Version 1.0

2026-10-12 02:18:39 +00:00 · 2019-03-28 09:09:19 -06:00
commit 604c304be9
37 changed files with 5879 additions and 0 deletions
@@ -0,0 +1,53 @@
+Apache License
+
+Version 2.0, January 2004
+
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.
+
+"Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:
+
+You must give any other recipients of the Work or Derivative Works a copy of this License; and
+You must cause any modified files to carry prominent notices stating that You changed the files; and
+You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
+If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. 
+
+You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.
+5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
@@ -0,0 +1,370 @@
+                                                                   
+       _________                                           .___      
+       \_   ___ \  ____   _____   _____ _____    ____    __| _/____  
+       /    \  \/ /  _ \ /     \ /     \\__  \  /    \  / __ |/  _ \ 
+       \     \___(  <_> )  Y Y  \  Y Y  \/ __ \|   |  \/ /_/ (  <_> )
+        \______  /\____/|__|_|  /__|_|  (____  /___|  /\____ |\____/ 
+               \/             \/      \/     \/     \/      \/       
+                        C O M P L E T E  M A N D I A N T                    
+                             O F F E N S I V E   V M                        
+                                   Version 1.0                                 
+               _____________________________________________________          
+
+                                   Developed by                                
+                                   Jake Barteaux                               
+                                 Proactive Services  
+                                  Blaine Stancill                           
+                                    Nhan Huynh   
+                     FireEye Labs Advanced Reverse Engineering                            
+______________________________________________________________________________ 
+
+<p align="center">
+  <img width="300" src="https://github.com/fireeye/commando-vm/blob/master/Commando.png?raw=true" alt="Commando VM"/>
+</p>  
+
+Welcome to CommandoVM - a fully customized, Windows-based security distribution for penetration testing and red teaming.
+
+
+
+Installation (Install Script)
+=============================
+
+Requirements
+------------
+* Windows 7 Service Pack 1 or Windows 10
+* 60 GB Hard Drive
+* 2 GB RAM
+
+Instructions
+------------
+1. Create and configure a new Windows Virtual Machine
+  * Ensure VM is updated completely. You may have to check for updates, reboot, and check again until no more remain 
+* Take a snapshot of your machine!
+* Download and copy `install.ps1` on your newly configured machine. 
+* Open PowerShell as an Administrator
+* Enable script execution by running the following command:
+  * `Set-ExecutionPolicy Unrestricted`
+* Finally, execute the installer script as follows:
+  * `.\install.ps1`
+  * You can also pass your password as an argument: `.\install.ps1 -password <password>`
+  
+The script will set up the Boxstarter environment and proceed to download and install the Commando VM environment. You will be prompted for the administrator password in order to automate host restarts during installation. If you do not have a password set, hitting enter when prompted will also work.
+
+
+Installing a new package
+========================
+
+Commando VM uses the Chocolatey Windows package manager. It is easy to install a new package. For example, enter the following command as Administrator to deploy Github Desktop on your system:
+
+    cinst github
+
+
+Staying up to date
+==================
+
+Type the following command to update all of the packages to the most recent version:
+
+    cup all
+
+
+
+Installed Tools
+===============
+
+### Active Directory Tools
+- Remote Server Administration Tools (RSAT)
+- SQL Server Command Line Utilities
+- Sysinternals
+
+### Command & Control
+- Covenant
+- PoshC2
+- WMImplant
+- WMIOps
+
+### Developer Tools
+- Dep
+- Git
+- Go
+- Java
+- Python 2
+- Python 3 (default)
+- Visual Studio 2017 Build Tools (Windows 10)
+- Visual Studio Code
+
+### Evasion
+- CheckPlease
+- Demiguise
+- DotNetToJScript
+- Invoke-CradleCrafter
+- Invoke-DOSfuscation
+- Invoke-Obfuscation
+- Invoke-Phant0m
+- Not PowerShell (nps)
+- PS>Attack
+- PSAmsi
+- Pafishmacro
+- PowerLessShell
+- PowerShdll
+- StarFighters
+
+### Exploitation
+- ADAPE-Script
+- API Monitor
+- CrackMapExec
+- CrackMapExecWin
+- DAMP
+- Exchange-AD-Privesc
+- FuzzySec's PowerShell-Suite
+- FuzzySec's Sharp-Suite
+- Generate-Macro
+- GhostPack
+  - Rubeus
+  - SafetyKatz
+  - Seatbelt
+  - SharpDPAPI
+  - SharpDump
+  - SharpRoast
+  - SharpUp
+  - SharpWMI
+- GoFetch
+- Impacket
+- Invoke-ACLPwn
+- Invoke-DCOM
+- Invoke-PSImage
+- Invoke-PowerThIEf
+- Kali Binaries for Windows
+- LuckyStrike
+- MetaTwin
+- Metasploit
+- Mr. Unikod3r's RedTeamPowershellScripts
+- NetshHelperBeacon
+- Nishang
+- Orca
+- PSReflect
+- PowerLurk
+- PowerPriv
+- PowerSploit
+- PowerUpSQL
+- PrivExchange
+- Ruler
+- SharpExchangePriv
+- SpoolSample
+- UACME
+- impacket-examples-windows
+- vssown
+
+### Information Gathering
+- ADACLScanner
+- ADExplorer
+- ADOffline
+- ADRecon
+- BloodHound
+- Get-ReconInfo
+- GoWitness
+- Nmap
+- PowerView
+  - Dev branch included
+- SharpHound
+- SharpView
+- SpoolerScanner
+
+### Networking Tools
+- Citrix Receiver
+- OpenVPN
+- Proxycap
+- PuTTY
+- Telnet
+- VMWare Horizon Client
+- VMWare vSphere Client
+- VNC-Viewer
+- WinSCP
+- Windump
+- Wireshark
+
+### Password Attacks
+- ASREPRoast
+- CredNinja
+- DSInternals
+- Get-LAPSPasswords
+- Hashcat
+- Internal-Monologue
+- Inveigh
+- Invoke-TheHash
+- KeeFarce
+- KeeThief
+- LAPSToolkit
+- MailSniper
+- Mimikatz
+- Mimikittenz
+- RiskySPN
+- SessionGopher
+
+### Reverse Engineering
+- DNSpy
+- Flare-Floss
+- ILSpy
+- PEview
+- Windbg
+- x64dbg
+
+### Utilities
+- 7zip
+- Adobe Reader
+- AutoIT
+- Cmder
+- CyberChef
+- Gimp
+- Greenshot
+- Hashcheck
+- Hexchat
+- HxD
+- Keepass
+- MobaXterm
+- Mozilla Thunderbird
+- Neo4j Community Edition
+- Pidgin
+- Process Hacker 2
+- SQLite DB Browser
+- Screentogif
+- Shellcode Launcher
+- Sublime Text 3
+- TortoiseSVN
+- VLC Media Player
+- Winrar
+- yEd Graph Tool
+
+### Vulnerability Analysis
+- Egress-Assess
+- Grouper2
+- zBang
+
+### Web Applications
+- Burp Suite
+- Fiddler
+- Firefox
+- OWASP Zap
+
+### Wordlists
+- FuzzDB
+- PayloadsAllTheThings
+- SecLists
+
+
+Legal Notice
+============
+<pre>This download configuration script is provided to assist penetration testers
+in creating handy and versatile toolboxes for offensive engagements. It
+provides a convenient interface for them to obtain a useful set of pentesting Tools directly from their original sources. Installation and use of this script
+is subject to the Apache 2.0 License.
+ 
+You as a user of this script must review, accept and comply with the license
+terms of each downloaded/installed package listed below. By proceeding with the
+installation, you are accepting the license terms of each package, and
+acknowledging that your use of each package will be subject to its respective
+license terms.
+
+List of package licenses:
+
+http://technet.microsoft.com/en-us/sysinternals/bb469936
+https://github.com/stufus/ADOffline/blob/master/LICENCE.md
+https://github.com/HarmJ0y/ASREPRoast/blob/master/LICENSE
+https://github.com/BloodHoundAD/BloodHound/blob/master/LICENSE.md
+https://github.com/Arvanaghi/CheckPlease/blob/master/LICENSE
+https://github.com/cobbr/Covenant/blob/master/LICENSE
+https://github.com/byt3bl33d3r/CrackMapExec/blob/master/LICENSE
+https://github.com/Raikia/CredNinja/blob/master/LICENSE
+https://github.com/MichaelGrafnetter/DSInternals/blob/master/LICENSE.md
+https://github.com/tyranid/DotNetToJScript/blob/master/LICENSE
+https://github.com/FortyNorthSecurity/Egress-Assess/blob/master/LICENSE
+https://github.com/cobbr/Elite/blob/master/LICENSE
+https://github.com/GoFetchAD/GoFetch/blob/master/LICENSE.md
+http://www.gnu.org/licenses/gpl.html
+https://github.com/Kevin-Robertson/Inveigh/blob/master/LICENSE.md
+https://github.com/danielbohannon/Invoke-CradleCrafter/blob/master/LICENSE
+https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/master/LICENSE
+https://github.com/danielbohannon/Invoke-Obfuscation/blob/master/LICENSE
+https://github.com/Kevin-Robertson/Invoke-TheHash/blob/master/LICENSE.md
+https://github.com/denandz/KeeFarce/blob/master/LICENSE
+https://github.com/HarmJ0y/KeeThief/blob/master/LICENSE
+https://github.com/gentilkiwi/mimikatz
+https://github.com/nettitude/PoshC2/blob/master/LICENSE
+https://github.com/Mr-Un1k0d3r/PowerLessShell/blob/master/LICENSE.md
+https://github.com/G0ldenGunSec/PowerPriv/blob/master/LICENSE
+https://github.com/p3nt4/PowerShdll/blob/master/LICENSE.md
+https://github.com/FuzzySecurity/PowerShell-Suite/blob/master/LICENSE
+https://github.com/PowerShellMafia/PowerSploit/blob/master/LICENSE
+https://github.com/PowerShellMafia/PowerSploit/blob/master/LICENSE
+https://github.com/dirkjanm/PrivExchange/blob/master/LICENSE
+https://github.com/Mr-Un1k0d3r/RedTeamPowershellScripts/blob/master/LICENSE.md
+https://github.com/cyberark/RiskySPN/blob/master/LICENSE.md
+https://github.com/GhostPack/Rubeus/blob/master/LICENSE
+https://github.com/GhostPack/SafetyKatz/blob/master/LICENSE
+https://github.com/NickeManarin/ScreenToGif/blob/master/LICENSE.txt
+https://github.com/GhostPack/Seatbelt
+https://github.com/danielmiessler/SecLists/blob/master/LICENSE
+https://github.com/Arvanaghi/SessionGopher
+https://github.com/GhostPack/SharpDPAPI/blob/master/LICENSE
+https://github.com/GhostPack/SharpDump/blob/master/LICENSE
+https://github.com/tevora-threat/SharpView/blob/master/LICENSE
+https://github.com/GhostPack/SharpRoast/blob/master/LICENSE
+https://github.com/GhostPack/SharpUp/blob/master/LICENSE
+https://github.com/GhostPack/SharpWMI/blob/master/LICENSE
+https://github.com/leechristensen/SpoolSample/blob/master/LICENSE
+https://github.com/vletoux/SpoolerScanner/blob/master/LICENSE
+http://www.sublimetext.com/eula
+https://github.com/HarmJ0y/TrustVisualizer/blob/master/LICENSE
+https://github.com/hfiref0x/UACME/blob/master/LICENSE.md
+https://github.com/FortyNorthSecurity/WMIOps/blob/master/LICENSE
+https://github.com/FortyNorthSecurity/WMImplant/blob/master/LICENSE
+http://www.adobe.com/products/eulas/pdfs/Reader10_combined-20100625_1419.pdf
+http://www.rohitab.com/apimonitor
+http://www.autoitscript.com/autoit3/docs/license.htm
+https://portswigger.net/burp
+http://www.citrix.com/buy/licensing/agreements.html
+https://github.com/cmderdev/cmder/blob/master/LICENSE
+https://github.com/nccgroup/demiguise/blob/master/LICENSE.txt
+http://www.telerik.com/purchase/license-agreement/fiddler
+https://www.mozilla.org/en-US/MPL/2.0/
+https://github.com/fireeye/flare-floss
+https://github.com/fuzzdb-project/fuzzdb/blob/master/_copyright.txt
+https://www.gimp.org/about/
+https://www.google.it/intl/en/chrome/browser/privacy/eula_text.html
+https://github.com/sensepost/gowitness/blob/master/LICENSE.txt
+https://github.com/hashcat/hashcat/blob/master/docs/license.txt
+https://www.gnu.org/licenses/gpl-2.0.html
+https://mh-nexus.de/en/hxd/license.php
+https://github.com/SecureAuthCorp/impacket/blob/master/LICENSE
+https://github.com/SecureAuthCorp/impacket/blob/master/LICENSE
+https://www.kali.org/about-us/
+http://keepass.info/help/v2/license.html
+https://github.com/putterpanda/mimikittenz
+http://mobaxterm.mobatek.net/license.html
+http://neo4j.com/open-source-project/
+https://github.com/samratashok/nishang/blob/master/LICENSE
+https://svn.nmap.org/nmap/COPYING
+https://github.com/Ben0xA/nps/blob/master/LICENSE
+https://openvpn.net/index.php/license.html
+https://www.microsoft.com/en-us/servicesagreement/
+https://github.com/joesecurity/pafishmacro/blob/master/LICENSE
+https://hg.pidgin.im/pidgin/main/file/f02ebb71b5e3/COPYING
+http://www.proxycap.com/eula.pdf
+http://www.chiark.greenend.org.uk/~sgtatham/putty/licence.html
