BanditLab-Universal.yaml

#cloud-config
#Description: BanditLab universal cloud-init config
#Version: v2026.07.14.4
#Created: 2025-11-13
#Updated: 2026-07-14
#Target: Ubuntu 24.04 (noble) — Multipass on macOS (aarch64 / x86_64)
#Usage: multipass launch 24.04 --name banditlab --cpus 4 --memory 8G --disk 80G --cloud-init BanditLab-Universal.yaml
#Post-deploy: starts automatically after cloud-init completes; monitor: tail -f ~/.lab/postdeploy.log

package_update: true

apt:
  sources:
    # Required for EZTools (.NET forensic binaries) — dotnet-runtime-6.0 is not in default noble repos
    dotnet_backports:
      source: deb [arch="arm64","amd64"] https://ppa.launchpadcontent.net/dotnet/backports/ubuntu/ $RELEASE main
      key: |
        -----BEGIN PGP PUBLIC KEY BLOCK-----
        
        mQINBGWzzawBEAD0r2+MRyiDtGRmCZ+S15spTUY9/l/0bKIZp5S+WTfd1NlSzkCl
        +XYQa4cy9+jzeAgosiN0Brx8X1ohYo2uRc4+yEZaODpuR4X5roAabLEE9/R3n9XL
        HJ0pqLiieqmsHcICqMFNYLc7eG3ttN3knRRbKQBk/P6UpJhcWRIex4Oeo5RK5pS3
        zCJzRCwqf/rZFfcHgssXSXjDqnYONOuNNyxp0qHG3PG3WVUjnnjx3tWI33T/Qiat
        FNJh3wW3Y+wMuRUuB04DymVgVoFBB2xWu158GtpuKrFQ7xf3ZSD4JgcwCx2pXQ+E
        P7GEm+S7ARk1hnN4vto3oqg8h6QdVbjaO+E+u7snmneC0GPCLlj9cvrKnRXEwJag
        oj+t0g7sR8iSbjfnLxAAPfPRpHnLCk/NjtB6kASJxggUEsRe3mcO+9WgvF/w85np
        or0L+AvPSnnUxrLybwKLT+0TbSOA3CKGAOfSAqCS77hbRjdjuzSoh5O7IQUZOrJJ
        XzfKZylSbW/t1mSZbmLMxB3aD/HfDeWLS3JWOQVMDCGCVE9yh6P9X0B/5UEYp5mu
        nQ34rttqMCu9gBPR93f21kz3dUoA5m/OSkvqrAwqgarlPKdQnjcthJGI0l+xU1fI
        fqC3wDjYIgJ+DCGl7OyLW7htMj+ZY7eJbHHXN4AMAwDFQcicW42VVnrIVwARAQAB
        tCJMYXVuY2hwYWQgUFBBIGZvciAuTkVUIEAgQ2Fub25pY2FsiQJOBBMBCgA4FiEE
        RaPxJxWb6eUBeBHGISWxZOjl0/oFAmWzzawCGwMFCwkIBwIGFQoJCAsCBBYCAwEC
        HgECF4AACgkQISWxZOjl0/poJA//U5RZZxAAWxWGj9qyelawo7KecLWImcFUDcnI
        2mfQOB9havZYcOcjenYiJTxKoJ4lRQzGbA/ssGea07zRtdaP/pyWv6iWfVsX3Dvl
        hwetndbkllbUKoFEQndyxKuK+JBaM3YLDqUVJhJp3w5Jn2IqfnWkZnGf3vZWFCtY
        Alobynkqnv0EVX4FteHG+/T4ouTXCkJVwMtekDdCkYXOE7mWWcRW7KAeHq/wI85T
        HaWR6jWjhsF9U0wjludVGeeoL6F8FGaHxbTbn7pQR8Epz92hl9+tQkyxjtjuXDtj
        TWvI1buewpzHujk5AXknLabmuFCGl/AHxYB6i4briBvar0SRy3x9XszvMiEtb69V
        ApepUcG/PmlUb5X0KofDoQ7btS56HxPRnScOyWX/tUccod41s7Tsx5eGYTEcZjRh
        FBYgjqhnMkcFoEpFx9Wt2Z2cRpZXzc07uz3WAF8eb3QcOkFrwySogVDhdF+cHvGI
        RyD27ZbxEsQDIr2hCgOdDg/Cvz9uvN5WhiFL/xM82idIWfczF1rkFb9p6AxR9c26
        99oVl+UOLTSPlPmsgtDwOTwc0EYjspEit30BQWQUEN4VaQlGpGLJxshs8hGf57fq
        5i/EmixUuQvkThlBZIdSkAeFhwS0mnGmcOQmfCE/6hBqBCgDEDspJPW56SGOVZMo
        yRDdXGU=
        =zcgX
        -----END PGP PUBLIC KEY BLOCK-----

