Pentest Setup Tool

Dumb vibe-coded scripts that install a bunch of tools, made for a Windows host with a WSL distro. Installs WSL2, pentesting tools, and development utilities with granular control over each component. This is basically an ugly workaround for when I am not able to use Exegol and I need to quickly setup a testing environment on a Windows-based host.

Quick Start

Step 1: Windows Setup

Open PowerShell as Administrator. Download and inspect the setup script before running it:

$setupScript = Join-Path $env:TEMP "setup-windows.ps1"
Invoke-WebRequest https://raw.githubusercontent.com/5tuk0v/pentest-setup/main/scripts/setup-windows.ps1 -OutFile $setupScript
Start-Process notepad.exe -ArgumentList $setupScript -Wait

# After reviewing and closing Notepad:
powershell.exe -NoProfile -ExecutionPolicy Bypass -File $setupScript

Follow the prompts to choose paths, a WSL distro, and optional components. If the script reports that newly enabled WSL features require a reboot, reboot and run it again.

For convenience, the script can also be executed directly without prior inspection:

irm https://raw.githubusercontent.com/5tuk0v/pentest-setup/main/scripts/setup-windows.ps1 | iex

Step 2: Initialize WSL

Launch the WSL distro selected during Windows setup and complete its one-time user-account creation. Ubuntu is recommended because the Linux setup script is designed and tested for Ubuntu.

Step 3: Linux Setup

Inside Ubuntu, download and inspect the setup script before running it:

curl -fsSL https://raw.githubusercontent.com/5tuk0v/pentest-setup/main/scripts/setup-ubuntu.sh -o /tmp/setup-ubuntu.sh
less /tmp/setup-ubuntu.sh
bash /tmp/setup-ubuntu.sh

For convenience, it can also be executed directly without prior inspection:

curl -fsSL https://raw.githubusercontent.com/5tuk0v/pentest-setup/main/scripts/setup-ubuntu.sh | bash

Linux Tools & Configurations

Base Environment

Tool	Installation	Details
Metasploit Framework	Official install script via curl	Exploitation and post-exploitation framework
uv	Official install script via curl	Fast Python package and project manager
Zsh + Oh My Zsh	apt + official install script; default shell; rkj-repos theme	Interactive shell and configuration framework

APT Package Inventory

The optional Install essential apt packages step installs:

build-essential, git, curl, python3-dev, python3-pip, pipx, python3-nftables, libkrb5-dev, libxml2-utils, krb5-pkinit, krb5-user, proxychains4, nmap, masscan, smbclient, xclip, xsltproc, tmux, zip, unzip, 7zip, dnsutils, zsh, libpcap-dev, and libfaketime.

Python Tools

Tool	Installation	Details
Responder	uv tool install from Git; fixed challenge 1122334455667788; privileged symlink	Name-resolution poisoning and credential capture
mitm6	uv tool install from Git; privileged wrapper	IPv6 DNS takeover for NTLM relay
netexec (nxc)	pipx install from Git; Rust via rustup; configuration patch	Network service enumeration and remote execution
bloodyAD	uv tool install from package index	Active Directory LDAP and ACL manipulation
certipy-ad	uv tool install from package index; privileged symlink	Active Directory Certificate Services enumeration and abuse
bloodhound-ce	uv tool install from package index	BloodHound CE command-line client
ADPathFinder	uv tool install from Git	Active Directory attack-path analysis
impacket	uv tool install from Git; adds pycryptodome; privileged symlinks	Network protocol libraries and remote-service tools
smbclientng	uv tool install from package index	Interactive SMB client with NTLM and Kerberos support
coercer	uv tool install from package index	RPC authentication coercion scanner
wspcoerce	uv tool install from Git	WS-Print authentication coercion
GPOHound	uv tool install from Git	Group Policy Object reconnaissance
gpoParser	pipx install from Git	Parses Group Policy preferences and settings
gpOddity	uv tool install from Git	Finds unusual GPO permissions and links
OUned	uv tool install from Git	gPLink poisoning through OU permissions
donpapi	uv tool install from package index; Python 3.12	Remote DPAPI secrets collection
dploot	uv tool install from package index	DPAPI credential and secret looting
lsassy	uv tool install from package index	Remote LSASS credential extraction
conpass	uv tool install from Git	Active Directory password policy enumeration
powerview.py	uv tool install from Git	Active Directory reconnaissance and administration
evil-winrm-py	uv tool install from package index; Kerberos extra	WinRM client for Windows remote management
soapy	uv tool install from Git	Active Directory Web Services protocol tooling
bofhound	uv tool install from package index	Converts BOF collection output for BloodHound
sccmhunter	uv tool install from Git; privileged symlink	Microsoft SCCM reconnaissance and exploitation
cmloot	uv tool install from Git	Credential and secret recovery from SCCM
ConfigManBearPig (OpenHound)	uv tool install from package index; prereleases allowed	ConfigMgr attack-path collection for OpenHound
pre2k	uv tool install from Git	Pre-Windows 2000 computer-account enumeration
defaultcreds-cheat-sheet	uv tool install from package index	Searchable vendor default-credential database
wsuks	uv tool install from package index with pip-nftables; privileged symlink	WSUS attack and reconnaissance toolkit
WebRelayX	uv tool install from Git; privileged wrapper	WebDAV relay and authentication-capture server
Spoonmap	uv tool install from Git; uses base nmap and masscan packages	Network scan orchestrator for Nmap and Masscan