+https://support.microsoft.com/en-us/gp/mats_eula
+https://raw.githubusercontent.com/sqlitebrowser/sqlitebrowser/master/LICENSE
+http://technet.microsoft.com/en-us/sysinternals/bb469936
+http://www.mozilla.org/en-US/legal/eula/thunderbird.html
+http://www.videolan.org/legal.html
+http://www.vmware.com/download/eula/universal_eula.html
+https://www.vmware.com/help/legal.html
+https://www.realvnc.com/legal/
+https://code.visualstudio.com/License
+http://go.microsoft.com/fwlink/?LinkID=251960
+http://opensource.org/licenses/BSD-3-Clause
+https://winscp.net/docs/license
+http://www.gnu.org/copyleft/gpl.html
+https://github.com/x64dbg/x64dbg/blob/development/LICENSE
+https://www.yworks.com/products/yed/license.html
+http://www.apache.org/licenses/LICENSE-2.0
+
+</pre>
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
+  <metadata>
+    <id>commandovm.win10.config.fireeye</id>
+    <version>1.0.0.2</version>
+    <title>CommandoVM</title>
+    <authors>Jake Barteaux</authors>
+    <description>CommandoVM - Penetration Testing Distribution</description>
+  </metadata>
+</package>
@@ -0,0 +1,196 @@
+$ErrorActionPreference = 'Continue'
+
+$packageName = 'commandovm.win10.config.fireeye'
+$toolsDir    = "$(Split-Path -parent $MyInvocation.MyCommand.Definition)"
+
+function PinToTaskbar {
+  # https://stackoverflow.com/questions/31720595/pin-program-to-taskbar-using-ps-in-windows-10
+  param (
+    [parameter(Mandatory=$True, HelpMessage="Target item to pin")]
+    [ValidateNotNullOrEmpty()]
+    [string] $Target
+  )
+  if (-Not (Test-Path $Target)) {
+    Write-Warning "$Target does not exist"
+    throw [System.IO.FileNotFoundException] "$Target does not exist"
+  }
+
+  $KeyPath1  = "HKCU:\SOFTWARE\Classes"
+  $KeyPath2  = "*"
+  $KeyPath3  = "shell"
+  $KeyPath4  = "{:}"
+  $ValueName = "ExplorerCommandHandler"
+  $ValueData =
+    (Get-ItemProperty `
+        ("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\" + `
+            "CommandStore\shell\Windows.taskbarpin")
+    ).ExplorerCommandHandler
+
+  $Key2 = (Get-Item $KeyPath1).OpenSubKey($KeyPath2, $true)
+  $Key3 = $Key2.CreateSubKey($KeyPath3, $true)
+  $Key4 = $Key3.CreateSubKey($KeyPath4, $true)
+  $Key4.SetValue($ValueName, $ValueData)
+
+  $Shell = New-Object -ComObject "Shell.Application"
+  $Folder = $Shell.Namespace((Get-Item $Target).DirectoryName)
+  $Item = $Folder.ParseName((Get-Item $Target).Name)
+  $Item.InvokeVerb("{:}")
+
+  $Key3.DeleteSubKey($KeyPath4)
+  if ($Key3.SubKeyCount -eq 0 -and $Key3.ValueCount -eq 0) {
+    $Key2.DeleteSubKey($KeyPath3)
+  }
+}
+
+### Commando Windows 10 Attack VM ###
+Write-Host "[+] Beginning host configuration..." -ForegroundColor Green
+
+
+# #### Disable services ####
+Write-Host "[-] Disabling services" -ForegroundColor Green
+Set-Service OpenVPNService -StartupType Manual -ErrorAction SilentlyContinue 
+Set-Service OpenVPNServiceInteractive -StartupType Manual -ErrorAction SilentlyContinue 
+Set-Service OpenVPNServiceLegacy -StartupType Manual -ErrorAction SilentlyContinue 
+Write-Host "`t[+] Disabled OpenVPN Services" -ForegroundColor Green
+Set-Service neo4j -StartupType Manual -ErrorAction SilentlyContinue
+Stop-Service -Name neo4j 
+Write-Host "`t[+] Disabled Neo4j" -ForegroundColor Green
+Set-Service OpenSSHd -StartupType Manual -ErrorAction SilentlyContinue
+Stop-Service -Name OpenSSHd -ErrorAction SilentlyContinue
+Write-Host "`t[+] Disabled OpenSSH Service" -ForegroundColor Green
+Start-Sleep -Seconds 2
+
+
+#### Remove Desktop Shortcuts ####
+Write-Host "[+] Cleaning up the Desktop" -ForegroundColor Green
+$shortcut_path = "C:\Users\Public\Desktop\Boxstarter Shell.lnk"
+Remove-Item $shortcut_path -Force | Out-Null
+Start-Sleep -Seconds 2
+$shortcut_path = "$Env:USERPROFILE\Desktop\Microsoft Edge.lnk"
+Remove-Item $shortcut_path -Force | Out-Null
+
+
+#### Add timestamp to PowerShell prompt ####
+$psprompt = @"
+function prompt
+{
+    Write-Host "COMMANDO " -ForegroundColor Green -NoNewLine
+    Write-Host `$(get-date) -ForegroundColor Green
+    Write-Host  "PS" `$PWD ">" -nonewline -foregroundcolor White
+    return " "
+}
+"@
+New-Item -ItemType File -Path $profile -Force | Out-Null
+Set-Content -Path $profile -Value $psprompt
+# Add timestamp to cmd prompt
+# Note: The string below is base64-encoded due to issues properly escaping the '$' character in PowersShell
+#   Offending string: "Y21kIC9jICdzZXR4IFBST01QVCBDT01NQU5ETyRTJGQkcyR0JF8kcCQrJGcn"
+#   Resolves to: "cmd /c 'setx PROMPT COMMANDO$S$d$s$t$_$p$+$g'"
+iex ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("Y21kIC9jICdzZXR4IFBST01QVCBDT01NQU5ETyRTJGQkcyR0JF8kcCQrJGcn"))) | Out-Null
+Write-Host "`t[+] Timestamps added to cmd prompt and PowerShell" -ForegroundColor Green
+
+
+#### Pin Items to Taskbar ####
+Write-Host "[-] Pinning items to Taskbar" -ForegroundColor Green
+# Explorer
+$target_file = Join-Path ${Env:WinDir} "explorer.exe"
+try {
+  PinToTaskbar $target_file
+} catch {
+  Write-Host "Could not pin $target_file to the tasbar"
+}
+# CMD prompt
+$target_file = Join-Path ${Env:WinDir} "system32\cmd.exe"
+$target_dir = ${Env:UserProfile}
+$target_args = '/K "cd ' + ${Env:UserProfile} + '"'
+$shortcut = Join-Path ${Env:UserProfile} "temp\CMD.lnk"
+Install-ChocolateyShortcut -shortcutFilePath $shortcut -targetPath $target_file -Arguments $target_args -WorkingDirectory $target_dir -PinToTaskbar -RunasAdmin
+try {
+  PinToTaskbar $shortcut
+} catch {
+  Write-Host "Could not pin $target_file to the tasbar"
+}
+# Powershell
+$target_file = Join-Path (Join-Path ${Env:WinDir} "system32\WindowsPowerShell\v1.0") "powershell.exe"
+$target_dir = ${Env:UserProfile}
+$target_args = '-NoExit -Command "cd ' + "${Env:UserProfile}" + '"'
+$shortcut = Join-Path ${Env:UserProfile} "temp\PowerShell.lnk"
+Install-ChocolateyShortcut -shortcutFilePath $shortcut -targetPath $target_file -Arguments $target_args -WorkingDirectory $target_dir -PinToTaskbar -RunasAdmin
+try {
+  PinToTaskbar $shortcut
+} catch {
+  Write-Host "Could not pin $target_file to the tasbar"
+}
+
+
+#### Rename the computer ####
+Write-Host "[+] Renaming host to 'commando'" -ForegroundColor Green
+(Get-WmiObject win32_computersystem).rename("commando") | Out-Null
+Write-Host "`t[-] Make sure to restart the machine for this change to take effect" -ForegroundColor Yellow
+Write-Host "[+] Changing Desktop Background" -ForegroundColor Green
+
+
+#### Update background ####
+# Set desktop background to black
+Set-ItemProperty -Path 'HKCU:\Control Panel\Colors' -Name Background -Value "0 0 0" -Force | Out-Null
+# Set desktop wallpaper using WallpaperChanger utility
+$wallpaperName = 'LightMale_Red.png'
+$fileBackground = Join-Path $toolsDir $wallpaperName
+$publicWallpaper = Join-Path ${env:public} $wallpaperName
+$WallpaperChanger = Join-Path $toolsDir 'WallpaperChanger.exe'
+Invoke-Expression "$WallpaperChanger $fileBackground 3"
+# Copy background images
+$backgroundzip = 'Backgrounds.7z'
+$backgrounds = Join-Path $toolsDir $backgroundzip
+Invoke-Expression "copy $backgrounds ${Env:USERPROFILE}\Pictures"
+Write-Host "`t[+] Alternative backgrounds copied to ${Env:USERPROFILE}\Pictures" -ForegroundColor Yellow
+foreach ($item in "0", "1", "2") {
+  # Try to set it multiple times! Windows 10 is not consistent
+  if ((Test-Path $publicWallpaper) -eq $false)
+  {
+    Copy-Item -Path $fileBackground -Destination $publicWallpaper -Force 
+  }
+  Set-ItemProperty -path 'HKCU:\Control Panel\Desktop\' -name Wallpaper -value $publicWallpaper
+  Set-ItemProperty -path 'HKCU:\Control Panel\Desktop\' -name TileWallpaper -value "0" -Force
+  Set-ItemProperty -path 'HKCU:\Control Panel\Desktop\' -name WallpaperStyle -value "6" -Force
+  Sleep -seconds 3
+  rundll32.exe user32.dll, UpdatePerUserSystemParameters, 1, True
+}
+  
+
+# Copy readme.txt on the Desktop
+Write-Host "[+] Copying README.txt to Desktop" -ForegroundColor Green
+$fileReadme = Join-Path $toolsDir 'readme.txt'
+$desktopReadme = Join-Path ${Env:USERPROFILE} "Desktop\README.txt"
+Copy-Item $fileReadme $desktopReadme
+
+
+# Remove desktop.ini files
+Get-ChildItem -Path (Join-Path ${Env:UserProfile} "Desktop") -Hidden -Filter "desktop.ini" -Force | foreach {$_.Delete()}
+Get-ChildItem -Path (Join-Path ${Env:Public} "Desktop") -Hidden -Filter "desktop.ini" -Force | foreach {$_.Delete()}
+
+
+# Should be PS >5.1 now, enable transcription and script block logging
+# More info: https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html
+if ($PSVersionTable -And $PSVersionTable.PSVersion.Major -ge 5) {
+  $psLoggingPath = 'HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell'
+  if (-Not (Test-Path $psLoggingPath)) {
+    New-Item -Path $psLoggingPath -Force | Out-Null
+  }
+  $psLoggingPath = 'HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\Transcription'
+  if (-Not (Test-Path $psLoggingPath)) {
+    New-Item -Path $psLoggingPath -Force | Out-Null
+  }
+  New-ItemProperty -Path $psLoggingPath -Name "EnableInvocationHeader" -Value 1 -PropertyType DWORD -Force | Out-Null
+  New-ItemProperty -Path $psLoggingPath -Name "EnableTranscripting" -Value 1 -PropertyType DWORD -Force | Out-Null
+  New-ItemProperty -Path $psLoggingPath -Name "OutputDirectory" -Value (Join-Path ${Env:UserProfile} "Desktop\PS_Transcripts") -PropertyType String -Force | Out-Null
+  
+  $psLoggingPath = 'HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
+  if (-Not (Test-Path $psLoggingPath)) {
+    New-Item -Path $psLoggingPath -Force | Out-Null
+  }
+  New-ItemProperty -Path $psLoggingPath -Name "EnableScriptBlockLogging" -Value 1 -PropertyType DWORD -Force | Out-Null
+}
+
+# Done
+Write-Host "[!] Done with configuration, shutting down Boxstarter..." -ForegroundColor Green
@@ -0,0 +1,9 @@
+$ErrorActionPreference = 'Stop'; # stop on all errors
+
+$packageName = 'flarevm'
+try {
+	$desktopReadme = Join-Path ${Env:USERPROFILE} "Desktop\README.txt"
+	Copy-Item $desktopReadme
+} catch {
+	# pass
+}
@@ -0,0 +1,48 @@
+       _________                                           .___      
+       \_   ___ \  ____   _____   _____ _____    ____    __| _/____  
+       /    \  \/ /  _ \ /     \ /     \\__  \  /    \  / __ |/  _ \ 
+       \     \___(  <_> )  Y Y  \  Y Y  \/ __ \|   |  \/ /_/ (  <_> )
+        \______  /\____/|__|_|  /__|_|  (____  /___|  /\____ |\____/ 
+               \/             \/      \/     \/     \/      \/       
+                        C O M P L E T E  M A N D I A N T                    
+                             O F F E N S I V E   V M                        
+                                   Version 1.0                                 
+               _____________________________________________________          
+
+                                   Developed by                                
+                                   Jake Barteaux                               
+                                 Proactive Services  
+                                  Blaine Stancill
+                     FireEye Labs Advanced Reverse Engineering                            
+                                    Nhan Huynh   
+                     FireEye Labs Advanced Reverse Engineering                            
+______________________________________________________________________________ 
+
+Welcome to Commando VM - Red Team Edition! This distribution contains a number
+of Tools and configurations to enhance Red Teaming and Penetration Testing.
+
+Please make sure to take a snapshot after installing so you can always revert
+back if you have issues.
+
+This image has the Chocolatey package manager installed, and you can continue to
+customize this machine with any package from the Chocolatey repository.
+
+Try this:
+  choco install github 
+Or:
+  cinst github
+
+To keep this distribution up to date, type this into an Administrative terminal:
+  cup all
+
+
+This machine now has the Windows package manager Chocolatey installed. For
+information on tools available to install, check out chocolatey.org/packages
+
+As this is a Red Teaming and Penetration Testing build certain protections have
+been disabled, and certain 'risky' features and tweaks have been enabled.
