Configurable Excluded Categories

[nadrojisk]

Details

Is it possible to make the excludedCategories configurable?

I know they were a recent change. Today I was attempting to install Flare-VM on Windows11 and I realized all the Offensive Security Focused tools were no longer listed. After some browsing I realized it was this line.

https://github.com/mandiant/flare-vm/blame/433e1b7161253bbf781f526b147d5982b8b6a4e6/install.ps1#L565

It would be nice if the install either took as a command line argument categories to exclude, or even better if the GUI had a page for it.

[nadrojisk]

Created a working POC for this, will try and do a merge sometime today.

[Ana06]

@nadrojisk note that it is still possible to add the tools using the Additional packages to install section to add packages from VM-Packages: https://github.com/mandiant/VM-Packages/wiki/Packages. The reason to not add the rest of the categories in the FLARE-VM installer is that these categories are for Commando VM, whose main purpose is not reverse engineer. So I expect FLARE-VM users to not be interested in installing tools from those categories and I think that complicating the UI view to include them is not a good idea. @nadrojisk can you please provide more details about your case of use and which tools do you find useful to install using FLARE-VM? 🤔

[nadrojisk]

@Ana06 super valid points!

I think it’s useful, but I could be an outlier. On one hand I think I could have implemented it a little better, it’s a little slow when changing categories, but it’s mainly just an example of how it could be implemented.

For reasons why it could be useful, for example, there’s a handful of forensics focused tools that are excluded by default that I find useful during my analysis with incident response work. I could add them, as you mentioned, but say new packages have been added and I wasn’t aware they were there I wouldn’t know what to add. Having the full list of packages with a short description is super handy.

I’m sure others also have similar use cases of needing other binaries. For example, it can be useful when practicing reversing to be able to compile and create malicious binaries which can be done with some of the packages included in the CommandoVM. Additionally, they are some reversing categories that not everyone may need. One that comes to mind is Java/Android. Having categories where you can quickly remove the entire set of packages would be useful.

For instance Kali has some meta packages that can be installed that downloads packages for other categories like reversing, even though Kali is more penetration testing focused.

I can see where you would not want to over complicate the UI, but removing packages from the UI that were there previously could be confusing to returning users that are reinstalling the VM (which happened to me lol). If nothing else it may be nice to include it in the README or something. I think it’s only mentioned in the issue/PR where the new GUI was implemented.

[Ana06]

@nadrojisk

For reasons why it could be useful, for example, there’s a handful of forensics focused tools that are excluded by default that I find useful during my analysis with incident response work.

The main target of FLARE-VM is reverse engineering. Are there others using FLARE-VM for incident response work and find these tools useful too?

I could add them, as you mentioned, but say new packages have been added and I wasn’t aware they were there I wouldn’t know what to add. Having the full list of packages with a short description is super handy.

https://github.com/mandiant/VM-Packages/wiki/Packages is the exact same list that we show in the installer with all the categories. So the list of packages with a short description is already available outside of the installer and linked from the installer.

it can be useful when practicing reversing to be able to compile and create malicious binaries which can be done with some of the packages included in the CommandoVM

Which tools exactly do you mean?

Additionally, they are some reversing categories that not everyone may need. One that comes to mind is Java/Android. Having categories where you can quickly remove the entire set of packages would be useful.

I think the feature to unselect all tools in a category could be useful. Although this could be implemented without allowing to configure the categories.

I can see where you would not want to over complicate the UI, but removing packages from the UI that were there previously could be confusing to returning users that are reinstalling the VM (which happened to me lol). If nothing else it may be nice to include it in the README or something

The new changes aim to make it easier for users to decide which packages to install and includes documentation of where to the rest of the packages:

I think FLARE-VM packages should be called VM-Packages though.

We added some documentation to the README with the new installer version, but I'll send a PR to improve the documentation based on this feedback. We are also planing to publish a blog post soon.

[Ana06]

@mandiant/flare-vm what do others think about this?