges with symbolic execution using angr [WaniCTF2021]. Create a virtual environment in an appropriate directory. This library is like an all-you-can-use set of tools for CTFs. It does not conflict much with other things, so I install it globally. A Python library that lets you use cryptographic functions. This can be used without conflicting with other packages, so I just install it globally. It can crack encrypted text pretty nicely. Create a virtual environment in an appropriate directory. A tool that is useful when you run into challenges involving weak RSA. Because the dependencies are complicated, I basically build it in Docker. Building the container image takes quite a while. It is a hassle to rebuild it every time I set up my environment, so I uploaded it to Docker Hub as my own image. You can pull it like this. Since running the full command every time is also annoying, I register an alias too. I only found out about it recently, so I do not use it much yet, but it is a great tool for hitting APIs. Extract the files downloaded from Download Postman | Try Postman for Free. Once extracted, you can use it. Add it to I sometimes use it for steganography. It is installed by default. A clipboard management tool. Being able to bring up the recent clipboard history with Install it with apt. By the way, after rebooting, it will not work unless you launch CopyQ each time. There probably is a setting for automatic startup, but I could not be bothered to look for it, so I configured it to launch every time from my profile. Download the Linux package from Eclipse downloads - Select a mirror | The Eclipse Foundation. Once extracted, you can use it. Add it to Install Wine and MinGW. I do not really want to use Wine much, so this is only for light verification. For PE binary analysis and similar work, I prepare a separate Windows machine. Clone GDB-PEDA directly under the Tools directory and configure it. Handy when doing heap challenges. Reference: GitHub - pwndbg/pwndbg: Exploit Development and Reverse Engineering with GDB Made Easy Download the deb package from Releases · RustScan/RustScan · GitHub. You can install it with the Something that makes file searching easier. Gobuster is available by default. If you want Feroxbuster, I think it is worth installing. You can download the deb package like this. Install it with the While you are at it, unpack Used for hacking Windows machines. Reference: byt3bl33d3r/CrackMapExec: A swiss army knife for pentesting networks Because it has many dependencies, I build the environment as a Docker image. It is a hassle to build it every time I set up my environment, so I uploaded it to Docker Hub as my own image. You can pull it like this. To make it easier to use, add an alias as well. A handy shell for remotely connecting to Windows machines. Reference: Hackplayers/evil-winrm: The ultimate WinRM shell for hacking/pentesting For peace of mind, I build it from its Dockerfile. You can pull it like this. To make it easier to use, add an alias as well. Windows-Exploit-Suggester is a useful tool for investigating Windows vulnerabilities. I use a container image created with reference to the repository below. Reference: gr33nm0nk2802/Windows-Exploit-Suggester Set an alias for it as well. The free edition of BurpSuite is installed by default. Once Chrome is installed, I barely use Firefox, so if you set proxy settings there and make it a browser dedicated to Burp, you do not have to keep changing the settings over and over. This is a tool for visualizing source code that was recently open-sourced. Download it from Releases · CoatiSoftware/Sourcetrail · GitHub. Move into the extracted directory and run YARA. I do not use YARA much in CTFs, but I personally like it and even contribute to it, so I always install it. The version you can install with apt is a little old, so I build it from source. You can download the latest source code from Releases · VirusTotal/yara · GitHub. By this point, all prerequisite packages have already been installed, so you can just run the following commands. If you leave it like this, YARA will not start because it cannot find the library, so add the library path to Now the latest build of YARA is installed. Sometimes you want to compile, analyze, or run executables for ARM. For example, when the challenge file is an ARM binary. So let’s build that environment. Next, install the tools for cross-compilation. I used How to cross-compile C/C++ source code for ARM/ARM64 on x86_64 Ubuntu and run it with QEMU - Qiita as a reference. When HackTheBox and the like occasionally throw you an AWS challenge, sometimes you want the CLI. This is a tool you can use when attacking machines with SMB packets and the like. Because you need Python 2’s pip and cannot install it directly on Parrot, I use Docker. A binary editor. I also use VSCode’s binary editor extension and hexeditor, but Tweak’s strength is that it can add and delete binary data. I only keep the minimum commands here because I often forget them. I use it to inspect PNGs. It is useful when you want information about PNG chunks and the like. For how to use it, see the README. Reference: Hedroed/png-parser: Analyse PNG file format for CTF, python API and CLI Used for forensics. For usage, see CiscoCXSecurity/creddump7. It parses input values from a USB pcap. Download it from the repository below. A tool like Cheat Engine for Linux. You can use it on Parrot and Kali as well. Reference: korcankaraokcu/PINCE: A reverse engineering tool that’ll supply the place of Cheat Engine for linux The command to run it is A WASM decompiler. It can decompile WASM source code. Reference: wabt/decompiler.md at main · WebAssembly/wabt Build it following the steps in the README of the repository above. I think it is a good idea to add it to Once it is built, you can decompile WASM with the following command. A powerful hex editor. My environment had 8 GB of RAM, but the virtual machine hung when I ran Background reading: ImHex: A binary editor for people doing their best at 3 AM - setodaNote I use it when opening KDBX files and the like. These are the images I use often in my Docker environment. When I use them in my own environment, I build the images from slightly customized Dockerfiles. The image I use especially often is the one where Python 2.7’s pip works, because I frequently use it to run exploit code that only works on Python 2. If you pass That means you can run exploit code from a container through the VPN connection established on the host. The debugger functionality is already included in current release versions, so building the development branch is no longer necessary. According to the official repository, building Ghidra requires the following applications. By the steps up to this point, everything except Gradle has already been set up, so first install Gradle. Next, clone Ghidra’s The first build takes quite a while. By the way, when I was writing this article, following the steps in the documentation above produced the following error and the build failed. When that happens, do not panic; search Ghidra’s issue tracker with the error message. In most cases, a solution for a similar problem has already been posted. This time, the build was failing on When the build succeeds, a file named After that, as before, replace the directory you put on your PATH with the extracted directory, and the development build you created will launch with In the Debugger build, a bug icon is added next to the usual dragon icon. After it starts, load the executable you want to analyze from [File] in the upper right. Right-click an appropriate location and select [Toggle Breakpoint], and it will be added to the Breakpoint window on the right. When you want to run the debugger, just choose and launch the debugger you want to use from [Debugger].Change the Menu Bar Position