+
+Please enjoy the VM and submit any feedback or feature reqeuests as github 
+issues here:
+https://github.com/fireeye/commandovm
+
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
+  <metadata>
+    <id>commandovm.win10.installer.fireeye</id>
+    <version>1.0.1.2</version>
+    <title>CommandoVM</title>
+    <authors>Jake Barteaux</authors>
+    <description>CommandoVM - Penetration Testing Distribution</description>
+  </metadata>
+</package>
@@ -0,0 +1,164 @@
+$ErrorActionPreference = 'Continue'
+
+Import-Module Boxstarter.Chocolatey
+Import-Module "$($Boxstarter.BaseDir)\Boxstarter.Common\boxstarter.common.psd1"
+
+$packageName      = 'commandovm.win10.installer.fireeye'
+$toolsDir         = "$(Split-Path -parent $MyInvocation.MyCommand.Definition)"
+$fireeyeFeed      = "https://www.myget.org/F/fireeye/api/v2"
+$cache            =  "$env:userprofile\AppData\Local\ChocoCache"
+$globalCinstArgs  = "--cacheLocation $cache -y"
+$toolList         = Join-Path ${Env:ProgramData} "Microsoft\Windows\Start Menu\Programs\Tool List"
+$pkgPath          = Join-Path $toolsDir "packages.json"
+
+
+# https://stackoverflow.com/questions/28077854/powershell-2-0-convertfrom-json-and-convertto-json-implementation
+function ConvertFrom-Json([object] $item) {
+  Add-Type -Assembly system.web.extensions
+  $ps_js = New-Object system.web.script.serialization.javascriptSerializer
+
+  #The comma operator is the array construction operator in PowerShell
+  return ,$ps_js.DeserializeObject($item)
+}
+
+function LoadPackages {
+  try {
+    $json = Get-Content $pkgPath -ErrorAction Stop
+    $packages = ConvertFrom-Json $json
+  } catch {
+    return $null
+  }
+  return $packages
+}
+
+function InstallOnePackage {
+  param([hashtable] $pkg)
+  $name = $pkg.name
+  $pkgargs = $pkg.args
+  try {
+    $is64Only = $pkg.x64Only
+  } catch {
+    $is64Only = $false
+  }
+
+  if ($is64Only) {
+    if (Get-OSArchitectureWidth -Compare 64) {
+      # pass
+    } else {
+      Write-Warning "[!] Not installing $name on x86 systems"
+      return $true
+    }
+  }
+
+  if ($pkgargs -eq $null) {
+    $args = $globalCinstArgs
+  } else {
+    $args = $pkgargs,$globalCinstArgs -Join " "
+  }
+
+  if ($args -like "*-source*" -Or $args -like "*--package-parameters*" -Or $args -like "*--parameters*") {
+    Write-Warning "[!] Installing using host choco.exe! Errors are ignored. Please check to confirm $name is installed properly"
+    Write-Warning "[!] Executing: iex choco upgrade $name $args"
+    $rc = iex "choco upgrade $name $args"
+    Write-Host $rc
+  } else {
+    choco upgrade $name $args
+  }
+
+  if ($([System.Environment]::ExitCode) -ne 0 -And $([System.Environment]::ExitCode) -ne 3010) {
+    Write-Host "ExitCode: $([System.Environment]::ExitCode)"
+    return $false
+  }
+  return $true
+}
+
+function InitialSetup {
+  # Basic system setup
+  Update-ExecutionPolicy Unrestricted
+  Set-WindowsExplorerOptions -EnableShowProtectedOSFiles -EnableShowFileExtensions -EnableShowHiddenFilesFoldersDrives
+  Disable-MicrosoftUpdate
+  Disable-BingSearch
+  Disable-GameBarTips
+  Disable-ComputerRestore -Drive ${Env:SystemDrive}
+
+  # Chocolatey setup
+  Write-Host "Initializing chocolatey"
+  iex "choco sources add -n=fireeye -s $fireeyeFeed --priority 1"
+  iex "choco feature enable -n allowGlobalConfirmation"
+  iex "choco feature enable -n allowEmptyChecksums"
+
+  # Create the cache directory
+  New-Item -Path $cache -ItemType directory -Force
+
+  # Create tool list desktop shortcut
+  if (-Not (Test-Path -Path $toolList) ) {
+    New-Item -Path $toolList -ItemType directory
+  }
+
+  # Create C:\Tools directory
+  if (-Not (Test-Path -Path "${Env:HomeDrive}\Tools")) {
+    New-Item -Path "${Env:HomeDrive}\Tools" -ItemType directory
+  }
+
+  $desktopShortcut = Join-Path ${Env:UserProfile} "Desktop\Tools.lnk"
+  Install-ChocolateyShortcut -shortcutFilePath $desktopShortcut -targetPath $toolList
+
+  # Set common paths in environment variables
+  Install-ChocolateyEnvironmentVariable -VariableName "FLARE_START" -VariableValue $toolList -VariableType 'Machine'
+  Install-ChocolateyEnvironmentVariable -VariableName "TOOL_LIST_SHORTCUT" -VariableValue $toolList -VariableType 'Machine'
+  refreshenv
+
+  # BoxStarter setup
+  Set-BoxstarterConfig -NugetSources "$fireeyeFeed;https://chocolatey.org/api/v2"
+
+  # Tweak power options to prevent installs from timing out
+  & powercfg -change -monitor-timeout-ac 0 | Out-Null
+  & powercfg -change -monitor-timeout-dc 0 | Out-Null
+  & powercfg -change -disk-timeout-ac 0 | Out-Null
+  & powercfg -change -disk-timeout-dc 0 | Out-Null
+  & powercfg -change -standby-timeout-ac 0 | Out-Null
+  & powercfg -change -standby-timeout-dc 0 | Out-Null
+  & powercfg -change -hibernate-timeout-ac 0 | Out-Null
+  & powercfg -change -hibernate-timeout-dc 0 | Out-Null
+}
+
+
+function CleanUp
+{
+  # clean up the cache directory
+  Remove-Item $cache -Recurse
+
+  # Final commandovm installation
+  iex "choco upgrade commandovm.win10.config.fireeye $globalCinstArgs"
+}
+
+
+function Main {
+  InitialSetup
+
+  $json = LoadPackages $pkgPath
+  if ($json -eq $null -Or $json.packages -eq $null) {
+    Write-Host "Packages property not found! Exiting"
+    return -1
+  }
+
+  $packages = $json.packages
+  foreach ($pkg in $packages) {
+    $name = $pkg.name
+    $rc = InstallOnePackage $pkg
+    if ($rc) {
+      # Try not to get rate-limited
+      if (-Not ($name.Contains(".flare") -or $name.Contains(".fireeye"))) {
+        Start-Sleep -Seconds 5
+      }
+    } else {
+      Write-Error "Failed to install $name"
+    }
+  }
+
+  CleanUp
+  return 0
+}
+
+
+Main
@@ -0,0 +1,140 @@
+$ErrorActionPreference = 'Continue'
+
+$packageName = 'commandovm.win10.installer.fireeye'
+$toolsDir    = "$(Split-Path -parent $MyInvocation.MyCommand.Definition)"
+
+# Set desktop background to black
+set-itemproperty -path 'HKCU:\Control Panel\Colors' -name Background -value "0 0 0"
+
+# Various options
+$cache =  "$env:userprofile\AppData\Local\ChocoCache"
+$globalCinstArgs = "--cacheLocation $cache"
+$pkgPath = Join-Path $toolsDir "packages.json"
+
+
+function Test-Win64() {
+    return [IntPtr]::size -eq 8
+}
+
+
+# https://stackoverflow.com/questions/28077854/powershell-2-0-convertfrom-json-and-convertto-json-implementation
+function ConvertFrom-Json([object] $item)
+{
+    add-type -assembly system.web.extensions
+    $ps_js=new-object system.web.script.serialization.javascriptSerializer
+
+    #The comma operator is the array construction operator in PowerShell
+    return ,$ps_js.DeserializeObject($item)
+}
+
+
+function LoadPackages
+{
+    try {
+        $json = Get-Content $pkgPath -ErrorAction Stop
+        $packages = ConvertFrom-Json $json
+    } catch {
+        return $null
+    }
+    return $packages
+}
+
+
+function UninstallOnePackage
+{
+    param([hashtable] $pkg)
+    $name = $pkg.name
+    $pkgargs = $pkg.args
+    try {
+        $is64Only = $pkg.x64Only
+    } catch {
+        $is64Only = $false
+    }
+
+    if ($is64Only) {
+        if (Test-WIn64) {
+            # pass
+        } else {
+            Write-Warning "[!] Not uninstalling $name on x86 systems"
+            return $true
+        }
+    }
+
+    if ($pkg.args -eq $null)
+    {
+        $args = $globalCinstArgs
+    } else {
+        $args = $pkgsargs,$globalCinstArgs -Join " "
+    }
+
+    if ($agrs -like "-source") {
+        Write-Warning "[!] Uninstalling using host choco.exe! Errors are not caught. Please check to confirm $name is uninstalled properly"
+        Write-Warning "[!] Uninstalling with choco uninstall $name -x -y $args"
+        $rc = iex "choco uninstall $name -x -y $args"
+    } else {
+        $rc = choco uninstall $name $args
+    }
+    if ($([System.Environment]::ExitCode) -ne 0 -And $([System.Environment]::ExitCode) -ne 3010)
+    {
+        return $false
+    }
+    return $true
+}
+
+
+function PostUninstall
+{
+
+    # Chocolatey setup
+    Write-Host "Initializing chocolatey"
+
+    try {
+        Remove-Item $cache -Recurse
+    } catch {
+        # Ignore exception, in case the directory does not exist.
+    }
+
+    $desktopShortcut = Join-Path ${Env:USERPROFILE} "Desktop\Tools.lnk"
+    Remove-Item $desktopShortcut
+}
+
+
+function PreUninstall
+{
+    try {
+        Remove-Item $cache -Recurse
+    } catch {
+        # Ignore exception, in case the directory does not exist.
+    }
+}
+
+
+function Main {
+    PreUninstall
+
+    $json = LoadPackages $pkgPath
+    Write-Host $json
+    if ($json -eq $null -Or $json.packages -eq $null)
+    {
+        Write-Host "Packages property not found! Exiting"
+        return -1
+    }
+
+    $packages = $json.packages
+    [array]::Reverse($packages)
+    foreach ($pkg in $packages)
+    {
+        $name = $pkg.name
+        Write-Host "Uninstalling $name"
+        $rc = UninstallOnePackage $pkg
+        if ($rc) {
+        } else {
+            Write-Error "Failed to install $name"
+        }
+    }
+
+    PostUninstall
+    return 0
+}
+
+Main
@@ -0,0 +1,175 @@
+{
+    "packages": [
+        {"name": "dotnet4.6.2"},
+        {"name": "dotnet4.7.2"},
+        {"name": "cmder.fireeye"},
+        {"name": "git"},
+        {"name": "adobereader.fireeye"},
+        {"name": "jre8"},
+        {"name": "wireshark.fireeye"},
+        {"name": "cyberchef.flare"},
+        {"name": "firefox.fireeye"},
+        {"name": "vscode.fireeye", "args":"--parameters /NoDesktopIcon --paramsglobal"},
+        {"name": "vcpython27"},
+        {
+            "name": "python2.x86.nopath.flare",
+            "x64Only": true,
+            "args": "--package-parameters \'/InstallDir:C:\\Python27.x86\'"
+        },
+        {"name": "python2"},
+        {"name": "python3"},
+        {"name": "golang"},
+        {"name": "dep"},
+        {"name": "adexplorer.fireeye"},
+        {"name": "rsat.fireeye"},
+        {"name": "tortoisesvn"},
+        {"name": "sysinternals.fireeye"},
+        {"name": "nmap.fireeye"},
+        {"name": "SublimeText3.fireeye"},
+        {"name": "ilspy.flare"},
+        {"name": "dnspy.flare"},
+        {"name": "autoit.fireeye"},
+        {"name": "ScreenToGif.fireeye"},
+        {"name": "telnet.fireeye"},
+        {"name": "citrix-receiver.fireeye"},
+        {"name": "sqlitebrowser.fireeye"},
+        {"name": "putty.fireeye"},
+        {"name": "vmwarevsphereclient.fireeye"},
+        {"name": "vmware-horizon-client.fireeye"},
+        {"name": "mobaxterm.fireeye"},
+        {"name": "processhacker.flare"},
+        {"name": "vlc.fireeye"},
+        {"name": "yed.fireeye"},
+        {"name": "hashcat.fireeye"},
+        {"name": "winrar"},
+        {"name": "7zip"},
+        {"name": "Greenshot.fireeye"},
+        {"name": "winscp.fireeye"},
+        {"name": "keepass.fireeye"},
+        {"name": "zap.fireeye"},
+        {"name": "vnc-viewer.fireeye"},
+        {"name": "hashcat.fireeye"},
+        {"name": "hashcheck"},
+        {
+            "name": "neo4j-community.fireeye",
+            "x64Only": true
+        },
+        {"name": "sqlserver-cmdlineutils.fireeye"},
+        {"name": "peview.flare"},
+        {"name": "shellcode_launcher.flare"},
+        {"name": "x64dbg.fireeye"},
+        {"name": "windbg.fireeye"},
+        {"name": "windbg.kenstheme.flare"},
+        {"name": "proxycap.fireeye"},
+        {"name": "windump.fireeye"},
+        {"name": "hexchat.fireeye"},
+        {"name": "pidgin.fireeye"},
+        {"name": "thunderbird.fireeye"},
+        {"name": "gimp.fireeye"},
+        {"name": "apimonitor.fireeye"},
+        {"name": "orca.fireeye"},
+        {"name": "fiddler.fireeye"},
+        {"name": "hxd.fireeye"},
+        {
+            "name": "metasploit.flare",
+            "x64Only": true
+        },
+        {"name": "burp.free.fireeye"},
+        {"name": "kali_windowsbinaries.fireeye"},
+
+        {"name": "ADACLScanner.fireeye"},
+        {"name": "ADAPE-Script.fireeye"},
+        {"name": "ADOffline.fireeye"},
+        {"name": "ADRecon.fireeye"},
+        {"name": "ASREPRoast.fireeye"},
+        {"name": "BloodHound.fireeye"},
+        {"name": "CheckPlease.fireeye"},
+        {"name": "CredNinja.fireeye"},
+        {"name": "DAMP.fireeye"},
+        {"name": "contextmenu.fireeye"},
+        {"name": "CrackMapExec.fireeye"},
+        {"name": "CrackMapExecWin.fireeye"},
+        {"name": "demiguise.fireeye"},
+        {"name": "DotNetToJScript.fireeye"},
+        {"name": "DSInternals.fireeye"},
+        {"name": "Egress-Assess.fireeye"},
+        {"name": "flare-floss.fireeye"},
+        {"name": "Exchange-AD-Privesc.fireeye"},
+        {"name": "fuzzdb.fireeye"},
+        {"name": "Generate-Macro.fireeye"},
+        {"name": "Get-LAPSPasswords.fireeye"},
+        {"name": "Get-ReconInfo.fireeye"},
+        {"name": "GoFetch.fireeye"},
+        {
+            "name": "gowitness.fireeye",
+            "x64Only": true
+        },
+        
+        {"name": "Grouper2.fireeye"},
+        {"name": "impacket.fireeye"},
+        {"name": "impacket-examples-windows.fireeye"},
+        {"name": "Internal-Monologue.fireeye"},
+        {"name": "Inveigh.fireeye"},
+        {"name": "Invoke-ACLPwn.fireeye"},
+        {"name": "Invoke-CradleCrafter.fireeye"},
+        {"name": "Invoke-DCOM.fireeye"},
+        {"name": "Invoke-DOSfuscation.fireeye"},
+        {"name": "Invoke-Obfuscation.fireeye"},
+        {"name": "Invoke-Phant0m.fireeye"},
+        {"name": "Invoke-PowerThIEf.fireeye"},
+        {"name": "Invoke-PSImage.fireeye"},
+        {"name": "Invoke-TheHash.fireeye"},
+        {"name": "KeeFarce.fireeye"},
+        {"name": "KeeThief.fireeye"},
+        {"name": "LAPSToolkit.fireeye"},
+        {"name": "luckystrike.fireeye"},
+        {"name": "MailSniper.fireeye"},
+        {"name": "metatwin.fireeye"},
+        {"name": "Mimikatz.fireeye"},
+        {"name": "mimikittenz.fireeye"},
+        {"name": "NetshHelperBeacon.fireeye"},
+        {"name": "nishang.fireeye"},
+        {"name": "nps.fireeye"},
+        {"name": "pafishmacro.fireeye"},
+        {"name": "PayloadsAllTheThings.fireeye"},
+        {"name": "PoshC2.fireeye"},
+        {"name": "PowerLessShell.fireeye"},
+        {"name": "PowerLurk.fireeye"},
+        {"name": "PowerPriv.fireeye"},
+        {"name": "PowerShdll.fireeye"},
+        {"name": "PowerShell-Suite.fireeye"},
+        {"name": "PowerSploit.fireeye"},
+        {"name": "PowerUpSQL.fireeye"},
+        {"name": "PowerView.fireeye"},
+        {"name": "PrivExchange.fireeye"},
+        {"name": "PSAmsi.fireeye"},
+        {"name": "PSAttack.fireeye"},
+        {"name": "PSReflect.fireeye"},
+        {"name": "RedTeamPowershellScripts.fireeye"},
+        {"name": "RiskySPN.fireeye"},
+        {"name": "Rubeus.fireeye"},
+        {"name": "ruler.fireeye"},
+        {"name": "SafetyKatz.fireeye"},
+        {"name": "Seatbelt.fireeye"},
+        {"name": "SessionGopher.fireeye"},
+        {"name": "Sharp-Suite.fireeye"},
+        {"name": "SharpDPAPI.fireeye"},
+        {"name": "SharpDump.fireeye"},
+        {"name": "SharpExchangePriv.fireeye"},
+        {"name": "SharpHound.fireeye"},
+        {"name": "SharpRoast.fireeye"},
+        {"name": "SharpUp.fireeye"},
+        {"name": "SharpView.fireeye"},
+        {"name": "SharpWMI.fireeye"},
+        {"name": "SpoolerScanner.fireeye"},
+        {"name": "StarFighters.fireeye"},
+        {"name": "SpoolSample.fireeye"},
+        {"name": "UACME.fireeye"},
+        {"name": "vssown.fireeye"},
+        {"name": "WMImplant.fireeye"},
+        {"name": "WMIOps.fireeye"},
+        {"name": "zBang.fireeye"},
+        {"name": "Elite.fireeye"},
+        {"name": "openvpn.fireeye", "args":"--parameters \'/SELECT_SHORTCUTS=0 /SELECT_LAUNCH=0\'"}
+    ]
+}
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
+  <metadata>
+    <id>commandovm.win10.preconfig.fireeye</id>
+    <version>1.0</version>
+    <title>CommandoVM</title>
+    <authors>Jake Barteaux</authors>
+    <description>CommandoVM - Penetration Testing Distribution</description>
+  </metadata>
+</package>
@@ -0,0 +1 @@
+@powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0Win10.ps1" -include "%~dp0Win10.psm1" -preset "%~dpn0.preset"
@@ -0,0 +1,194 @@
+##########
+# Win 10 / Server 2016 / Server 2019 Initial Setup Script - Default preset
+# Author: Disassembler <[email protected]>
+# Version: v3.6, 2019-01-28
+# Source: https://github.com/Disassembler0/Win10-Initial-Setup-Script
+##########
+
+### Require administrator privileges ###
+RequireAdmin
+
+### Privacy Tweaks ###
+DisableTelemetry                # EnableTelemetry
+DisableWiFiSense                # EnableWiFiSense
+# DisableSmartScreen            # EnableSmartScreen
+DisableWebSearch                # EnableWebSearch
+DisableAppSuggestions           # EnableAppSuggestions
+DisableActivityHistory          # EnableActivityHistory
+DisableBackgroundApps           # EnableBackgroundApps
+DisableLocationTracking         # EnableLocationTracking
+DisableMapUpdates               # EnableMapUpdates
+DisableFeedback                 # EnableFeedback
+DisableTailoredExperiences      # EnableTailoredExperiences
+DisableAdvertisingID            # EnableAdvertisingID
+DisableWebLangList              # EnableWebLangList
+DisableCortana                  # EnableCortana
+DisableErrorReporting           # EnableErrorReporting
+# SetP2PUpdateLocal             # SetP2PUpdateInternet          # SetP2PUpdateDisable
+DisableDiagTrack                # EnableDiagTrack
+DisableWAPPush                  # EnableWAPPush
+# EnableClearRecentFiles        # DisableClearRecentFiles
+# DisableRecentFiles            # EnableRecentFiles
+
+### Security Tweaks ###
+SetUACLow                       # SetUACHigh
+# EnableSharingMappedDrives     # DisableSharingMappedDrives
+DisableAdminShares              # EnableAdminShares
+DisableSMB1                   # EnableSMB1
+# DisableSMBServer              # EnableSMBServer
+DisableLLMNR                  # EnableLLMNR
+# DisableNCSIProbe              # EnableNCSIProbe
+SetCurrentNetworkPrivate        # SetCurrentNetworkPublic
+# SetUnknownNetworksPrivate     # SetUnknownNetworksPublic
+# DisableNetDevicesAutoInst     # EnableNetDevicesAutoInst
+# DisableFirewall               # EnableFirewall
+# HideDefenderTrayIcon          # ShowDefenderTrayIcon
+DisableDefender               # EnableDefender
+DisableDefenderCloud          # EnableDefenderCloud
+# EnableCtrldFolderAccess       # DisableCtrldFolderAccess
+# EnableCIMemoryIntegrity       # DisableCIMemoryIntegrity
+DisableDefenderAppGuard        # EnableDefenderAppGuard
+HideAccountProtectionWarn       # ShowAccountProtectionWarn
+DisableDownloadBlocking       # EnableDownloadBlocking
+DisableScriptHost               # EnableScriptHost
+EnableDotNetStrongCrypto        # DisableDotNetStrongCrypto
+# EnableMeltdownCompatFlag      # DisableMeltdownCompatFlag
+EnableF8BootMenu                # DisableF8BootMenu
+# DisableBootRecovery           # EnableBootRecovery
+# DisableRecoveryAndReset       # EnableRecoveryAndReset
+# SetDEPOptOut                    # SetDEPOptIn
+
+### Service Tweaks ###
+DisableUpdateMSRT             # EnableUpdateMSRT
+# DisableUpdateDriver           # EnableUpdateDriver
+DisableUpdateRestart            # EnableUpdateRestart
+# DisableHomeGroups             # EnableHomeGroups
+DisableSharedExperiences        # EnableSharedExperiences
+DisableRemoteAssistance         # EnableRemoteAssistance
+# EnableRemoteDesktop             # DisableRemoteDesktop
+DisableAutoplay                 # EnableAutoplay
+DisableAutorun                  # EnableAutorun
+# DisableRestorePoints          # EnableRestorePoints
+# EnableStorageSense            # DisableStorageSense
+# DisableDefragmentation        # EnableDefragmentation
+# DisableSuperfetch             # EnableSuperfetch
+# DisableIndexing               # EnableIndexing
+# DisableSwapFile               # EnableSwapFile
+# DisableNTFSLastAccess         # EnableNTFSLastAccess
+# SetBIOSTimeUTC                # SetBIOSTimeLocal
+# EnableHibernation             # DisableHibernation
+# DisableSleepButton            # EnableSleepButton
+# DisableSleepTimeout           # EnableSleepTimeout
+# DisableFastStartup            # EnableFastStartup
+# DisableAutoRebootOnCrash      # EnableAutoRebootOnCrash
+
+### UI Tweaks ###
+DisableActionCenter             # EnableActionCenter
+DisableLockScreen               # EnableLockScreen
+# DisableLockScreenRS1          # EnableLockScreenRS1
+HideNetworkFromLockScreen       # ShowNetworkOnLockScreen
+HideShutdownFromLockScreen      # ShowShutdownOnLockScreen
+DisableAeroShake              # EnableAeroShake
+DisableStickyKeys               # EnableStickyKeys
+ShowTaskManagerDetails          # HideTaskManagerDetails
+ShowFileOperationsDetails       # HideFileOperationsDetails
+# EnableFileDeleteConfirm       # DisableFileDeleteConfirm
+# HideTaskbarSearch               # ShowTaskbarSearchIcon         # ShowTaskbarSearchBox
+# HideTaskView                    # ShowTaskView
+# ShowSmallTaskbarIcons           # ShowLargeTaskbarIcons
+# SetTaskbarCombineWhenFull       # SetTaskbarCombineNever        # SetTaskbarCombineAlways
+HideTaskbarPeopleIcon           # ShowTaskbarPeopleIcon
+ShowTrayIcons                   # HideTrayIcons
+# DisableSearchAppInStore         # EnableSearchAppInStore
+DisableNewAppPrompt             # EnableNewAppPrompt
+# HideRecentlyAddedApps         # ShowRecentlyAddedApps
+# HideMostUsedApps              # ShowMostUsedApps
+SetControlPanelSmallIcons     # SetControlPanelLargeIcons     # SetControlPanelCategories
+DisableShortcutInName           # EnableShortcutInName
+# HideShortcutArrow             # ShowShortcutArrow
+SetVisualFXPerformance          # SetVisualFXAppearance
+# EnableTitleBarColor           # DisableTitleBarColor
+EnableDarkTheme               # DisableDarkTheme
+# AddENKeyboard                 # RemoveENKeyboard
+# EnableNumlock                 # DisableNumlock
+# DisableEnhPointerPrecision    # EnableEnhPointerPrecision
+# SetSoundSchemeNone            # SetSoundSchemeDefault
+# DisableStartupSound           # EnableStartupSound
+# DisableChangingSoundScheme    # EnableChangingSoundScheme
+
+### Explorer UI Tweaks ###
+ShowKnownExtensions             # HideKnownExtensions
+ShowHiddenFiles                 # HideHiddenFiles
+EnableNavPaneExpand             # DisableNavPaneExpand
+# EnableFldrSeparateProcess     # DisableFldrSeparateProcess
+# EnableRestoreFldrWindows      # DisableRestoreFldrWindows
+# DisableSharingWizard          # EnableSharingWizard
+# HideSelectCheckboxes          # ShowSelectCheckboxes
+HideSyncNotifications           # ShowSyncNotifications
+HideRecentShortcuts             # ShowRecentShortcuts
+SetExplorerThisPC               # SetExplorerQuickAccess
+HideQuickAccess                 # ShowQuickAccess
+ShowThisPCOnDesktop             # HideThisPCFromDesktop
+# ShowUserFolderOnDesktop       # HideUserFolderFromDesktop
+# ShowControlPanelOnDesktop     # HideControlPanelFromDesktop
+HideDesktopFromThisPC           # ShowDesktopInThisPC
+# HideDesktopFromExplorer       # ShowDesktopInExplorer
+# HideDocumentsFromThisPC         # ShowDocumentsInThisPC
+# HideDocumentsFromExplorer     # ShowDocumentsInExplorer
+# HideDownloadsFromThisPC         # ShowDownloadsInThisPC
+# HideDownloadsFromExplorer     # ShowDownloadsInExplorer
+HideMusicFromThisPC             # ShowMusicInThisPC
+# HideMusicFromExplorer         # ShowMusicInExplorer
+HidePicturesFromThisPC          # ShowPicturesInThisPC
+# HidePicturesFromExplorer      # ShowPicturesInExplorer
+HideVideosFromThisPC            # ShowVideosInThisPC
+# HideVideosFromExplorer        # ShowVideosInExplorer
+Hide3DObjectsFromThisPC         # Show3DObjectsInThisPC
+# Hide3DObjectsFromExplorer     # Show3DObjectsInExplorer
+# HideIncludeInLibraryMenu      # ShowIncludeInLibraryMenu
+# HideGiveAccessToMenu          # ShowGiveAccessToMenu
+# HideShareMenu                 # ShowShareMenu
+# DisableThumbnails             # EnableThumbnails
+DisableThumbnailCache           # EnableThumbnailCache
+DisableThumbsDBOnNetwork        # EnableThumbsDBOnNetwork
+
+### Application Tweaks ###
+DisableOneDrive                 # EnableOneDrive
+UninstallOneDrive               # InstallOneDrive
+UninstallMsftBloat              # InstallMsftBloat
+UninstallThirdPartyBloat        # InstallThirdPartyBloat
+# UninstallWindowsStore         # InstallWindowsStore
+DisableXboxFeatures             # EnableXboxFeatures
+DisableAdobeFlash               # EnableAdobeFlash
+DisableEdgePreload              # EnableEdgePreload
+DisableEdgeShortcutCreation     # EnableEdgeShortcutCreation
+DisableIEFirstRun               # EnableIEFirstRun
+# UninstallMediaPlayer          # InstallMediaPlayer
+# UninstallInternetExplorer     # InstallInternetExplorer
+# UninstallWorkFolders          # InstallWorkFolders
+# UninstallPowerShellV2         # InstallPowerShellV2
+InstallLinuxSubsystem         # UninstallLinuxSubsystem
+InstallHyperV                 # UninstallHyperV
+# InstallNET23                  # UninstallNET23
+SetPhotoViewerAssociation       # UnsetPhotoViewerAssociation
+AddPhotoViewerOpenWith          # RemovePhotoViewerOpenWith
+# UninstallPDFPrinter           # InstallPDFPrinter
+UninstallXPSPrinter             # InstallXPSPrinter
+RemoveFaxPrinter                # AddFaxPrinter
+UninstallFaxAndScan           # InstallFaxAndScan
+
+### Server Specific Tweaks ###
+# HideServerManagerOnLogin      # ShowServerManagerOnLogin
+# DisableShutdownTracker        # EnableShutdownTracker
+# DisablePasswordPolicy         # EnablePasswordPolicy
+# DisableCtrlAltDelLogin        # EnableCtrlAltDelLogin
+# DisableIEEnhancedSecurity     # EnableIEEnhancedSecurity
+# EnableAudio                   # DisableAudio
+
+### Unpinning ###
+UnpinStartMenuTiles
+UnpinTaskbarIcons
+
+### Auxiliary Functions ###
+# WaitForKey
+# Restart
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2017 Disassembler <[email protected]>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
@@ -0,0 +1,271 @@
+## Contents
+ - [Description](#description)
+ - [Usage](#usage)
+ - [FAQ](#faq)
+ - [Windows builds overview](#windows-builds-overview)
+ - [Advanced usage](#advanced-usage)
+ - [Maintaining own forks](#maintaining-own-forks)
+ - [Contribution guidelines](#contribution-guidelines)
+
+&nbsp;
+
+## Description
+
+This is a PowerShell script for automation of routine tasks done after fresh installations of Windows 10 and Windows Server 2016 / 2019. This is by no means any complete set of all existing Windows tweaks and neither is it another "antispying" type of script. It's simply a setting which I like to use and which in my opinion make the system less obtrusive.
+
+&nbsp;
+
+## Usage
+If you just want to run the script with the default preset, download and unpack the [latest release](https://github.com/Disassembler0/Win10-Initial-Setup-Script/releases) and then simply double-click on the *Default.cmd* file and confirm *User Account Control* prompt. Make sure your account is a member of *Administrators* group as the script attempts to run with elevated privileges.
+
+The script supports command line options and parameters which can help you customize the tweak selection or even add your own custom tweaks, however these features require some basic knowledge of command line usage and PowerShell scripting. Refer to [Advanced usage](#advanced-usage) section for more details.
+
+&nbsp;
+
+## FAQ
+
+**Q:** Can I run the script safely?  
+**A:** Definitely not. You have to understand what the functions do and what will be the implications for you if you run them. Some functions lower security, hide controls or uninstall applications. **If you're not sure what the script does, do not attempt to run it!**
+
+**Q:** Can I run the script repeatedly?  
+**A:** Yes! In fact the script has been written to support exactly that, as it's not uncommon that big Windows Updates reset some of the settings.
+
+**Q:** Which versions and editions of Windows are supported?  
+**A:** The script aims to be fully compatible with the most up-to-date 64bit version of Windows 10 receiving updates from semi-annual channel, however if you create your own preset and exclude the incompatible tweaks, it will work also on LTSB/LTSC and possibly also on 32bit systems. Vast majority of the tweaks will work on all Windows editions. Some of them rely on group policy settings, so there may be a few limitations for Home and Education editions.
+
+**Q:** Can I run the script on Windows Server 2016 or 2019?  
+**A:** Yes. Starting from version 2.5, Windows Server is supported. There are even few tweaks specific to Server environment. Keep in mind though, that the script is still primarily designed for Windows 10, so you have to create your own preset.
+
+**Q:** Can I run the script on Windows 7, 8, 8.1 or other versions of Windows?  
+**A:** No. Although some tweaks may work also on older versions of Windows, the script is developed only for Windows 10 and Windows Server 2016 / 2019. There are no plans to support older versions.
+
+**Q:** Can I run the script in multi-user environment?  
+**A:** Yes, to certain extent. Some tweaks (most notably UI tweaks) are set only for the user currently executing the script. As stated above, the script can be run repeatedly; therefore it's possible to run it multiple times, each time as different user. Due to the nature of authentication and privilege escalation mechanisms in Windows, most of the tweaks can be successfully applied only by users belonging to *Administrators* group. Standard users will get an UAC prompt asking for admin credentials which then causes the tweaks to be applied to the given admin account instead of the original non-privileged one. There are a few ways how this can be circumvented programmatically, but I'm not planning to include any as it would negatively impact code complexity and readability. If you still wish to try to use the script in multi-user environment, check [this answer in issue #29](https://github.com/Disassembler0/Win10-Initial-Setup-Script/issues/29#issuecomment-333040591) for some pointers.
+
+**Q:** Did you test the script?  
+**A:** Yes. I'm testing new additions on up-to-date 64bit Home and Enterprise editions in VMs. I'm also regularly using it for all my home installations after all bigger updates.
+
+**Q**: I've run the script and it did something I don't like, how can I undo it?  
+**A:** For every tweak, there is also a corresponding function which restores the default settings. The default is considered freshly installed Windows 10 or Windows Server 2016 with no adjustments made during or after the installation. Use the tweaks to create and run new preset. Alternatively, since some functions are just automation for actions which can be done using GUI, find appropriate control and modify it manually.
+
+**Q:** I've run the script and some controls are now greyed out and display message "*Some settings are hidden or managed by your organization*", why?  
+**A:** To ensure that system-wide tweaks are applied smoothly and reliably, some of them make use of *Group Policy Objects* (*GPO*). The same mechanism is employed also in companies managing their computers in large scale, so the users without administrative privileges can't change the settings. If you wish to change a setting locked by GPO, apply the appropriate restore tweak and the control will become available again.
+
+**Q:** I've run the script and it broke my computer / killed neighbor's dog / caused world war 3.  
+**A:** I don't care. Also, that's not a question.
+
+**Q:** I'm using a tweak for &lt;feature&gt; on my installation, can you add it?  
+**A:** Submit a PR, create a feature request issue or drop me a message. If I find the functionality simple, useful and not dependent on any 3rd party modules or executables (including also *Chocolatey*, *NuGet*, *Ninite* or other automation solutions), I might add it.
+
+**Q:** Can I use the script or modify it for my / my company's needs?  
+**A:** Sure, knock yourself out. Just don't forget to include copyright notice as per MIT license requirements. I'd also suggest including a link to this GitHub repo as it's very likely that something will be changed, added or improved to keep track with future versions of Windows 10.
+
+**Q:** Why are there repeated pieces of code throughout some functions?  
+**A:** So you can directly take a function block or a line from within a function and use it elsewhere, without elaborating on any dependencies.
+
+**Q:** For how long are you going to maintain the script?  
+**A:** As long as I use Windows 10.
+
+**Q:** I really like the script. Can I send a donation?  