write_files:
  - path: /etc/profile.d/banditlab-path.sh
    owner: root:root
    permissions: '0644'
    content: |
      # BanditLab tool PATH — interactive and non-interactive shells
      export PATH="/home/ubuntu/bin:/home/ubuntu/pyapps/bin:/home/ubuntu/plaso/bin:${PATH}"

  - path: /etc/profile.d/banditlab-aliases.sh
    owner: root:root
    permissions: '0644'
    content: |
      # Convenience aliases — invocation uses symlinks/PATH; 'tools' lists the catalog
      alias tools='banditlab-tools'
      alias pyapps='source /home/ubuntu/pyapps/bin/activate'

  - path: /etc/systemd/system/banditlab-postdeploy.service
    owner: root:root
    permissions: '0644'
    content: |
      [Unit]
      Description=BanditLab forensic tool deployment
      After=network-online.target cloud-init.target
      Wants=network-online.target
      ConditionPathExists=!/home/ubuntu/.lab/.postdeploy.done

      [Service]
      Type=oneshot
      User=ubuntu
      Group=ubuntu
      Environment=HOME=/home/ubuntu
      ExecStart=/home/ubuntu/.lab/run-postdeploy.sh
      RemainAfterExit=yes

      [Install]
      WantedBy=multi-user.target

  - path: /home/ubuntu/.lab/start-postdeploy-after-cloudinit.sh
    owner: root:root
    permissions: '0755'
    content: |
      #!/usr/bin/env bash
      # Waits for cloud-init (including deferred write_files) then starts post-deploy.
      LOG=/var/log/banditlab-trigger.log
      echo "[trigger] $(date -Is) waiting for cloud-init to finish" >> "$LOG"
      cloud-init status --wait >> "$LOG" 2>&1 || true

      for i in $(seq 1 60); do
        if [ -x /home/ubuntu/.lab/fortoolsinit.sh ] && [ -f /home/ubuntu/.lab/plasoinit.in ]; then
          echo "[trigger] $(date -Is) deploy scripts ready" >> "$LOG"
          break
        fi
        echo "[trigger] $(date -Is) waiting for deploy scripts ($i/60)" >> "$LOG"
        sleep 2
      done

      echo "[trigger] $(date -Is) starting banditlab-postdeploy.service" >> "$LOG"
      systemctl start banditlab-postdeploy.service >> "$LOG" 2>&1

  - path: /etc/cron.d/banditlab-postdeploy
    owner: root:root
    permissions: '0644'
    content: |
      # Fallback if cloud-init trigger missed first boot
      @reboot root sleep 180 && [ ! -f /home/ubuntu/.lab/.postdeploy.done ] && /usr/bin/systemctl start banditlab-postdeploy.service

  - path: /home/ubuntu/.lab/run-postdeploy.sh
    owner: ubuntu:ubuntu
    permissions: '0755'
    content: |
      #!/usr/bin/env bash
      set -euo pipefail

      SENTINEL="/home/ubuntu/.lab/.postdeploy.done"
      LOG="/home/ubuntu/.lab/postdeploy.log"
      LOCK="/home/ubuntu/.lab/.postdeploy.lock"

      [ -f "$SENTINEL" ] && exit 0

      mkdir -p /home/ubuntu/.lab
      exec 9>"$LOCK"
      if ! flock -n 9; then
        echo "[postdeploy] Another instance is running." | tee -a "$LOG"
        exit 0
      fi

      for i in $(seq 1 30); do
        if [ -x /home/ubuntu/.lab/fortoolsinit.sh ] && [ -f /home/ubuntu/.lab/plasoinit.in ]; then
          break
        fi
        echo "[postdeploy] Waiting for deploy scripts ($i/30)..." | tee -a "$LOG"
        sleep 2
      done

      if [ ! -x /home/ubuntu/.lab/fortoolsinit.sh ]; then
        echo "[postdeploy] ERROR: fortoolsinit.sh not found. Cloud-init may be incomplete." | tee -a "$LOG"
        exit 1
      fi

      echo "[postdeploy] Starting at $(date -Is)" | tee -a "$LOG"

      if bash /home/ubuntu/.lab/fortoolsinit.sh 2>&1 | tee -a "$LOG" \
        && /home/ubuntu/plaso/bin/python3 -m pip install -r /home/ubuntu/.lab/plasoinit.in 2>&1 | tee -a "$LOG"; then
        bash /home/ubuntu/.lab/generate-tools-manifest.sh
        touch "$SENTINEL"
        echo "[postdeploy] Finished OK at $(date -Is)" | tee -a "$LOG"
        exit 0
      fi

      echo "[postdeploy] Failed at $(date -Is). Will retry on next boot or login." | tee -a "$LOG"
      exit 1
    defer: true

