{"componentChunkName":"component---src-templates-post-template-js","path":"/ctf-setup-windows-lab-en","result":{"data":{"markdownRemark":{"id":"5fc51777-b9e0-5b4b-84b4-5e66b0b62e9e","html":"
\n

This page has been machine-translated from the original page.

\n
\n

My CTF machine’s configuration had gotten complicated enough that I could no longer keep track of it, so I decided to start fresh and build a new environment.

\n

This time, I want to set things up as much as possible using command-based approaches, so I can save effort the next time I need to build a similar environment.

\n

Note that since the problems I mainly work on are Reversing (Rev) and Forensics, the tools I install may be somewhat biased toward those categories — please bear with me.

\n\n

Table of Contents

\n\n

Prerequisites

\n

Clean OS Installation and Updates

\n

Since I normally solve CTF problems on a Windows machine, the VM I’m building is also Windows.

\n

I’m using Hyper-V as the virtualization platform, and created the machine with the following configuration.

\n

\n \n \n \n \n \n \n \n \n

\n

The storage capacity is set to 232 GB.

\n

The OS clean installation and update procedure is omitted here.

\n

Enabling Nested Virtualization

\n

After creating the virtual machine, shut it down and run the following cmdlet from an elevated PowerShell prompt to enable nested virtualization.

\n

This allows you to launch Android Emulator and similar tools inside the virtual machine.

\n
# Set-VMProcessor -VMName <VMName> -ExposeVirtualizationExtensions $true\nSet-VMProcessor -VMName \"Win10CTF\" -ExposeVirtualizationExtensions $true
\n

Reference: Run Hyper-V in a Virtual Machine with Nested Virtualization | Microsoft Learn

\n

Changing Network Adapter Settings

\n

Run the following from an elevated PowerShell prompt to change the network adapter settings.

\n

In this setup, the Default Switch for external connectivity uses the default DHCP connection, and the Internal network adapter is assigned the static address 192.168.50.10/28.

\n
# Use Get-NetIPAddress to identify the InterfaceIndex for the Internal NIC\nGet-NetIPAddress\n>\nIPAddress         : 169.254.116.214\nInterfaceIndex    : 8\nInterfaceAlias    : Ethernet 3\nAddressFamily     : IPv4\n\n# Assign 192.168.50.10/28 to the network with InterfaceIndex 8\nNew-Netipaddress -InterfaceIndex 8 -IpAddress 192.168.50.10 -PrefixLength 28
\n

Reference: New-NetIPAddress (NetTCPIP) | Microsoft Learn

\n

Deleting the Recovery Partition

\n

Since this is a virtual machine, I’ll delete the recovery partition.

\n

Launch Diskpart.exe from an elevated Command Prompt and run the following commands in order.

\n
Diskpart.exe\n\n# List disks and select one\nDISKPART> list disk\nDisk 0    Online\n\nDISKPART> select disk 0\n\n# List partitions and identify the Recovery partition ID\nDISKPART> list partition\n\nPartition ###  Type              Size     Offset\n-------------  ----------------  -------  -------\nPartition 3    Recovery           535 MB    79 GB\n\n# Select the identified Recovery partition and delete it\nDISKPART> select partition 3\nDISKPART> delete partition override
\n

Windows Setup

\n

After starting the created virtual machine, open PowerShell as administrator and apply the various settings.

\n

The following command can apply all settings at once.