+**A:** Feel free to send donations via [PayPal](https://www.paypal.me/Disassembler). Any amount is appreciated, but keep in mind that donations are completely voluntary and I'm not obliged to make any script adjustments in your favor regardless of the donated amount. You can also drop me a mail to discuss an alternative way.
+
+&nbsp;
+
+## Windows builds overview
+
+| Version |        Code name        |     Marketing name     | Build |
+| :-----: | ----------------------- | ---------------------- | :---: |
+|  1507   | Threshold 1 (TH1 / RTM) | N/A                    | 10240 |
+|  1511   | Threshold 2 (TH2)       | November Update        | 10586 |
+|  1607   | Redstone 1 (RS1)        | Anniversary Update     | 14393 |
+|  1703   | Redstone 2 (RS2)        | Creators Update        | 15063 |
+|  1709   | Redstone 3 (RS3)        | Fall Creators Update   | 16299 |
+|  1803   | Redstone 4 (RS4)        | April 2018 Update      | 17134 |
+|  1809   | Redstone 5 (RS5)        | October 2018 Update    | 17763 |
+
+&nbsp;
+
+## Advanced usage
+
+    powershell.exe -NoProfile -ExecutionPolicy Bypass -File Win10.ps1 [-include filename] [-preset filename] [[!]tweakname]
+
+    -include filename       load module with user-defined tweaks
+    -preset filename        load preset with tweak names to apply
+    tweakname               apply tweak with this particular name
+    !tweakname              remove tweak with this particular name from selection
+
+### Presets
+
+The tweak library consists of separate idempotent functions, containing one tweak each. The functions can be grouped to *presets*. Preset is simply a list of function names which should be called. Any function which is not present or is commented in a preset will not be called, thus the corresponding tweak will not be applied. In order for the script to do something, you need to supply at least one tweak library via `-include` and at least one tweak name, either via `-preset` or directly as command line argument.
+
+The tweak names can be prefixed with exclamation mark (`!`) which will instead cause the tweak to be removed from selection. This is useful in cases when you want to apply the whole preset, but omit a few specific tweaks in the current run. Alternatively, you can have a preset which "patches" another preset by adding and removing a small amount of tweaks.
+
+To supply a customized preset, you can either pass the function names directly as arguments.
+
+    powershell.exe -NoProfile -ExecutionPolicy Bypass -File Win10.ps1 -include Win10.psm1 EnableFirewall EnableDefender
+
+Or you can create a file where you write the function names (one function name per line, no commas or quotes, whitespaces allowed, comments starting with `#`) and then pass the filename using `-preset` parameter.  
+Example of a preset file `mypreset.txt`:
+
+    # Security tweaks
+    EnableFirewall
+    EnableDefender
+
+    # UI tweaks
+    ShowKnownExtensions
+    ShowHiddenFiles   # Only hidden, not system
+
+Command using the preset file above:
+
+    powershell.exe -NoProfile -ExecutionPolicy Bypass -File Win10.ps1 -include Win10.psm1 -preset mypreset.txt
+
+### Includes
+
+The script also supports inclusion of custom tweaks from user-supplied modules passed via `-include` parameter. The content of the user-supplied module is completely up to the user, however it is strongly recommended to have the tweaks separated in respective functions as the main tweak library has. The user-supplied scripts are loaded into the main script via `Import-Module`, so the library should ideally be a `.psm1` PowerShell module. 
+Example of a user-supplied tweak library `mytweaks.psm1`:
+
+```powershell
+Function MyTweak1 {
+    Write-Output "Running MyTweak1..."
+    # Do something
+}
+
+Function MyTweak2 {
+    Write-Output "Running MyTweak2..."
+    # Do something else
+}
+```
+
+Command using the script above:
+
+    powershell.exe -NoProfile -ExecutionPolicy Bypass -File Win10.ps1 -include mytweaks.psm1 MyTweak1 MyTweak2
+
+### Combination
+
+All features described above can be combined. You can have a preset which includes both tweaks from the original script and your personal ones. Both `-include` and `-preset` options can be used more than once, so you can split your tweaks into groups and then combine them based on your current needs. The `-include` modules are always imported before the first tweak is applied, so the order of the command line parameters doesn't matter and neither does the order of the tweaks (except for `RequireAdmin`, which should always be called first and `Restart`, which should be always called last). It can happen that some tweaks are applied more than once during a singe run because you have them in multiple presets. That shouldn't cause any problems as the tweaks are idempotent.  
+Example of a preset file `otherpreset.txt`:
+
+    MyTweak1
+    MyTweak2
+    !ShowHiddenFiles   # Will remove the tweak from selection
+    WaitForKey
+
+Command using all three examples combined:
+
+    powershell.exe -NoProfile -ExecutionPolicy Bypass -File Win10.ps1 -include Win10.psm1 -include mytweaks.psm1 -preset mypreset.txt -preset otherpreset.txt Restart
+
+&nbsp;
+
+## Maintaining own forks
+
+The easiest way to customize the script settings it is to create your own preset and, if needed, your own tweak scripts as described above. For easy start, you can base the modifications on the *Default.cmd* and *Default.preset* and maintain just that. If you choose to fork the script anyway, you don't need to comment or remove the actual functions in *Win10.psm1*, because if they are not called, they are not used.
+
+If you wish to make more elaborate modifications of the basic script and incorporate some personal tweaks or adjustments, then I suggest doing it in a following way:
+
+1. Fork the repository on GitHub (obviously).
+2. Clone your fork on your computer.
+
+    ```
+    git clone https://github.com/<yournamehere>/Win10-Initial-Setup-Script
+    cd Win10-Initial-Setup-Script
+    ```
+
+3. Add the original repository as a remote (*upstream*).
+
+    ```
+    git remote add upstream https://github.com/Disassembler0/Win10-Initial-Setup-Script
+    ```
+
+4. Commit your modifications as you see fit.
+5. Once there are new additions in the upstream, create a temporary branch, fetch the changes and reset the branch to be identical with this repository.
+
+    ```
+    git branch upstream
+    git checkout upstream
+    git fetch upstream
+    git reset --hard upstream/master
+    ```
+
+6. When you have the upstream branch up to date, check back your master and rebase it based on the upstream branch. If there are some conflicts between the changesets, you'll be asked to resolve them manually.
+
+    ```
+    git checkout master
+    git rebase upstream
+    ```
+
+7. Eventually, delete the upstream branch and force push your changes back onto GitHub.
+
+    ```
+    git branch -D upstream
+    git push -f master
+    ```
+
+**Word of warning:** Rebasing and force-pushing will change the history of your commits. The upside is that your adjustments will always stay on top of the commit history. The downside is that everybody remote-tracking your repository will always have to rebase and force-push too, otherwise their commit history will not match yours.
+
+&nbsp;
+
+## Contribution guidelines
+
+Following is a list of rules which I'm trying to apply in this project. The rules are not binding and I accept pull requests even if they don't adhere to them, as long as their purpose and content are clear. In cases when there are too many rule violations, I might simply redo the whole functionality and reject the PR while still crediting you. If you'd like to make my work easier, please consider adhering to the following rules too.
+
+### Function naming
+Try to give a function a meaningful name up to 25 characters long, which gives away the purpose of the function. Use verbs like `Enable`/`Disable`, `Show`/`Hide`, `Install`/`Uninstall`, `Add`/`Remove` in the beginning of the function name. In case the function doesn't fit any of these verbs, come up with another name, beginning with the verb `Set`, which indicates what the function does, e.g. `SetCurrentNetworkPrivate` and `SetCurrentNetworkPublic`.
+
+### Revert functions
+Always add a function with opposite name (or equivalent) which reverts the behavior to default. The default is considered freshly installed Windows 10 or Windows Server 2016 / 2019 with no adjustments made during or after the installation. If you don't have access to either of these, create the revert function to the best of your knowledge and I will fill in the rest if necessary.
+
+### Function similarities
+Check if there isn't already a function with similar purpose as the one you're trying to add. As long as the name and objective of the existing function is unchanged, feel free to add your tweak to that function rather than creating a new one.
+
+### Function grouping
+Try to group functions thematically. There are already several major groups (privacy, security, services etc.), but even within these, some tweaks may be related to each other. In such case, add a new tweak below the existing one and not to the end of the whole group.
+
+### Default preset
+Always add a reference to the tweak and its revert function in the *Default.preset*. Add references to both functions on the same line (mind the spaces) and always comment out the revert function. Whether to comment out also the tweak in the default preset is a matter of personal preference. The rule of thumb is that if the tweak makes the system faster, smoother, more secure and less obtrusive, it should be enabled by default. Usability has preference over performance (that's why e.g. indexing is kept enabled).
+
+### Repeatability
+Unless applied on unsupported system, all functions have to be applicable repeatedly without any errors. When you're creating a registry key, always check first if the key doesn't happen to already exist. When you're deleting registry value, always append `-ErrorAction SilentlyContinue` to prevent errors while deleting already deleted values.
+
+### Input / output hiding
+Suppress all output generated by commands and cmdlets using `| Out-Null` or `-ErrorAction SilentlyContinue` where applicable. Whenever an input is needed, use appropriate arguments to suppress the prompt and programmatically provide values for the command to run (e.g. using `-Confirm:$false`). The only acceptable output is from the `Write-Output` cmdlets in the beginning of each function and from non-suppressible cmdlets like `Remove-AppxPackage`.
+
+### Registry
+Create the registry keys only if they don't exist on fresh installation if Windows 10 or Windows Server 2016 / 2019. When deleting registry, delete only registry values, not the whole keys. When you're setting registry values, always use `Set-ItemProperty` instead of `New-ItemProperty`. When you're removing registry values, choose either `Set-ItemProperty` or `Remove-ItemProperty` to reinstate the same situation as it was on the clean installation. Again, if you don't know what the original state was, let me know in PR description and I will fill in the gaps. When you need to use `HKEY_USERS` registry hive, always add following snippet before the registry modification to ensure portability.
+
+```powershell
+If (!(Test-Path "HKU:")) {
+    New-PSDrive -Name HKU -PSProvider Registry -Root HKEY_USERS | Out-Null
+}
+```
+
+### Force usage
+Star Wars jokes aside, don't use `-Force` option unless absolutely necessary. The only permitted case is when you're creating a new registry key (not a value) and you need to ensure that all parent keys will be created as well. In such case always check first if the key doesn't already exist, otherwise you will delete all its existing values.
+
+### Comments
+Always add a simple comment above the function briefly describing what the function does, especially if it has an ambiguous name or if there is some logic hidden under the hood. If you know that the tweak doesn't work on some editions of Windows 10 or on Windows Server, state it in the comment too. Add a `Write-Output` cmdlet with the short description of action also to the first line of the function body, so the user can see what is being executed and which function is the problematic one whenever an error occurs. The comment is written in present simple tense, the `Write-Output` in present continuous with ellipsis (resp. three dots) at the end.
+
+### Coding style
+Indent using tabs, enclose all string values in double quotes (`"`) and strictly use `PascalCase` wherever possible. Put opening curly bracket on the same line as the function name or condition, but leave the closing bracket on a separate line for readability.
+
+### Examples
+
+**Naming example**: Consider function `EnableFastMenu`. What does it do? Which menu? How fast is *fast*? A better name might be `EnableFastMenuFlyout`, so it's a bit clearer that we're talking about the menu flyouts delays. But the counterpart function would be `DisableFastMenuFlyouts` which is not entirely true. We're not *disabling* anything, we're just making it slow again. So even better might be to name them `SetFastMenuFlyouts` and `SetSlowMenuFlyouts`. Or better yet, just add the functionality to already existing `SetVisualFXPerformance`/`SetVisualFXAppearance`. Even though the names are not 100% match, they aim to tweak similar aspects and operate within the same registry keys.
+
+**Coding example:** The following code applies most of the rules mentioned above (naming, output hiding, repeatability, force usage, comments and coding style).
+
+```powershell
+# Enable some feature
+Function EnableSomeFeature {
+    Write-Output "Enabling some feature..."
+    If (!(Test-Path "HKLM:\Some\Registry\Key")) {
+        New-Item -Path "HKLM:\Some\Registry\Key" -Force | Out-Null
+    }
+    Set-ItemProperty -Path "HKLM:\Some\Registry\Key" -Name "SomeValueName" -Type String -Value "SomeValue"
+}
+
+# Disable some feature
+Function DisableSomeFeature {
+    Write-Output "Disabling some feature..."
+    Remove-ItemProperty -Path "HKLM:\Some\Registry\Key" -Name "SomeValueName" -ErrorAction SilentlyContinue
+}
+```
@@ -0,0 +1,53 @@
+##########
+# Win 10 / Server 2016 / Server 2019 Initial Setup Script - Main execution loop
+# Author: Disassembler <[email protected]>
+# Version: v3.6, 2019-01-28
+# Source: https://github.com/Disassembler0/Win10-Initial-Setup-Script
+##########
+
+# Relaunch the script with administrator privileges
+Function RequireAdmin {
+	If (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]"Administrator")) {
+		Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`" $PSCommandArgs" -Verb RunAs
+		Exit
+	}
+}
+
+$tweaks = @()
+$PSCommandArgs = @()
+
+Function AddOrRemoveTweak($tweak) {
+	If ($tweak[0] -eq "!") {
+		# If the name starts with exclamation mark (!), exclude the tweak from selection
+		$script:tweaks = $script:tweaks | Where-Object { $_ -ne $tweak.Substring(1) }
+	} ElseIf ($tweak -ne "") {
+		# Otherwise add the tweak
+		$script:tweaks += $tweak
+	}
+}
+
+# Parse and resolve paths in passed arguments
+$i = 0
+While ($i -lt $args.Length) {
+	If ($args[$i].ToLower() -eq "-include") {
+		# Resolve full path to the included file
+		$include = Resolve-Path $args[++$i]
+		$PSCommandArgs += "-include `"$include`""
+		# Import the included file as a module
+		Import-Module -Name $include
+	} ElseIf ($args[$i].ToLower() -eq "-preset") {
+		# Resolve full path to the preset file
+		$preset = Resolve-Path $args[++$i]
+		$PSCommandArgs += "-preset `"$preset`""
+		# Load tweak names from the preset file
+		Get-Content $preset -ErrorAction Stop | ForEach-Object { AddOrRemoveTweak($_.Split("#")[0].Trim()) }
+	} Else {
+		$PSCommandArgs += $args[$i]
+		# Load tweak names from command line
+		AddOrRemoveTweak($args[$i])
+	}
+	$i++
+}
+
+# Call the desired tweak functions
+$tweaks | ForEach-Object { Invoke-Expression $_ }
@@ -0,0 +1,10 @@
+$ErrorActionPreference = 'Continue'
+
+$packageName = 'commandovm.win10.preconfig.fireeye'
+$toolsDir    = "$(Split-Path -parent $MyInvocation.MyCommand.Definition)"
+
+$ps1 = Join-Path $toolsDir 'Win10.ps1'
+$psm1 = Join-Path $toolsDir 'Win10.psm1'
+$preset = Join-Path $toolsDir 'Default.preset'
+
+powershell.exe -NoProfile -File "$ps1" -include "$psm1" -preset "$preset"
@@ -0,0 +1,9 @@
+$ErrorActionPreference = 'Stop'; # stop on all errors
+
+$packageName = 'flarevm'
+try {
+	$desktopReadme = Join-Path ${Env:USERPROFILE} "Desktop\README.txt"
+	Copy-Item $desktopReadme
+} catch {
+	# pass
+}
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
+  <metadata>
+    <id>commandovm.win7.config.fireeye</id>
+    <version>1.0.0.2</version>
+    <title>CommandoVM</title>
+    <authors>Jake Barteaux</authors>
+    <description>CommandoVM - Penetration Testing Distribution</description>
+  </metadata>
+</package>
@@ -0,0 +1,293 @@
+$ErrorActionPreference = 'Continue'
+function Set-PinnedApplication { 
+  [CmdletBinding()] 
+  param( 
+  [Parameter(Mandatory=$true)][string]$Action,  
+  [Parameter(Mandatory=$true)][string]$FilePath 
+  ) 
+  if(-not (test-path $FilePath)) {  
+    throw "FilePath does not exist."   
