Dumb vibe-coded scripts that install a bunch of tools, made for a Windows host with a WSL distro. Installs WSL2, pentesting tools, and development utilities with granular control over each component. This is basically an ugly workaround for when I am not able to use Exegol and I need to quickly setup a testing environment on a Windows-based host.
Open PowerShell as Administrator. Download and inspect the setup script before running it:
$setupScript = Join-Path $env:TEMP "setup-windows.ps1"
Invoke-WebRequest https://raw.githubusercontent.com/5tuk0v/pentest-setup/main/scripts/setup-windows.ps1 -OutFile $setupScript
Start-Process notepad.exe -ArgumentList $setupScript -Wait
# After reviewing and closing Notepad:
powershell.exe -NoProfile -ExecutionPolicy Bypass -File $setupScriptFollow the prompts to choose paths, a WSL distro, and optional components. If the script reports that newly enabled WSL features require a reboot, reboot and run it again.
For convenience, the script can also be executed directly without prior inspection:
irm https://raw.githubusercontent.com/5tuk0v/pentest-setup/main/scripts/setup-windows.ps1 | iexLaunch the WSL distro selected during Windows setup and complete its one-time user-account creation. Ubuntu is recommended because the Linux setup script is designed and tested for Ubuntu.
Inside Ubuntu, download and inspect the setup script before running it:
curl -fsSL https://raw.githubusercontent.com/5tuk0v/pentest-setup/main/scripts/setup-ubuntu.sh -o /tmp/setup-ubuntu.sh
less /tmp/setup-ubuntu.sh
bash /tmp/setup-ubuntu.shFor convenience, it can also be executed directly without prior inspection:
curl -fsSL https://raw.githubusercontent.com/5tuk0v/pentest-setup/main/scripts/setup-ubuntu.sh | bash| Tool | Installation | Details |
|---|---|---|
| Metasploit Framework | Official install script via curl |
— |
| uv | Official install script via curl |
— |
| Zsh + Oh My Zsh | apt + official install script |
Default shell; rkj-repos theme |
| tmux | apt |
Terminal multiplexer |
| xclip | apt |
X11 clipboard utility |
| proxychains4 | apt |
Proxy-chain utility |
| Tool | Installation | Details |
|---|---|---|
| Responder | uv tool install from Git |
Fixed challenge 1122334455667788; privileged symlink available |
| mitm6 | uv tool install from Git |
Privileged wrapper available |
| netexec (nxc) | pipx install from Git |
Rust via rustup; configuration patch |
| bloodyAD | uv tool install from package index |
— |
| certipy-ad | uv tool install from package index |
Privileged symlink available |
| bloodhound-ce | uv tool install from package index |
— |
| ADPathFinder | uv tool install from Git |
Git source |
| impacket | uv tool install from Git |
Adds pycryptodome; privileged symlinks available |
| smbclientng | uv tool install from package index |
— |
| coercer | uv tool install from package index |
— |
| wspcoerce | uv tool install from Git |
Git source |
| GPOHound | uv tool install from Git |
Git source |
| gpoParser | pipx install from Git |
Git source |
| gpOddity | uv tool install from Git |
Git source |
| donpapi | uv tool install from package index |
Python 3.12 |
| dploot | uv tool install from package index |
— |
| lsassy | uv tool install from package index |
— |
| conpass | uv tool install from Git |
Git source |
| powerview.py | uv tool install from Git |
Git source |
| evil-winrm-py | uv tool install from package index |
Kerberos extra |
| soapy | uv tool install from Git |
Git source |
| bofhound | uv tool install from package index |
— |
| sccmhunter | uv tool install from Git |
Privileged symlink available |
| cmloot | uv tool install from Git |
Git source |
| ConfigManBearPig (OpenHound) | uv tool install from package index |
OpenHound with ConfigManBearPig; prereleases allowed |
| pre2k | uv tool install from Git |
Git source |
| defaultcreds-cheat-sheet | uv tool install from package index |
— |
| wsuks | pipx install from package index |
System site packages; privileged symlink available |
| WebRelayX | uv tool install from Git |
Privileged wrapper available |
| Tool | Installation | Details |
|---|---|---|
| krbrelayx | Git clone + uv add --script |
Adds impacket and pycryptodome; privileged wrapper available |
| targetedKerberoast | Git clone + uv add --script |