  - path: /home/ubuntu/.lab/generate-tools-manifest.sh
    owner: ubuntu:ubuntu
    permissions: '0755'
    content: |
      #!/usr/bin/env bash
      set -euo pipefail

      HOME="${HOME:-/home/ubuntu}"
      MANIFEST="${HOME}/.lab/tools.manifest"
      TMP="$(mktemp)"

      add() {
        printf '%s|%s|%s\n' "$1" "$2" "$3" >> "$TMP"
      }

      for name in mftecmd amcacheparser bstrings evtxecmd jlecmd lecmd rbcmd recmd \
        srumecmd recentfilecacheparser sqlecmd wxtcmd rla; do
        add eztools "$name" "Eric Zimmerman EZTool"
      done

      for name in hayabusa nuclei chainsaw trufflehog noseyparker vt pup sidr timeliner; do
        add binary "$name" "Standalone forensic binary"
      done

      for name in edrparser hindsight hindsight_gui pdfid olevba peepdf fat_parser \
        ntfs_parser browserexport parse_smsdb prefetcher xlsxgrep auto-archiver ioc-scan odl; do
        add python "$name" "Python tool (pyapps venv)"
      done

      for name in log2timeline pinfo psteal psort; do
        add plaso "$name" "Plaso forensic suite"
      done

      for name in sleuthkit tshark yara exiftool testdisk dc3dd dnsrecon nikto; do
        add apt "$name" "System package (apt)"
      done

      add optional install-pwsh "Install PowerShell on demand"
      add optional install-azurecli "Install Azure CLI on demand"
      add optional install-gcloud "Install Google Cloud CLI via snap on demand"

      sort -t'|' -k1,1 -k2,2 "$TMP" > "$MANIFEST"
      rm -f "$TMP"
      echo "[manifest] Wrote $(wc -l < "$MANIFEST") tools to ${MANIFEST}"
    defer: true

  - path: /home/ubuntu/bin/banditlab-tools
    owner: ubuntu:ubuntu
    permissions: '0755'
    content: |
      #!/usr/bin/env bash
      set -euo pipefail

      HOME="${HOME:-/home/ubuntu}"
      MANIFEST="${HOME}/.lab/tools.manifest"

      usage() {
        cat <<'EOF'
      Usage: banditlab-tools [category]

      List installed BanditLab forensic tools by category.
        banditlab-tools           Show categories and counts
        banditlab-tools eztools   List Eric Zimmerman EZTools
        banditlab-tools python    List pyapps Python tools
        banditlab-tools plaso     List Plaso tools
        banditlab-tools binary    List standalone binaries
        banditlab-tools apt       List key apt packages
        banditlab-tools optional  List on-demand installers

      Shortcut: alias tools='banditlab-tools'
      EOF
      }

      case "${1:-}" in
        -h|--help) usage; exit 0 ;;
      esac

      if [ ! -f "$MANIFEST" ]; then
        if [ -f "${HOME}/.lab/.postdeploy.done" ]; then
          echo "Manifest missing. Regenerating..."
          bash "${HOME}/.lab/generate-tools-manifest.sh"
        else
          echo "BanditLab deploy in progress or not started."
          echo "  tail -f ~/.lab/postdeploy.log"
          echo "  sudo tail -f /var/log/banditlab-trigger.log"
          exit 1
        fi
      fi

      if [ -n "${1:-}" ]; then
        printf "%-22s %s\n" "NAME" "DESCRIPTION"
        printf "%-22s %s\n" "----" "-----------"
        awk -F'|' -v cat="${1}" '$1 == cat { printf "%-22s %s\n", $2, $3 }' "$MANIFEST"
        exit 0
      fi

      echo "BanditLab tool catalog"
      echo "Run: banditlab-tools <category>"
      echo ""
      awk -F'|' '
        { cats[$1]++ }
        END {
          for (c in cats) printf "  %-12s (%d tools)\n", c, cats[c]
        }' "$MANIFEST" | sort
      echo ""
      echo "Examples: banditlab-tools eztools | banditlab-tools python"
    defer: true

  - path: /etc/update-motd.d/99-banditlab
    owner: root:root
    permissions: '0755'
    content: |
      #!/bin/sh
      SENTINEL="/home/ubuntu/.lab/.postdeploy.done"
      MANIFEST="/home/ubuntu/.lab/tools.manifest"
      LOG="/home/ubuntu/.lab/postdeploy.log"

      if [ -f "$SENTINEL" ] && [ -f "$MANIFEST" ]; then
        COUNT="$(wc -l < "$MANIFEST" | tr -d ' ')"
        printf "\n  BanditLab: ready (%s tools) — run: banditlab-tools\n\n" "$COUNT"
      elif pgrep -f "run-postdeploy.sh|fortoolsinit.sh" >/dev/null 2>&1; then
        printf "\n  BanditLab: deploying tools...  tail -f ~/.lab/postdeploy.log\n\n"
      elif [ -f "$LOG" ]; then
        printf "\n  BanditLab: deploy incomplete — tail -f ~/.lab/postdeploy.log\n\n"
      else
        printf "\n  BanditLab: starting deploy shortly...\n\n"
      fi

  - path: /etc/profile.d/99-postdeploy.sh
    owner: root:root
    permissions: '0644'
    content: |
      # Fallback: retry post-deploy on interactive login if auto-trigger failed
      case $- in *i* ) ;; * ) return ;; esac
      [ "$USER" = "ubuntu" ] || return
      [ -f /home/ubuntu/.lab/.postdeploy.done ] && return
      nohup /home/ubuntu/.lab/run-postdeploy.sh >> /home/ubuntu/.lab/postdeploy.log 2>&1 &
    defer: true

  - path: /home/ubuntu/.lab/plasoinit.in
    owner: ubuntu:ubuntu
    permissions: '0644'
    content: |
      acstore==20240407
      artifacts==20240518
      bencode.py==4.0.0
      certifi==2025.1.31
      cffi==1.17.1
      charset-normalizer==3.4.1
      defusedxml==0.7.1
      dfdatetime==20251018
      dfvfs==20240505
      dfwinreg==20240229
      dtfabric
      Events==0.5
      Flor==1.1.3
      idna==3.10
      libbde-python==20240502
      libcaes-python==20240413
      libcreg-python==20240419
      libesedb-python==20240420
      libevt-python==20240421
      libevtx-python==20240504
      libewf-python==20240506
      libfcrypto-python==20240414
      libfsapfs-python==20240429
      libfsext-python==20240501
      libfsfat-python==20240501
      libfshfs-python==20240501
      libfsntfs-python==20240501
      libfsxfs-python==20240501
      libfvde-python==20240502
      libfwnt-python==20240415
      libfwsi-python==20240423
      liblnk-python==20240423
      libluksde-python==20240503
      libmodi-python==20240507
      libmsiecf-python==20240425
      libolecf-python==20240427
      libphdi-python==20240508
      libqcow-python==20240308
      libregf-python==20240421
      libscca-python==20240427
      libsigscan-python==20240505
      libsmdev-python==20240505
      libsmraw-python==20240506
      libvhdi-python==20240509
      libvmdk-python==20240510
      libvsapm-python==20240503
      libvsgpt-python==20240504
      libvshadow-python==20240504
      libvslvm-python==20240504
      lz4==4.4.3
      opensearch-py==2.8.0
      pefile==2024.8.26
      plaso==20240826
      psutil==7.0.0
      pycparser==2.22
      pyparsing==3.1.4
      python-dateutil==2.9.0.post0
      pytsk3==20250312
      pytz==2025.2
      PyYAML==6.0.2
      pyzmq==26.3.0
      redis==5.2.1
      requests==2.32.3
      six==1.17.0
      urllib3==2.3.0
      xattr==1.1.4
      XlsxWriter==3.2.2
      yara-python==4.5.1
      zstd==1.5.6.6
    defer: true

  - path: /home/ubuntu/bin/install-pwsh
    owner: ubuntu:ubuntu
    permissions: '0755'
    content: |
      #!/usr/bin/env bash
      set -euo pipefail
      ARCH="$(uname -m)"
      case "${ARCH}" in
        aarch64)
          PWSH_URL="https://github.com/PowerShell/PowerShell/releases/download/v7.5.0/powershell-7.5.0-linux-arm64.tar.gz"
          ;;
        x86_64)
          PWSH_URL="https://github.com/PowerShell/PowerShell/releases/download/v7.5.4/powershell-7.5.4-linux-musl-x64.tar.gz"
          ;;
        *)
          echo "install-pwsh: unsupported architecture: ${ARCH}" >&2
          exit 1
          ;;
      esac
      wget --no-check-certificate -qO- "${PWSH_URL}" \
        | tar -xz -C "${HOME}/tools/" --one-top-level=powershell
      chmod 755 "${HOME}/tools/powershell/pwsh"
      sudo ln -sf "${HOME}/tools/powershell/pwsh" /usr/local/bin/pwsh
      echo "PowerShell installed: $(pwsh --version)"
    defer: true

  - path: /home/ubuntu/bin/install-azurecli
    owner: ubuntu:ubuntu
    permissions: '0755'
    content: |
      #!/usr/bin/env bash
      set -euo pipefail
      curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
    defer: true

  - path: /home/ubuntu/bin/install-gcloud
    owner: ubuntu:ubuntu
    permissions: '0755'
    content: |
      #!/usr/bin/env bash
      set -euo pipefail
      sudo snap install google-cloud-cli --classic
    defer: true

  - path: /home/ubuntu/.lab/fortoolsinit.sh
    owner: ubuntu:ubuntu
    permissions: '0755'
    content: |
      #!/usr/bin/env bash
      [ -z "${BASH_VERSION:-}" ] && exec /usr/bin/env bash "$0" "$@"
      set -uo pipefail
      export DEBIAN_FRONTEND=noninteractive
      
      echo '#######################################'
      echo '# BanditLab tool deployment script    #'
      echo '#######################################'
      
      HOME="${HOME:-/home/ubuntu}"
      PYAPPS="${HOME}/pyapps/bin/python3"
      TOOLS="${HOME}/tools"
      BIN="${HOME}/bin"
      FAIL_LOG="${HOME}/.lab/fortoolsinit.failures"
      
      OK=()
      FAILED=()
      
      step() {
        local name="$1"
        shift
        echo "[fortoolsinit] >>> ${name}"
        if "$@"; then
          echo "[fortoolsinit] OK: ${name}"
          OK+=("${name}")
          return 0
        fi
        echo "[fortoolsinit] FAIL: ${name}" >&2
        FAILED+=("${name}")
        echo "$(date -Is) FAIL: ${name}" >> "${FAIL_LOG}"
        return 1
      }
      
      fetch_tar() {
        local url="$1" dest="$2"
        local tmp
        tmp="$(mktemp)"
        wget --no-check-certificate -qO "${tmp}" "${url}" && [ -s "${tmp}" ] \
          && { tar -xzf "${tmp}" -C "${dest}" 2>/dev/null || tar -xf "${tmp}" -C "${dest}"; } \
          && rm -f "${tmp}"
      }
      
      fetch_archive() {
        local url="$1" dest="$2"
        local tmp
        tmp="$(mktemp)"
        wget --no-check-certificate -qO "${tmp}" "${url}" && [ -s "${tmp}" ] \
          && bsdtar -xf "${tmp}" -C "${dest}" \
          && rm -f "${tmp}"
      }
      
      link_user() {
        [ -e "$1" ] || return 1
        ln -sf "$1" "${BIN}/$(basename "$2")"
      }
      
      link_system() {
        [ -e "$1" ] || return 1
        sudo ln -sf "$1" "/usr/local/bin/$(basename "$2")"
      }
      
      mkdir -p "${BIN}" "${HOME}"/{DATA,ewfmount,evidence,.lab}
      mkdir -p "${TOOLS}"/{hayabusa,memprocfs,trufflehog,noseyparker,pup,vt,nuclei}
      : > "${FAIL_LOG}"
      
      step "apt-update" sudo apt-get update -qq
      
      step "apt-forensic-packages" sudo apt-get install -y \
        afflib-tools attr cewl dc3dd dislocker dnsrecon ewf-tools exifprobe \
        fcrackzip forensic-artifacts forensics-colorize galleta hashdeep pff-tools \
        mc recoverdm scrounge-ntfs sleuthkit ssdeep wipe yara ext3grep \
        libimage-exiftool-perl testdisk geoip-bin mblaze mboxgrep pev unar \
        tesseract-ocr libvshadow-utils python3.12 python3.12-venv python3-pip \
        extundelete libarchive-tools ugrep apt-transport-https parallel nikto jq \
        xmlstarlet poppler-utils xq libplist-utils qpdf tshark wireshark-common \
        unzip git
      
      step "pip-pyapps-core" "${PYAPPS}" -m pip install wheel construct pdfid oletools pyhindsight \
        auto-archiver xlsxgrep tabulate dnspython domaintools_api evtxtract \
        parse_smsdb pycryptodome chardet
      
      step "pip-dfir-ntfs" "${PYAPPS}" -m pip install \
        https://github.com/msuhanov/dfir_ntfs/archive/refs/tags/1.1.20.tar.gz
      
      step "pip-ioc-scanner" "${PYAPPS}" -m pip install git+https://github.com/cisagov/ioc-scanner.git
      
      step "pip-ccl-chromium" "${PYAPPS}" -m pip install git+https://github.com/cclgroupltd/ccl_chromium_reader.git
      
      step "pip-edrparser" "${PYAPPS}" -m pip install \
        https://github.com/0CM/BanditLab/raw/refs/heads/main/packages/edrparser-2.2.0.tar.gz
      
      step "prefetcher-download" bash -c "
        wget --no-check-certificate -q \
          https://raw.githubusercontent.com/ajread4/prefetcher/refs/heads/main/prefetcher.py \
          -O '${HOME}/pyapps/bin/prefetcher.py' \
        && chmod 755 '${HOME}/pyapps/bin/prefetcher.py' \
        && chmod 755 '${HOME}/pyapps/bin/hindsight.py' '${HOME}/pyapps/bin/hindsight_gui.py' 2>/dev/null || true
      "
      
      ARCH="$(uname -m)"
      HAYABUSA_VERSION="3.7.0"
      HAYABUSA_BIN=""
      
      if [ "${ARCH}" = "aarch64" ]; then
        echo "[fortoolsinit] Architecture: aarch64"
      
        step "binary-eztools" fetch_tar \
          "https://github.com/0CM/BanditLab/raw/main/packages/EZTools_aarch64-20240710.tar.gz" "${TOOLS}/"
        step "binary-sidr" fetch_tar \
          "https://github.com/0CM/BanditLab/raw/main/packages/sidr_aarch64-20240702.tar.gz" "${TOOLS}/"
        step "binary-memprocfs" fetch_tar \
          "https://github.com/ufrisk/MemProcFS/releases/download/v5.17/MemProcFS_files_and_binaries_v5.17.9-linux_aarch64-20260709.tar.gz" \
          "${TOOLS}/memprocfs"
        step "binary-hayabusa" fetch_archive \
          "https://github.com/Yamato-Security/hayabusa/releases/download/v3.10.0/hayabusa-3.10.0-lin-aarch64-gnu.zip" \
          "${TOOLS}/hayabusa"
        HAYABUSA_BIN="${TOOLS}/hayabusa/hayabusa-${HAYABUSA_VERSION}-lin-aarch64-gnu"
        step "binary-trufflehog" fetch_tar \
          "https://github.com/trufflesecurity/trufflehog/releases/download/v3.95.9/trufflehog_3.95.9_linux_arm64.tar.gz" \
          "${TOOLS}/trufflehog"
        step "binary-noseyparker" fetch_tar \
          "https://github.com/praetorian-inc/noseyparker/releases/download/v0.24.0/noseyparker-v0.24.0-aarch64-unknown-linux-gnu.tar.gz" \
          "${TOOLS}/noseyparker"
        step "binary-chainsaw" fetch_tar \
          "https://github.com/WithSecureLabs/chainsaw/releases/download/v2.16.2/chainsaw_aarch64-unknown-linux-gnu.tar.gz" \
          "${TOOLS}/"
        step "binary-timeliner" fetch_tar \
          "https://github.com/0CM/BanditLab/raw/main/packages/timeliner_aarch64-20240805.tar.gz" "${TOOLS}/"
        step "binary-pup" fetch_archive \
          "https://github.com/ericchiang/pup/releases/download/v0.4.0/pup_v0.4.0_linux_arm64.zip" "${TOOLS}/pup"
        step "binary-vt" fetch_tar \
          "https://github.com/0CM/BanditLab/raw/main/packages/vt-cli_aarch64-20240720.tar.gz" "${TOOLS}/vt"
        step "binary-nuclei" fetch_archive \
          "https://github.com/projectdiscovery/nuclei/releases/download/v3.11.0/nuclei_3.11.0_linux_arm64.zip" "${TOOLS}/nuclei"
      
      elif [ "${ARCH}" = "x86_64" ]; then
        echo "[fortoolsinit] Architecture: x86_64"
      
        step "binary-eztools" fetch_tar \
          "https://github.com/0CM/BanditLab/raw/main/packages/EZTools_x86_64-20240725.tar.gz" "${TOOLS}/"
        step "binary-sidr" fetch_tar \
          "https://github.com/0CM/BanditLab/raw/main/packages/sidr_x86_64-20240725.tar.gz" "${TOOLS}/"
        step "binary-memprocfs" fetch_tar \
          "https://github.com/ufrisk/MemProcFS/releases/download/v5.17/MemProcFS_files_and_binaries_v5.17.9-linux_x64-20260709.tar.gz" \
          "${TOOLS}/memprocfs"
        step "binary-hayabusa" fetch_archive \
          "https://github.com/Yamato-Security/hayabusa/releases/download/v3.10.0/hayabusa-3.10.0-lin-x64-musl.zip" \
          "${TOOLS}/hayabusa"
        HAYABUSA_BIN="${TOOLS}/hayabusa/hayabusa-${HAYABUSA_VERSION}-lin-x64-musl"
        step "binary-trufflehog" fetch_tar \
          "https://github.com/trufflesecurity/trufflehog/releases/download/v3.95.9/trufflehog_3.95.9_linux_amd64.tar.gz" \
          "${TOOLS}/trufflehog"
        step "binary-noseyparker" fetch_tar \
          "https://github.com/praetorian-inc/noseyparker/releases/download/v0.24.0/noseyparker-v0.24.0-x86_64-unknown-linux-gnu.tar.gz" \
          "${TOOLS}/noseyparker"
        step "binary-chainsaw" fetch_tar \
          "https://github.com/WithSecureLabs/chainsaw/releases/download/v2.16.2/chainsaw_x86_64-unknown-linux-gnu.tar.gz" \
          "${TOOLS}/"
        step "binary-timeliner" fetch_tar \
          "https://github.com/0CM/BanditLab/raw/main/packages/timeliner_x86_64-20240805.tar.gz" "${TOOLS}/"
        step "binary-pup" fetch_archive \
          "https://github.com/ericchiang/pup/releases/download/v0.4.0/pup_v0.4.0_linux_amd64.zip" "${TOOLS}/pup"
        step "binary-vt" fetch_archive \
          "https://github.com/VirusTotal/vt-cli/releases/download/1.3.1/Linux64.zip" "${TOOLS}/vt"
        step "binary-nuclei" fetch_archive \
          "https://github.com/projectdiscovery/nuclei/releases/download/v3.11.0/nuclei_3.11.0_linux_amd64.zip" "${TOOLS}/nuclei"
        step "odl-download" bash -c "
          wget --no-check-certificate -q \
            https://raw.githubusercontent.com/ydkhatri/OneDrive/refs/heads/main/odl.py \
            -O '${HOME}/pyapps/bin/odl.py' && chmod 755 '${HOME}/pyapps/bin/odl.py'
        "
      
      else
        echo "[fortoolsinit] ERROR: unsupported architecture: ${ARCH}" >&2
        exit 1
      fi
      
      step "hayabusa-symlink" bash -c "
        [ -x '${HAYABUSA_BIN}' ] && chmod 755 '${HAYABUSA_BIN}' \
          && ln -sf '${HAYABUSA_BIN}' '${TOOLS}/hayabusa/hayabusa'
      "
      
      step "link-pup" bash -c "[ -f '${TOOLS}/pup/pup' ] && chmod 755 '${TOOLS}/pup/pup'"
      step "link-vt" bash -c "[ -f '${TOOLS}/vt/vt' ] && chmod 755 '${TOOLS}/vt/vt'"
      step "link-nuclei" bash -c "[ -f '${TOOLS}/nuclei/nuclei' ] && chmod 755 '${TOOLS}/nuclei/nuclei'"
      
