mandiant · emtuls · Apr 12, 2024 · Apr 12, 2024
diff --git a/packages/adconnectdump.vm/adconnectdump.vm.nuspec b/packages/adconnectdump.vm/adconnectdump.vm.nuspec
@@ -2,11 +2,11 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>adconnectdump.vm</id>
-    <version>0.0.0.20240411</version>
+    <version>0.0.0.20240412</version>
     <authors>fox-it</authors>
     <description>This toolkit offers several ways to extract and decrypt stored Azure AD and Active Directory credentials from Azure AD Connect servers.</description>
     <dependencies>
-      <dependency id="common.vm" version="0.0.0.20240411" />
+      <dependency id="common.vm" version="0.0.0.20240412" />
     </dependencies>
   </metadata>
 </package>
diff --git a/packages/adconnectdump.vm/tools/chocolateyinstall.ps1 b/packages/adconnectdump.vm/tools/chocolateyinstall.ps1
@@ -8,4 +8,4 @@ $zipUrl = 'https://github.com/fox-it/adconnectdump/archive/3ff6ebe7afac83263dd41
 $zipSha256 = '6f36659f4d0ef7e20ddea0d7c17f36786c2fa8ca0728e6fd790f3234f408e0e9'
 
 # This tool does not have a `.exe` associated with it, so this links it to the directory
-VM-Install-Raw-GitHub-Repo $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
+VM-Install-From-Zip $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
diff --git a/packages/asreproast.vm/asreproast.vm.nuspec b/packages/asreproast.vm/asreproast.vm.nuspec
@@ -2,11 +2,11 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>asreproast.vm</id>
-    <version>0.0.0.20240411</version>
+    <version>0.0.0.20240412</version>
     <authors>HarmJ0y</authors>
     <description>Project that retrieves crackable hashes from KRB5 AS-REP responses for users without kerberoast preauthentication enabled.</description>
     <dependencies>
-      <dependency id="common.vm" version="0.0.0.20240411" />
+      <dependency id="common.vm" version="0.0.0.20240412" />
     </dependencies>
   </metadata>
 </package>
diff --git a/packages/asreproast.vm/tools/chocolateyinstall.ps1 b/packages/asreproast.vm/tools/chocolateyinstall.ps1
@@ -8,4 +8,4 @@ $zipUrl = 'https://codeload.github.com/HarmJ0y/ASREPRoast/zip/1c94ef12038df1378f
 $zipSha256 = '3e90bb0755f9076e74ad749a188ad99b9dc11f197d4366a8eaa4f056953e4cab'
 $powershellCommand = "Import-Module .\ASREPRoast.ps1; Get-Help Invoke-ASREPRoast"
 
-VM-Install-Raw-GitHub-Repo $toolName $category $zipUrl $zipSha256 -innerFolder $true -powershellCommand $powershellCommand
+VM-Install-From-Zip $toolName $category $zipUrl $zipSha256 -innerFolder $true -powershellCommand $powershellCommand
diff --git a/packages/bloodhound-custom-queries.vm/bloodhound-custom-queries.vm.nuspec b/packages/bloodhound-custom-queries.vm/bloodhound-custom-queries.vm.nuspec
@@ -2,11 +2,11 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>bloodhound-custom-queries.vm</id>
-    <version>0.0.0.20240411</version>
+    <version>0.0.0.20240412</version>
     <authors>hausec</authors>
     <description>Custom Query list for the Bloodhound GUI based off my cheatsheet</description>
     <dependencies>
-      <dependency id="common.vm" version="0.0.0.20240411" />
+      <dependency id="common.vm" version="0.0.0.20240412" />
     </dependencies>
   </metadata>
 </package>
diff --git a/packages/bloodhound-custom-queries.vm/tools/chocolateyinstall.ps1 b/packages/bloodhound-custom-queries.vm/tools/chocolateyinstall.ps1
@@ -8,4 +8,4 @@ $zipUrl = 'https://github.com/hausec/Bloodhound-Custom-Queries/archive/7ef909966
 $zipSha256 = '78a71b9797506200b4c86bdad6799ba8c3519171353ce329dff5ff4fc703ddb0'
 