\n
# Set the username used in user folder paths\n$username = \"kash1064\"\n\n# Set timezone to UTC\ntzutil.exe /s \"UTC\"\n\n# Change PowerShell script execution policy\nSet-ExecutionPolicy RemoteSigned\n\n# Show file extensions and hidden files in Explorer\nSet-ItemProperty \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\" -name \"HideFileExt\" -Value 0\nSet-ItemProperty \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\" -name \"Hidden\" -Value 1\n\n# Enable RDP connections\nSet-ItemProperty -Path \"HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\" -Name \"fDenyTSConnections\" -Value 0\nEnable-NetFirewallRule -DisplayGroup \"Remote Desktop\"\n\n# List feature names: Get-WindowsOptionalFeature -Online\n# Enable WSL, Virtual Machine Platform, and Hyper-V\nEnable-WindowsOptionalFeature -NoRestart -Online -FeatureName Microsoft-Windows-Subsystem-Linux\nEnable-WindowsOptionalFeature -NoRestart -Online -FeatureName HypervisorPlatform\nEnable-WindowsOptionalFeature -NoRestart -Online -FeatureName VirtualMachinePlatform\nEnable-WindowsOptionalFeature -NoRestart -Online -FeatureName Microsoft-Hyper-V-All\n\n# Remove unnecessary pre-installed Store packages\n# List packages with: Get-AppxPackage | Select-Object Name\n# TikTok and Instagram require manual removal\nGet-AppxPackage -alluser *MicrosoftSolitaireCollection* | Remove-Appxpackage\nGet-AppxPackage -alluser *MicrosoftStickyNotes* | Remove-Appxpackage\nGet-AppxPackage -alluser *Microsoft.People* | Remove-Appxpackage\nGet-AppxPackage -alluser *Office.OneNote* | Remove-Appxpackage\nGet-AppxPackage -alluser *Microsoft.GetHelp* | Remove-Appxpackage\nGet-AppxPackage -alluser *MicrosoftOfficeHub* | Remove-Appxpackage\nGet-AppxPackage -alluser *MicrosoftSolitaireCollection* | Remove-Appxpackage\nGet-AppxPackage -alluser *MicrosoftStickyNotes* | Remove-Appxpackage\nGet-AppxPackage -alluser *Microsoft.People* | Remove-Appxpackage\nGet-AppxPackage -alluser *SkypeApp* | Remove-Appxpackage\nGet-AppxPackage -alluser *YourPhone* | Remove-Appxpackage\nGet-AppxPackage -alluser *SpotifyAB.SpotifyMusic* | Remove-Appxpackage\nGet-AppxPackage -alluser *Disney* | Remove-Appxpackage\nGet-AppxPackage -alluser *ZuneMusic* | Remove-Appxpackage\nGet-AppxPackage -alluser *3DViewer* | Remove-Appxpackage\nGet-AppxPackage -alluser *Microsoft.MSPaint* | Remove-Appxpackage\nGet-AppxPackage -alluser *Microsoft.WindowsMaps* | Remove-Appxpackage\nGet-AppxPackage -alluser *messaging* | Remove-Appxpackage\nGet-AppxPackage -alluser *windowscommunicationsapps* | Remove-Appxpackage\nGet-AppxPackage -alluser *ZuneVideo* | Remove-Appxpackage\nGet-AppxPackage -alluser *BingWeather* | Remove-Appxpackage\nGet-AppxPackage -alluser *MicrosoftOfficeHub* | Remove-Appxpackage\nGet-AppxPackage -alluser *Microsoft.549981C3F5F10* | Remove-AppxPackage\nGet-AppxPackage -alluser *Microsoft.Todo* | Remove-AppxPackage\nGet-AppxPackage -alluser *Microsoft.GetHelp* | Remove-AppxPackage\nGet-AppxPackage -alluser *Microsoft.GamingApp* | Remove-AppxPackage\nGet-AppxPackage -alluser *Microsoft.People* | Remove-AppxPackage\nGet-AppxPackage -alluser *Microsoft.WindowsCamera* | Remove-AppxPackage\nGet-AppxPackage -alluser *Microsoft.WindowsFeedbackHub* | Remove-AppxPackage\nGet-AppxPackage -alluser *Microsoft.YourPhone* | Remove-AppxPackage\nGet-AppxPackage -alluser *Microsoft.BingNews* | Remove-AppxPackage\nGet-AppxPackage -alluser *Microsoft.BingWeather* | Remove-AppxPackage\nGet-AppxPackage -alluser *Microsoft.MicrosoftSolitaireCollection* | Remove-AppxPackage\nGet-AppxPackage -alluser *Microsoft.Getstarted* | Remove-AppxPackage\nGet-AppxPackage -alluser *Microsoft.WindowsNotepad* | Remove-AppxPackage\n\n\n# Remove unnecessary shortcuts\n# C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\n# %USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\nGet-ChildItem -Path \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\"\nRemove-Item -Path \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\" -Include *.lnk\n\n# Register all Desktop shortcuts in the Start Menu as well\nCopy-Item -Path \"C:\\Users\\$username\\Desktop\\*.lnk\" -Destination \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\"\n\n# Create the Tools folder\nNew-Item -ItemType \"directory\" -Path \"C:\\Tools\"\n\n# Add Defender exclusions\nAdd-MpPreference -ExclusionPath \"C:\\Tools\\\"\nAdd-MpPreference -ExclusionPath  \"C:\\Users\\kash1064\\AppData\\Local\\Packages\\CanonicalGroupLimited.Ubuntu_*\\\"\nAdd-MpPreference -ExclusionPath \"C:\\Users\\kash1064\\Downloads\\\"\n\n# Change UAC to level 2 (notify only)\n# Get-ItemProperty HKLM:Software\\Microsoft\\Windows\\CurrentVersion\\policies\\system\nSet-ItemProperty \"HKLM:Software\\Microsoft\\Windows\\CurrentVersion\\policies\\system\" -name \"ConsentPromptBehaviorAdmin\" -Value 5\nSet-ItemProperty \"HKLM:Software\\Microsoft\\Windows\\CurrentVersion\\policies\\system\" -name \"PromptOnSecureDesktop\" -Value 0\nSet-ItemProperty \"HKLM:Software\\Microsoft\\Windows\\CurrentVersion\\policies\\system\" -name \"EnableLUA\" -Value 1\n\n# Restart the OS\nStart-Sleep -Seconds 30\nRestart-Computer
\n

An OS restart is required for the settings to take effect.

\n

Show File Extensions and Hidden Files in Explorer

\n

Explorer option settings can be managed via registry keys under HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced.

\n

The following cmdlets configure Explorer to show file extensions and hidden files.

\n
# Show file extensions and hidden files in Explorer\nSet-ItemProperty \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\" -name \"HideFileExt\" -Value 0\nSet-ItemProperty \"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\" -name \"Hidden\" -Value 1
\n

Enable Windows Features

\n

The following features are enabled to support WSL2, Android Studio emulator, and similar tools.

\n

Note: omitting -NoRestart will cause a restart immediately after executing the command.

\n
# Enable WSL, Virtual Machine Platform, and Hyper-V\nEnable-WindowsOptionalFeature -NoRestart -Online -FeatureName Microsoft-Windows-Subsystem-Linux\nEnable-WindowsOptionalFeature -NoRestart -Online -FeatureName HypervisorPlatform\nEnable-WindowsOptionalFeature -NoRestart -Online -FeatureName VirtualMachinePlatform\nEnable-WindowsOptionalFeature -NoRestart -Online -FeatureName Microsoft-Hyper-V-All
\n

Reference: Enable-WindowsOptionalFeature (DISM) | Microsoft Learn

\n

Change IME Settings

\n

I configured this through the GUI for now.

\n

Reference: Customize the IME layout

\n

Disable System Sounds

\n

I also configured this through the GUI for now.

\n

Open [Change system sounds] from Control Panel and set it to [No Sounds].

\n

\n \n \n \n \n \n \n \n \n

\n

Addendum (Windows 11 only): Change Explorer Right-Click Behavior

\n

The following command changes the right-click behavior in Explorer to match Windows 10 style.

\n
reg.exe add \"HKCU\\Software\\Classes\\CLSID\\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\\InprocServer32\" /f /ve
\n

Addendum: Add Desktop Shortcuts for All EXE Files Under a Specific Folder

\n
$src='C:\\Tools\\AllTools';$desktop=[Environment]::GetFolderPath('Desktop');$ws=New-Object -ComObject WScript.Shell;Get-ChildItem -Path $src -Filter *.exe -Recurse -File|ForEach-Object{$name=[IO.Path]::GetFileNameWithoutExtension($_.FullName);$lnk=Join-Path $desktop ($name+'.lnk');$s=$ws.CreateShortcut($lnk);$s.TargetPath=$_.FullName;$s.WorkingDirectory=$_.DirectoryName;$s.IconLocation=$_.FullName;$s.Save()}
\n

Install Analysis Tools via WinGet

\n

I’ll manage tools using winget wherever possible.

\n

Any tools that cannot be obtained via winget, or that are easier to manage without it, will all be installed in the section below.

\n
# Install various packages\nwinget.exe install --id Google.Chrome\nwinget.exe install --id Mozilla.Firefox\nwinget.exe install --id Canonical.Ubuntu\nwinget.exe install --id Typora.Typora\nwinget.exe install --id Microsoft.WindowsTerminal\nwinget.exe install --id Git.Git\nwinget.exe install --id WiresharkFoundation.Wireshark\nwinget.exe install --id SoftwareFreedomConservancy.QEMU\nwinget.exe install --id 7zip.7zip\nwinget.exe install --id Microsoft.XMLNotepad\nwinget.exe install --id Brave.Brave\nwinget.exe install --id PortSwigger.BurpSuite.Community\nwinget.exe install --id Google.AndroidStudio\nwinget.exe install --id Hex-Rays.IDA.Free\nwinget.exe install --id icsharpcode.ILSpy\nwinget.exe install --id dnSpyEx.dnSpy\nwinget.exe install --id Notepad++.Notepad++\nwinget.exe install --id WinMerge.WinMerge\nwinget.exe install --id Microsoft.WinDbg\nwinget.exe install --id OliverBetz.ExifTool\nwinget.exe install --id GIMP.GIMP\nwinget.exe install --id Microsoft.Office\nwinget.exe install --id Canonical.Ubuntu.2204\nwinget.exe install --id kalilinux.kalilinux\nwinget.exe install --id Chocolatey.ChocolateyGUI\nwinget.exe install --id MHNexus.HxD\nwinget.exe install --id ImageMagick.ImageMagick\nwinget.exe install --id WinsiderSS.SystemInformer
\n

Reference: Installing Commonly Used Applications with Windows Package Manager (winget) - Frog’s Secret Base

\n

Manually Install Various Analysis Tools

\n

Installing tools that cannot (or should not) be installed via WinGet.

\n

The versions of some tools (such as Visual Studio and JDK) reflect those available at the time of writing; please install the latest versions as appropriate.

\n

WinDbg

\n

Install using the Windows SDK installer downloaded from the link below.

\n

Reference: Debugging Tools for Windows - Windows drivers | Microsoft Learn

\n

Also, set up the workspace using the reg file downloaded from the link below.

\n

Reference: Releases · kash1064/WinDbg-Classic-Dark

\n

Sysinternals

\n

Download files from the link below and place them in C:\\Tools\\SysinternalsSuite.

\n

Reference: Sysinternals Utilities - Sysinternals | Microsoft Learn

\n

Also, configure symbol settings for Procmon and Procexp.

\n

\n \n \n \n \n \n \n \n \n

\n

Noriben

\n

Download files from the link below and extract them to C:\\Tools\\Noriben.

\n

Reference: GitHub - Rurik/Noriben: Noriben - Portable, Simple, Malware Analysis Sandbox

\n

Java 17

\n

Download files from the link below and extract them to C:\\Tools\\jdk-17.

\n

Reference: Java Downloads | Oracle

\n

Java 8

\n

Download from the link below and extract to C:\\Tools\\jdk-8.

\n

Reference: Latest Releases | Adoptium

\n

Eclipse Memory Analyzer

\n

Download files from the link below and extract them to C:\\Tools\\MemoryAnalyzer.

\n

Reference: Open Source Project | The Eclipse Foundation

\n

Follow the procedure below to specify the Java path.

\n

Reference: How to Fix the “version 1.8.0_261 of the jvm is not suitable” Error When Launching Eclipse Memory Analyzer as a Single Binary - Frog’s Secret Base

\n

Android Studio

\n

Launch the Android Studio installed via WinGet and proceed through the setup.

