Kali Rolling ISO of DOOM, Too.

A while back we introduced the idea of Kali Linux Customisation by demonstrating the Kali Linux ISO of Doom. Our scenario covered the installation of a custom Kali configuration that contained select tools required for a remote vulnerability assessment. The customised Kali ISO would undergo an unattended autoinstall in a remote client site and automatically connect back to our OpenVPN server over TCP port 443. The OpenVPN connection would then bridge the remote and local networks, allowing us full “layer 3” access to the internal network from our remote location. The resulting custom ISO could then be sent to the client who would just pop it into a virtual machine template and the whole setup would happen automagically with no intervention – as depicted in the image below.

When we revisited these instructions, we noticed that there were a few subtle changes required to make this work on Kali Rolling, both due to changes in live-build versions, as well as the preseed configuration. So, here’s an updated recipe to get the Kali Rolling ISO of doom.

Setting Up the OpenVPN Server

Before we begin, we’ll set up the OpenVPN server – which has a public IP address (a.b.c.d). This is also the server on which we will build and generate the custom agent ISO file. On the remote Kali server, create and configure OpenVPN as follows:

Next, we create SSH keys, enable IP forwarding on the VPN server and configure iptables. Once that’s done, we start the OpenVPN server.

Building the Custom Kali Rolling ISO

Now, we create the custom ISO which will autoinstall itself and auto-connect back with the OpenVPN configuration we set it with. Other than starting the installation via the ISO, nothing else will be needed for this agent to connect back to us. We start by installing live-build prerequisites and modifying the default configuration to include only our required packages and configuration files.

Due to a change in how Kali’s setup work, the following patch needs to be applied:

We then define the packages we would like installed in the Agent ISO. In this case, it’s a minimal subset of tools as well as the required SSH and OpenVPN daemons:

Once done, we copy over the OpenSSH and OpenVPN keys and configuration files on to the chroot overlay:

We introduce a new boot option which will process the preseed file, and boot this choice with no user interaction:

And create a couple of hooks to have the SSH and OpenVPN services start at boot time:

Lastly, we include a preseed file which will skip all the common installation questions.

Now that all our ducks are in a row, we generate the agent ISO file. Once the file is ready, we send it over to be installed in the local network we want bridged to us.

Bridging the Network Gaps

Once the VPN connection is established by the client, we can SSH to our internal Kali Linux agent and complete the final requirement: to bridge the remote and local networks together.

On the Server

We enable routing to the remote network on the OpenVPN server:

On the Kali Agent

We proceed to turn on IP forwarding along with IP masquerade on the remote Kali agent:

With this complete, our remote target network is now fully accessible via layer 3 and we can use any tools we have to interact with the remote network.

And lastly, once again, a small tribute to Morbo: