Configure Your Environment

In my last post on Reverse Shell Methods, I discussed the shell a lot.  As a penetration tester, I spend the majority of my actual “work” time in a shell.  I leverage Windows, OSX, and Linux about evenly throughout the day, so I’ve tried to customize my environment in all three, though I have had substantially more success tweaking OSX and Linux to my liking.  Today, I want to discuss the way I’ve configured my OSX, Kali, and Metasploit prompts to give me the information I need when I need it – for example, when I am writing a penetration test report. Besides, it’s always a good idea to keep track of what I’m doing and when I’m doing it!  Always CYA!

OSX and Kali

These two Operating Systems rely on the BASH (Bourne-Again SHell), though they are two different versions.  (OSX 10.8.5 uses version 3.2.48 while Kali uses 4.2.37).  Editing the configuration file for each of these environments is largely similar, though on OSX I’ve edited the ~/.bash_profile file, while the same configuration in Kali is made to the ~/.bashrc file.  See Cos’s explanation at StackOverflow of when to use ~/.bashrc versus ~/.bash_profile.

Set Vi Mode This changes the mode of the terminal from Emacs to Vi.

(See this article for a brief comparison of the two)

#!bash
#Changes from Emacs mode to Vi mode. 
set -o vi

Update Window Size and Line Wrappings

This checks the window size after each command and, if necessary, updates the value of $LINES and $COLUMNS which are used by the terminal to output characters to coordinates on the screen.

#!bash
shopt -s checkwinsize

Aliases

Aliases will assign a command to a string of characters, which is useful for shortening a command, or re-mapping a command to a memorable string. I’ve created a number of aliases that make my day-to-day life easier:

#!bash
#Aliases 
#Default "list" replacement.  List long, all files, sort by time 
#OSX 
alias ll="ls -talF" 
#Kali 
alias ll="ls -alhF"

#Screen aliases 
#List screens 
alias sl="screen -list"
#Detach/Reattach to a screen 
alias sdr="screen -dr"

#list groups 
alias groupl="cut -d: -f1 /etc/group"

#Kali - Netstat Numeric 
alias nsn="netstat -antp"

Customized Terminal Prompt

I get teased a lot at work about the amount of information I have in my prompt, but it has come in handy on more than one occasion.  I spent a long while poring over the information a Bash Prompt Customization Google search revealed.  

The following is mine:

#!bash
#OSX export PS1="[$(tput bold)][$(tput setaf 161)]D{%Y-%m-%d} [$(tput setaf 126)] t [$(tput setaf 103)] ! [$(tput setaf 60)] u@h [$(tput setaf 250)]n w $ [$(tput sgr0)]"

#Kali - I like this one more because I can list the IP of all interfaces on the prompt with hostname -I. 
#This is something I have not been able to replicate on OSX. 
ip=$(hostname -I) 
export PS1="[$(tput bold)][$(tput setaf 161)] D{%Y-%m-%d} [$(tput setaf 126)] t [$(tput setaf 103)] ! [$(tput setaf 60)] u@$ip [$(tput setaf 250)]n w $ [$(tput sgr0)]"

My Kali prompt looks like this as a result:

customized kali prompt with date, command number, IP, user, and host

Terminal Activity Logging

I use the script utility to log all terminal command activity.  This, combined with a prompt that includes my IP and a timestamp, supports my activity and can prevent a lot of unpleasantness if my activities are called into question.

#!bash
script ~/assessment/notes/<date>.txt

If I’m using multiple tabs or windows, or I come back to my assessment after a few days, I add -a to script to append my findings:

#!bash
script -a ~/assessment/notes/<date>.txt

I try to always remember to log my activity!  It sucks, I know, but it’s very important.

Metasploit Framework – msfconsole

The Metasploit Framework’s msfconsole can have its prompt customized as well.  The configuration file for this is stored in

#!bash
~/.msf4/msfconsole.rc

I’ve added the following to it to add the day, time, and my current IP address to the msf prompt:

#!bash
setg PROMPT %clr%T%clr %und%L%und%clr msf%clr

Spooling

Spooling logs the output of my msf session to a file I specify.  This is super handy, and has been invaluable when someone has come to me asking why I brought their system down.

I enable Spooling:

#!bash
msf> spool ~/assessment/msf-log.txt

I disable Spooling:

#!bash
msf> spool off

Note that spooling can only track one msf instance per screen session.  If I have multiple screens containing multiple instances of msf on the same host, only one will reliably log with spool.

Leave a Reply