\n

Also, create x86 and x86_64 emulators from the Device Manager.

\n

\n \n \n \n \n \n \n \n \n

\n

Set the installation destination to C:\\Tools\\Eclipse.

\n

Also, create the workspace at %USERPROFILE%\\Documents\\eclipse-workspace.

\n

Gradle

\n

Download from the link below and extract to C:\\Tools\\Gradle.

\n

Reference: Gradle | Releases

\n

PEiD

\n

Download from the link below and extract to C:\\Tools\\PEiD.

\n

Reference: PEiD (Windows) - Download & Review

\n

jadx

\n

Download from the link below and extract to C:\\Tools\\jadx.

\n

Reference: Releases · skylot/jadx · GitHub

\n

jd-gui

\n

Download from the link below and extract to C:\\Tools\\jd-gui.

\n

Reference: Java Decompiler

\n

ProcessHacker

\n

Download from the link below and extract to C:\\Tools\\ProcessHacker.

\n

Reference: Downloads - Process Hacker

\n

LLDB

\n

Install to C:\\Tools\\LLVM using the installer downloaded from the link below.

\n

Reference: Releases · llvm/llvm-project · GitHub

\n

npcap

\n

Install using the installer downloaded from the link below.

\n

Reference: Npcap: Windows Packet Capture Library & Driver

\n

Windows Terminal

\n

Set up the application installed via WinGet.

\n

Configure shortcut keys and the startup folder.

\n

Also, add a PowerShell profile with [elevate] set to True, and reorder settings.json as follows.

\n
{omitted}\n{\n    \"commandline\": \"%SystemRoot%\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\n    \"guid\": \"{61c54bbd-c2c6-5271-96e7-009a87ff44bf}\",\n    \"hidden\": false,\n    \"name\": \"Windows PowerShell\",\n    \"startingDirectory\": \"%USERPROFILE%\\\\Downloads\"\n},\n{\n    \"commandline\": \"%SystemRoot%\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\n    \"elevate\": true,\n    \"guid\": \"{61c54bbd-c2c6-5271-96e7-009a87ff44ba}\",\n    \"hidden\": false,\n    \"name\": \"Elevate Windows PowerShell\",\n    \"startingDirectory\": \"%USERPROFILE%\\\\Downloads\"\n},\n{\n    \"guid\": \"{51855cb2-8cce-5362-8f54-464b92b32386}\",\n    \"hidden\": false,\n    \"name\": \"Ubuntu\",\n    \"source\": \"CanonicalGroupLimited.Ubuntu_79rhkp1fndgsc\"\n},\n{\n    \"guid\": \"{07b52e3e-de2c-5db4-bd2d-ba144ed6c273}\",\n    \"hidden\": false,\n    \"name\": \"Ubuntu-20.04\",\n    \"source\": \"Windows.Terminal.Wsl\",\n    \"tabTitle\": \"Remnux\"\n},\n{\n    \"commandline\": \"%SystemRoot%\\\\System32\\\\cmd.exe\",\n    \"guid\": \"{0caa0dad-35be-5f56-a8ff-afceeeaa6101}\",\n    \"hidden\": false,\n    \"name\": \"Command Prompt\",\n    \"startingDirectory\": \"%USERPROFILE%\\\\Downloads\"\n},\n{omitted}
\n

This allows you to easily launch an elevated PowerShell prompt from Windows Terminal.

\n

hollows_hunter

\n

Download files from the link below and extract to C:\\Tools\\hollows_hunter.

\n

Reference: Releases · hasherezade/hollows_hunter

\n

APIMiner

\n

Download files from the link below and extract to C:\\Tools\\APIMiner.

\n

Reference: Release APIMiner-v1.0.0 · poona/APIMiner

\n

CyberChef

\n

Download files from the link below, extract to C:\\Tools\\CyberChef, and bookmark it in your browser.

\n

Reference: Releases · gchq/CyberChef · GitHub

\n

UPX

\n

Download files from the link below and extract to C:\\Tools\\upx.

\n

Reference: Releases · upx/upx · GitHub

\n

FTK Imager

\n

Install to C:\\Tools\\AccessData using the installer downloaded from the link below.

\n

Reference: Exterro Thank You Page - Exterro

\n

PDFStreamDumper

\n

Install to C:\\Tools\\PDFStreamDumper using the installer downloaded from the link below.

\n

Reference: Releases · dzzie/pdfstreamdumper

\n

UsaMimi Hurricane, Aozora Shiro Neko

\n

Download files from the link below and extract to C:\\Tools\\UsaMimi.

\n

Reference: General File Analyzer “Looking Up at the Blue Sky, There’s Always a White Cat” (青い空を見上げればいつもそこに白い猫)

\n

Volatility 2.6

\n

Download files from the link below and extract to C:\\Tools\\volatility2.

\n

Volatility 3 is typically used from the version installed in WSL.

\n

Reference: Release Downloads | Volatility Foundation

\n

Universal Radio Hacker (URH)

\n

Install to C:\\Tools\\Universal Radio Hacker using the installer downloaded from the link below.

\n

Reference: Releases · jopohl/urh

\n

Cheat Engine

\n

Downloadable from the link below; note that the installer reportedly bundles adware and is detected as PUA by Defender.