 # This tool does not have a `.exe` associated with it, so this links it to the directory
-VM-Install-Raw-GitHub-Repo $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
+VM-Install-From-Zip $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
diff --git a/packages/c3.vm/c3.vm.nuspec b/packages/c3.vm/c3.vm.nuspec
@@ -2,11 +2,11 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>c3.vm</id>
-    <version>0.0.0.20240411</version>
+    <version>0.0.0.20240412</version>
     <authors>WithSecureLabs</authors>
     <description>C3 (Custom Command and Control) is a tool that allows Red Teams to rapidly develop and utilise esoteric command and control channels (C2). It's a framework that extends other red team tooling, such as the commercial Cobalt Strike (CS) product via ExternalC2.</description>
     <dependencies>
-      <dependency id="common.vm" version="0.0.0.20240411" />
+      <dependency id="common.vm" version="0.0.0.20240412" />
     </dependencies>
   </metadata>
 </package>
diff --git a/packages/c3.vm/tools/chocolateyinstall.ps1 b/packages/c3.vm/tools/chocolateyinstall.ps1
@@ -8,4 +8,4 @@ $zipUrl = 'https://github.com/WithSecureLabs/C3/archive/e1b9922d199e45e222001a3a
 $zipSha256 = '8dd29ed32c2a38312b617c430ff84019da8bd434e3704b778f031aaa859c4e8e'
 
 # This tool does not have a `.exe` associated with it, so this links it to the directory
-VM-Install-Raw-GitHub-Repo $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
+VM-Install-From-Zip $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
diff --git a/packages/certify.vm/certify.vm.nuspec b/packages/certify.vm/certify.vm.nuspec
@@ -2,11 +2,11 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>certify.vm</id>
-    <version>1.1.0.20240411</version>
+    <version>1.1.0.20240412</version>
     <authors>HarmJ0y, leechristensen</authors>
     <description>Certify is a C# tool to enumerate and abuse misconfigurations in Active Directory Certificate Services (AD CS).</description>
     <dependencies>
-      <dependency id="common.vm" version="0.0.0.20240411" />
+      <dependency id="common.vm" version="0.0.0.20240412" />
     </dependencies>
   </metadata>
 </package>
diff --git a/packages/certify.vm/tools/chocolateyinstall.ps1 b/packages/certify.vm/tools/chocolateyinstall.ps1
@@ -7,4 +7,4 @@ $category = 'Exploitation'
 $zipUrl = 'https://github.com/GhostPack/Certify/archive/fb297ad30476cfdba745b9062171cd7ac145a16d.zip'
 $zipSha256 = '4827485203eb08271e953bbd5816e95bf8b0b897ae0937c798525afe7ed5b9e0'
 
-VM-Install-Raw-GitHub-Repo $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
+VM-Install-From-Zip $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
diff --git a/packages/common.vm/common.vm.nuspec b/packages/common.vm/common.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>common.vm</id>
-    <version>0.0.0.20240411</version>
+    <version>0.0.0.20240412</version>
     <description>Common libraries for VM-packages</description>
     <authors>Mandiant</authors>
   </metadata>

diff --git a/packages/common.vm/tools/vm.common/vm.common.psm1 b/packages/common.vm/tools/vm.common/vm.common.psm1
@@ -198,43 +198,6 @@ function VM-New-Install-Log {
     return $outputFile
 }
 
-# This functions returns $toolDir
-function VM-Install-Raw-GitHub-Repo {
-    [CmdletBinding()]
-    Param
-    (
-        [Parameter(Mandatory=$true, Position=0)]
-        [string] $toolName,
-        [Parameter(Mandatory=$true, Position=1)]
-        [string] $category,
-        [Parameter(Mandatory=$true, Position=2)]
-        [string] $zipUrl,
-        [Parameter(Mandatory=$true, Position=3)]
-        [string] $zipSha256,
-        [Parameter(Mandatory=$false)]
-        [bool] $innerFolder=$false, # Subfolder in zip with the app files
-        [Parameter(Mandatory=$false)]
-        [string] $executableName = "", # Executable name, needed if different from "$toolName.exe"
-        [Parameter(Mandatory=$false)]
-        [switch] $withoutBinFile, # Tool should not be installed as a bin file
-        # Examples:
-        # $powershellCommand = "Get-Content README.md"
-        # $powershellCommand = "Import-Module module.ps1; Get-Help Main-Function"
-        [Parameter(Mandatory=$false)]
-        [string] $powershellCommand
-    )
-    try {
-        if ($withoutBinFile) {
-            $toolDir = (VM-Install-From-Zip -toolName $toolName -category $category -zipUrl $zipUrl -zipSha256 $zipSha256 -innerFolder $innerFolder -executableName $executableName -withoutBinFile -powershellCommand $powershellCommand)[0]
-        } else {
-            $toolDir = (VM-Install-From-Zip -toolName $toolName -category $category -zipUrl $zipUrl -zipSha256 $zipSha256 -innerFolder $innerFolder -executableName $executableName -powershellCommand $powershellCommand)[0]
-        }
-        return $toolDir
-    } catch {
-        VM-Write-Log-Exception $_
-    }
-}
-
 function VM-Install-Shortcut{
     [CmdletBinding()]
     Param