Dependencies from requirements.txt |
| SMBLoot | Git clone + uv add --script |
Dependencies from requirements.txt |
| PassTheCert | Git clone + uv add --script |
Adds impacket |
| CVE-2026-54121 (Certighost) | Git clone + uv add --script |
Adds impacket, cryptography, pyasn1, asn1crypto, pycryptodome, and dnspython |
| rbcdbrute | Git clone + uv add --script |
Adds impacket and tqdm |
| PKINITtools | Git clone + uv add --script |
Dependencies from requirements.txt; adds oscrypto from Git |
| mssqlkaren | Git clone + uv sync |
Project environment |
| scomhunter | Git clone + uv sync |
Project environment |
| wtftp | Git clone + uv sync |
Project environment; privileged wrapper available |
| RelayInformer | Git clone + uv sync |
Python subdirectory |
| PXEThief | Git clone + uv add --script |
Checks out PR #11; dependencies from requirements.txt; privileged wrapper available |
| pxethiefy | Git clone + uv add --script |
Dependencies from requirements.txt; privileged wrapper available |
| WSUScripts | Git clone + uv add --script |
Adds scapy to wsusniff.py; privileged wrapper available |
| RelayKing-Depth | Git clone + uv add --script |
Dependencies from requirements.txt |
| rpc2efs | Git clone + uv add --script |
Adds impacket |
| ntlmv1-multi | Git clone + uv add --script |
Adds pycryptodome |
| pywsus | Git clone + uv add --script |
Dependencies from requirements.txt |
| tdo_dump | Git clone + uv add --script |
Adds impacket |
| susinternals | Git clone + uv add --script |
Adds impacket |
| ghostsurf | Git clone + uv add --script |
Dependencies from requirements.txt; privileged wrapper available |
| krbHash | Git clone + uv sync |
Project environment |
| gopacket | Git clone + native build | Impacket Go port; Go 1.24.13 installed when needed; installs to /usr/local/bin |
| sqlmap | Git clone | Privileged wrapper available |
| Tool | Installation | Details |
|---|---|---|
| RustHound-CE | Latest GitHub release | Linux GNU x64 archive; installs to /usr/local/bin |
| pssrecon | Fixed GitHub release | Linux binary; installs to /usr/local/bin |
| pretender | Latest GitHub release | Linux x64 archive; installs to /usr/local/bin |
| flamingo | Latest GitHub release | Linux x64 binary; installs to /usr/local/bin |
| nuclei | Latest GitHub release | Linux x64 ZIP; installs to /usr/local/bin |
| ffuf | Latest GitHub release | Linux x64 archive; installs to /usr/local/bin |
| MSSQLHound | Latest GitHub release | Linux x64 binary; installs to /usr/local/bin |
| skewrun | Latest GitHub release | Linux x64 musl binary; requires libfaketime; installs to /usr/local/bin |
| Titanis | Latest GitHub release | Self-contained Linux x64 ZIP; includes .NET 8 runtime; extracts below the tools directory |
| Configuration | Installation | Details |
|---|---|---|
| Pentest environment | Managed template | Creates ~/.pentest-env; sourced from ~/.zshrc |
| ShellOpsLog | Direct script download | Configures automatic logging; sourced from ~/.zshrc |
| Tools path and logs | Interactive configuration | Tools default to ~/tools; logs stored below the selected tools directory |
| Tool | Installation | Details |
|---|---|---|
| WSL2 + Linux distro | Windows features + WSL | Selectable Ubuntu, Debian, or Kali distro |
| Docker Desktop | winget |
Required for BloodHound CE orchestration |
| Visual Studio 2022 Community | winget |
Managed and native desktop workloads |
| Visual Studio Code | winget |
Package ID Microsoft.VisualStudioCode |
| Git | winget |
Package ID Git.Git |
| RSAT: Active Directory DS-LDS Tools | Windows capability | ActiveDirectory PowerShell module; AD DS and AD LDS management tools |
| Oh My Posh | winget |
Theme, Nerd Font, and PowerShell profile configuration |
| ShareNot | winget |
Screenshot utility |
| 7-Zip | winget |
Archive utility |
| Notepad++ | winget |
Text editor |
| Wireshark | winget |
Npcap requires manual installation |
| Burp Suite Community | winget |
Community edition |
| SQL Server Management Studio (SSMS) | winget |
SQL Server client |
| BloodHound CE | bloodhound-cli + Docker Compose |
Docker-based deployment |
These tools are downloaded from tagged releases in pentest-setup-builds, where source commits, build inputs, and release artifacts are reviewed and pinned.