+  } 
+    
+  function InvokeVerb { 
+    param([string]$FilePath,$verb) 
+    $verb = $verb.Replace("&","") 
+    $path= split-path $FilePath 
+    $shell=new-object -com "Shell.Application"  
+    $folder=$shell.Namespace($path)    
+    $item = $folder.Parsename((split-path $FilePath -leaf)) 
+    $itemVerb = $item.Verbs() | ? {$_.Name.Replace("&","") -eq $verb} 
+    if($itemVerb -eq $null){ 
+      throw "Verb $verb not found."             
+    } else { 
+      $itemVerb.DoIt() 
+    } 
+  }
+
+  function GetVerb { 
+    param([int]$verbId) 
+    try { 
+      $t = [type]"CosmosKey.Util.MuiHelper" 
+    } catch { 
+      $def = [Text.StringBuilder]"" 
+      [void]$def.AppendLine('[DllImport("user32.dll")]') 
+      [void]$def.AppendLine('public static extern int LoadString(IntPtr h,uint id, System.Text.StringBuilder sb,int maxBuffer);') 
+      [void]$def.AppendLine('[DllImport("kernel32.dll")]') 
+      [void]$def.AppendLine('public static extern IntPtr LoadLibrary(string s);') 
+      add-type -MemberDefinition $def.ToString() -name MuiHelper -namespace CosmosKey.Util             
+    } 
+    if($global:CosmosKey_Utils_MuiHelper_Shell32 -eq $null){         
+      $global:CosmosKey_Utils_MuiHelper_Shell32 = [CosmosKey.Util.MuiHelper]::LoadLibrary("shell32.dll") 
+    } 
+    $maxVerbLength=255 
+    $verbBuilder = new-object Text.StringBuilder "",$maxVerbLength 
+    [void][CosmosKey.Util.MuiHelper]::LoadString($CosmosKey_Utils_MuiHelper_Shell32,$verbId,$verbBuilder,$maxVerbLength) 
+    return $verbBuilder.ToString() 
+  } 
+
+  $verbs = @{  
+    "PintoStartMenu"=5381 
+    "UnpinfromStartMenu"=5382 
+    "PintoTaskbar"=5386 
+    "UnpinfromTaskbar"=5387 
+  } 
+      
+  if($verbs.$Action -eq $null){ 
+    Throw "Action $action not supported`nSupported actions are:`n`tPintoStartMenu`n`tUnpinfromStartMenu`n`tPintoTaskbar`n`tUnpinfromTaskbar" 
+  } 
+  InvokeVerb -FilePath $FilePath -Verb $(GetVerb -VerbId $verbs.$action) 
+} 
+
+$packageName = 'commandovm.win7.config.fireeye'
+$toolsDir    = "$(Split-Path -parent $MyInvocation.MyCommand.Definition)"
+
+### Commando Windows 7 Attack VM ###
+Write-Host "[+] Beginning host configuration..." -ForegroundColor Green
+Write-Host "[+] Disabling LLMNR (No pwning yourself with Responder!)" -ForegroundColor Green
+
+
+#### Disable LLMNR ####
+$registryPath = "HKLM:\Software\policies\Microsoft\Windows NT\DNSClient"
+if (-Not (Test-Path $registryPath)) {
+  New-Item -path $registryPath -Force | Out-Null
+}
+New-ItemProperty -Path $registryPath -Name "EnableMulticast" -Value 0 -PropertyType DWORD -Force | Out-Null
+
+
+#### Disable services ####
+Write-Host "[-] Disabling services" -ForegroundColor Green
+Set-Service MpsSvc -StartupType Disabled -ErrorAction SilentlyContinue # Windows Firewall
+Write-Host "`t[+] Disabled Windows Defender" -ForegroundColor Green
+
+# TODO: move to OpenVPN package
+Set-Service OpenVPNService -StartupType Manual -ErrorAction SilentlyContinue 
+Set-Service OpenVPNServiceInteractive -StartupType Manual -ErrorAction SilentlyContinue 
+Set-Service OpenVPNServiceLegacy -StartupType Manual -ErrorAction SilentlyContinue 
+Write-Host "`t[+] Disabled OpenVPN Services" -ForegroundColor Green
+Set-Service neo4j -StartupType Manual -ErrorAction SilentlyContinue
+Stop-Service -Name neo4j -ErrorAction SilentlyContinue
+Write-Host "`t[+] Disabled Neo4j" -ForegroundColor Green
+Set-Service OpenSSHd -StartupType Manual -ErrorAction SilentlyContinue
+Stop-Service -Name OpenSSHd -ErrorAction SilentlyContinue
+Write-Host "`t[+] Disabled OpenSSH Service" -ForegroundColor Green
+Start-Sleep -Seconds 2
+
+
+#### Remove Desktop Shortcuts ####
+Write-Host "[+] Cleaning up the Desktop" -ForegroundColor Green
+$shortcut_path = "C:\Users\Public\Desktop\Boxstarter Shell.lnk"
+Remove-Item $shortcut_path -Force | Out-Null
+Start-Sleep -Seconds 2
+
+
+#### Set file associations ####
+Write-Host "[-] Setting file associations..." -ForegroundColor Green
+# Zip
+$7zip = "${Env:ProgramFiles}\7-Zip\7z.exe"
+if (Test-Path $7zip) {
+  $7zipfiletype = "7z.exe"
+  cmd /c assoc .zip=$7zipfiletype | Out-Null
+  cmd /c assoc .7z=$7zipfiletype | Out-Null
+  cmd /c assoc .tar=$7zipfiletype | Out-Null
+  cmd /c assoc .bz=$7zipfiletype | Out-Null
+  cmd /c assoc .gz=$7zipfiletype | Out-Null
+  cmd /c assoc .gzip=$7zipfiletype | Out-Null
+  cmd /c assoc .bzip=$7zipfiletype | Out-Null
+  cmd /c @"
+    ftype $7zipfiletype="$7zip" "%1" "%*" > NUL
+"@
+  New-PSDrive -Name HKCR -PSProvider Registry -Root HKEY_CLASSES_ROOT | Out-Null
+  Set-ItemProperty -Path "HKCR:\$7zipfiletype" -Name "(DEFAULT)" -Value "$7zipfiletype file" -Force | Out-Null
+  Write-Host "`t[+] 7zip -> .zip" -ForegroundColor Green
+}
+
+
+#### Unpin Items from Taskbar ####
+# TODO: more research: https://github.com/Disassembler0/Win10-Initial-Setup-Script/issues/8
+Write-Host "[+] Unpinning IE and Windows Media Player from Taskbar" -ForegroundColor Green
+$unpin_list = @(
+  "${Env:ProgramFiles}\Internet Explorer\iexplore.exe",
+  "${Env:ProgramFiles(x86)}\Windows Media Player\wmplayer.exe",
+  "${Env:WinDir}\explorer.exe"
+)
+foreach ($to_unpin in $unpin_list) {
+  try {
+    Set-PinnedApplication -Action UnPinFromTaskBar -FilePath "$to_unpin"
+  } catch {}
+}
+Start-Sleep -Seconds 2
+
+
+#### Add timestamp to PowerShell prompt ####
+$psprompt = @"
+function prompt
+{
+    Write-Host "COMMANDO " -ForegroundColor Green -NoNewLine
+    Write-Host `$(get-date) -ForegroundColor Green
+    Write-Host  "PS" `$PWD ">" -nonewline -foregroundcolor White
+    return " "
+}
+"@
+New-Item -ItemType File -Path $profile -Force | Out-Null
+Set-Content -Path $profile -Value $psprompt
+# Add timestamp to cmd prompt
+# Note: The string below is base64-encoded due to issues properly escaping the '$' character in PowersShell
+#   Offending string: "Y21kIC9jICdzZXR4IFBST01QVCBDT01NQU5ETyRTJGQkcyR0JF8kcCQrJGcn"
+#   Resolves to: "cmd /c 'setx PROMPT COMMANDO$S$d$s$t$_$p$+$g'"
+iex ([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("Y21kIC9jICdzZXR4IFBST01QVCBDT01NQU5ETyRTJGQkcyR0JF8kcCQrJGcn"))) | Out-Null
+Write-Host "`t[+] Timestamps added to cmd prompt and PowerShell" -ForegroundColor Green
+
+
+#### Pin Items to Taskbar ####
+Write-Host "[-] Pinning items to Taskbar" -ForegroundColor Green
+$target_file = Join-Path ${Env:WinDir} "explorer.exe"
+$shortcut = Join-Path ${Env:UserProfile} "temp\explorer.lnk"
+Install-ChocolateyShortcut -shortcutFilePath $shortcut -targetPath $target_file -PinToTaskbar
+# CMD prompt
+Write-Host "`t[+] cmd.exe" -ForegroundColor Green
+$target_file = Join-Path ${Env:WinDir} "system32\cmd.exe"
+$target_dir = ${Env:UserProfile}
+$target_args = '/K "cd ' + ${Env:UserProfile} + '"'
+$shortcut = Join-Path ${Env:UserProfile} "temp\CMD.lnk"
+Install-ChocolateyShortcut -shortcutFilePath $shortcut -targetPath $target_file -Arguments $target_args -WorkingDirectory $target_dir -PinToTaskbar -RunasAdmin
+# Powershell
+Write-Host "`t[+] Powershell" -ForegroundColor Green
+$target_file = Join-Path (Join-Path ${Env:WinDir} "system32\WindowsPowerShell\v1.0") "powershell.exe"
+$target_dir = ${Env:UserProfile}
+$target_args = '-NoExit -Command "cd ' + "${Env:UserProfile}" + '"'
+$shortcut = Join-Path ${Env:UserProfile} "temp\PowerShell.lnk"
+Install-ChocolateyShortcut -shortcutFilePath $shortcut -targetPath $target_file -Arguments $target_args -WorkingDirectory $target_dir -PinToTaskbar -RunasAdmin
+
+
+#### Enable RSAT Tools ####
+Write-Host "[-] Enabling Remote Server Administration Tools" -ForegroundColor Green
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Roles > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Roles-AD > $null
+Write-Host "`t[+] This will take a minute..." -ForegroundColor Green
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Roles-AD-Powershell > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-ServerManager > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Roles-CertificateServices > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Roles-CertificateServices-CA > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Roles-CertificateServices-OnlineResponder > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Roles-AD-DS > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Roles-AD-DS-SnapIns > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Roles-AD-DS-AdministrativeCenter > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Roles-AD-DS-NIS > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Roles-AD-LDS > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Roles-DHCP > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Roles-DNS > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Roles-FileServices > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Roles-FileServices-Dfs > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Roles-FileServices-Fsrm > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Roles-FileServices-StorageMgmt > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Roles-HyperV > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Roles-RDS > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Features > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Features-BitLocker > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Features-Clustering > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Features-GP > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Features-LoadBalancing > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Features-StorageExplorer > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Features-StorageManager > $null
+cmd.exe /c dism /online /enable-feature /featurename:RemoteServerAdministrationTools-Features-Wsrm > $null
+Write-Host "`t[+] Done!" -ForegroundColor Green
+Start-Sleep -Seconds 1
+
+
+#### Rename the computer ####
+Write-Host "[+] Renaming host to 'commando'" -ForegroundColor Green
+(Get-WmiObject win32_computersystem).rename("commando") | Out-Null
+Write-Host "`t[-] Make sure to restart the machine for this change to take effect" -ForegroundColor Yellow
+Write-Host "[+] Changing Desktop Background" -ForegroundColor Green
+
+
+#### Update background ####
+# Set desktop background to black
+Set-ItemProperty -Path 'HKCU:\Control Panel\Colors' -Name Background -Value "0 0 0" -Force | Out-Null
+# Set desktop wallpaper using WallpaperChanger utility
+$wallpaperName = 'LightMale_Red.png'
+$fileBackground = Join-Path $toolsDir $wallpaperName
+$publicWallpaper = Join-Path ${env:public} $wallpaperName
+$WallpaperChanger = Join-Path $toolsDir 'WallpaperChanger.exe'
+Invoke-Expression "$WallpaperChanger $fileBackground 3"
+# Copy background images
+$backgroundzip = 'Backgrounds.7z'
+$backgrounds = Join-Path $toolsDir $backgroundzip
+Invoke-Expression "copy $backgrounds ${Env:USERPROFILE}\Pictures"
+Write-Host "`t[+] Alternative backgrounds copied to ${Env:USERPROFILE}\Pictures" -ForegroundColor Yellow
+foreach ($item in "0", "1", "2") {
+  # Try to set it multiple times! Windows 10 is not consistent
+  if ((Test-Path $publicWallpaper) -eq $false)
+  {
+    Copy-Item -Path $fileBackground -Destination $publicWallpaper -Force 
+  }
+  Set-ItemProperty -path 'HKCU:\Control Panel\Desktop\' -name Wallpaper -value $publicWallpaper
+  Set-ItemProperty -path 'HKCU:\Control Panel\Desktop\' -name TileWallpaper -value "0" -Force
+  Set-ItemProperty -path 'HKCU:\Control Panel\Desktop\' -name WallpaperStyle -value "6" -Force
+  Sleep -seconds 3
+  rundll32.exe user32.dll, UpdatePerUserSystemParameters, 1, True
+}
+  
+if ( -Not ([System.Environment]::OSVersion.Version.Major -eq 10)) {
+  Invoke-Expression "$WallpaperChanger $fileBackground 1"
+}
+
+
+# Copy readme.txt on the Desktop
+Write-Host "[+] Copying README.txt to Desktop" -ForegroundColor Green
+$fileReadme = Join-Path $toolsDir 'readme.txt'
+$desktopReadme = Join-Path ${Env:USERPROFILE} "Desktop\README.txt"
+Copy-Item $fileReadme $desktopReadme
+
+
+# Remove desktop.ini files
+Get-ChildItem -Path (Join-Path ${Env:UserProfile} "Desktop") -Hidden -Filter "desktop.ini" -Force | foreach {$_.Delete()}
+Get-ChildItem -Path (Join-Path ${Env:Public} "Desktop") -Hidden -Filter "desktop.ini" -Force | foreach {$_.Delete()}
+
+
+# Should be PS >5.1 now, enable transcription and script block logging
+# More info: https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html
+if ($PSVersionTable -And $PSVersionTable.PSVersion.Major -ge 5) {
+  $psLoggingPath = 'HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell'
+  if (-Not (Test-Path $psLoggingPath)) {
+    New-Item -Path $psLoggingPath -Force | Out-Null
+  }
+  $psLoggingPath = 'HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\Transcription'
+  if (-Not (Test-Path $psLoggingPath)) {
+    New-Item -Path $psLoggingPath -Force | Out-Null
+  }
+  New-ItemProperty -Path $psLoggingPath -Name "EnableInvocationHeader" -Value 1 -PropertyType DWORD -Force | Out-Null
+  New-ItemProperty -Path $psLoggingPath -Name "EnableTranscripting" -Value 1 -PropertyType DWORD -Force | Out-Null
+  New-ItemProperty -Path $psLoggingPath -Name "OutputDirectory" -Value (Join-Path ${Env:UserProfile} "Desktop\PS_Transcripts") -PropertyType String -Force | Out-Null
+  
+  $psLoggingPath = 'HKLM:\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
+  if (-Not (Test-Path $psLoggingPath)) {
+    New-Item -Path $psLoggingPath -Force | Out-Null
+  }
+  New-ItemProperty -Path $psLoggingPath -Name "EnableScriptBlockLogging" -Value 1 -PropertyType DWORD -Force | Out-Null
+}
+
+
+# Done
+Write-Host "[!] Done with configuration, shutting down Boxstarter..." -ForegroundColor Green
@@ -0,0 +1,9 @@
+$ErrorActionPreference = 'Stop'; # stop on all errors
+
+$packageName = 'flarevm'
+try {
+	$desktopReadme = Join-Path ${Env:USERPROFILE} "Desktop\README.txt"
+	Copy-Item $desktopReadme
+} catch {
+	# pass
+}
@@ -0,0 +1,47 @@
+       _________                                           .___      
+       \_   ___ \  ____   _____   _____ _____    ____    __| _/____  
+       /    \  \/ /  _ \ /     \ /     \\__  \  /    \  / __ |/  _ \ 
+       \     \___(  <_> )  Y Y  \  Y Y  \/ __ \|   |  \/ /_/ (  <_> )
+        \______  /\____/|__|_|  /__|_|  (____  /___|  /\____ |\____/ 
+               \/             \/      \/     \/     \/      \/       
+                        C O M P L E T E  M A N D I A N T                    
+                             O F F E N S I V E   V M                        
+                                   Version 1.0                                 
+               _____________________________________________________          
+
+                                   Developed by                                
+                                   Jake Barteaux                               
+                                 Proactive Services  
+                                  Blaine Stancill
+                     FireEye Labs Advanced Reverse Engineering                            
+                                    Nhan Huynh   
+                     FireEye Labs Advanced Reverse Engineering                            
+______________________________________________________________________________ 
+
+Welcome to Commando VM - Red Team Edition! This distribution contains a number
+of Tools and configurations to enhance Red Teaming and Penetration Testing.