diff --git a/packages/covenant.vm/covenant.vm.nuspec b/packages/covenant.vm/covenant.vm.nuspec
@@ -2,11 +2,11 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>covenant.vm</id>
-    <version>0.0.0.20240411</version>
+    <version>0.0.0.20240412</version>
     <authors>cobbr</authors>
     <description>Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers.</description>
     <dependencies>
-      <dependency id="common.vm" version="0.0.0.20240411" />
+      <dependency id="common.vm" version="0.0.0.20240412" />
     </dependencies>
   </metadata>
 </package>
diff --git a/packages/covenant.vm/tools/chocolateyinstall.ps1 b/packages/covenant.vm/tools/chocolateyinstall.ps1
@@ -8,4 +8,4 @@ $zipUrl = 'https://github.com/cobbr/Covenant/archive/5decc3ccfab04e6e881ed00c9de
 $zipSha256 = '53f532e350b7a43b0dab8e21a5298587b9a2f498c46bed77d443dea32525b525'
 
 # This tool does not have a `.exe` associated with it, so this links it to the directory
-VM-Install-Raw-GitHub-Repo $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
+VM-Install-From-Zip $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
diff --git a/packages/credninja.vm/credninja.vm.nuspec b/packages/credninja.vm/credninja.vm.nuspec
@@ -2,11 +2,11 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>credninja.vm</id>
-    <version>2.3.0.20240411</version>
+    <version>2.3.0.20240412</version>
     <authors>raikiasec</authors>
     <description>This tool will tell you if the credentials you dumped are valid on the domain, and if you have local administrator access to a host.</description>
     <dependencies>
-      <dependency id="common.vm" version="0.0.0.20240411" />
+      <dependency id="common.vm" version="0.0.0.20240412" />
     </dependencies>
   </metadata>
 </package>
diff --git a/packages/credninja.vm/tools/chocolateyinstall.ps1 b/packages/credninja.vm/tools/chocolateyinstall.ps1
@@ -8,4 +8,4 @@ $zipUrl = 'https://github.com/Raikia/CredNinja/archive/4a13f297851cd6fe88017288e
 $zipSha256 = '35b7dfae877c08bd9e50a5b9406eead0687b460db9428b9fe22130cc47b1ec10'
 
 # This tool does not have a `.exe` associated with it, so this links it to the directory
-VM-Install-Raw-GitHub-Repo $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
+VM-Install-From-Zip $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
diff --git a/packages/dotnettojscript.vm/dotnettojscript.vm.nuspec b/packages/dotnettojscript.vm/dotnettojscript.vm.nuspec
@@ -2,11 +2,11 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>dotnettojscript.vm</id>
-    <version>0.0.0.20240411</version>
+    <version>0.0.0.20240412</version>
     <authors>James Forshaw</authors>
     <description>A tool to generate a JScript which bootstraps an arbitrary .NET Assembly and class.</description>
     <dependencies>
-      <dependency id="common.vm" version="0.0.0.20240411" />
+      <dependency id="common.vm" version="0.0.0.20240412" />
     </dependencies>
   </metadata>
 </package>
diff --git a/packages/dotnettojscript.vm/tools/chocolateyinstall.ps1 b/packages/dotnettojscript.vm/tools/chocolateyinstall.ps1
@@ -8,4 +8,4 @@ $zipUrl = 'https://github.com/tyranid/DotNetToJScript/archive/4dbe155912186f9574
 $zipSha256 = '12566bdfced108fafba97548c59c07be55988beb1c1e970e62bf40ddaebc4a0a'
 
