Merge pull request #903 from mandiant/category-cleanup

Clean up categories for better organization
mandiant · Mar 1, 2024 · 87e43bf · 87e43bf
2 parents 047c8ad + 46dcfff
commit 87e43bf
Show file tree

Hide file tree

Showing 133 changed files with 167 additions and 165 deletions.
diff --git a/.github/ISSUE_TEMPLATE/new_metapackage.yml b/.github/ISSUE_TEMPLATE/new_metapackage.yml
@@ -50,39 +50,34 @@ body:
       label: Category
       description: Which category should this tool be installed to?
       options:
-        - Active Directory
-        - Cloud
         - Command & Control
         - Credential Access
         - Debuggers
         - Delphi
         - Disassemblers
         - dotNet
-        - Evasion
+        - Documents
         - Exploitation
+        - File Information
         - Forensic
         - Hex Editors
-        - Information Gathering
         - InnoSetup
         - Java & Android
         - Javascript
         - Lateral Movement
+        - Memory
         - Networking
-        - Office
         - Packers
-        - Password Attacks
         - Payload Development
-        - PDF
         - PE
         - Persistence
-        - PowerShell
         - Privilege Escalation
-        - Python
+        - Productivity Tools
         - Reconnaissance
-        - Text Editors
+        - Registry
+        - Shellcode
         - Utilities
-        - VB
-        - Vulnerability Analysis
+        - Visual Basic
         - Web Application
         - Wordlists
   - type: input

diff --git a/.github/ISSUE_TEMPLATE/new_package.yml b/.github/ISSUE_TEMPLATE/new_package.yml
@@ -69,39 +69,34 @@ body:
       label: Category
       description: Which category should this tool be installed to?
       options:
-        - Active Directory
-        - Cloud
         - Command & Control
         - Credential Access
         - Debuggers
         - Delphi
         - Disassemblers
         - dotNet
-        - Evasion
+        - Documents
         - Exploitation
+        - File Information
         - Forensic
         - Hex Editors
-        - Information Gathering
         - InnoSetup
         - Java & Android
         - Javascript
         - Lateral Movement
+        - Memory
         - Networking
-        - Office
         - Packers
-        - Password Attacks
         - Payload Development
-        - PDF
         - PE
         - Persistence
-        - PowerShell
         - Privilege Escalation
-        - Python
+        - Productivity Tools
         - Reconnaissance
-        - Text Editors
+        - Registry
+        - Shellcode
         - Utilities
-        - VB
-        - Vulnerability Analysis
+        - Visual Basic
         - Web Application
         - Wordlists
   - type: input

diff --git a/categories.txt b/categories.txt
@@ -1,35 +1,31 @@
-Active Directory
-Cloud
 Command & Control
 Credential Access
 Debuggers
 Delphi
 Disassemblers
+Documents
 dotNet
-Evasion
 Exploitation
+File Information
 Forensic
 Hex Editors
-Information Gathering
 InnoSetup
 Java & Android
 Javascript
 Lateral Movement
+Memory
 Networking
-Office
 Packers
-Password Attacks
 Payload Development
-PDF
 PE
 Persistence
 PowerShell
 Privilege Escalation
-Python
+Productivity Tools
 Reconnaissance
-Text Editors
+Registry
+Shellcode
 Utilities
-VB
-Vulnerability Analysis
+Visual Basic
 Web Application
-Wordlists
+Wordlists
diff --git a/packages/arsenalimagemounter.vm/arsenalimagemounter.vm.nuspec b/packages/arsenalimagemounter.vm/arsenalimagemounter.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>arsenalimagemounter.vm</id>
-    <version>3.11.279.20240222</version>
+    <version>3.11.279.20240226</version>
     <authors>Arsenal Recon</authors>
     <description>Mounts the contents of disk images as complete disks in Windows.</description>
     <dependencies>

diff --git a/packages/arsenalimagemounter.vm/tools/chocolateyinstall.ps1 b/packages/arsenalimagemounter.vm/tools/chocolateyinstall.ps1
@@ -3,7 +3,7 @@ Import-Module vm.common -Force -DisableNameChecking
 
 try {
   $toolName = 'ArsenalImageMounter'
-  $category = 'Utilities'
+  $category = 'Forensic'
   $shimPath = "\bin\${toolName}.exe"
 