Repository Installs

Tool	Installation	Details
krbrelayx	Git clone + uv add --script; adds impacket and pycryptodome; privileged wrapper	Kerberos relay and unconstrained-delegation attacks
targetedKerberoast	Git clone + uv add --script; dependencies from requirements.txt	Targeted Kerberoasting through writable SPNs
SMBLoot	Git clone + uv add --script; dependencies from requirements.txt	Searches SMB shares for sensitive files
CVE-2026-54121 (Certighost)	Git clone + uv add --script; adds impacket, cryptography, pyasn1, asn1crypto, pycryptodome, and dnspython	Certificate-based proof of concept for CVE-2026-54121
rbcdbrute	Git clone + uv add --script; adds impacket and tqdm	Resource-based constrained-delegation attack automation
PKINITtools	Git clone + uv add --script; dependencies from requirements.txt; oscrypto from Git	PKINIT and certificate-based Kerberos tooling
mssqlkaren	Git clone + uv sync; project environment	MSSQL reconnaissance and relay tooling
scomhunter	Git clone + uv sync; project environment	SCOM reconnaissance and exploitation
wtftp	Git clone + uv sync; project environment; privileged wrapper	TFTP server for Windows deployment scenarios
RelayInformer	Git clone + uv sync; Python subdirectory	Identifies hosts suitable for NTLM relay
PXEThief	Git clone + uv add --script; PR #11; dependencies from requirements.txt; privileged wrapper	Captures credentials from PXE boot traffic
pxethiefy	Git clone + uv add --script; dependencies from requirements.txt; privileged wrapper	PXE boot credential-capture server
WSUScripts	Git clone + uv add --script; adds scapy to wsusniff.py; privileged wrapper	WSUS spoofing and credential-capture scripts
RelayKing-Depth	Git clone + uv add --script; dependencies from requirements.txt	NTLM relay automation framework
rpc2efs	Git clone + uv add --script; adds impacket	EFS RPC authentication coercion
ntlmv1-multi	Git clone + uv add --script; adds pycryptodome	Captures and cracks NetNTLMv1 responses
pywsus	Git clone + uv add --script; dependencies from requirements.txt	Lightweight WSUS server implementation
tdo_dump	Git clone + uv add --script; adds impacket	Trust-domain object and trust-key extraction
pyTGTdeleg	Git clone + uv add --script; adds impacket	Remote Kerberos TGT delegation through MSSQL CLR
susinternals	Git clone + uv add --script; adds impacket	WSUS server assessment and abuse toolkit
ghostsurf	Git clone + uv add --script; dependencies from requirements.txt; privileged wrapper	Ghost-traffic proxy and network testing tool
krbHash	Git clone + uv sync; project environment	Kerberos hash extraction and cracking helper
gopacket	Git clone + native build; Go 1.24.13 when needed; installs to /usr/local/bin	Go implementation of selected Impacket functionality
sqlmap	Git clone; privileged wrapper	Automated SQL injection detection and exploitation

