We're now ready for our first demonstration,
in which we will prepare our host for installation of Luckystrike.
We'll then install Luckystrike.
We're also going to install Invoke‑Obfuscation, as that is an
optional feature that Luckystrike will take advantage of in order to
help add some obfuscation to your mail docs.
And then finally, we will ensure that Luckystrike is operational,
that is ready for you to use.
Let's get started.
While the installation of Luckystrike is relatively straightforward,
there are a few prerequisites that we need to ensure are in place
to make this process as painless as possible.
If you haven't reviewed the documentation on the wiki that is
located on the GitHub of the Luckystrike project page,
as well as the corresponding blog post the wiki refers you
to. I would encourage you to pause the video and just take
a few minutes to review that.
However,
the steps that we're going to go through will be a summary
of everything that is recommended there.
One of the first recommendations is that you use a
version of Windows that's between 7 and 10.
As you can see here,
I'll be using Windows 10 and I'll also be using a virtual
machine in order to set up the environment.
You'll also need a version of Office installed. The wiki just
says Office 2010 plus. For this course, I'll be using a version of Office 2010.
Next,
we need to ensure that we have the right version of PowerShell installed.
By clicking on the Windows icon and typing in PowerShell, you should be
presented with the ability to launch PowerShell.
Before we do that, though,
we're going to right‑click and run this as an administrator
because we're going to need administrative‑level permissions
throughout the installation.
The next step is to ensure that we have a version of
PowerShell that is five or later.
We can get this information from our PowerShell prompt by
typing in $PSVersionTable.PSVersion.
As you can see from the output,
the value under the Major column needs to be at least 5.
If that's not the case for your environment,
then you'll need to upgrade your installation of PowerShell.
The next thing we need to do is set the execution policy.
This will allow for us to execute the script that is
provided for the installation of Luckystrike.
I'm going to use the command Set‑ExecutionPolicy Unrestricted.
You do need to be careful with this setting,
though, as this now allows any PowerShell script to be executed on this host.
You will be prompted about execution policy changes,
and in this case, it's safe to say A, or Yes to All.
The next recommendation I have is to actually disable Windows
Defender Security. Once you download Luckystrike,
as well as Invoke‑Obfuscation,
there are PowerShell files that will be flagged as malicious and will
be instantly quarantined from Windows Defender.
By clicking on the Windows icon and searching for Windows Security settings,
we can go ahead and make the necessary changes to
allow for the download of these files.
Our next step is to click on Open Windows Security and then,
from there, Virus and threat protection.
Finally, we'll click on Manage settings.
All I'm going to do for this demonstration is to disable real‑time protection.
This will mitigate Windows Defender's interference with the
installation and setup of Luckystrike.
Keep in mind, though, that as you reboot the system,
Windows Defender may turn back on.
You could also consider excluding the folder location for Luckystrike and
Invoke‑Obfuscation so that it is ignored by Defender after setup.
We should now be ready for installation.
And another reason that we needed to have an administrative PowerShell prompt is
that the script will need to install the PS SQLite module.
Before running the installation command,
you're going to want to navigate to the location in the file
system where you want Luckystrike installed.
For this demonstration, I'm just going to place it on the desktop.
The command that we're going to execute comes from the wiki
on the Luckystrike GitHub homepage and is going to use IEX to
download and execute a script.
Let's go ahead and execute that.
If you've met all the prerequisite setup items,
then you should see no warnings or errors during the installation process.
However, if you do encounter errors at this point,
it's likely because you missed one of the steps that we previously went over.
So please go back and review and ensure that you've taken all
the necessary preparations for the host.
We can now change into the Luckystrike directory and
execute the Luckystrike PowerShell script.
You'll notice that when the tool loads,
we get a warning that the Module Invoke‑Obfuscation was not installed,
and therefore, obfuscation options will not be available.
So that's the last step for our set up.
The installation of Invoke‑Obfuscation is also relatively straightforward.
You can go to the GitHub page and download the project as a Zip file,
which you can see I've done and extracted to my desktop.
Once you have the project downloaded,
navigate into that directory and then execute the Import‑Module command,
providing as an argument the Invoke‑Obfuscation.psd1.
After you've executed that command, you can run Invoke‑Obfuscation.
Make sure to run this command without the .ps1 extension.
If everything installed correctly,
then you should see output similar to the following,
and eventually you'll be presented with the main menu for Invoke‑Obfuscation.
However, we don't need to do anything inside Invoke‑ Obfuscation at this point,
so we can go ahead and quit.
In fact,
this is really the extent in which we'll cover
Invoke‑Obfuscation in this course as this now enables all
options when working with Luckystrike.
If you'd like to spend more time with Invoke‑Obfuscation,
there is a course in the Pluralsight library that you can go and check out.
If you go back to Luckystrike, we'll see that it was unable to find
the Invoke‑Obfuscation module, still, and that's due to the fact that
Luckystrike still can't find the module. To resolve the situation, I
found the easiest solution is just to place the Invoke‑Obfuscation
directory into a location where PowerShell will look for these
installed modules.
If you're not sure what location to put it in,
you can get information from the PSModulePath, as you see here.
This will provide you with a listing of all locations that
PowerShell will look for, in order to identify where these
modules are. For this demonstration,
I'm going to go ahead and add the module to the first directory location
that was provided. Depending on the location you pick,
you may have to create some of these folders.
However, once all the necessary directories are created,
you should be able to copy the Invoke‑Obfuscation directory to that
new location, and now when we run Lucky strike,
you should no longer see the warning information about
the lack of Invoke‑Obfuscation support.
At this point, we're ready to begin creating our malicious Office documents.