Attacker VMs

Setup scripts for creating attacker VM templates in Proxmox.

Kali Linux

1. Install base OS
2. Download contents of kali directory
3. Run the setup script: chmod +x kali-setup.sh && ./kali-setup.sh
4. Set up Kerberos file for GOAD (optional): sudo mv krb5.conf /etc/krb5.conf
5. Clear logs (optional): sudo rm -f ~/.zsh_history /root/.zsh_history /var/log/* && sudo find /var/log -type f -exec rm -f {} \;
6. Shutdown and create template

Windows Server 2025

Note: There's a known issue with IDE where ID 0 conflicts with 1 and 2 conflicts with 3. When adding a cloud-init drive to your Windows VM, either ensure that you've removed the other IDE drives or use SCSI.

1. Install base OS
2. Check for updates and install all updates - may need to be done multiple times
3. Modify local group policy: Start > gpedit.msc
   • Permanently disable Windows Defender: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus - set "Turn off Windows Defender" to Enabled
   • Stop Server Manager from starting on login: Computer Configuration > Administrative Templates > System > Server Manager - set "Do not display Server Manager automatically at logon" to Enabled
4. Install VirtIO drivers and QEMU guest agent (optional): see this link and follow steps under Installation > Using the ISO > Wizard Installation
5. Reboot
6. Download contents of windows directory
7. Download cloudbase-init from here, and go through prompts
   • At the end, select the option to run sysprep but DO NOT select the option to shutdown after installation
8. Run the setup script in PowerShell: Set-ExecutionPolicy Bypass && .\windows-setup.ps1
   • Newer versions of PingCastle need to be downloaded manually from here
   • Some links in the setup script are dated, and I like to manually install additional software. View the full list of software below.
9. move cloudbase-init/* "C:\Program Files\Cloudbase Solutions\Cloudbase-Init"
   • You may need to change the DNS server and suffix in DNS.bat
10. move shortcuts/* "C:\Users\Public\Desktop"
11. Shutdown and create template

Windows Software

Eventually, I'll add updated versions of all this to the setup script.

• Python 3
• MobaXterm
• Notepad++
• Visual Studio
• Visual Studio Code
• 7-Zip File Manager
• Tooling in C:\Tools: Rubeus, Certify, Seatbelt, PrivescCheck, SharpGPOAbuse, SharpSCCM, Whisker, SharpDPAPI, PrivescCheck, winPEAS, SigmaPotato, Snaffler, PingCastle