Release Binaries

Tool	Installation	Details
RustHound-CE	Latest GitHub release; Linux GNU x64 archive to /usr/local/bin	BloodHound CE Active Directory collector
PassTheCert-rs	Latest GitHub release; Linux GNU x64 archive to /usr/local/bin	Certificate-based LDAP authentication and AD actions
pssrecon	Fixed GitHub release; Linux binary to /usr/local/bin	Process Snapshotting Service reconnaissance
pretender	Latest GitHub release; Linux x64 archive to /usr/local/bin	Local network spoofing and name-resolution responder
flamingo	Latest GitHub release; Linux x64 binary to /usr/local/bin	Active Directory Certificate Services attack toolkit
nuclei	Latest GitHub release; Linux x64 ZIP to /usr/local/bin	Template-based vulnerability scanner
ffuf	Latest GitHub release; Linux x64 archive to /usr/local/bin	Fast web content and parameter fuzzer
MSSQLHound	Latest GitHub release; Linux x64 binary to /usr/local/bin	MSSQL attack-path collector for BloodHound
skewrun	Latest GitHub release; Linux x64 musl binary; libfaketime; /usr/local/bin	Runs processes with a manipulated system time
Titanis	Latest GitHub release; self-contained Linux x64 ZIP with .NET 8 runtime; tools directory	Windows and AD enumeration toolkit
ntlmrain	Latest GitHub release; Linux x64 ZIP; tools directory	Recovers NT hashes from NetNTLMv1 responses
Atlas	Latest GitHub release; Linux x64 ZIP; tools directory	Cross-platform network execution and AD assessment toolkit

Environment Configuration

Configuration	Installation	Details
Pentest environment	Managed template; ~/.pentest-env sourced from ~/.zshrc	Shared shell variables and aliases
ShellOpsLog	Direct script download; sourced from ~/.zshrc	Automatic shell-operation logging
Tools path and logs	Interactive configuration; default tools path ~/tools	Per-installation tool and setup-log locations

Windows Tools & Configurations

Infrastructure and System Applications

Tool	Installation	Details
WSL2 + Linux distro	Windows features + WSL; selectable Ubuntu, Debian, or Kali	Linux environment on the Windows host
Docker Desktop	winget; BloodHound CE prerequisite	Container runtime and desktop management
Visual Studio 2022 Community	winget; managed and native desktop workloads	Windows development and native-build environment
Visual Studio Code	winget (Microsoft.VisualStudioCode)	Source editor
Git	winget (Git.Git)	Version-control client and clone prerequisite
RSAT: Active Directory DS-LDS Tools	Windows capability; includes ActiveDirectory PowerShell module	AD DS and AD LDS administration tools
Oh My Posh	winget; theme, Nerd Font, and profile configuration	PowerShell prompt theming
ShareNot	winget	Screenshot utility
7-Zip	winget	Archive manager
Notepad++	winget	Text and code editor
Wireshark	winget; Npcap installed manually	Network protocol analyzer
Burp Suite Community	winget; Community edition	Web application testing proxy
SQL Server Management Studio (SSMS)	winget	SQL Server administration client
BloodHound CE	bloodhound-cli + Docker Compose	Self-hosted attack-path analysis platform

Reviewed Builds

These tools are downloaded from tagged releases in pentest-setup-builds, where source commits, build inputs, and release artifacts are reviewed and pinned.

Tool	Installation	Details
Certify	Reviewed GitHub release; .NET Framework 4.7.2; AnyCPU	AD CS enumeration and abuse
Rubeus	Reviewed GitHub release; .NET Framework 4.8; AnyCPU	Kerberos ticket operations and abuse
SpoolSample	Reviewed GitHub release; native x64 and .NET Framework 4.8	Print Spooler authentication coercion
SharpPXE	Reviewed GitHub release; .NET Framework 4.8; AnyCPU	PXE boot credential capture
SharpPrinter	Reviewed GitHub release; single-file .NET Framework 4.8; pinned NuGet dependencies; Costura	Printer reconnaissance and administration
RequestAADRefreshToken	Reviewed GitHub release; .NET Framework 4.8; AnyCPU	Requests Entra ID refresh tokens
ROADtoken	Reviewed GitHub release; .NET Framework 4.8; AnyCPU	Obtains Entra ID tokens via device registration
askWAM	Reviewed GitHub release; native x64; static C runtime; inbox WinRT; Windows 10 1803+	Requests tokens through the Windows Account Manager
RAIWhateverTrigger	Reviewed GitHub release; x64 ZIP with native RAICTrigger.exe and .NET Framework 4.7.2 RAICSTrigger.exe; BOF excluded	RPC authentication coercion
AxiomSecrets	Reviewed GitHub release; self-contained x64 executable; NTFSLib parser	Searches NTFS artifacts for secrets
WebClientTrigger	Reviewed GitHub release; native C17 x64 ZIP	Starts the Windows WebClient service