\n

Since I don’t use it very often, I normally don’t install it and only do so when I absolutely need it.

\n

Reference: Cheat Engine

\n

Sysmon

\n

Download from the link below and install with sysmon64 -i.

\n

Reference: Sysmon - Sysinternals | Microsoft Learn

\n

VcXsrv Windows X Server

\n

Download from the link below and install to C:\\Tools\\VcXsrv.

\n

Reference: VcXsrv Windows X Server download | SourceForge.net

\n

Pybag

\n

Install using the following commands.

\n
cd C:\\Tools\n\n# The official repository has a bug at install time (as of 2023/5/24), so clone the forked repository instead\ngit clone https://github.com/kash1064/Pybag\ncd .\\Pybag\\\npython.exe ./setup.py install
\n

Reference: kash1064/Pybag: Python module for Windbg’s dbgeng plus additional wrappers.

\n

AssetStudio

\n

Download from the link below.

\n

Reference: GitHub - Perfare/AssetStudio: AssetStudio is a tool for exploring, extracting and exporting assets and assetbundles.

\n

ExtremeDumper

\n

Download from the repository below.

\n

Reference: Releases · wwh1004/ExtremeDumper · GitHub

\n

Quick Assembler

\n

Download the binary from the repository below.

\n

Reference: zodiacon/AllTools: All reasonably stable tools

\n

cutter

\n

Download and extract the files from the link below.

\n

Reference: Cutter

\n

Fiddler

\n

Use the installer downloaded from the link below.

\n

Reference: Web Debugging Proxy and Troubleshooting Tools|Fiddler

\n

Install Tools via Chocolatey

\n

Some tools, including CFF Explorer, will be installed via Chocolatey.

\n

First, run the following command in an elevated PowerShell prompt to install Chocolatey.

\n
Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
\n

Once Chocolatey is installed, run the following command to install each tool.

\n
# Install tools\nchoco install apimonitor -y\nchoco install hashmyfiles -y\nchoco install fakenet -y\nchoco install explorersuite -y
\n

Set Up Environment Variables

\n

Run the following commands in an elevated PowerShell prompt to configure all environment variables at once.

\n

Adjust the actual paths to match your environment.

\n
# Set up user environment variables\n$usename = \"kash1064\"\n$UserPath = @\"\nC:\\Tools\\SysinternalsSuite;\nC:\\Tools\\android-sdk;\nC:\\Tools\\android-ndk;\nC:\\Tools\\Noriben;\nC:\\Tools\\Ghidra;\nC:\\Tools\\MemoryAnalyzer;\nC:\\Tools\\Hayabusa;\nC:\\Tools\\Hasher;\nC:\\Tools\\TimelineExplorer;\nC:\\Tools\\jq;\nC:\\Tools\\Frida;\nC:\\Tools\\Gradle\\bin;\nC:\\Tools\\jdk-17\\bin;\nC:\\Tools\\LLVM\\bin;\nC:\\Tools\\APIMiner;\nC:\\Tools\\hollows_hunter;\nC:\\Tools\\upx;\nC:\\Tools\\UsaMimi;\nC:\\Tools\\volatility2;\nC:\\Tools\\Universal Radio Hacker;\n\nC:\\Program Files\\qemu;\n\nC:\\ProgramData\\chocolatey\\lib\\apimonitor;\nC:\\ProgramData\\chocolatey\\lib\\hashmyfiles;\nC:\\Program Files\\NTCore\\Explorer Suite;\n\nC:\\Users\\$usename\\AppData\\Local\\Programs\\Python\\Python310\\Scripts\\;\nC:\\Users\\$usename\\AppData\\Local\\Programs\\Python\\Python310\\;\nC:\\Users\\$usename\\AppData\\Local\\Microsoft\\WindowsApps;\nC:\\Users\\$usename\\AppData\\Local\\Programs\\Microsoft VS Code\\bin;\nC:\\Users\\$usename\\AppData\\Local\\Microsoft\\WinGet\\Links;\nC:\\Users\\$usename\\AppData\\Local\\Programs\\ExifTool;\n\nC:\\Python27\\Scripts;\nC:\\Python27;\n\"@\n$UserPath = $UserPath.Replace(\"`n\", \"\")\n\n[System.Environment]::SetEnvironmentVariable(\"Path\", $UserPath, \"User\")\n[System.Environment]::SetEnvironmentVariable(\"NDK_PROJECT_PATH\", \"C:\\Tools\\NDK\", \"User\")\n[System.Environment]::SetEnvironmentVariable(\"JAVA_HOME\", \"C:\\Tools\\jdk-17\", \"User\")\n\n\n# Set up system environment variables\n$usename = \"kash1064\"\n$SytemPath = @\"\nC:\\Users\\$usename\\AppData\\Local\\Programs\\Python\\Python310\\Scripts\\;\nC:\\Users\\$usename\\AppData\\Local\\Programs\\Python\\Python310\\;\nC:\\Python27\\Scripts;\nC:\\Python27;\n\nC:\\Windows\\system32;\nC:\\Windows;\nC:\\Windows\\System32\\Wbem;\nC:\\Windows\\System32\\WindowsPowerShell\\v1.0\\;\nC:\\Windows\\System32\\OpenSSH\\;\nC:\\Program Files\\Microsoft SQL Server\\130\\Tools\\Binn\\;\nC:\\Program Files\\dotnet\\;\nC:\\ProgramData\\chocolatey\\bin;\nC:\\Program Files (x86)\\Windows Kits\\10\\Windows Performance Toolkit\\;\nC:\\Program Files\\Git\\cmd;\nC:\\Tools\\SysinternalsSuite;\nC:\\Tools\\APIMiner;\nC:\\Tools\\hollows_hunter;\nC:\\Tools\\UsaMimi;\nC:\\Tools\\volatility2;\n\nC:\\Program Files\\qemu;\n\"@\n$SytemPath = $SytemPath.Replace(\"`n\", \"\")\n[System.Environment]::SetEnvironmentVariable(\"Path\", $SytemPath, \"Machine\")\n\n# Restart the OS\nRestart-Computer
\n

