WEBVTT 00:00:01.740 --> 00:00:03.720 We're now ready for our first demonstration, 00:00:03.940 --> 00:00:07.050 in which we will prepare our host for installation of Luckystrike. 00:00:07.440 --> 00:00:09.050 We'll then install Luckystrike. 00:00:09.500 --> 00:00:12.710 We're also going to install Invoke‑Obfuscation, as that is an 00:00:12.720 --> 00:00:15.670 optional feature that Luckystrike will take advantage of in order to 00:00:15.670 --> 00:00:18.740 help add some obfuscation to your mail docs. 00:00:19.100 --> 00:00:22.210 And then finally, we will ensure that Luckystrike is operational, 00:00:22.210 --> 00:00:24.190 that is ready for you to use. 00:00:24.510 --> 00:00:25.350 Let's get started. 00:00:26.040 --> 00:00:28.650 While the installation of Luckystrike is relatively straightforward, 00:00:28.650 --> 00:00:31.740 there are a few prerequisites that we need to ensure are in place 00:00:31.740 --> 00:00:34.400 to make this process as painless as possible. 00:00:34.660 --> 00:00:37.880 If you haven't reviewed the documentation on the wiki that is 00:00:37.880 --> 00:00:40.650 located on the GitHub of the Luckystrike project page, 00:00:40.840 --> 00:00:43.820 as well as the corresponding blog post the wiki refers you 00:00:43.820 --> 00:00:46.550 to. I would encourage you to pause the video and just take 00:00:46.550 --> 00:00:47.820 a few minutes to review that. 00:00:47.830 --> 00:00:48.250 However, 00:00:48.250 --> 00:00:50.790 the steps that we're going to go through will be a summary 00:00:50.800 --> 00:00:52.750 of everything that is recommended there. 00:00:53.300 --> 00:00:55.930 One of the first recommendations is that you use a 00:00:55.930 --> 00:00:58.700 version of Windows that's between 7 and 10. 00:00:59.560 --> 00:01:00.430 As you can see here, 00:01:00.430 --> 00:01:03.350 I'll be using Windows 10 and I'll also be using a virtual 00:01:03.350 --> 00:01:05.420 machine in order to set up the environment. 00:01:06.040 --> 00:01:09.020 You'll also need a version of Office installed. The wiki just 00:01:09.020 --> 00:01:13.950 says Office 2010 plus. For this course, I'll be using a version of Office 2010. 00:01:14.940 --> 00:01:15.280 Next, 00:01:15.280 --> 00:01:18.300 we need to ensure that we have the right version of PowerShell installed. 00:01:18.820 --> 00:01:22.040 By clicking on the Windows icon and typing in PowerShell, you should be 00:01:22.040 --> 00:01:23.720 presented with the ability to launch PowerShell. 00:01:24.330 --> 00:01:25.510 Before we do that, though, 00:01:25.520 --> 00:01:28.360 we're going to right‑click and run this as an administrator 00:01:28.560 --> 00:01:31.460 because we're going to need administrative‑level permissions 00:01:31.460 --> 00:01:32.550 throughout the installation. 00:01:32.990 --> 00:01:35.540 The next step is to ensure that we have a version of 00:01:35.540 --> 00:01:37.510 PowerShell that is five or later. 00:01:37.770 --> 00:01:40.460 We can get this information from our PowerShell prompt by 00:01:40.460 --> 00:01:43.640 typing in $PSVersionTable.PSVersion. 00:01:44.790 --> 00:01:46.130 As you can see from the output, 00:01:46.140 --> 00:01:49.100 the value under the Major column needs to be at least 5. 00:01:49.800 --> 00:01:51.690 If that's not the case for your environment, 00:01:51.700 --> 00:01:53.880 then you'll need to upgrade your installation of PowerShell. 00:01:54.700 --> 00:01:57.620 The next thing we need to do is set the execution policy. 00:01:57.870 --> 00:02:01.080 This will allow for us to execute the script that is 00:02:01.080 --> 00:02:03.870 provided for the installation of Luckystrike. 