+
+Please make sure to take a snapshot after installing so you can always revert
+back if you have issues.
+
+This image has the Chocolatey package manager installed, and you can continue to
+customize this machine with any package from the Chocolatey repository.
+
+Try this:
+  choco install github 
+Or:
+  cinst github
+
+To keep this distribution up to date, type this into an Administrative terminal:
+  cup all
+
+This machine now has the Windows package manager Chocolatey installed. For
+information on tools available to install, check out chocolatey.org/packages
+
+Note: As this is a Red Teaming and Penetration Testing build certain protections have
+been disabled, and certain 'risky' features and tweaks have been enabled.
+
+Please enjoy the VM and submit any feedback or feature reqeuests as github 
+issues here:
+https://github.com/fireeye/commandovm
+
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="utf-8"?>
+<package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
+  <metadata>
+    <id>commandovm.win7.installer.fireeye</id>
+    <version>1.0.1.1</version>
+    <title>CommandoVM</title>
+    <authors>Jake Barteaux</authors>
+    <description>CommandoVM - Penetration Testing Distribution</description>
+  </metadata>
+</package>
@@ -0,0 +1,164 @@
+$ErrorActionPreference = 'Continue'
+
+Import-Module Boxstarter.Chocolatey
+Import-Module "$($Boxstarter.BaseDir)\Boxstarter.Common\boxstarter.common.psd1"
+
+$packageName      = 'commandovm.win7.installer.fireeye'
+$toolsDir         = "$(Split-Path -parent $MyInvocation.MyCommand.Definition)"
+$fireeyeFeed      = "https://www.myget.org/F/fireeye/api/v2"
+$cache            =  "$env:userprofile\AppData\Local\ChocoCache"
+$globalCinstArgs  = "--cacheLocation $cache -y"
+$toolList         = Join-Path ${Env:ProgramData} "Microsoft\Windows\Start Menu\Programs\Tool List"
+$pkgPath          = Join-Path $toolsDir "packages.json"
+
+
+# https://stackoverflow.com/questions/28077854/powershell-2-0-convertfrom-json-and-convertto-json-implementation
+function ConvertFrom-Json([object] $item) {
+  Add-Type -Assembly system.web.extensions
+  $ps_js = New-Object system.web.script.serialization.javascriptSerializer
+
+  #The comma operator is the array construction operator in PowerShell
+  return ,$ps_js.DeserializeObject($item)
+}
+
+function LoadPackages {
+  try {
+    $json = Get-Content $pkgPath -ErrorAction Stop
+    $packages = ConvertFrom-Json $json
+  } catch {
+    return $null
+  }
+  return $packages
+}
+
+function InstallOnePackage {
+  param([hashtable] $pkg)
+  $name = $pkg.name
+  $pkgargs = $pkg.args
+  try {
+    $is64Only = $pkg.x64Only
+  } catch {
+    $is64Only = $false
+  }
+
+  if ($is64Only) {
+    if (Get-OSArchitectureWidth -Compare 64) {
+      # pass
+    } else {
+      Write-Warning "[!] Not installing $name on x86 systems"
+      return $true
+    }
+  }
+
+  if ($pkgargs -eq $null) {
+    $args = $globalCinstArgs
+  } else {
+    $args = $pkgargs,$globalCinstArgs -Join " "
+  }
+
+  if ($args -like "*-source*" -Or $args -like "*--package-parameters*" -Or $args -like "*--parameters*") {
+    Write-Warning "[!] Installing using host choco.exe! Errors are ignored. Please check to confirm $name is installed properly"
+    Write-Warning "[!] Executing: iex choco upgrade $name $args"
+    $rc = iex "choco upgrade $name $args"
+    Write-Host $rc
+  } else {
+    choco upgrade $name $args
+  }
+
+  if ($([System.Environment]::ExitCode) -ne 0 -And $([System.Environment]::ExitCode) -ne 3010) {
+    Write-Host "ExitCode: $([System.Environment]::ExitCode)"
+    return $false
+  }
+  return $true
+}
+
+function InitialSetup {
+  # Basic system setup
+  Update-ExecutionPolicy Unrestricted
+  Set-WindowsExplorerOptions -EnableShowProtectedOSFiles -EnableShowFileExtensions -EnableShowHiddenFilesFoldersDrives
+  Disable-MicrosoftUpdate
+  Disable-BingSearch
+  Disable-GameBarTips
+  Disable-ComputerRestore -Drive ${Env:SystemDrive}
+
+  # Chocolatey setup
+  Write-Host "Initializing chocolatey"
+  iex "choco sources add -n=fireeye -s $fireeyeFeed --priority 1"
+  iex "choco feature enable -n allowGlobalConfirmation"
+  iex "choco feature enable -n allowEmptyChecksums"
+
+  # Create the cache directory
+  New-Item -Path $cache -ItemType directory -Force
+
+  # Create tool list desktop shortcut
+  if (-Not (Test-Path -Path $toolList) ) {
+    New-Item -Path $toolList -ItemType directory
+  }
+
+  # Create C:\Tools directory
+  if (-Not (Test-Path -Path "${Env:HomeDrive}\Tools")) {
+    New-Item -Path "${Env:HomeDrive}\Tools" -ItemType directory
+  }
+
+  $desktopShortcut = Join-Path ${Env:UserProfile} "Desktop\Tools.lnk"
+  Install-ChocolateyShortcut -shortcutFilePath $desktopShortcut -targetPath $toolList
+  
+  # Set common paths in environment variables  
+  Install-ChocolateyEnvironmentVariable -VariableName "FLARE_START" -VariableValue $toolList -VariableType 'Machine'
+  Install-ChocolateyEnvironmentVariable -VariableName "TOOL_LIST_SHORTCUT" -VariableValue $toolList -VariableType 'Machine'
+  refreshenv
+
+  # BoxStarter setup
+  Set-BoxstarterConfig -NugetSources "$fireeyeFeed;https://chocolatey.org/api/v2"
+
+  # Tweak power options to prevent installs from timing out
+  & powercfg -change -monitor-timeout-ac 0 | Out-Null
+  & powercfg -change -monitor-timeout-dc 0 | Out-Null
+  & powercfg -change -disk-timeout-ac 0 | Out-Null
+  & powercfg -change -disk-timeout-dc 0 | Out-Null
+  & powercfg -change -standby-timeout-ac 0 | Out-Null
+  & powercfg -change -standby-timeout-dc 0 | Out-Null
+  & powercfg -change -hibernate-timeout-ac 0 | Out-Null
+  & powercfg -change -hibernate-timeout-dc 0 | Out-Null
+}
+
+
+function CleanUp
+{
+  # clean up the cache directory
+  Remove-Item $cache -Recurse
+
+  # Final commandovm installation
+  iex "choco upgrade commandovm.win7.config.fireeye $globalCinstArgs"
+}
+
+
+function Main {
+  InitialSetup
+
+  $json = LoadPackages $pkgPath
+  if ($json -eq $null -Or $json.packages -eq $null) {
+    Write-Host "Packages property not found! Exiting"
+    return -1
+  }
+
+  $packages = $json.packages
+  foreach ($pkg in $packages) {
+    $name = $pkg.name
+    $rc = InstallOnePackage $pkg
+    if ($rc) {
+      # Try not to get rate-limited
+      if (-Not ($name.Contains(".flare") -or $name.Contains(".fireeye"))) {
+        Start-Sleep -Seconds 5
+      }
+    } else {
+      Write-Error "Failed to install $name"
+    }
+  }
+
+  CleanUp
+  return 0
+}
+
+
+Main
@@ -0,0 +1,140 @@
+$ErrorActionPreference = 'Continue'
+
+$packageName = 'commandovm.win7.installer.fireeye'
+$toolsDir    = "$(Split-Path -parent $MyInvocation.MyCommand.Definition)"
+
+# Set desktop background to black
+set-itemproperty -path 'HKCU:\Control Panel\Colors' -name Background -value "0 0 0"
+
+# Various options
+$cache =  "$env:userprofile\AppData\Local\ChocoCache"
+$globalCinstArgs = "--cacheLocation $cache"
+$pkgPath = Join-Path $toolsDir "packages.json"
+
+
+function Test-Win64() {
+    return [IntPtr]::size -eq 8
+}
+
+
+# https://stackoverflow.com/questions/28077854/powershell-2-0-convertfrom-json-and-convertto-json-implementation
+function ConvertFrom-Json([object] $item)
+{
+    add-type -assembly system.web.extensions
+    $ps_js=new-object system.web.script.serialization.javascriptSerializer
+
+    #The comma operator is the array construction operator in PowerShell
+    return ,$ps_js.DeserializeObject($item)
+}
+
+
+function LoadPackages
+{
+    try {
+        $json = Get-Content $pkgPath -ErrorAction Stop
+        $packages = ConvertFrom-Json $json
+    } catch {
+        return $null
+    }
+    return $packages
+}
+
+
+function UninstallOnePackage
+{
+    param([hashtable] $pkg)
+    $name = $pkg.name
+    $pkgargs = $pkg.args
+    try {
+        $is64Only = $pkg.x64Only
+    } catch {
+        $is64Only = $false
+    }
+
+    if ($is64Only) {
+        if (Test-WIn64) {
+            # pass
+        } else {
+            Write-Warning "[!] Not uninstalling $name on x86 systems"
+            return $true
+        }
+    }
+
+    if ($pkg.args -eq $null)
+    {
+        $args = $globalCinstArgs
+    } else {
+        $args = $pkgsargs,$globalCinstArgs -Join " "
+    }
+
+    if ($agrs -like "-source") {
+        Write-Warning "[!] Uninstalling using host choco.exe! Errors are not caught. Please check to confirm $name is uninstalled properly"
+        Write-Warning "[!] Uninstalling with choco uninstall $name -x -y $args"
+        $rc = iex "choco uninstall $name -x -y $args"
+    } else {
+        $rc = choco uninstall $name $args
+    }
+    if ($([System.Environment]::ExitCode) -ne 0 -And $([System.Environment]::ExitCode) -ne 3010)
+    {
+        return $false
+    }
+    return $true
+}
+
+
+function PostUninstall
+{
+
+    # Chocolatey setup
+    Write-Host "Initializing chocolatey"
+
+    try {
+        Remove-Item $cache -Recurse
+    } catch {
+        # Ignore exception, in case the directory does not exist.
+    }
+
+    $desktopShortcut = Join-Path ${Env:USERPROFILE} "Desktop\FLARE.lnk"
+    Remove-Item $desktopShortcut
+}
+
+
+function PreUninstall
+{
+    try {
+        Remove-Item $cache -Recurse
+    } catch {
+        # Ignore exception, in case the directory does not exist.
