forked from mandiant/commando-vm
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request mandiant#90 from fireeye/commando-2.0
commando 2.0
- Loading branch information
Showing
20 changed files
with
957 additions
and
129 deletions.
There are no files selected for viewing
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| ## 2.0 - August 5 2019 | ||
| - Added Kali Linux https://www.kali.org | ||
| - Added Docker https://www.docker.com #88 | ||
| - Added SpiderFoot https://github.com/smicallef/spiderfoot #84 | ||
| - Added Amass https://github.com/OWASP/Amass | ||
| - Added customization support #42, #25 | ||
|
|
||
| ## 1.3 - June 28 2019 | ||
| - Added RottenPotatoNG https://github.com/breenmachine/RottenPotatoNG #63 | ||
| - Added Juicy Potato https://github.com/ohpe/juicy-potato #63, #64 | ||
| - Added Watson https://github.com/rasta-mouse/Watson #64 | ||
| - Added PwndPasswordsNTLM https://github.com/JacksonVD/PwnedPasswordsNTLM #67 | ||
| - Added FOCA https://github.com/JacksonVD/PwnedPasswordsNTLM #71 | ||
| - Added Vulcan https://github.com/praetorian-code/vulcan | ||
| - Added SharpClipHistory https://github.com/mwrlabs/SharpClipHistory | ||
| - Added NetRipper https://github.com/NytroRST/NetRipper | ||
| - Added RobotsDisallowed https://github.com/danielmiessler/RobotsDisallowed | ||
| - Added Probable-Wordlists https://github.com/berzerk0/Probable-Wordlists | ||
| - Added SharpSploit https://github.com/cobbr/SharpSploit | ||
| - Changed WinRM configuration #65 | ||
| - Un-hardened UNC file paths #68 | ||
| - Fixed install issues with Covenant #61, #76 | ||
|
|
||
| ## 1.2 - May 31 2019 | ||
| - Added recommended hardware settings #20, #17 | ||
| - Added DomainPasswordSpray https://github.com/dafthack/DomainPasswordSpray #2 | ||
| - Added GoBuster https://github.com/OJ/gobuster #39 | ||
| - Added Wfuzz https://github.com/xmendez/wfuzz #40 | ||
| - Added Notepad++ #30 | ||
| - Added TextFX plugin for Notepad++ | ||
| - Added Explorer Suite (CFF Explorer) | ||
|
|
||
| ## 1.1 - April 30 2019 | ||
| - Added AD-Control-Paths https://github.com/ANSSI-FR/AD-control-paths/releases | ||
| - Added DefenderCheck https://github.com/matterpreter/DefenderCheck | ||
| - Added dnsrecon https://github.com/darkoperator/dnsrecon | ||
| - Added EvilClippy https://github.com/outflanknl/EvilClippy | ||
| - Added NtdsAudit https://github.com/Dionach/NtdsAudit | ||
| - Added SharpExec https://github.com/anthemtotheego/SharpExec | ||
| - Added Subdomain-Bruteforce https://github.com/visualbasic6/subdomain-bruteforce | ||
| - Fixed issue #18 with PATH | ||
| - Added Commando Logos with transparent backgrounds to $Home\Pictures | ||
| - Pinned Firefox to Taskbar | ||
| - Fixed misspellings in Readme #42/#43 | ||
| - Added Ruby and Ruby Devkit #1 | ||
| - Updated Rubeus package to current version (1.4.2) #31 | ||
|
|
||
| 1.0.2 - April 10 2019 | ||
| - Added missing 'seclists.fireeye' package to packages.json #38 | ||
|
|
||
| 1.0.1 - March 31 2019 | ||
| - Used https instead of http to install boxstarter #10 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| #NoEnv ; Recommended for performance and compatibility with future AutoHotkey releases. | ||
| #Warn ; Enable warnings to assist with detecting common errors. | ||
| #WinActivateForce | ||
|
|
||
|
|
||
| SendMode Input ; Recommended for new scripts due to its superior speed and reliability. | ||
