October 23, 2019

815 words 4 mins read

fireeye/commando-vm

Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. commandovm@fireeye.com


repo name	fireeye/commando-vm
repo link	https://github.com/fireeye/commando-vm
homepage	https://www.fireeye.com/blog/threat-research/2019/08/commando-vm-customization-containers-kali.html
language	PowerShell
size (curr.)	14777 kB
stars (curr.)	3351
created	2019-03-26
license	Apache License 2.0

   _________                                           .___      
   \_   ___ \  ____   _____   _____ _____    ____    __| _/____  
   /    \  \/ /  _ \ /     \ /     \\__  \  /    \  / __ |/  _ \ 
   \     \___(  <_> )  Y Y  \  Y Y  \/ __ \|   |  \/ /_/ (  <_> )
    \______  /\____/|__|_|  /__|_|  (____  /___|  /\____ |\____/ 
           \/             \/      \/     \/     \/      \/       
                    C O M P L E T E  M A N D I A N T                    
                         O F F E N S I V E   V M                        
                              Version 2020.1                                 
                          commandovm@fireeye.com
           _____________________________________________________          

                                Created by                                
                         Jake Barteaux @day1player                              
                             Mandiant Red Team  
                      Blaine Stancill @MalwareMechanic                           
                                Nhan Huynh   
                 FireEye Labs Advanced Reverse Engineering

Welcome to CommandoVM - a fully customizable, Windows-based security distribution for penetration testing and red teaming.

For detailed install instructions or more information please see our blog

Installation (Install Script)

Requirements

Windows 10 1803, 1809, 1903 or 1909
- Windows 7 is no longer supported. Install should work but issues will not be resolved. New tools will not be added but can be manually installed.
60 GB Hard Drive
2 GB RAM

Instructions

Standard install

Create and configure a new Windows Virtual Machine

Ensure VM is updated completely. You may have to check for updates, reboot, and check again until no more remain

Take a snapshot of your machine!
Download and copy install.ps1 on your newly configured machine.
Open PowerShell as an Administrator
Unblock the install file by running Unblock-File .\install.ps1
Enable script execution by running Set-ExecutionPolicy Unrestricted -f
Finally, execute the installer script as follows:

.\install.ps1
You can also pass your password as an argument: .\install.ps1 -password <password>

The script will set up the Boxstarter environment and proceed to download and install the Commando VM environment. You will be prompted for the administrator password in order to automate host restarts during installation. If you do not have a password set, hitting enter when prompted will also work.

Custom install

Download the zip from https://github.com/fireeye/commando-vm into your Downloads folder.
Decompress the zip and edit the ${Env:UserProfile}\Downloads\commando-vm-master\commando-vm-master\profile.json file by removing tools or adding tools in the “packages” section. Tools are available from our package list or from the chocolatey repository.
Open an administrative PowerShell window and enable script execution. Set-ExecutionPolicy Unrestricted -f
Change to the unzipped project directory. cd ${Env:UserProfile}\Downloads\commando-vm-master\commando-vm-master\
Execute the install with the -profile_file argument. .\install.ps1 -profile_file .\profile.json

For more detailed instructions about custom installations, see our blog

Installing a new package

Commando VM uses the Chocolatey Windows package manager. It is easy to install a new package. For example, enter the following command as Administrator to deploy Github Desktop on your system:

cinst github

Staying up to date

Type the following command to update all of the packages to the most recent version:

cup all

Installed Tools

Active Directory Tools

Remote Server Administration Tools (RSAT)
SQL Server Command Line Utilities
Sysinternals

Command & Control

Covenant
WMImplant
WMIOps

Developer Tools

Dep
Git
Go
Java
Python 2
Python 3 (default)
Ruby
Ruby Devkit
Visual Studio 2017 Build Tools (Windows 10)
Visual Studio Code

Docker

Amass
SpiderFoot

Evasion

CheckPlease
Demiguise
DefenderCheck
DotNetToJScript
Invoke-CradleCrafter
Invoke-DOSfuscation
Invoke-Obfuscation
Invoke-Phant0m
Not PowerShell (nps)
PS>Attack
PSAmsi
Pafishmacro
PowerLessShell
PowerShdll
StarFighters
SysWhispers

Exploitation

ADAPE-Script
API Monitor
CrackMapExec
CrackMapExecWin
DAMP
Dumpert
EvilClippy
Exchange-AD-Privesc
FuzzySec’s PowerShell-Suite
FuzzySec’s Sharp-Suite
GadgetToJScript
Generate-Macro
GhostPack
- Rubeus
- SafetyKatz
- Seatbelt
- SharpDPAPI
- SharpDump
- SharpRoast
- SharpUp
- SharpWMI
GoFetch
Impacket
Invoke-ACLPwn
Invoke-DCOM
Invoke-PSImage
Invoke-PowerThIEf
Juicy Potato
Kali Binaries for Windows
LuckyStrike
MetaTwin
Metasploit
Mr. Unikod3r’s RedTeamPowershellScripts
NetshHelperBeacon
Nishang
Orca
PSBits
PSReflect
PowerLurk
PowerPriv
PowerSploit
PowerUpSQL
PrivExchange
RottenPotatoNG
Ruler
SharpClipHistory
SharpExchangePriv
SharpExec
SpoolSample
SharpSploit
ThreadContinue
TikiTorch
UACME
impacket-examples-windows
vssown
Vulcan

Information Gathering

ADACLScanner
ADExplorer
ADOffline
ADRecon
BeRoot
BloodHound
BloodHound-Custom-Queries (Hausec)
dnsrecon
FOCA
Get-ReconInfo
GoBuster
GoWitness
Net-GPPPassword
NetRipper
Nmap
PowerView
- Dev branch included
Privesc (enjoiz)
Recon-AD
SharpHound
SharpView
SpoolerScanner
Watson

Kali Linux

kali-linux-default
kali-linux-xfce
VcXsrv

Networking Tools

Citrix Receiver
OpenVPN
Powercat
Proxycap
PuTTY
Telnet
VMWare Horizon Client
VMWare vSphere Client
VNC-Viewer
WinSCP
Windump
Wireshark

Password Attacks

ASREPRoast
CredNinja
DomainPasswordSpray
DSInternals
Get-LAPSPasswords
Hashcat
Internal-Monologue
Inveigh
Invoke-TheHash
KeeFarce
KeeThief
LAPSToolkit
MailSniper
Mimikatz
Mimikittenz
RiskySPN
SessionGopher

Reverse Engineering

DNSpy
Flare-Floss
ILSpy
PEview
Windbg
x64dbg

Utilities

7zip
Adobe Reader
AutoIT
Cmder
CyberChef
Explorer Suite
Gimp
Greenshot
Hashcheck
HeidiSQL
Hexchat
HTTP File Server (hfs)
HxD
Keepass
MobaXterm
Mozilla Thunderbird
Neo4j Community Edition
NirLauncher
Notepad++
Pidgin
Process Hacker 2
qBittorrent
SQLite DB Browser
Screentogif
Shellcode Launcher
SimpleDNSCrypt
SQLite DB Browser
Sublime Text 3
Tor Browser
TortoiseSVN
VLC Media Player
yEd Graph Tool

Vulnerability Analysis

AD Control Paths
Egress-Assess
Grouper2
NtdsAudit
PwnedPasswordsNTLM
zBang

Web Applications

Burp Suite
Fiddler
Firefox
OWASP Zap
Subdomain-Bruteforce
Wfuzz

Wordlists

FuzzDB
PayloadsAllTheThings
SecLists
Probable-Wordlists
RobotsDisallowed

Legal Notice