WSL Setup

\n

Switch to WSL2

\n

First, install wsl_update_x64.msi downloaded from the link below.

\n

Reference: Manual installation steps for older versions of WSL | Microsoft Learn

\n

Next, run the following commands from an elevated PowerShell prompt to enable WSL2.

\n
wsl --set-version Ubuntu 2\nwsl --set-version Ubuntu-20.04 2
\n

The WSL2 enable command is run twice because the following two packages are installed during WinGet installation.

\n
winget.exe install --id Canonical.Ubuntu.2204\nwinget.exe install --id Canonical.Ubuntu.2004
\n

Ubuntu 20.04 is required to satisfy the prerequisites for SHIFT and REMnux described later.

\n

Also, since Ubuntu 20.04 cannot run recent problem binaries due to a glib version dependency, Ubuntu 22.04 is used as the main CTF analysis environment.

\n

Install Packages

\n

Use the following commands to install packages and tools.

\n

This environment is used for the main analysis, so Ubuntu 22.04 is used here.

\n
# Update\nsudo apt update && sudo apt upgrade -y\n\n# Install Docker\n# https://docs.docker.com/engine/install/ubuntu/\nsudo apt install \\\n    ca-certificates \\\n    curl \\\n    gnupg \\\n    lsb-release \\\n    -y\nsudo mkdir -p /etc/apt/keyrings\ncurl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg\necho \\\n  \"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \\\n  $(lsb_release -cs) stable\" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null\n\n# Install packages\nsudo apt update && sudo apt install \\\napktool \\\n    bash-completion \\\n    build-essential \\\n    binwalk \\\n    cifs-utils \\\n    containerd.io \\\n    docker-ce \\\n    docker-ce-cli \\\n    docker-compose \\\n    docker-compose-plugin \\\n    elfutils \\\n    exiftool \\\n    foremost \\\n    gdb \\\n    gdbserver \\\n    glibc-source \\\n    golang-go \\\n    git \\\n    hexedit \\\n    hprof-conv \\\n    libc6-dbg \\\n    lldb \\\n    libbpf-dev \\\n    libseccomp-dev \\\n    libfuzzy-dev \\\n    maven \\\n    make \\\n    mingw-w64-* \\\n    nasm \\\n    netcat \\\n    net-tools \\\n    openjdk-17-jdk \\\n    patchelf \\\n    pdftohtml \\\n    pngcheck \\\n    python2.7 \\\n    python3-pip \\\n    python3.10 \\\n    python3.10-dev \\\n    qemu \\\n    rar \\\n    ruby-rubygems \\\n    snapd \\\n    steghide \\\n    ssh \\\n    tmux \\\n    tshark \\\n    ufw \\\n    unzip \\\n    upx-ucl \\\n    vim \\\n    yara \\\n    7zip \\\n    -y\n\n# Required to run docker-compose as of 2024/06\npip3 install requests==2.29.0\n\n# Select /usr/sbin/iptables-legacy\nsudo update-alternatives --config iptables\n\n# Install Rust\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n\n# Install SageMath (large package, skip if not needed)\nsudo apt install sagemath -y\n\n# Use Docker as a normal user\nsudo gpasswd -a $USER docker\nsudo service docker start --enable\n\n# Create SSH key and register it with GitHub\nssh-keygen\n\n# Install tools\nmkdir ~/Tools\n\n# Install gdb peda and pwndbg\ngit clone https://github.com/longld/peda.git ~/Tools/peda\ngit clone https://github.com/scwuaptx/Pwngdb.git ~/Tools/Pwngdb\n\ncat << EOF > ~/.gdbinit\nsource ~/Tools/peda/peda.py\nsource ~/Tools/Pwngdb/pwngdb.py\nsource ~/Tools/Pwngdb/angelheap/gdbinit.py\n\ndefine hook-run\npython\nimport angelheap\nangelheap.init_angelheap()\nend\nend\nEOF\n\n# zsteg\nsudo gem install zsteg\n\n# stegsolve\nmkdir -p ~/Tools/stegsolve\ncd ~/Tools/stegsolve\nwget http://www.caesum.com/handbook/Stegsolve.jar -O stegsolve.jar\nchmod +x stegsolve.jar\n\n# pwninit\nmkdir -p ~/Tools/pwninit\ncd ~/Tools/pwninit\nwget https://github.com/io12/pwninit/releases/download/3.3.0/pwninit\nchmod +x ./pwninit\n\n# Install pip2\ncurl https://bootstrap.pypa.io/pip/2.7/get-pip.py -o ~/Tools/get-pip.py\npython2.7 ~/Tools/get-pip.py\n/home/ubuntu/.local/bin/pip2 install --upgrade setuptools\n/home/ubuntu/.local/bin/pip2 install pipenv\nsudo apt install python2-dev --fix-missing\n\n# pip tools\nsudo pip3 install \\\nangr \\\nciphey \\\n    pipenv \\\n    python-magic \\\n    pycryptodome \\\n    pwntools \\\n    yara-python\n\n# volatility3\ncd ~/Tools\ngit clone https://github.com/volatilityfoundation/volatility3.git\n\n# Download extract-vmlinux\ncd ~/Tools\nwget