+    }
+}
+
+
+function Main {
+    PreUninstall
+
+    $json = LoadPackages $pkgPath
+    Write-Host $json
+    if ($json -eq $null -Or $json.packages -eq $null)
+    {
+        Write-Host "Packages property not found! Exiting"
+        return -1
+    }
+
+    $packages = $json.packages
+    [array]::Reverse($packages)
+    foreach ($pkg in $packages)
+    {
+        $name = $pkg.name
+        Write-Host "Uninstalling $name"
+        $rc = UninstallOnePackage $pkg
+        if ($rc) {
+        } else {
+            Write-Error "Failed to install $name"
+        }
+    }
+
+    PostUninstall
+    return 0
+}
+
+Main
@@ -0,0 +1,174 @@
+{
+    "packages": [
+        {"name": "dotnet4.6.2"},
+        {"name": "dotnet4.7.2"},
+        {"name": "cmder.fireeye"},
+        {"name": "git"},
+        {"name": "adobereader.fireeye"},
+        {"name": "jre8"},
+        {"name": "wireshark.fireeye"},
+        {"name": "cyberchef.flare"},
+        {"name": "firefox.fireeye"},
+        {"name": "vscode.fireeye", "args":"--parameters /NoDesktopIcon --paramsglobal"},
+        {"name": "vcpython27"},
+        {
+            "name": "python2.x86.nopath.flare",
+            "x64Only": true,
+            "args": "--package-parameters \'/InstallDir:C:\\Python27.x86\'"
+        },
+        {"name": "python2"},
+        {"name": "python3"},
+        {"name": "golang"},
+        {"name": "dep"},
+        {"name": "adexplorer.fireeye"},
+        {"name": "rsat.fireeye"},
+        {"name": "tortoisesvn"},
+        {"name": "sysinternals.fireeye"},
+        {"name": "nmap.fireeye"},
+        {"name": "SublimeText3.fireeye"},
+        {"name": "ilspy.flare"},
+        {"name": "dnspy.flare"},
+        {"name": "autoit.fireeye"},
+        {"name": "ScreenToGif.fireeye"},
+        {"name": "telnet.fireeye"},
+        {"name": "citrix-receiver.fireeye"},
+        {"name": "sqlitebrowser.fireeye"},
+        {"name": "putty.fireeye"},
+        {"name": "vmwarevsphereclient.fireeye"},
+        {"name": "vmware-horizon-client.fireeye"},
+        {"name": "mobaxterm.fireeye"},
+        {"name": "processhacker.flare"},
+        {"name": "vlc.fireeye"},
+        {"name": "yed.fireeye"},
+        {"name": "hashcat.fireeye"},
+        {"name": "winrar"},
+        {"name": "7zip"},
+        {"name": "Greenshot.fireeye"},
+        {"name": "winscp.fireeye"},
+        {"name": "keepass.fireeye"},
+        {"name": "zap.fireeye"},
+        {"name": "vnc-viewer.fireeye"},
+        {"name": "hashcat.fireeye"},
+        {"name": "hashcheck"},
+        {
+            "name": "neo4j-community.fireeye",
+            "x64Only": true
+        },
+        {"name": "sqlserver-cmdlineutils.fireeye"},
+        {"name": "peview.flare"},
+        {"name": "shellcode_launcher.flare"},
+        {"name": "x64dbg.fireeye"},
+        {"name": "windbg.fireeye"},
+        {"name": "windbg.kenstheme.flare"},
+        {"name": "proxycap.fireeye"},
+        {"name": "windump.fireeye"},
+        {"name": "hexchat.fireeye"},
+        {"name": "pidgin.fireeye"},
+        {"name": "thunderbird.fireeye"},
+        {"name": "gimp.fireeye"},
+        {"name": "apimonitor.fireeye"},
+        {"name": "orca.fireeye"},
+        {"name": "fiddler.fireeye"},
+        {"name": "hxd.fireeye"},
+        {
+            "name": "metasploit.flare",
+            "x64Only": true
+        },
+        {"name": "burp.free.fireeye"},
+        {"name": "kali_windowsbinaries.fireeye"},
+
+        {"name": "ADACLScanner.fireeye"},
+        {"name": "ADAPE-Script.fireeye"},
+        {"name": "ADOffline.fireeye"},
+        {"name": "ADRecon.fireeye"},
+        {"name": "ASREPRoast.fireeye"},
+        {"name": "BloodHound.fireeye"},
+        {"name": "CheckPlease.fireeye"},
+        {"name": "CredNinja.fireeye"},
+        {"name": "DAMP.fireeye"},
+        {"name": "contextmenu.fireeye"},
+        {"name": "CrackMapExec.fireeye"},
+        {"name": "CrackMapExecWin.fireeye"},
+        {"name": "demiguise.fireeye"},
+        {"name": "DotNetToJScript.fireeye"},
+        {"name": "DSInternals.fireeye"},
+        {"name": "Egress-Assess.fireeye"},
+        {"name": "flare-floss.fireeye"},
+        {"name": "Exchange-AD-Privesc.fireeye"},
+        {"name": "fuzzdb.fireeye"},
+        {"name": "Generate-Macro.fireeye"},
+        {"name": "Get-LAPSPasswords.fireeye"},
+        {"name": "Get-ReconInfo.fireeye"},
+        {"name": "GoFetch.fireeye"},
+        {
+            "name": "gowitness.fireeye",
+            "x64Only": true
+        },
+        
+        {"name": "Grouper2.fireeye"},
+        {"name": "impacket.fireeye"},
+        {"name": "impacket-examples-windows.fireeye"},
+        {"name": "Internal-Monologue.fireeye"},
+        {"name": "Inveigh.fireeye"},
+        {"name": "Invoke-ACLPwn.fireeye"},
+        {"name": "Invoke-CradleCrafter.fireeye"},
+        {"name": "Invoke-DCOM.fireeye"},
+        {"name": "Invoke-DOSfuscation.fireeye"},
+        {"name": "Invoke-Obfuscation.fireeye"},
+        {"name": "Invoke-Phant0m.fireeye"},
+        {"name": "Invoke-PowerThIEf.fireeye"},
+        {"name": "Invoke-PSImage.fireeye"},
+        {"name": "Invoke-TheHash.fireeye"},
+        {"name": "KeeFarce.fireeye"},
+        {"name": "KeeThief.fireeye"},
+        {"name": "LAPSToolkit.fireeye"},
+        {"name": "luckystrike.fireeye"},
+        {"name": "MailSniper.fireeye"},
+        {"name": "metatwin.fireeye"},
+        {"name": "Mimikatz.fireeye"},
+        {"name": "mimikittenz.fireeye"},
+        {"name": "NetshHelperBeacon.fireeye"},
+        {"name": "nishang.fireeye"},
+        {"name": "nps.fireeye"},
+        {"name": "pafishmacro.fireeye"},
+        {"name": "PayloadsAllTheThings.fireeye"},
+        {"name": "PoshC2.fireeye"},
+        {"name": "PowerLessShell.fireeye"},
+        {"name": "PowerLurk.fireeye"},
+        {"name": "PowerPriv.fireeye"},
+        {"name": "PowerShdll.fireeye"},
+        {"name": "PowerShell-Suite.fireeye"},
+        {"name": "PowerSploit.fireeye"},
+        {"name": "PowerUpSQL.fireeye"},
+        {"name": "PowerView.fireeye"},
+        {"name": "PrivExchange.fireeye"},
+        {"name": "PSAmsi.fireeye"},
+        {"name": "PSAttack.fireeye"},
+        {"name": "PSReflect.fireeye"},
+        {"name": "RedTeamPowershellScripts.fireeye"},
+        {"name": "RiskySPN.fireeye"},
+        {"name": "Rubeus.fireeye"},
+        {"name": "ruler.fireeye"},
+        {"name": "SafetyKatz.fireeye"},
+        {"name": "Seatbelt.fireeye"},
+        {"name": "SessionGopher.fireeye"},
+        {"name": "Sharp-Suite.fireeye"},
+        {"name": "SharpDPAPI.fireeye"},
+        {"name": "SharpDump.fireeye"},
+        {"name": "SharpExchangePriv.fireeye"},
+        {"name": "SharpHound.fireeye"},
+        {"name": "SharpRoast.fireeye"},
+        {"name": "SharpUp.fireeye"},
+        {"name": "SharpView.fireeye"},
+        {"name": "SharpWMI.fireeye"},
+        {"name": "SpoolerScanner.fireeye"},
+        {"name": "StarFighters.fireeye"},
+        {"name": "SpoolSample.fireeye"},
+        {"name": "UACME.fireeye"},
+        {"name": "vssown.fireeye"},
+        {"name": "WMImplant.fireeye"},
+        {"name": "WMIOps.fireeye"},
+        {"name": "zBang.fireeye"},
+        {"name": "openvpn.fireeye", "args":"--parameters \'/SELECT_SHORTCUTS=0 /SELECT_LAUNCH=0\'"}
+    ]
+}
@@ -0,0 +1,206 @@
+###########################################
+#
+# CommandoVM Installation Script
+#
+# To execute this script:
+# 1) Open powershell window as administrator
+# 2) Allow script execution by running command "Set-ExecutionPolicy Unrestricted"
+# 3) Execute the script by running ".\install.ps1"
+#
+###########################################
+param (
+  [string]$password = "",
+  [bool]$nochecks = $false
+)
+function installBoxStarter()
+{
+  <#
+  .SYNOPSIS
+  Install BoxStarter on the current system  
+  .DESCRIPTION
+  Install BoxStarter on the current system. Returns $true or $false to indicate success or failure. On
+  fresh windows 7 systems, some root certificates are not installed and updated properly. Therefore,
+  this funciton also temporarily trust all certificates before installing BoxStarter.  
+  #>  
+  # https://stackoverflow.com/questions/11696944/powershell-v3-invoke-webrequest-https-error
+  # Allows current PowerShell session to trust all certificates
+  # Also a good find: https://www.briantist.com/errors/could-not-establish-trust-relationship-for-the-ssltls-secure-channel/
+  try {
+  Add-Type @"
+  using System.Net;
+  using System.Security.Cryptography.X509Certificates;
+  public class TrustAllCertsPolicy : ICertificatePolicy {
+  	public bool CheckValidationResult(
+  		ServicePoint srvPoint, X509Certificate certificate,
+  		WebRequest request, int certificateProblem) {
+  		return true;
+  	}
+  }
+"@
+  } catch {
+    Write-Debug "Failed to add new type"
+  }  
+  try {
+  	$AllProtocols = [System.Net.SecurityProtocolType]'Ssl3,Tls,Tls11,Tls12'
+  } catch {
+  	Write-Debug "Failed to find SSL type...1"
+  }  
+  try {
+  	$AllProtocols = [System.Net.SecurityProtocolType]'Ssl3,Tls'
+  } catch {
+  	Write-Debug "Failed to find SSL type...2"
+  }  
+  $prevSecProtocol = [System.Net.ServicePointManager]::SecurityProtocol
+  $prevCertPolicy = [System.Net.ServicePointManager]::CertificatePolicy  
+  Write-Host "[ * ] Installing Boxstarter"
+  # Become overly trusting
+  [System.Net.ServicePointManager]::SecurityProtocol = $AllProtocols
+  [System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy  
+  # download and instal boxstarter
+  iex ((New-Object System.Net.WebClient).DownloadString('http://boxstarter.org/bootstrapper.ps1')); get-boxstarter -Force  
+  # Restore previous trust settings for this PowerShell session
+  # Note: SSL certs trusted from installing BoxStarter above will be trusted for the remaining PS session
+  [System.Net.ServicePointManager]::SecurityProtocol = $prevSecProtocol
+  [System.Net.ServicePointManager]::CertificatePolicy = $prevCertPolicy
+  return $true
+}
+Write-Host "[+] Beginning install..."
+Write-Host " ____________________________________________________________________________ " -ForegroundColor Red 
+Write-Host "|                                                                            |" -ForegroundColor Red 
+Write-Host "|    "  -ForegroundColor Red -NoNewline; Write-Host "                  " -ForegroundColor Green -NoNewline; Write-Host "                                                      |" -ForegroundColor Red 
+Write-Host "|        "  -ForegroundColor Red -NoNewline; Write-Host "_________                                           .___      " -ForegroundColor Green -NoNewline; Write-Host "      |" -ForegroundColor Red 
+Write-Host "|        "  -ForegroundColor Red -NoNewline; Write-Host "\_   ___ \  ____   _____   _____ _____    ____    __| _/____  " -ForegroundColor Green -NoNewline; Write-Host "      |" -ForegroundColor Red 
+Write-Host "|        "  -ForegroundColor Red -NoNewline; Write-Host "/    \  \/ /  _ \ /     \ /     \\__  \  /    \  / __ |/  _ \ " -ForegroundColor Green -NoNewline; Write-Host "      |" -ForegroundColor Red 
+Write-Host "|        "  -ForegroundColor Red -NoNewline; Write-Host "\     \___(  <_> )  Y Y  \  Y Y  \/ __ \|   |  \/ /_/ (  <_> )" -ForegroundColor Green -NoNewline; Write-Host "      |" -ForegroundColor Red 
+Write-Host "|        "  -ForegroundColor Red -NoNewline; Write-Host " \______  /\____/|__|_|  /__|_|  (____  /___|  /\____ |\____/ " -ForegroundColor Green -NoNewline; Write-Host "      |" -ForegroundColor Red 
+Write-Host "|        "  -ForegroundColor Red -NoNewline; Write-Host "        \/             \/      \/     \/     \/      \/       " -ForegroundColor Green -NoNewline; Write-Host "      |" -ForegroundColor Red 
+Write-Host "|                       C O M P L E T E  M A N D I A N T                     |" -ForegroundColor Red 
+Write-Host "|                            O F F E N S I V E   V M                         |" -ForegroundColor Red 
+Write-Host "|                                                                            |" -ForegroundColor Red 
+Write-Host "|                                  Version 1.0                               |" -ForegroundColor Red 
+Write-Host "|____________________________________________________________________________|" -ForegroundColor Red 
+Write-Host "|                                                                            |" -ForegroundColor Red 
+Write-Host "|                                  Developed by                              |" -ForegroundColor Red 
+Write-Host "|                                 Jake  Barteaux                             |" -ForegroundColor Red 
+Write-Host "|                               Proactive Services                           |" -ForegroundColor Red 
+Write-Host "|                                 Blaine Stancill                            |" -ForegroundColor Red 
+Write-Host "|                                   Nhan Huynh                               |" -ForegroundColor Red 
+Write-Host "|                    FireEye Labs Advanced Reverse Engineering               |" -ForegroundColor Red 
+Write-Host "|____________________________________________________________________________|" -ForegroundColor Red 
+Write-Host ""
+
+
+# Check to make sure script is run as administrator
+Write-Host "[+] Checking if script is running as administrator.."
+$currentPrincipal = New-Object Security.Principal.WindowsPrincipal( [Security.Principal.WindowsIdentity]::GetCurrent() )
+if (-Not $currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+  Write-Host "`t[ERR] Please run this script as administrator`n" -ForegroundColor Red
+  Read-Host  "Press any key to continue"
+  exit
+}
+else {
+  Start-Sleep -Milliseconds 500
+  Write-Host "`tphenomenal " -ForegroundColor Magenta -NoNewLine
+  Start-Sleep -Milliseconds 500
+  Write-Host "cosmic " -ForegroundColor Cyan -NoNewLine
+  Start-Sleep -Milliseconds 500
+  Write-Host "powers " -ForegroundColor Green
+  Start-Sleep -Milliseconds 500
+}
+
+if ($nochecks -eq $false) {
+  
+  # Check to make sure host is supported
+  Write-Host "[+] Checking to make sure Operating System is compatible"
+  if (-Not (((Get-WmiObject -class Win32_OperatingSystem).Version -eq "6.1.7601") -or ([System.Environment]::OSVersion.Version.Major -eq 10))){
+    Write-Host "`t[ERR] $((Get-WmiObject -class Win32_OperatingSystem).Caption) is not supported, please use Windows 7 Service Pack 1 or Windows 10" -ForegroundColor Red
+    exit 
+  }
+  else
+  {
+    Write-Host "`t$((Get-WmiObject -class Win32_OperatingSystem).Caption) supported" -ForegroundColor Green
+  }
+
+  # Check to make sure host has been updated
+  Write-Host "[+] Checking if host has been configured with updates"
+  if (-Not (get-hotfix | where { (Get-Date($_.InstalledOn)) -gt (get-date).adddays(-30) })) {
+    Write-Host "`t[ERR] This machine has not been updated in the last 30 days, please run Windows Updates to continue`n" -ForegroundColor Red
+    Read-Host  "Press any key to continue"
+    exit
+  }
+  else
+  {
+	  Write-Host "`tupdates appear to be in order" -ForegroundColor Green
+  }
+
+  #Check to make sure host has enough disk space
+  Write-Host "[+] Checking if host has enough disk space"
+  $disk = Get-PSDrive C
+  Start-Sleep -Seconds 1
+  if (-Not (($disk.used + $disk.free)/1GB -gt 58.8)){
+    Write-Host "`t[ERR] This install requires a minimum 60 GB hard drive, please increase hard drive space to continue`n" -ForegroundColor Red
+    Read-Host "Press any key to continue"
+    exit
+  }
+  else
+  {
+    Write-Host "`t> 60 GB hard drive. looks good" -ForegroundColor Green
+  }
+
+  # Prompt user to remind them to take a snapshot
+  Write-Host "[-] Do you need to take a snapshot before continuing? Y/N " -ForegroundColor Yellow -NoNewline
+  $response = Read-Host
+  if ($response -ne "N") {
+    Write-Host "[*] Exiting..." -ForegroundColor Red
+    exit
+  }
+  Write-Host "`tContinuing..." -ForegroundColor Green
+}
+
+# Get user credentials for autologin during reboots
+Write-Host "[ * ] Getting user credentials ..."
+Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\PowerShell\1\ShellIds" -Name "ConsolePrompting" -Value $True
+
+if ([string]::IsNullOrEmpty($password)) {
+	$cred=Get-Credential $env:username
+} else {
+	$spasswd=ConvertTo-SecureString -String $password -AsPlainText -Force
+	$cred=New-Object -TypeName "System.Management.Automation.PSCredential" -ArgumentList $env:username, $spasswd
+}
+# TO DO - Verify credentials before continuing
+
+# Install Boxstarter
+Write-Host "[ * ] Installing Boxstarter"
+try {
+  iex ((New-Object System.Net.WebClient).DownloadString('http://boxstarter.org/bootstrapper.ps1')); get-boxstarter -Force
+} catch {
+  $rc = installBoxStarter
+  if (-Not $rc) {
+  	Write-Host "[ERR] Failed to install BoxStarter"
+  	Read-Host  "      Press ANY key to continue..."
+  	exit
+  }
+}
+
+# Boxstarter options
+$Boxstarter.RebootOk = $true    # Allow reboots?
+$Boxstarter.NoPassword = $false # Is this a machine with no login password?
+$Boxstarter.AutoLogin = $true   # Save my password securely and auto-login after a reboot
+Set-BoxstarterConfig -NugetSources "https://www.myget.org/F/fireeye/api/v2;https://chocolatey.org/api/v2"
+
+# Needed for many applications
+# Set up the correct feed
+$fireeyeFeed = "https://www.myget.org/F/fireeye/api/v2"
+iex "choco sources add -n=fireeye -s $fireeyeFeed --priority 1"
+iex "choco upgrade -y vcredist-all.flare"
+iex "cinst -y powershell"
+
+if ([System.Environment]::OSVersion.Version.Major -eq 6) {
+  Install-BoxstarterPackage -PackageName commandovm.win7.installer.fireeye -Credential $cred
+} elseif ([System.Environment]::OSVersion.Version.Major -eq 10) {
+  choco config set cacheLocation ${Env:TEMP}
+  iex "choco upgrade -y commandovm.win10.preconfig.fireeye"
+  Install-BoxstarterPackage -PackageName commandovm.win10.installer.fireeye -Credential $cred
+} else {
+  Write-Host "`t[ERR] This install requires Windows 7 SP1 or Windows 10`n" -ForegroundColor Red
+}
				`@@ -0,0 +1 @@`
				`@powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0Win10.ps1" -include "%~dp0Win10.psm1" -preset "%~dpn0.preset"`