Other Security Tools

Tool	Installation	Details
bloodhound-cli	Latest GitHub release; Windows x64 ZIP	Manages BloodHound CE instances and data
SharpHound	Latest GitHub release; Windows ZIP	Collects Active Directory data for BloodHound
AzureHound	Latest GitHub release; Windows x64 ZIP	Collects Entra ID and Azure data for BloodHound
Inveigh	Latest GitHub release; .NET Framework 4.6.2 ZIP	Windows network-spoofing and credential-capture tool
PassTheCert-rs	Latest GitHub release; Windows MSVC x64 ZIP	Certificate-based LDAP authentication and AD actions
Snaffler	Latest GitHub release; Snaffler.exe	Finds sensitive files in Active Directory environments
SharpSCCM	Latest GitHub release; SharpSCCM.exe	Microsoft SCCM reconnaissance and abuse
DCOMIllusionist	Latest GitHub release; DCOMIllusionist.exe	DCOM lateral movement and remote execution
PingCastle	Latest GitHub release; ZIP to the tools directory	Active Directory security assessment
DumpGuard	Latest GitHub release; ZIP to the tools directory	Reviews Windows process-dump protections
pssrecon	Fixed GitHub release; pssrecon.exe	Process Snapshotting Service reconnaissance
MSSQLHound	Latest GitHub release; Windows x64 executable	MSSQL attack-path collector for BloodHound
Titanis	Latest GitHub release; self-contained Windows x64 ZIP with .NET 8 runtime	Windows and Active Directory enumeration toolkit
ntlmrain	Latest GitHub release; Windows x64 ZIP to the tools directory	Recovers NT hashes from NetNTLMv1 responses
Atlas	Latest GitHub release; Windows x64 ZIP to the tools directory	Cross-platform network execution and AD assessment toolkit
Sysinternals Suite	Official direct download; ZIP to the tools directory	Windows troubleshooting and system-inspection utilities
CMLoot	Git clone	PowerShell SCCM reconnaissance and looting
Powermad	Git clone	Active Directory machine-account manipulation
ResetNightmare	Git clone; requires ActiveDirectory, Rubeus.exe, and an unpatched DC	CVE-2026-27912 account-password-reset proof of concept
gopacket	Git clone + native build; Go 1.24.13 when needed; Windows target	Go implementation of selected Impacket functionality

Scripts and Host Configuration

Configuration	Installation	Details
PowerView.ps1	Direct script download to the tools directory	Active Directory reconnaissance and administration
ADTamper.ps1	Direct script download to the tools directory	Active Directory ACL and object modification
SnafflerParser.ps1	Direct script download to the tools directory	Parses and filters Snaffler output
PrivescCheck.ps1	Direct script download to the tools directory	Windows local privilege-escalation checks
ShellOpsLog	Direct profile download	Automatic PowerShell operation logging
disable-smb.bat	Direct script download	Stops SMB services to release TCP port 445
enable-smb.bat	Direct script download	Restores SMB services
Firewall rules	Interactive configuration; SSH, RDP, SMB, HTTP, and HTTPS	Optional inbound firewall access
Defender exclusion	Automatic configuration; selected tools directory	Reduces real-time scanning of installed tools
Daily reboot task	Interactive configuration	Optional scheduled reboot
Evidence, tools, and log paths	Interactive configuration; defaults C:\_Preuves and C:\_Tools	Per-installation evidence, tool, and setup-log locations

Paths Reference

Both scripts prompt for custom directories and create log files:

Windows Paths:

• Evidence: C:\_Preuves (default) - Client evidence and operation logs
• Tools: C:\_Tools (default) - Downloaded security tools
• Setup Log: <ToolsPath>\logs\setup-windows-TIMESTAMP.log

Linux Paths:

• Tools: ~/tools (default) - Cloned repositories, standalone tools, and logs
• Operation Logs: /mnt/c/_Preuves/opslogs_wsl/ (default) - ShellOpsLog output
• Setup Log: <ToolsPath>/logs/setup-ubuntu-TIMESTAMP.log

AI Assistance Disclosure

This project was developed by 5tuk0v with substantial assistance from AI coding tools, including OpenCode and OpenAI Codex, using multiple models. The exact models and versions used were not consistently recorded.

AI assistance included implementation, debugging, testing, documentation, and code review. All AI-assisted contributions were directed and reviewed by the maintainer, who remains responsible for the final result.

License

MIT License - see LICENSE file for details.

This project integrates third-party tools, each with their own licenses. See the respective repositories for license information.

Disclaimer

This is a minimal automation framework. You are responsible for choosing and installing appropriate tools for your use case. Use tools responsibly and only on systems you own or have authorization to test.