https://raw.githubusercontent.com/torvalds/linux/master/scripts/extract-vmlinux\nchmod +x extract-vmlinux\n\n# Install ropr\ncargo install ropr\n\n# Install Steganography\ncd ~/Tools\ngit clone https://github.com/ragibson/Steganography\ncd Steganography\nsudo python3 setup.py install\n\n# Set up stegoveritas\npip3 install stegoveritas\nstegoveritas_install_deps\n\n# Install darling (with all dependencies)\nsudo apt install cmake clang bison flex libfuse-dev libudev-dev pkg-config libc6-dev-i386 \\\ngcc-multilib libcairo2-dev libgl1-mesa-dev libglu1-mesa-dev libtiff5-dev \\\nlibfreetype6-dev git git-lfs libelf-dev libxml2-dev libegl1-mesa-dev libfontconfig1-dev \\\nlibbsd-dev libxrandr-dev libxcursor-dev libgif-dev libavutil-dev libpulse-dev \\\nlibavformat-dev libavcodec-dev libswresample-dev libdbus-1-dev libxkbfile-dev \\\nlibssl-dev python2 -y\nwget https://github.com/darlinghq/darling/releases/download/v0.1.20220704/darling_0.1.20220704.focal_amd64.deb\nsudo dpkg -i darling_0.1.20220704.focal_amd64.deb\nrm darling_0.1.20220704.focal_amd64.deb\n\n# Install QEMU-related tools\nsudo apt install qemu-user-binfmt qemu-efi qemu-efi-aarch64 qemu-efi-arm qemu-system qemu-system-arm qemu-system-common qemu-system-x86 qemu-system-misc qemu-utils g++-arm-linux-gnueabihf gdb-multiarch -y\n\n# Install wabt\nwget https://github.com/WebAssembly/wabt/releases/download/1.0.33/wabt-1.0.33-ubuntu.tar.gz\n\n# Install smali2java and jadx: https://github.com/skylot/jadx/releases\n\n# Install one_gadget\nsudo gem install one_gadget\n\n# Install seccomp-tools\nsudo apt install ruby-dev -y\nsudo gem install seccomp-tools\n\n# Risc-V\ngit clone https://github.com/riscv-collab/riscv-gnu-toolchain\ncd riscv-gnu-toolchain\ngit checkout origin/extra-multi-lib-test\n\nsudo apt-get install autoconf automake autotools-dev curl python3 python3-pip libmpc-dev libmpfr-dev libgmp-dev gawk build-essential bison flex texinfo gperf libtool patchutils bc zlib1g-dev libexpat-dev ninja-build git cmake libglib2.0-dev python-is-python3 -y\n\n# Install gef for root\nsudo su\nwget -O ~/.gdbinit-gef.py -q https://gef.blah.cat/py\n\nsudo su\n./configure --prefix=/home/ubuntu/Tools/riscv\nmake linux\n\n# Clone glibc source\ncd ~/Tools\ngit clone https://github.com/bminor/glibc\necho source ~/.gdbinit-gef.py > ~/.gdbinit\n\n# Set up aliases\necho -e \"\nalias tarbz2='tar -jxvf'\nalias targz='tar -zxvf'\nalias tarxz='tar -Jxvf'\nalias aptupgrade='sudo apt update && sudo apt upgrade -y && sudo apt autoremove -y'\nalias checksec='pwn checksec'\n\nalias run_python2='docker run --net host --rm -it -v $PWD:/app python2 bash'\nalias run_python3='docker run --net host --rm -it -v `pwd`:/app python3 bash'\nalias run_wine='docker run --rm -it --user ubuntu -v $PWD:/usr/app wine32 bash'\nalias run_php='docker run --net host --rm -it -v $PWD:/root php bash'\nalias run_impacker='docker run --net host --rm -it -v `pwd`:/root impacket'\nalias pince='cd /home/parrot/Tools/PINCE && sh PINCE.sh'\n\nalias aptupgrade='sudo apt update && sudo apt upgrade -y && sudo apt autoremove -y'\nalias sample2zip='zip -P infected -r'\n\nsudo /etc/init.d/docker start > /dev/null\n\nexport PATH=$PATH:/home/ubuntu/.local/bin:/home/ubuntu/Tools:/home/ubuntu/Tools/stegsolve:/home/ubuntu/Tools/wabt:/home/ubuntu/Tools/pwninit\nexport DISPLAY=$(cat /etc/resolv.conf | grep nameserver | awk '{print $2}'):0\" >> ~/.bashrc\n\n# Create a symbolic link to the host machine\nln -s /mnt/c/Users/kash1064/Downloads/ win\n\n# Remove password requirement for frequently used commands\necho $USER ALL=NOPASSWD: /usr/bin/apt | sudo tee /etc/sudoers.d/apt\necho $USER ALL=NOPASSWD: /etc/init.d/docker | sudo tee /etc/sudoers.d/docker\nsudo chmod 440 /etc/sudoers.d/*\n\n# Add libraries to run 32-bit binaries\nsudo dpkg --add-architecture i386\nsudo apt update\n\nsudo apt install libncurses6:i386\n\n# Install ripgrep\n# To enable pcre2: cargo install ripgrep --features 'pcre2'\nrustup install stable\ncargo install ripgrep\n\n# Clean up\nsudo apt autoremove -y\nsudo rm /var/crash/*
\n

Install libc-database in WSL2

\n

libc-database lets you look up libc offsets, but online tools may have outdated information, making it impossible to identify the needed version.

