{"id":448,"date":"2019-04-03T14:51:53","date_gmt":"2019-04-03T13:51:53","guid":{"rendered":"https:\/\/cybercop-training.ch\/?p=448"},"modified":"2019-04-03T14:51:53","modified_gmt":"2019-04-03T13:51:53","slug":"commando-vm","status":"publish","type":"post","link":"https:\/\/cybercop-training.ch\/?p=448","title":{"rendered":"Commando VM"},"content":{"rendered":"<h1>Description<\/h1>\n<p style=\"text-align: justify;\"><a href=\"https:\/\/www.fireeye.com\" target=\"_blank\" rel=\"noopener noreferrer\">FireEye<\/a> released Commando VM, a windows based security distribution designed for penetration testers.<\/p>\n<p style=\"text-align: justify;\">Penetration testers commonly use their own variants of Windows machines when assessing Active Directory environments. Commando VM was designed specifically to be the go-to platform for performing these internal penetration tests. The benefits of using a Windows machine include native support for Windows and Active Directory, using your VM as a staging area for C2 frameworks, browsing shares more easily (and interactively), and using tools such as <a href=\"https:\/\/www.harmj0y.net\/blog\/redteaming\/powerview-2-0\/\">PowerView<\/a>\u00a0and <a href=\"https:\/\/wald0.com\/?p=68\">BloodHound<\/a> without having to worry about placing output files on client assets.<\/p>\n<p style=\"text-align: justify;\">Commando VM uses <a href=\"https:\/\/boxstarter.org\">Boxstarter<\/a>, <a href=\"https:\/\/chocolatey.org\">Chocolatey<\/a>, and <a href=\"https:\/\/myget.org\">MyGet<\/a>\u00a0packages to install all of the software, and delivers many tools and utilities to support penetration testing. This list includes more than 140 tools, including:<\/p>\n<ul>\n<li><a href=\"https:\/\/nmap.org\">Nmap<\/a><b><\/b><\/li>\n<li><a href=\"https:\/\/www.wireshark.org\">Wireshark<\/a><b><\/b><\/li>\n<li><a href=\"https:\/\/github.com\/cobbr\/Covenant\">Covenant<\/a><b><\/b><\/li>\n<li><a href=\"https:\/\/www.python.org\">Python<\/a><b><\/b><\/li>\n<li><a href=\"https:\/\/golang.org\">Go<\/a><b><\/b><\/li>\n<li><a href=\"https:\/\/support.microsoft.com\/en-us\/help\/2693643\/remote-server-administration-tools-rsat-for-windows-operating-systems\">Remote Server Administration Tools<\/a><b><\/b><\/li>\n<li><a href=\"https:\/\/docs.microsoft.com\/en-us\/sysinternals\/\">Sysinternals<\/a><b><\/b><\/li>\n<li><a href=\"https:\/\/github.com\/gentilkiwi\/mimikatz\">Mimikatz<\/a><b><\/b><\/li>\n<li><a href=\"https:\/\/portswigger.net\">Burp-Suite<\/a><b><\/b><\/li>\n<li><a href=\"https:\/\/x64dbg.com\/\">x64dbg<\/a><b><\/b><\/li>\n<li><a href=\"https:\/\/hashcat.net\/\">Hashcat<\/a><\/li>\n<\/ul>\n<h1 style=\"text-align: justify;\">Installation<\/h1>\n<p style=\"text-align: justify;\">Start by creating a new virtual machine (VM) with these minimum specifications:<\/p>\n<ul style=\"text-align: justify;\">\n<li>60 GB of disk space<\/li>\n<li>2 GB memory<\/li>\n<\/ul>\n<p style=\"text-align: justify;\">Next, perform a fresh installation of Windows. Commando VM is designed to be installed on Windows 7 Service Pack 1, or Windows 10, with Windows 10 allowing more features to be installed.<\/p>\n<p style=\"text-align: justify;\">Once the Windows installation has completed, we recommend you install your specific VM guest tools (e.g., VMware Tools) to allow additional features such as copy\/paste and screen resizing. From this point, all installation steps should be performed within your VM.<\/p>\n<ol>\n<li style=\"text-align: justify;\">Make sure Windows is completely updated with the latest patches using the Windows Update utility. Note: you may have to check for updates again after a restart.<\/li>\n<li style=\"text-align: justify;\">We recommend taking a snapshot of your VM at this point to have a clean instance of Windows before the install.<\/li>\n<li style=\"text-align: justify;\">Navigate to the following URL and download the compressed Commando VM repository onto your VM:\n<ul>\n<li><a href=\"https:\/\/github.com\/fireeye\/commando-vm\">https:\/\/github.com\/fireeye\/commando-vm<\/a><\/li>\n<\/ul>\n<\/li>\n<li>Follow these steps to complete the installation of Commando VM:\n<ol>\n<li style=\"text-align: justify;\">Decompress the Commando VM repository to a directory of your choosing.