| SetWorkingDir %A_ScriptDir% ; Ensures a consistent starting directory. | ||
| SetKeyDelay, 50 | ||
|
|
||
| psScript = | ||
| ( | ||
| winrm quickconfig -q | ||
| Enable-PSRemoting -SkipNetworkProfileCheck -Force | ||
| Set-Service -Name WinRM -StartupType Automatic | ||
| Set-NetFirewallRule -Name "WINRM-HTTP-In-TCP" -RemoteAddress Any | ||
| Set-Item wsman:localhost\client\trustedhosts -Value "*" -Force | ||
| Enable-WSManCredSSP -Role "Client" -DelegateComputer "*" -Force | ||
| ) | ||
|
|
||
| RunWait PowerShell.exe -Command &{%psScript%} | ||
|
|
||
| title = Local Group Policy Editor | ||
| Run, C:\Windows\System32\gpedit.msc | ||
| WinWait, %title%, , 5000 | ||
| IfWinExist %title% | ||
| { | ||
| WinActivate %title% | ||
| WinMaximize, %title% | ||
| Sleep, 500 | ||
| BlockInput On | ||
| SendInput, {down}{down}{down}{down}{right} ; Expand "Administrative Template" | ||
| Sleep, 500 | ||
| SendInput, {down}{down}{down}{down}{down}{down}{right} ; Expand "System" | ||
| Sleep, 500 | ||
| SendInput, c ; Delegate credentials | ||
| Sleep, 500 | ||
| SendInput, {tab} ; Switch Pane | ||
| Sleep, 500 | ||
| SendInput, {down}{down}{down}{down} ; Delegate fresh creds with NTML-Only server Auth | ||
| Sleep, 500 | ||
| SendInput, {enter} | ||
| Sleep, 500 | ||
| SendInput, !E | ||
| Sleep, 500 | ||
| SendInput, {tab}{tab}{tab} ; Show | ||
| Sleep, 500 | ||
| SendInput, {enter} | ||
| Sleep, 500 | ||
| SendInput, {tab}{tab} | ||
| Sleep, 500 | ||
| SendInput, WSMAN/* | ||
| Sleep, 500 | ||
| SendInput, !O ; OK | ||
| Sleep, 500 | ||
| SendInput, {tab}{enter} ; Done | ||
| SendInput, !fx ; Quit | ||
| BlockInput Off | ||
| } | ||
| Exit |
58 changes: 58 additions & 0 deletions
58
commandovm.win10.config.fireeye/tools/UNCPathSoftening.ahk
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| #NoEnv ; Recommended for performance and compatibility with future AutoHotkey releases. | ||
| #Warn ; Enable warnings to assist with detecting common errors. | ||
| #WinActivateForce | ||
|
|
||
| SendMode Input | ||
| SetWorkingDir %A_ScriptDir% | ||
| SetKeyDelay, 50 | ||
|
|
||
| ; Handle installation | ||
| title = Local Group Policy Editor | ||
| Run, C:\Windows\system32\gpedit.msc | ||
| WinWait, %title%,,5000 | ||
| IfWinExist %title% | ||
| { | ||
| WinActivate, %title% | ||
| WinMaximize, %title% | ||
|
|
||
| Sleep, 500 | ||
| BlockInput On | ||
|
|
||
| Sleep, 500 | ||
| SendInput, {down}{down}{down}{down}{right} ; Administrative Template | ||
|
|
||
| Sleep, 500 | ||
| SendInput, {down}{down}{right} ; Network | ||
|
|
||
| Sleep, 500 | ||
| SendInput, N{down}{down}{down}{right} ; Network Provider | ||
|
|
||
| Sleep, 500 | ||
| SendInput, {tab} | ||
|
|
||
| Sleep, 500 | ||
| SendInput, {Enter} | ||
|
|
||
| Sleep, 500 | ||
| SendInput, !E | ||
|
|
||
| Sleep, 500 | ||
| SendInput, {tab}{tab}{tab}{enter} | ||
|
|
||
| Sleep, 500 | ||
| SendInput, {tab}{tab} | ||
|
|
||
| SendInput, \\* | ||
| SendInput, {tab} | ||
| SendInput, RequireMutualAuthentication=0,RequireIntegrity=0,RequirePrivacy=0RequireMutualAuthentication=0,RequireIntegrity=0,RequirePrivacy=0 | ||
|
|
||
| Sleep, 500 | ||
| SendInput, !O | ||
| SendInput, {tab}{tab}{Enter} | ||
|
|
||
| Sleep, 500 | ||
| WinClose | ||
| BlockInput Off | ||
| } | ||
|
|
||
| Exit, |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.