\n

Therefore, we set up libc-database locally.

\n
# Clone libc-database\ncd ~/Tools\ngit clone https://github.com/niklasb/libc-database\n\n# Install dependencies\nsudo apt update && sudo apt install -y \\\n  binutils file \\\n  wget \\\n  rpm2cpio cpio \\\n  zstd jq -y\n\n# Fetch libc information for each platform (consumes time and storage)\ncd ~/Tools/libc-database\n./get ubuntu debian rpm centos alpine
\n

Reference: GitHub - niklasb/libc-database: Build a database of libc offsets to simplify exploitation

\n

Install rp++ in WSL2

\n

Download from the link below.

\n

Reference: Releases · 0vercl0k/rp

\n

Install REMnux Tools in WSL2

\n

Next, install the REMnux add-on to the Ubuntu 20.04 WSL2 instance.

\n
sudo apt update && sudo apt upgrade -y\n\n# Place the installer\nwget https://REMnux.org/remnux-cli\nmv remnux-cli remnux\nchmod +x remnux\nsudo mv remnux /usr/local/bin\n\n# Install\nsudo remnux install --mode=addon
\n

Reference: Install from Scratch - REMnux Documentation

\n

Reference: Using Linux Forensics Tools in a Windows Environment! - Qiita

\n

Enable GUI Tools in WSL2

\n

The REMnux add-on includes many GUI tools, and we want to be able to use them.

\n

First, launch the already-installed VcXsrv Windows X Server.

\n

Leave the settings at their defaults, and on the next screen also select [Start no client].

\n

\n \n \n \n \n \n \n \n \n

\n

Save the generated config.xlaunch to %USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup.

\n

Next, add the following command to .bashrc in the WSL instance where REMnux is set up to register the display setting.

\n
export DISPLAY=$(cat /etc/resolv.conf | grep nameserver | awk '{print $2}'):0
\n

After restarting the OS, the setup is complete once GUI apps launched from WSL are accessible on the Windows side.

\n

\n \n \n \n \n \n \n \n \n

\n

Kali Setup

\n

Let’s also set up the Kali Linux installed in WSL.

\n

First, switch Kali to WSL2.

\n
wsl --set-version kali-linux 2
\n

You could also install kali-tools into Ubuntu, but for minimal setup to easily use tools like msfvenom, proceed as follows.

\n

First, to resolve the EXPKEYSIG ED444FF07D8D0BF6 Kali Linux Repository error, download kali-archive-keyring_2022.1_all.deb from the repository below, place it in the WSL Kali instance, and install it.

\n
# https://http.kali.org/kali/pool/main/k/kali-archive-keyring/\nsudo dpkg -i kali-archive-keyring_2022.1_all.deb
\n

Reference: Index of /kali/pool/main/k/kali-archive-keyring

\n

Reference: The following signatures were invalid: EXPKEYSIG ED444FF07D8D0BF6 Kali Linux Repository

\n

This enables package updates via apt.

\n

Next, proceed with package updates and setup using the following commands. (Note: running dist-upgrade immediately can break apt, so be careful.)

\n
# Install Tools\nsudo apt update && sudo apt install kali-linux-large -y\nsudo apt install \\\nbash-completion \\\nvim \\\nsox \\\nmultimon-ng \\\n-y
\n

Reference: Win-KeX | Kali Linux Documentation

\n

The Kali tools include many GUI applications.

\n

To be able to use these, add the following to .bashrc on the Kali side as well.

\n
export DISPLAY=$(cat /etc/resolv.conf | grep nameserver | awk '{print $2}'):0
\n

Note: if you run into issues on the WSL side and cannot access it, you can access the shell as the root user by running the following command from PowerShell.

\n
wsl --distribution kali-linux -u root
\n

Summary

\n

I rebuilt my CTF environment that I had been using for about three years.

\n

After a while, the configuration starts getting hard to keep track of, so I plan to update this article whenever I make changes in the future.

","fields":{"slug":"/ctf-setup-windows-lab-en","tagSlugs":["/tag/ctf-en/","/tag/windows-en/","/tag/notes-en/","/tag/備忘録/","/tag/english/"]},"frontmatter":{"date":"2023-05-19","description":"A guide for setting up a virtual machine for CTF competitions.","tags":["CTF (en)","Windows (en)","Notes (en)","備忘録","English"],"title":"Setting Up a Windows CTF Environment","socialImage":{"publicURL":"/static/df364e33e8462f80af1bc320bdee15bd/ctf-setup-windows-lab.png"}}}},"pageContext":{"slug":"/ctf-setup-windows-lab-en"}},"staticQueryHashes":["251939775","401334301","825871152"]}