exegol

Install

Install git, python3 and pipx

sudo apt update && sudo apt install -y git python3 pipx

Ensure pipx will work correctly

pipx ensurepath

Reload your terminal to apply changes

exec $SHELL

Run exegol base install

pipx install exegol

Set docker permissions

echo "alias exegol='sudo -E $(echo ~/.local/bin/exegol)'" >> ~/.bash_aliases && source ~/.bash_aliases

Run exegol image install

exegol install

When asked to accept the EULA, answer Y.
When asked if you want to activate your Exegol subscription, answer N.
When asked if you're a good person, say Y.
When asked if you want to download exegol resources, answer Y.
When asked if you want to start that download, say Y.
When offered a choice of available images, choose free, then wait for install to complete.

Verify exegol install

exegol start

Build a hosts file (for using on domains/labs)

Scan your subnet:

nxc smb 10.3.10.0/24 --generate-hosts-file hosts.txt

Build the hosts file:

sudo cat hosts.txt >> /etc/hosts

Update exegol to latest version

If you installed with pipx, do this outside of the exegol shell:

pipx upgrade exegol

Delete exegol container

To get info on exegol containers:

exegol info

You'll see something like:

─$ exegol info
[*] Exegol Community is currently in version v5.1.11
[*] More about Exegol at: https://exegol.com

[*] An Exegol update is available (v5.1.11 ➡ v5.1.13)                                                                                                                                                        
[>] You can update your exegol wrapper with the command pipx upgrade exegol [Press ENTER to acknowledge]: 

🛸 Available images                           
┌─────────┬──────────┬───────────────────────┐
│ Image   │ Size     │ Status                │
├─────────┼──────────┼───────────────────────┤
│ free    │ 42.3 GB  │ Up to date (v.3.1.14) │
│ nightly │ 44.92 GB │ Pro / Enterprise only │
│ web     │ 20.28 GB │ Pro / Enterprise only │
│ full    │ 45.09 GB │ Pro / Enterprise only │
│ light   │ 14.97 GB │ Pro / Enterprise only │
│ ad      │ 30.56 GB │ Pro / Enterprise only │
│ osint   │ 11.8 GB  │ Pro / Enterprise only │
└─────────┴──────────┴───────────────────────┘


👽 Available containers                                         
┌───────────────┬─────────┬───────────┬────────────────────────┐
│ Container tag │ State   │ Image tag │ Configurations         │
├───────────────┼─────────┼───────────┼────────────────────────┤
│ default       │ Running │ free      │ Share timezone: Off 🪓 │
└───────────────┴─────────┴───────────┴────────────────────────┘

Delete the one you don't want:

exegol remove "default"

Output will look like:

─$ exegol remove "default"
[*] Exegol Community is currently in version v5.1.11
[*] More about Exegol at: https://exegol.com

[*] An Exegol update is available (v5.1.11 ➡ v5.1.13)                                                                                                                                                        
[>] You can update your exegol wrapper with the command pipx upgrade exegol [Press ENTER to acknowledge]: 
[*] Removing container(s)                                                                                                                                                                                    
[?] Are you sure you want to permanently remove the following containers? [ default ] [y/N]: y
[?] Workspace /home/kali/.exegol/workspaces/default is not empty, do you want to delete it? [y/N]: y
[+] Private workspace volume removed successfully                                                                                                                                                            
[*] Stopping container default                                                                                                                                                                               
[*] Removing container default                                                                                                                                                                               
[+] Container default successfully removed.       

Troubleshooting

Operations that require privileged mode

I found that some operations, like packet-sniffing, require starting exegol in privileged mode, so to do that:

exegol start default --privileged

Run on a headless system

Out of nowhere I got this nonsense when trying to start exegol on a fresh Ubuntu box:

<snip>
[?] Is the container configuration correct? [Y/n]: 
[*] Command line of the configuration: exegol start default free                                                                                                                                             
[*] To use exegol without interaction, read CLI options with exegol start -h                                                                                                                                 
[*] Creating new exegol container                                                                                                                                                                            
[-] Docker error received: invalid mount config for type "bind": bind source path does not exist: /tmp/.X11-unix                                                                                             
[*] Rollback: removing dedicated workspace directory                                                                                                                                                         
[!] Error while creating exegol container. Exiting.                                                                                                                                                          

[*] Exiting... 

This was the fix!

exegol start default free --disable-X11

Turn on logging

exegol start ad -l

TIP

When logging is turned on, logs get saved to /home/sevminsec/.exegol/workspaces/ad/logs

Also, if you're looking for log output from tools like Responder, check the /opt/tools subfolder within the exegol prompt (in other words, not the /opt in the root of your hard drive).

Sync time to domain controller

If the DC is 10.3.10.40:

faketime "$(rdate -n 10.3.10.40 -p | awk '{print $2, $3, $4}' | date -f - "+%Y-%m-%d %H:%M:%S")" zsh

Then you should be able to grab the ticket you need without it complaining of time skew.

Internal server error

On a couple of my recent (summer of 2026) assessments, after a fresh exegol install I'd get this error after firing up exegol with exegol start:

APIError: 500 Server Error for http+docker://localhost/v1.51/containers/xxx/archive?path=%2F: Internal Server Error ("openat etc/localtime: path
escapes from parent")

Claude led me down a long and sad path that didn't fix my issue. But ChatGPT said to just do this:

# Remove the busted container
exegol remove default 

# Restart with this command:

exegol start default --disable-shared-timezones

Never heard of that flag until now (read more here) but it worked!