| Tool | Installation | Details |
|---|---|---|
| Certify | Reviewed GitHub release | .NET Framework 4.7.2; AnyCPU |
| Rubeus | Reviewed GitHub release | .NET Framework 4.8; AnyCPU |
| SpoolSample | Reviewed GitHub release | Native x64 and .NET Framework 4.8 |
| PassTheCert | Reviewed GitHub release | .NET Framework 4.8; AnyCPU |
| SharpPXE | Reviewed GitHub release | .NET Framework 4.8; AnyCPU |
| SharpPrinter | Reviewed GitHub release | Single-file .NET Framework 4.8; pinned NuGet dependencies; Costura embedding |
| RequestAADRefreshToken | Reviewed GitHub release | .NET Framework 4.8; AnyCPU |
| ROADtoken | Reviewed GitHub release | .NET Framework 4.8; AnyCPU |
| RAIWhateverTrigger | Reviewed GitHub release | Release/x64 ZIP with native RAICTrigger.exe and .NET Framework 4.7.2 RAICSTrigger.exe; BOF excluded |
| AxiomSecrets | Reviewed GitHub release | Self-contained x64 executable; bundled NTFSLib parser |
| WebClientTrigger | Reviewed GitHub release | Native C17; x64 ZIP |
| Tool | Installation | Details |
|---|---|---|
| bloodhound-cli | Latest GitHub release | Windows x64 ZIP |
| SharpHound | Latest GitHub release | Windows ZIP |
| AzureHound | Latest GitHub release | Windows x64 ZIP |
| Inveigh | Latest GitHub release | .NET Framework 4.6.2 ZIP |
| Snaffler | Latest GitHub release | Snaffler.exe |
| SharpSCCM | Latest GitHub release | SharpSCCM.exe |
| DCOMIllusionist | Latest GitHub release | DCOMIllusionist.exe |
| PingCastle | Latest GitHub release | ZIP extracted below the tools directory |
| DumpGuard | Latest GitHub release | ZIP extracted below the tools directory |
| pssrecon | Fixed GitHub release | pssrecon.exe |
| MSSQLHound | Latest GitHub release | Windows x64 executable |
| Titanis | Latest GitHub release | Self-contained Windows x64 ZIP; includes .NET 8 runtime |
| Sysinternals Suite | Official direct download | ZIP extracted below the tools directory |
| CMLoot | Git clone | PowerShell SCCM tool |
| Powermad | Git clone | AD machine-account tooling |
| ResetNightmare | Git clone | CVE-2026-27912 PowerShell PoC; requires the ActiveDirectory module, Rubeus.exe, and an unpatched DC |
| gopacket | Git clone + native build | Impacket Go port; Go 1.24.13 installed when needed; Windows target |
| Configuration | Installation | Details |
|---|---|---|
| PowerView.ps1 | Direct script download | Stored below the selected tools directory |
| ADTamper.ps1 | Direct script download | Stored below the selected tools directory |
| SnafflerParser.ps1 | Direct script download | Stored below the selected tools directory |
| PrivescCheck.ps1 | Direct script download | Stored below the selected tools directory |
| ShellOpsLog | Direct profile download | Configures automatic PowerShell operation logging |
| disable-smb.bat | Direct script download | Disables SMB services to release TCP port 445 |
| enable-smb.bat | Direct script download | Re-enables SMB services |
| Firewall rules | Interactive configuration | Optional SSH, RDP, SMB, HTTP, and HTTPS inbound rules |
| Defender exclusion | Automatic configuration | Selected tools directory |
| Daily reboot task | Interactive configuration | Optional scheduled reboot |
| Evidence, tools, and log paths | Interactive configuration | Evidence defaults to C:\_Preuves; tools default to C:\_Tools; logs stored below the selected tools directory |
Both scripts prompt for custom directories and create log files:
Windows Paths:
- Evidence:
C:\_Preuves(default) - Client evidence and operation logs - Tools:
C:\_Tools(default) - Downloaded security tools - Setup Log:
<ToolsPath>\logs\setup-windows-TIMESTAMP.log
Linux Paths:
- Tools:
~/tools(default) - Cloned repositories, standalone tools, and logs - Operation Logs:
/mnt/c/_Preuves/opslogs_wsl/(default) - ShellOpsLog output - Setup Log:
<ToolsPath>/logs/setup-ubuntu-TIMESTAMP.log
This project was developed by 5tuk0v with substantial assistance from AI coding tools, including OpenCode and OpenAI Codex, using multiple models. The exact models and versions used were not consistently recorded.
AI assistance included implementation, debugging, testing, documentation, and code review. All AI-assisted contributions were directed and reviewed by the maintainer, who remains responsible for the final result.
MIT License - see LICENSE file for details.
This project integrates third-party tools, each with their own licenses. See the respective repositories for license information.
This is a minimal automation framework. You are responsible for choosing and installing appropriate tools for your use case. Use tools responsibly and only on systems you own or have authorization to test.