\nDisable the Automatic Update Window
\nChange the Time Zone
\nAdjust the Terminal Settings
\nChange the OS Shortcut Keys
\nRegister an SSH Key with GitHub
\nssh-keygen with GitHub.Disable Automatic Sleep
\nInstall Various Tools
\nGoogle Chrome
\nsudo dpkg -i xxx.deb command.VSCode
\nsudo dpkg -i xxx.deb command.files.watcherExclude and the memory limit, so tune them as needed.Docker
\nfocal explicitly.echo \"deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu focal stable\" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/nullsudo.sudo gpasswd -a $USER docker\nsudo service docker start --enableJDK
\nPATH.sudo mv jdk-11.0.11+9 /usr/local/lib/jdk-11.0.11+9\necho \"PATH=$PATH:/usr/local/lib/jdk-11.0.11+9/bin\" >> ~/.bashrcGhidra
\nghidraRun to PATH.echo \"PATH=$PATH:/home/parrot/Tools/Ghidra/\" >> ~/.bashrcUniversal Radio Hacker (URH)
\npipenv install\npipenv shell\npip install urhangr
\npipenv install\npipenv shell\npip install angrpwntools
\npip install pwntoolsPyCryptodome
\npip install pycryptodomeCiphey
\npipenv install\npipenv shell\npython3 -m pip install ciphey --upgradeRSACTFTool
\nFROM alpine:3.13\nRUN apk update && \\\n apk add --no-cache \\ \n gmp-dev mpfr-dev mpc1-dev python3 python3-dev py3-pip gcc musl-dev openssl-dev libffi-dev py3-wheel git gcc g++ make cmake git\nWORKDIR /opt\nRUN git clone https://github.com/Ganapati/RsaCtfTool.git\nWORKDIR /opt/RsaCtfTool\nRUN pip install -r \"requirements.txt\"\nWORKDIR /data\nENTRYPOINT [\"/opt/RsaCtfTool/RsaCtfTool.py\"]docker pull kashiwabayuki/rsactftool:1.0alias rsactftool='docker run --rm -it -v $PWD:/data kashiwabayuki/rsactftool:1.0'Postman
\nPATH as well.echo \"PATH=$PATH:/home/parrot/Tools/Postman\" >> ~/.bashrcGIMP
\nCopyQ
\nCtrl + ; and similar shortcuts turns out to be surprisingly useful.sudo apt install copyq -yEclipse
\nPATH as well.echo \"PATH=$PATH:/home/parrot/Tools/eclipse\" >> ~/.bashrcWine
\nsudo apt install wine mingw-w64 mingw-w64-common mingw-w64-i686-dev mingw-w64-tools mingw-w64-x86-64-dev -yGDB-PEDA
\ngit clone https://github.com/longld/peda.git ~/Tools/peda\necho \"source ~/Tools/peda/peda.py\" >> ~/.gdbinitPwndbg
\nRustScan
\nsudo dpkg -i xxx.deb command.FZF
\ngit clone --depth 1 https://github.com/junegunn/fzf.git ~/Tools/.fzf\n~/Tools/.fzf/installGobuster/Feroxbuster
\nwget https://github.com/epi052/feroxbuster/releases/latest/download/feroxbuster_amd64.deb.zip\nunzip feroxbuster_amd64.deb.zipsudo dpkg -i xxx.deb command.rockyou.txt in advance too.sudo gunzip /usr/share/wordlists/rockyou.txt.gzCrackMapExec
\ngit clone https://github.com/byt3bl33d3r/CrackMapExec.git\ncd CrackMapExec/\ndocker build -t crackmapexec .docker pull kashiwabayuki/crackmapexec:1.0alias crackmapexec='docker run --rm -it -v $PWD:/usr/src/crackmapexec kashiwabayuki/crackmapexec:1.0'Evil-WinRM
\n# Evil-WinRM Dockerfile\n\n# Base image\nFROM ruby:latest\n\n# Credits & Data\nLABEL \\\n name=\"Evil-WinRM\" \\\n author=\"CyberVaca <cybervaca@gmail.com>\" \\\n maintainer=\"OscarAkaElvis <oscar.alfonso.diaz@gmail.com>\" \\\n description=\"The ultimate WinRM shell for hacking/pentesting\"\n\n#Env vars\nENV EVILWINRM_URL=\"https://github.com/Hackplayers/evil-winrm.git\"\n\n# Install dependencies\nRUN gem install \\\n winrm \\\n winrm-fs \\\n stringio \\\n logger \\\n fileutils\n\n# Create volume for powershell scripts\nRUN mkdir /ps1_scripts\nVOLUME /ps1_scripts\n\n# Create volume for executable files\nRUN mkdir /exe_files\nVOLUME /exe_files\n\n# Create volume for data (upload/download)\nRUN mkdir /data\nVOLUME /data\n\n# Set workdir\nWORKDIR /opt/\n\n#Evil-WinRM install method 1 (only one method can be used, other must be commented)\n#Install Evil-WinRM (Docker Hub automated build process)\nRUN mkdir evil-winrm\nCOPY . /opt/evil-winrm\n\n#Evil-WinRM install method 2 (only one method can be used, other must be commented)\n#Install Evil-WinRM (manual image build)\n#Uncomment git clone line and one of the ENV vars to select branch (master->latest, dev->beta)\n#ENV BRANCH=\"master\"\n#ENV BRANCH=\"dev\"\n#RUN git clone -b ${BRANCH} ${EVILWINRM_URL}\n\n# Make script file executable\nRUN chmod +x evil-winrm/*.rb\n\n# Clean and remove useless files\nRUN rm -rf /opt/evil-winrm/resources > /dev/null 2>&1 && \\\n rm -rf /opt/evil-winrm/.github > /dev/null 2>&1 && \\\n rm -rf /opt/evil-winrm/CONTRIBUTING.md > /dev/null 2>&1 && \\\n rm -rf /opt/evil-winrm/CODE_OF_CONDUCT.md > /dev/null 2>&1 && \\\n rm -rf /opt/evil-winrm/Dockerfile > /dev/null 2>&1 && \\\n rm -rf /opt/evil-winrm/Gemfile* > /dev/null 2>&1 && \\\n rm -rf /tmp/* > /dev/null 2>&1\n\n# Start command (launching Evil-WinRM)\nENTRYPOINT [\"/opt/evil-winrm/evil-winrm.rb\"]docker pull kashiwabayuki/evil-winrm:1.0alias evil-winrm='docker run --rm -it -v $PWD:/data kashiwabayuki/evil-winrm:1.0'Windows-Exploit-Suggester
\nkashiwabayuki/windows-exploit-suggester:1.0alias windows-exploit-suggester='docker run --rm -it -v $PWD:/exploit-suggester kashiwabayuki/windows-exploit-suggester:1.0'BurpSuite
\nSourceTrail
\nsudo ./install.sh to complete the installation.YARA
\n./bootstrap.sh\n./configure\nmake\nsudo make install/etc/ld.so.conf.sudo echo \"/usr/local/lib\" >> /etc/ld.so.conf\nsudo ldconfig$ yara -v\n4.1.0QEMU and Cross-Compilation Environment
\nsudo apt install qemu-user-binfmt qemu-efi qemu-efi-aarch64 qemu-efi-arm qemu-system qemu-system-arm qemu-system-common qemu-system-x86 qemu-system-misc qemu-utils -ysudo apt install g++-arm-linux-gnueabihfAWS CLI
\ncurl \"https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip\" -o \"awscliv2.zip\"\nunzip awscliv2.zip\nsudo ./aws/installImpacket
\ngit clone https://github.com/SecureAuthCorp/impacket\ncd impacket\ndocker build -t impacket .Tweak
\nsudo apt install tweak^X^I : Insert\n^X^S : Save\n^X^C : Exitpngcheck
\nsudo apt install pngcheck -ypng-parser
\npip install --user git+https://github.com/Hedroed/png-parsercreddump
\nUSB keyboard parser
\nPINCE
\ncd ~/Tools\ngit clone --recursive https://github.com/korcankaraokcu/PINCE\ncd PINCE\nsudo sh install_pince.shsh PINCE.sh, but that is a hassle, so I create an alias.wabt
\nPATH../wasm-decompile file.wasm -o out.wasmImHex
\nmake -j.git clone https://github.com/WerWolv/ImHex.git\n\ncd ImHex\nsudo ./dist/get_deps_debian.sh\n\nmkdir build\ncd build\n\ncmake ..\nmake -jKeePassX
\nsudo apt install keepassx -yBuild Docker Environments
\n\n
\n## Python2\n```\ndocker build -t python2 .\ndocker run --rm -it -v $PWD:/app python2 bash\ndocker run --net host --rm -it -v $PWD:/app python2 bash\n```\n\n## Ubuntu16\n```\ndocker build -t ubuntu16 .\ndocker run --rm -it -v $PWD:/app ubuntu16 bash\ndocker run --rm --cap-add=SYS_PTRACE --security-opt=\"seccomp=unconfined\" -it -v $PWD:/app ubuntu16 bash\n```\n\n## PHP\n```bash\ndocker build -t php .\ndocker run --rm -it -v $PWD:/root php bash\n```\n\n## node\n```\ndocker pull node\ndocker run --rm -it -v $PWD:/root node bash\n```\n\n## Impacket\n```\ngit clone https://github.com/SecureAuthCorp/impacket\ncd impacket\ndocker build -t impacket .\ndocker run --net host --rm -it -v $PWD:/root impacket bash\n```\n\n## RSACTFTool\n``` bash\ndocker run --rm -it -v $PWD:/data rsactftool --publickey ./key.pub\n```--net host to Docker’s run command, the container can use the host’s network.Build Ghidra’s Debugger Branch
\n\n
\nunzip gradle-7.0.2-all.zip\nsudo mv gradle-7.0.2 /opt/gradle\necho \"PATH=$PATH:/opt/gradle/bin\" >> ~/.bashrcdebugger branch and build it with Gradle.git clone -b debugger https://github.com/NationalSecurityAgency/ghidra.git\ncd ghidra\ngradle -I gradle/support/fetchDependencies.gradle init\ngradle buildGhidra> Task :Graph:ip FAILED\nFAILURE: Build failed with an exceptionTask :GraphServices:ip, so I followed the advice in the issue and ran the following command, and the build succeeded.gradle buildGhidra -x ipghidra/build/dist/ghidra_10.0_DEV_20210523_linux64.zip is created.ghidraRun.mv ghidra_10.0_DEV ~/Tools/Ghidra