 # This tool does not have a `.exe` associated with it, so this links it to the directory
-VM-Install-Raw-GitHub-Repo $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
+VM-Install-From-Zip $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
diff --git a/packages/dumpert.vm/dumpert.vm.nuspec b/packages/dumpert.vm/dumpert.vm.nuspec
@@ -2,11 +2,11 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>dumpert.vm</id>
-    <version>0.0.0.20240411</version>
+    <version>0.0.0.20240412</version>
     <authors>outflank</authors>
     <description>This tool demonstrates the use of direct System Calls and API unhooking and combines these techniques in a proof of concept code which can be used to create a LSASS memory dump using Cobalt Strike.</description>
     <dependencies>
-      <dependency id="common.vm" version="0.0.0.20240411" />
+      <dependency id="common.vm" version="0.0.0.20240412" />
     </dependencies>
   </metadata>
 </package>
diff --git a/packages/dumpert.vm/tools/chocolateyinstall.ps1 b/packages/dumpert.vm/tools/chocolateyinstall.ps1
@@ -8,4 +8,4 @@ $zipUrl = 'https://github.com/outflanknl/Dumpert/archive/8000ca4c585b0fc317cee69
 $zipSha256 = '1ffbf3332db29e834c779008586c386ebbf1ca21e5c081ae6bba1a033d937bec'
 
 # This tool does not have a `.exe` associated with it, so this links it to the directory
-VM-Install-Raw-GitHub-Repo $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
+VM-Install-From-Zip $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
diff --git a/packages/evilclippy.vm/evilclippy.vm.nuspec b/packages/evilclippy.vm/evilclippy.vm.nuspec
@@ -2,11 +2,11 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>evilclippy.vm</id>
-    <version>1.3.0.20240411</version>
+    <version>1.3.0.20240412</version>
     <authors>outflank</authors>
     <description>A cross-platform assistant for creating malicious MS Office documents. Can hide VBA macros, stomp VBA code (via P-Code) and confuse macro analysis tools.</description>
     <dependencies>
-      <dependency id="common.vm" version="0.0.0.20240411" />
+      <dependency id="common.vm" version="0.0.0.20240412" />
     </dependencies>
   </metadata>
 </package>
diff --git a/packages/evilclippy.vm/tools/chocolateyinstall.ps1 b/packages/evilclippy.vm/tools/chocolateyinstall.ps1
@@ -8,4 +8,4 @@ $zipUrl = 'https://github.com/outflanknl/EvilClippy/archive/refs/tags/v1.3.zip'
 $zipSha256 = '6ff1633de0ce8b99d5cf59a3e3cddf1960d4e7410d1441fd86940db42a7785a7'
 
 # This tool does not have a `.exe` associated with it, so this links it to the directory
-VM-Install-Raw-GitHub-Repo $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
+VM-Install-From-Zip $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
diff --git a/packages/fuzzdb.vm/fuzzdb.vm.nuspec b/packages/fuzzdb.vm/fuzzdb.vm.nuspec
@@ -2,11 +2,11 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>fuzzdb.vm</id>
-    <version>0.0.0.20240411</version>
+    <version>0.0.0.20240412</version>
     <authors>fuzzdb-project</authors>
     <description>FuzzDB is the most comprehensive open dictionary of fault injection patterns, predictable resource locations, and regex for matching server responses.</description>
     <dependencies>
-      <dependency id="common.vm" version="0.0.0.20240411" />
+      <dependency id="common.vm" version="0.0.0.20240412" />
     </dependencies>
   </metadata>
 </package>
diff --git a/packages/fuzzdb.vm/tools/chocolateyinstall.ps1 b/packages/fuzzdb.vm/tools/chocolateyinstall.ps1
@@ -8,4 +8,4 @@ $zipUrl = 'https://github.com/fuzzdb-project/fuzzdb/archive/5656ab25dc6bb43bae32
 $zipSha256 = 'b732136975be06f71e8c8cfa6923a6dfba028b7f8c4cfa21c6280ef5b74aa1fa'
 