   $shortcutDir = Join-Path ${Env:TOOL_LIST_DIR} $category

diff --git a/packages/arsenalimagemounter.vm/tools/chocolateyuninstall.ps1 b/packages/arsenalimagemounter.vm/tools/chocolateyuninstall.ps1
@@ -2,6 +2,6 @@ $ErrorActionPreference = 'Continue'
 Import-Module vm.common -Force -DisableNameChecking
 
 $toolName = 'ArsenalImageMounter'
-$category = 'Utilities'
+$category = 'Forensic'
 
 VM-Remove-Tool-Shortcut $toolName $category
diff --git a/packages/blobrunner.vm/blobrunner.vm.nuspec b/packages/blobrunner.vm/blobrunner.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>blobrunner.vm</id>
-    <version>0.0.5</version>
+    <version>0.0.5.20240217</version>
     <authors>OALabs</authors>
     <description>BlobRunner is a simple tool to quickly debug shellcode extracted during malware analysis.</description>
     <dependencies>

diff --git a/packages/blobrunner.vm/tools/chocolateyinstall.ps1 b/packages/blobrunner.vm/tools/chocolateyinstall.ps1
@@ -2,7 +2,7 @@ $ErrorActionPreference = 'Stop'
 Import-Module vm.common -Force -DisableNameChecking
 
 $toolName = 'blobrunner'
-$category = 'Utilities'
+$category = 'Shellcode'
 
 $zipUrl = 'https://github.com/OALabs/BlobRunner/releases/download/v0.0.5/blobrunner.zip'
 $zipSha256 = '369ed39086e40fe9ae5404b52cafe0a9b747abb11f2d33d73e5a51097d0ae2a4'

diff --git a/packages/blobrunner.vm/tools/chocolateyuninstall.ps1 b/packages/blobrunner.vm/tools/chocolateyuninstall.ps1
@@ -2,6 +2,6 @@ $ErrorActionPreference = 'Continue'
 Import-Module vm.common -Force -DisableNameChecking
 
 $toolName = 'blobrunner'
-$category = 'Utilities'
+$category = 'Shellcode'
 
 VM-Uninstall $toolName $category
diff --git a/packages/blobrunner64.vm/blobrunner64.vm.nuspec b/packages/blobrunner64.vm/blobrunner64.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>blobrunner64.vm</id>
-    <version>0.0.5</version>
+    <version>0.0.5.20240217</version>
     <authors>OALabs</authors>
     <description>BlobRunner is a simple tool to quickly debug shellcode extracted during malware analysis.</description>
     <dependencies>

diff --git a/packages/blobrunner64.vm/tools/chocolateyinstall.ps1 b/packages/blobrunner64.vm/tools/chocolateyinstall.ps1
@@ -2,7 +2,7 @@ $ErrorActionPreference = 'Stop'
 Import-Module vm.common -Force -DisableNameChecking
 
 $toolName = 'blobrunner64'
-$category = 'Utilities'
+$category = 'Shellcode'
 
 $zipUrl = 'https://github.com/OALabs/BlobRunner/releases/download/v0.0.5/blobrunner64.zip'
 $zipSha256 = '325e3e26ccdce53cdd8b6665c7ed7d1765fc1c56cd088a5b4433593682c9f503'

diff --git a/packages/blobrunner64.vm/tools/chocolateyuninstall.ps1 b/packages/blobrunner64.vm/tools/chocolateyuninstall.ps1
@@ -2,6 +2,6 @@ $ErrorActionPreference = 'Continue'
 Import-Module vm.common -Force -DisableNameChecking
 
 $toolName = 'blobrunner64'
-$category = 'Utilities'
+$category = 'Shellcode'
 
 VM-Uninstall $toolName $category
diff --git a/packages/burp-free.vm/burp-free.vm.nuspec b/packages/burp-free.vm/burp-free.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>burp-free.vm</id>
-    <version>0.0.0.20230711</version>
+    <version>0.0.0.20240217</version>
     <authors>PortSwigger Ltd.</authors>
     <description>Burp Suite Community Edition is PortSwigger's free integrated platform for performing security testing of web applications.</description>
     <dependencies>

diff --git a/packages/burp-free.vm/tools/chocolateyinstall.ps1 b/packages/burp-free.vm/tools/chocolateyinstall.ps1
@@ -3,7 +3,7 @@ Import-Module vm.common -Force -DisableNameChecking
 
 try {
   $toolName = 'BurpSuiteCommunity'
-  $category = 'Utilities'
+  $category = 'Web Application'
   $shimPath = 'BurpSuiteCommunity\BurpSuiteCommunity.exe'
 