00:02:04.640 --> 00:02:08.449 I'm going to use the command Set‑ExecutionPolicy Unrestricted. 00:02:09.039 --> 00:02:10.710 You do need to be careful with this setting, 00:02:10.710 --> 00:02:14.450 though, as this now allows any PowerShell script to be executed on this host. 00:02:15.020 --> 00:02:17.630 You will be prompted about execution policy changes, 00:02:17.730 --> 00:02:20.650 and in this case, it's safe to say A, or Yes to All. 00:02:22.330 --> 00:02:25.880 The next recommendation I have is to actually disable Windows 00:02:25.880 --> 00:02:29.020 Defender Security. Once you download Luckystrike, 00:02:29.020 --> 00:02:30.190 as well as Invoke‑Obfuscation, 00:02:30.190 --> 00:02:34.060 there are PowerShell files that will be flagged as malicious and will 00:02:34.060 --> 00:02:36.050 be instantly quarantined from Windows Defender. 00:02:36.500 --> 00:02:40.060 By clicking on the Windows icon and searching for Windows Security settings, 00:02:40.060 --> 00:02:42.630 we can go ahead and make the necessary changes to 00:02:42.630 --> 00:02:44.470 allow for the download of these files. 00:02:45.440 --> 00:02:49.060 Our next step is to click on Open Windows Security and then, 00:02:49.060 --> 00:02:50.960 from there, Virus and threat protection. 00:02:52.520 --> 00:02:54.310 Finally, we'll click on Manage settings. 00:02:55.740 --> 00:02:59.350 All I'm going to do for this demonstration is to disable real‑time protection. 00:02:59.800 --> 00:03:02.940 This will mitigate Windows Defender's interference with the 00:03:02.940 --> 00:03:04.900 installation and setup of Luckystrike. 00:03:05.440 --> 00:03:07.760 Keep in mind, though, that as you reboot the system, 00:03:07.770 --> 00:03:09.690 Windows Defender may turn back on. 00:03:10.140 --> 00:03:13.590 You could also consider excluding the folder location for Luckystrike and 00:03:13.590 --> 00:03:17.350 Invoke‑Obfuscation so that it is ignored by Defender after setup. 00:03:18.440 --> 00:03:20.090 We should now be ready for installation. 00:03:20.100 --> 00:03:23.830 And another reason that we needed to have an administrative PowerShell prompt is 00:03:23.830 --> 00:03:27.440 that the script will need to install the PS SQLite module. 00:03:27.940 --> 00:03:29.470 Before running the installation command, 00:03:29.470 --> 00:03:31.870 you're going to want to navigate to the location in the file 00:03:31.870 --> 00:03:34.250 system where you want Luckystrike installed. 00:03:34.990 --> 00:03:37.350 For this demonstration, I'm just going to place it on the desktop. 00:03:37.820 --> 00:03:39.970 The command that we're going to execute comes from the wiki 00:03:39.970 --> 00:03:43.360 on the Luckystrike GitHub homepage and is going to use IEX to 00:03:43.360 --> 00:03:45.340 download and execute a script. 00:03:45.500 --> 00:03:47.110 Let's go ahead and execute that. 00:03:47.940 --> 00:03:50.120 If you've met all the prerequisite setup items, 00:03:50.120 --> 00:03:54.340 then you should see no warnings or errors during the installation process. 00:03:54.940 --> 00:03:57.700 However, if you do encounter errors at this point, 00:03:57.710 --> 00:04:01.470 it's likely because you missed one of the steps that we previously went over. 00:04:01.680 --> 00:04:05.020 So please go back and review and ensure that you've taken all 00:04:05.020 --> 00:04:07.150 the necessary preparations for the host. 00:04:07.740 --> 00:04:10.360 We can now change into the Luckystrike directory and 00:04:10.370 --> 00:04:12.950 execute the Luckystrike PowerShell script. 