 # This tool does not have a `.exe` associated with it, so this links it to the directory
-VM-Install-Raw-GitHub-Repo $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
+VM-Install-From-Zip $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
diff --git a/packages/gadgettojscript.vm/gadgettojscript.vm.nuspec b/packages/gadgettojscript.vm/gadgettojscript.vm.nuspec
@@ -2,11 +2,11 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>gadgettojscript.vm</id>
-    <version>2.0.0.20240411</version>
+    <version>2.0.0.20240412</version>
     <authors>med0x2e</authors>
     <description>A tool for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA scripts.</description>
     <dependencies>
-      <dependency id="common.vm" version="0.0.0.20240411" />
+      <dependency id="common.vm" version="0.0.0.20240412" />
     </dependencies>
   </metadata>
 </package>
diff --git a/packages/gadgettojscript.vm/tools/chocolateyinstall.ps1 b/packages/gadgettojscript.vm/tools/chocolateyinstall.ps1
@@ -8,4 +8,4 @@ $zipUrl = 'https://github.com/med0x2e/GadgetToJScript/archive/98f50984015c29eecb
 $zipSha256 = '093451115744beec90e7de4efc61857361b56d16a3a31d78182a8c7ef675938b'
 
 # This tool does not have a `.exe` associated with it, so this links it to the directory
-VM-Install-Raw-GitHub-Repo $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
+VM-Install-From-Zip $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
diff --git a/packages/invokedosfuscation.vm/invokedosfuscation.vm.nuspec b/packages/invokedosfuscation.vm/invokedosfuscation.vm.nuspec
@@ -2,11 +2,11 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>invokedosfuscation.vm</id>
-    <version>1.0.0.20240411</version>
+    <version>1.0.0.20240412</version>
     <authors>danielbohannon</authors>
     <description>Invoke-DOSfuscation is a PowerShell v2.0+ compatible cmd.exe command obfuscation framework.</description>
     <dependencies>
-      <dependency id="common.vm" version="0.0.0.20240411" />
+      <dependency id="common.vm" version="0.0.0.20240412" />
     </dependencies>
   </metadata>
 </package>
diff --git a/packages/invokedosfuscation.vm/tools/chocolateyinstall.ps1 b/packages/invokedosfuscation.vm/tools/chocolateyinstall.ps1
@@ -9,4 +9,4 @@ $zipSha256 = '60b78094731fc8f54333193e840cb847ac4018c6ca1ccc36c107cda533016791'
 
 $powershellCommand = 'Import-Module .\Invoke-DOSfuscation.psd1; Invoke-DOSfuscation'
 
-VM-Install-Raw-GitHub-Repo $toolName $category $zipUrl $zipSha256 -innerFolder $true -powershellCommand $powershellCommand
+VM-Install-From-Zip $toolName $category $zipUrl $zipSha256 -innerFolder $true -powershellCommand $powershellCommand
diff --git a/packages/invokeobfuscation.vm/invokeobfuscation.vm.nuspec b/packages/invokeobfuscation.vm/invokeobfuscation.vm.nuspec
@@ -2,11 +2,11 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>invokeobfuscation.vm</id>
-    <version>1.8.2.20240411</version>
+    <version>1.8.2.20240412</version>
     <authors>cobbr, 4d4c, mvle, danielbohannon</authors>
     <description>Invoke-Obfuscation is a PowerShell v2.0+ compatible PowerShell command and script obfuscator.</description>
     <dependencies>
-      <dependency id="common.vm" version="0.0.0.20240411" />
+      <dependency id="common.vm" version="0.0.0.20240412" />
     </dependencies>
   </metadata>
 </package>
diff --git a/packages/invokeobfuscation.vm/tools/chocolateyinstall.ps1 b/packages/invokeobfuscation.vm/tools/chocolateyinstall.ps1
@@ -9,4 +9,4 @@ $zipSha256 = '24149efe341b4bfc216dea22ece4918abcbe0655d3d1f3c07d1965fac5b4478e'
 
 $powershellCommand = 'Import-Module ./Invoke-Obfuscation.psd1; Invoke-Obfuscation'
 
-VM-Install-Raw-GitHub-Repo $toolName $category $zipUrl $zipSha256 -innerFolder $true -powershellCommand $powershellCommand
+VM-Install-From-Zip $toolName $category $zipUrl $zipSha256 -innerFolder $true -powershellCommand $powershellCommand
diff --git a/packages/keethief.vm/keethief.vm.nuspec b/packages/keethief.vm/keethief.vm.nuspec
@@ -2,11 +2,11 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>keethief.vm</id>
-    <version>0.0.0.20240411</version>
+    <version>0.0.0.20240412</version>
     <authors>tifkin_, harmj0y</authors>
     <description>Allows for the extraction of KeePass 2.X key material from memory, as well as the backdooring and enumeration of the KeePass trigger system.</description>
     <dependencies>
-      <dependency id="common.vm" version="0.0.0.20240411" />
+      <dependency id="common.vm" version="0.0.0.20240412" />
     </dependencies>
   </metadata>
 </package>
diff --git a/packages/keethief.vm/tools/chocolateyinstall.ps1 b/packages/keethief.vm/tools/chocolateyinstall.ps1
@@ -8,4 +8,4 @@ $zipUrl = 'https://github.com/GhostPack/KeeThief/archive/04f3fbc0ba87dbcd9011ad4
 $zipSha256 = '2fe020645855564ce1d0236c3e83e8d66a09c91c00d95a40b88cbe9ffd5ca204'
 