   $shortcutDir = Join-Path ${Env:TOOL_LIST_DIR} $category

diff --git a/packages/burp-free.vm/tools/chocolateyuninstall.ps1 b/packages/burp-free.vm/tools/chocolateyuninstall.ps1
@@ -2,6 +2,6 @@ $ErrorActionPreference = 'Continue'
 Import-Module vm.common -Force -DisableNameChecking
 
 $toolName = 'BurpSuiteCommunity'
-$category = 'Utilities'
+$category = 'Web Application'
 
 VM-Remove-Tool-Shortcut $toolName $category
diff --git a/packages/cmder.vm/cmder.vm.nuspec b/packages/cmder.vm/cmder.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>cmder.vm</id>
-    <version>1.3.24</version>
+    <version>1.3.24.20240217</version>
     <description>Metapackage for cmder</description>
     <authors>Mandiant, Samuel Vasko</authors>
     <dependencies>

diff --git a/packages/cmder.vm/tools/chocolateyinstall.ps1 b/packages/cmder.vm/tools/chocolateyinstall.ps1
@@ -3,7 +3,7 @@ Import-Module vm.common -Force -DisableNameChecking
 
 try {
   $toolName = 'cmder'
-  $category = 'Utilities'
+  $category = 'Productivity Tools'
   $shortcutDir = Join-Path ${Env:TOOL_LIST_DIR} $category
 
   $toolDir = Join-Path ${Env:RAW_TOOLS_DIR} $toolName -Resolve

diff --git a/packages/cmder.vm/tools/chocolateyuninstall.ps1 b/packages/cmder.vm/tools/chocolateyuninstall.ps1
@@ -1,5 +1,5 @@
 $ErrorActionPreference = 'Continue'
-$category = 'Utilities'
+$category = 'Productivity Tools'
 $shortcutDir = Join-Path ${Env:TOOL_LIST_DIR} $category
 $shortcut = Join-Path $shortcutDir 'cmder.lnk'
 Remove-Item $shortcut -Force -ea 0 | Out-Null
diff --git a/packages/common.vm/common.vm.nuspec b/packages/common.vm/common.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>common.vm</id>
-    <version>0.0.0.20240220</version>
+    <version>0.0.0.20240229</version>
     <description>Common libraries for VM-packages</description>
     <authors>Mandiant</authors>
   </metadata>

diff --git a/packages/common.vm/tools/vm.common/vm.common.psm1 b/packages/common.vm/tools/vm.common/vm.common.psm1
@@ -281,7 +281,9 @@ function VM-Install-Shortcut{
     )
     $shortcutDir = Join-Path ${Env:TOOL_LIST_DIR} $category
     $shortcut = Join-Path $shortcutDir "$toolName.lnk"
+    $extension = [System.IO.Path]::GetExtension($executablePath)
 
+    # Set the default icon to be the executable's icon
     if (-Not $iconLocation) {$iconLocation = $executablePath}
 
     if ($consoleApp) {
@@ -320,6 +322,18 @@ function VM-Install-Shortcut{
         Install-ChocolateyShortcut @shortcutArgs
     }
     VM-Assert-Path $shortcut
+
+    # If the file targets a .bat, we should set the shortcut to match (requires shortcut to have been created already)
+    if ($extension -eq ".bat") {
+        $Shell = New-Object -ComObject ("WScript.Shell")
+        $Shortcut = $Shell.CreateShortcut($shortcut)
+
+        $IconArrayIndex = -68   # This is the specific icon that Windows uses for .bat files by default
+        $IconLocation = "C:\WINDOWS\system32\imageres.dll"
+        $Shortcut.IconLocation = "$IconLocation,$IconArrayIndex"
+
+        $Shortcut.Save()
+    }
 }
 
 # This functions returns $toolDir (outputed by Install-ChocolateyZipPackage) and $executablePath

diff --git a/packages/cygwin.vm/cygwin.vm.nuspec b/packages/cygwin.vm/cygwin.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>cygwin.vm</id>
-    <version>3.5.0</version>
+    <version>3.5.0.20240217</version>
     <description>Wrapper for cygwin and useful cygwin packages</description>
     <authors>Red Hat Inc.</authors>
     <dependencies>

diff --git a/packages/cygwin.vm/tools/chocolateyinstall.ps1 b/packages/cygwin.vm/tools/chocolateyinstall.ps1
@@ -3,7 +3,7 @@ Import-Module vm.common -Force -DisableNameChecking
 
 try {
   $toolName = 'cygwin'
-  $category = 'Utilities'
+  $category = 'Productivity Tools'
 