<\/li>\n<li style=\"text-align: justify;\">Start a new session of PowerShell with elevated privileges. Commando VM attempts to install additional software and modify system settings; therefore, escalated privileges are required for installation.<\/li>\n<li style=\"text-align: justify;\">Within PowerShell, change directory to the location where you have decompressed the Commando VM repository.<\/li>\n<li style=\"text-align: justify;\">Change PowerShell\u2019s execution policy to unrestricted by executing the following command and answering \u201c<b>Y<\/b>\u201d when prompted by PowerShell:\n<ul>\n<li><span class=\"code\">Set-ExecutionPolicy unrestricted<\/span><\/li>\n<\/ul>\n<\/li>\n<li style=\"text-align: justify;\">Execute the <span class=\"code\">install.ps1<\/span> installation script. You will be prompted to enter the current user\u2019s password. Commando VM needs the current user\u2019s password to automatically login after a reboot. Optionally, you can specify the current user\u2019s password by passing the \u201c-password &lt;current_user_password&gt;\u201d at the command line.<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<p><a href=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2019\/04\/install_1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-451\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2019\/04\/install_1.png\" alt=\"\" width=\"767\" height=\"352\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2019\/04\/install_1.png 767w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2019\/04\/install_1-300x138.png 300w\" sizes=\"auto, (max-width: 767px) 100vw, 767px\" \/><\/a><\/p>\n<p><a href=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2019\/04\/install_2.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone  wp-image-452\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2019\/04\/install_2.png\" alt=\"\" width=\"773\" height=\"497\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2019\/04\/install_2.png 720w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2019\/04\/install_2-300x193.png 300w\" sizes=\"auto, (max-width: 773px) 100vw, 773px\" \/><\/a><\/p>\n<p>Installationprocess takes about 3-4 hours to complete.<\/p>\n<p><a href=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2019\/04\/Picture3a.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-large wp-image-455\" src=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2019\/04\/Picture3a-1024x805.png\" alt=\"\" width=\"1024\" height=\"805\" srcset=\"https:\/\/cybercop-training.ch\/wp-content\/uploads\/2019\/04\/Picture3a-1024x805.png 1024w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2019\/04\/Picture3a-300x236.png 300w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2019\/04\/Picture3a-768x603.png 768w, https:\/\/cybercop-training.ch\/wp-content\/uploads\/2019\/04\/Picture3a.png 1708w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<div class=\"mh-excerpt\"><p>Description FireEye released Commando VM, a windows based security distribution designed for penetration testers. Penetration testers commonly use their own variants of Windows machines when <a class=\"mh-excerpt-more\" href=\"https:\/\/cybercop-training.ch\/?p=448\" title=\"Commando VM\">[&#8230;]<\/a><\/p>\n<\/div>","protected":false},"author":2,"featured_media":449,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,22,10],"tags":[],"class_list":["post-448","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hacking","category-virtual-machines","category-windows-security"],"_links":{"self":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/448","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=448"}],"version-history":[{"count":3,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/448\/revisions"}],"predecessor-version":[{"id":456,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/posts\/448\/revisions\/456"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=\/wp\/v2\/media\/449"}],"wp:attachment":[{"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=448"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=448"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybercop-training.ch\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=448"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}