 # This tool does not have a `.exe` associated with it, so this links it to the directory
-VM-Install-Raw-GitHub-Repo $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
+VM-Install-From-Zip $toolName $category $zipUrl $zipSha256 -withoutBinFile -innerFolder $true
diff --git a/packages/malware-jail.vm/malware-jail.vm.nuspec b/packages/malware-jail.vm/malware-jail.vm.nuspec
@@ -2,11 +2,11 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>malware-jail.vm</id>
-    <version>0.0.0.20240411</version>
+    <version>0.0.0.20240412</version>
     <authors>Hynek Petrak</authors>
     <description>Sandbox for semi-automatic Javascript malware analysis, deobfuscation and payload extraction.</description>
     <dependencies>
-      <dependency id="common.vm" version="0.0.0.20240411" />
+      <dependency id="common.vm" version="0.0.0.20240412" />
       <dependency id="nodejs.vm" />
     </dependencies>
   </metadata>

diff --git a/packages/malware-jail.vm/tools/chocolateyinstall.ps1 b/packages/malware-jail.vm/tools/chocolateyinstall.ps1
@@ -10,7 +10,7 @@ try {
     # Install dependencies with npm when running shortcut as we ignore errors below
     $powershellCommand = "npm install; node jailme.js -h -b list"
 
-    $toolDir = VM-Install-Raw-GitHub-Repo $toolName $category $zipUrl $zipSha256 -innerFolder $true -powershellCommand $powershellCommand
+    $toolDir = (VM-Install-From-Zip $toolName $category $zipUrl $zipSha256 -innerFolder $true -powershellCommand $powershellCommand)[0]
 
 } catch {
     VM-Write-Log-Exception $_

diff --git a/packages/microburst.vm/microburst.vm.nuspec b/packages/microburst.vm/microburst.vm.nuspec
@@ -2,11 +2,11 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>microburst.vm</id>
-    <version>0.0.0.20240411</version>
+    <version>0.0.0.20240412</version>
     <authors>NetSPI</authors>
     <description>MicroBurst includes functions and scripts that support Azure Services discovery, weak configuration auditing, and post exploitation actions such as credential dumping.</description>
     <dependencies>
-      <dependency id="common.vm" version="0.0.0.20240411" />
+      <dependency id="common.vm" version="0.0.0.20240412" />
       <dependency id="az.powershell" />
     </dependencies>
   </metadata>
Original file line number	Diff line number	Diff line change
Expand Up		@@ -9,4 +9,4 @@ $zipSha256 = '60b78094731fc8f54333193e840cb847ac4018c6ca1ccc36c107cda533016791'

		$powershellCommand = 'Import-Module .\Invoke-DOSfuscation.psd1; Invoke-DOSfuscation'

		VM-Install-Raw-GitHub-Repo $toolName $category $zipUrl $zipSha256 -innerFolder $true -powershellCommand $powershellCommand
		VM-Install-From-Zip $toolName $category $zipUrl $zipSha256 -innerFolder $true -powershellCommand $powershellCommand
Original file line number	Diff line number	Diff line change
Expand Up		@@ -9,4 +9,4 @@ $zipSha256 = '24149efe341b4bfc216dea22ece4918abcbe0655d3d1f3c07d1965fac5b4478e'

		$powershellCommand = 'Import-Module ./Invoke-Obfuscation.psd1; Invoke-Obfuscation'

		VM-Install-Raw-GitHub-Repo $toolName $category $zipUrl $zipSha256 -innerFolder $true -powershellCommand $powershellCommand
		VM-Install-From-Zip $toolName $category $zipUrl $zipSha256 -innerFolder $true -powershellCommand $powershellCommand