   # install additional cygwin packages
   $packages = @(

diff --git a/packages/cygwin.vm/tools/chocolateyuninstall.ps1 b/packages/cygwin.vm/tools/chocolateyuninstall.ps1
@@ -1,7 +1,7 @@
 $ErrorActionPreference = 'Continue'
 
 $toolName = 'cygwin'
-$category = 'Utilities'
+$category = 'Productivity Tools'
 
 $shortcutDir = Join-Path ${Env:TOOL_LIST_DIR} $category
 $shortcut = Join-Path $shortcutDir "$toolName.lnk"

diff --git a/packages/dcode.vm/dcode.vm.nuspec b/packages/dcode.vm/dcode.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>dcode.vm</id>
-    <version>5.5.21194.20231212</version>
+    <version>5.5.21194.20240217</version>
     <authors>Digital Detective Group</authors>
     <description>Utility for converting data found on desktop and mobile devices into human-readable timestamps.</description>
     <dependencies>

diff --git a/packages/dcode.vm/tools/chocolateyinstall.ps1 b/packages/dcode.vm/tools/chocolateyinstall.ps1
@@ -2,7 +2,7 @@ $ErrorActionPreference = 'Stop'
 Import-Module vm.common -Force -DisableNameChecking
 
 $toolName = 'DCode'
-$category = 'Utilities'
+$category = 'Forensic'
 
 $url = 'https://www.digital-detective.net/download/download.php?downcode=ae2znu5994j1lforlh03'
 $sha256 = 'dbb23d6ea4f572fbaec017fb8acc2a8b62b74fafa81ea4a388966ec14087a9e4'

diff --git a/packages/dcode.vm/tools/chocolateyuninstall.ps1 b/packages/dcode.vm/tools/chocolateyuninstall.ps1
@@ -2,6 +2,6 @@ $ErrorActionPreference = 'Continue'
 Import-Module vm.common -Force -DisableNameChecking
 
 $toolName = 'DCode'
-$category = 'Utilities'
+$category = 'Forensic'
 
 VM-Uninstall $toolName $category
diff --git a/packages/didier-stevens-beta.vm/didier-stevens-beta.vm.nuspec b/packages/didier-stevens-beta.vm/didier-stevens-beta.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>didier-stevens-beta.vm</id>
-    <version>0.0.0.20240122</version>
+    <version>0.0.0.20240226</version>
     <authors>Didier Stevens</authors>
     <description>Beta versions of Didier Stevens's software</description>
     <dependencies>

diff --git a/packages/didier-stevens-beta.vm/tools/chocolateyinstall.ps1 b/packages/didier-stevens-beta.vm/tools/chocolateyinstall.ps1
@@ -2,7 +2,7 @@ $ErrorActionPreference = 'Stop'
 Import-Module vm.common -Force -DisableNameChecking
 
 try {
-    $category = 'Office'
+    $category = 'Documents'
     $zipUrl = 'https://github.com/DidierStevens/Beta/archive/cbb1d5c32d02b4e07128a197c8b8fb6ea597916a.zip'
     $zipSha256 = 'e9d83063f45f8e2791d33de194a46850bd7f1921e755bd4651c769cbcdbd5052'
 

diff --git a/packages/didier-stevens-beta.vm/tools/chocolateyuninstall.ps1 b/packages/didier-stevens-beta.vm/tools/chocolateyuninstall.ps1
@@ -2,7 +2,7 @@ $ErrorActionPreference = 'Continue'
 Import-Module vm.common -Force -DisableNameChecking
 
 # Remove shortcuts
-$category = 'Office'
+$category = 'Documents'
 ForEach ($toolName in @('onedump')) {
   VM-Remove-Tool-Shortcut $toolName $category
 }

diff --git a/packages/didier-stevens-suite.vm/didier-stevens-suite.vm.nuspec b/packages/didier-stevens-suite.vm/didier-stevens-suite.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>didier-stevens-suite.vm</id>
-    <version>0.0.0.20240122</version>
+    <version>0.0.0.20240226</version>
     <authors>Didier Stevens</authors>
     <description>Tools collection by Didier Stevens</description>
     <dependencies>