00:04:13.640 --> 00:04:15.200 You'll notice that when the tool loads, 00:04:15.200 --> 00:04:19.240 we get a warning that the Module Invoke‑Obfuscation was not installed, 00:04:19.310 --> 00:04:21.950 and therefore, obfuscation options will not be available. 00:04:22.340 --> 00:04:24.650 So that's the last step for our set up. 00:04:25.760 --> 00:04:29.460 The installation of Invoke‑Obfuscation is also relatively straightforward. 00:04:29.690 --> 00:04:33.770 You can go to the GitHub page and download the project as a Zip file, 00:04:33.790 --> 00:04:36.450 which you can see I've done and extracted to my desktop. 00:04:37.140 --> 00:04:38.780 Once you have the project downloaded, 00:04:38.790 --> 00:04:43.340 navigate into that directory and then execute the Import‑Module command, 00:04:43.560 --> 00:04:46.560 providing as an argument the Invoke‑Obfuscation.psd1. 00:04:48.580 --> 00:04:52.190 After you've executed that command, you can run Invoke‑Obfuscation. 00:04:52.640 --> 00:04:55.910 Make sure to run this command without the .ps1 extension. 00:04:56.430 --> 00:04:58.070 If everything installed correctly, 00:04:58.070 --> 00:05:00.140 then you should see output similar to the following, 00:05:00.300 --> 00:05:04.140 and eventually you'll be presented with the main menu for Invoke‑Obfuscation. 00:05:04.630 --> 00:05:07.900 However, we don't need to do anything inside Invoke‑ Obfuscation at this point, 00:05:08.010 --> 00:05:09.310 so we can go ahead and quit. 00:05:10.490 --> 00:05:11.160 In fact, 00:05:11.170 --> 00:05:13.490 this is really the extent in which we'll cover 00:05:13.490 --> 00:05:16.930 Invoke‑Obfuscation in this course as this now enables all 00:05:16.940 --> 00:05:18.950 options when working with Luckystrike. 00:05:19.010 --> 00:05:21.900 If you'd like to spend more time with Invoke‑Obfuscation, 00:05:21.980 --> 00:05:25.350 there is a course in the Pluralsight library that you can go and check out. 00:05:26.740 --> 00:05:30.040 If you go back to Luckystrike, we'll see that it was unable to find 00:05:30.040 --> 00:05:33.510 the Invoke‑Obfuscation module, still, and that's due to the fact that 00:05:33.510 --> 00:05:37.080 Luckystrike still can't find the module. To resolve the situation, I 00:05:37.080 --> 00:05:40.530 found the easiest solution is just to place the Invoke‑Obfuscation 00:05:40.530 --> 00:05:43.830 directory into a location where PowerShell will look for these 00:05:43.840 --> 00:05:45.040 installed modules. 00:05:45.390 --> 00:05:47.230 If you're not sure what location to put it in, 00:05:47.280 --> 00:05:50.800 you can get information from the PSModulePath, as you see here. 00:05:51.200 --> 00:05:53.730 This will provide you with a listing of all locations that 00:05:53.730 --> 00:05:56.820 PowerShell will look for, in order to identify where these 00:05:56.820 --> 00:05:58.600 modules are. For this demonstration, 00:05:58.600 --> 00:06:02.340 I'm going to go ahead and add the module to the first directory location 00:06:02.340 --> 00:06:06.040 that was provided. Depending on the location you pick, 00:06:06.040 --> 00:06:07.800 you may have to create some of these folders. 00:06:08.240 --> 00:06:10.740 However, once all the necessary directories are created, 00:06:10.750 --> 00:06:13.690 you should be able to copy the Invoke‑Obfuscation directory to that 00:06:13.690 --> 00:06:16.220 new location, and now when we run Lucky strike, 00:06:16.230 --> 00:06:18.860 you should no longer see the warning information about 00:06:18.860 --> 00:06:20.770 the lack of Invoke‑Obfuscation support. 00:06:21.240 --> 00:06:24.500 At this point, we're ready to begin creating our malicious Office documents.