      step "symlink-pup" link_system "${TOOLS}/pup/pup" pup
      step "symlink-vt" link_system "${TOOLS}/vt/vt" vt
      step "symlink-nuclei" link_system "${TOOLS}/nuclei/nuclei" nuclei
      step "symlink-hayabusa" link_system "${TOOLS}/hayabusa/hayabusa" hayabusa
      step "symlink-trufflehog" link_system "${TOOLS}/trufflehog/trufflehog" trufflehog
      step "symlink-noseyparker" link_system "${TOOLS}/noseyparker/bin/noseyparker" noseyparker
      step "symlink-chainsaw" link_system "${TOOLS}/chainsaw/chainsaw" chainsaw
      step "symlink-timeliner" link_system "${TOOLS}/timeliner/timeliner" timeliner
      step "symlink-sidr" link_system "${TOOLS}/sidr/sidr" sidr
      
      step "nuclei-update" bash -c "command -v nuclei >/dev/null && nuclei -update"
      
      step "recmd-batch-kroll" bash -c "
        mkdir -p '${TOOLS}/EZTools/RECmd/BatchExamples' \
        && wget --no-check-certificate -q \
          https://raw.githubusercontent.com/EricZimmerman/RECmd/refs/heads/master/BatchExamples/Kroll_Batch.reb \
          -O '${TOOLS}/EZTools/RECmd/BatchExamples/Kroll_Batch.reb'
      "
      
      step "recmd-batch-useractivity" bash -c "
        wget --no-check-certificate -q \
          https://raw.githubusercontent.com/EricZimmerman/RECmd/refs/heads/master/BatchExamples/UserActivity.reb \
          -O '${TOOLS}/EZTools/RECmd/BatchExamples/UserActivity.reb'
      "
      
      echo "[fortoolsinit] Linking EZTools into ~/bin..."
      for tool in \
        "MFTECmd:mftecmd" "AmcacheParser:amcacheparser" "bstrings:bstrings" \
        "EvtxECmd:evtxecmd" "JLECmd:jlecmd" "LECmd:lecmd" "RBCmd:rbcmd" \
        "RECmd:recmd" "SrumECmd:srumecmd" "RecentFileCacheParser:recentfilecacheparser" \
        "SQLECmd:sqlecmd" "WxTCmd:wxtcmd" "rla:rla"; do
        src_name="${tool%%:*}"
        link_name="${tool##*:}"
        step "eztool-${link_name}" link_user "${TOOLS}/EZTools/${src_name}/${src_name}" "${link_name}"
      done
      
      step "git-sigma" bash -c "
        rm -rf '${TOOLS}/chainsaw/sigma' \
        && git clone --depth 1 https://github.com/SigmaHQ/sigma '${TOOLS}/chainsaw/sigma'
      "
      
      step "git-chainsaw-rules" bash -c "
        tmpdir=\$(mktemp -d) \
        && git clone --depth 1 https://github.com/WithSecureLabs/chainsaw.git \"\${tmpdir}/chainsaw\" \
        && mv \"\${tmpdir}/chainsaw/mappings\" \"\${tmpdir}/chainsaw/rules\" '${TOOLS}/chainsaw/' \
        && rm -rf \"\${tmpdir}\"
      "
      
      step "git-lynis" git clone --depth 1 https://github.com/CISOfy/lynis "${TOOLS}/lynis"
      
      step "hayabusa-update-rules" bash -c "
        [ -x '${TOOLS}/hayabusa/hayabusa' ] && '${TOOLS}/hayabusa/hayabusa' update-rules
      "
      
      echo ""
      echo "[fortoolsinit] ========== DEPLOYMENT SUMMARY =========="
      echo "[fortoolsinit] Succeeded: ${#OK[@]} steps"
      echo "[fortoolsinit] Failed:    ${#FAILED[@]} steps"
      
      if [ "${#FAILED[@]}" -gt 0 ]; then
        echo "[fortoolsinit] Failed steps:"
        printf '  - %s\n' "${FAILED[@]}"
        echo "[fortoolsinit] Details: ${FAIL_LOG}"
      fi
      
      echo "[fortoolsinit] Deployment finished (partial success allowed)."
      echo "[fortoolsinit] Run 'banditlab-tools' to list installed tools."
      
      # Exit 0 so plaso pip install still runs in run-postdeploy.sh
      exit 0
    defer: true

runcmd:
  - update-ca-certificates
  - apt-get update
  - DEBIAN_FRONTEND=noninteractive apt-get install -y libplist-utils python3.12 python3.12-venv python3-pip ca-certificates curl wget libarchive-tools unzip git cron
  - snap install multipass-sshfs || true
  - install -d -o ubuntu -g ubuntu /home/ubuntu/bin /home/ubuntu/.lab
  - chown -R ubuntu:ubuntu /home/ubuntu
  - sudo -u ubuntu python3.12 -m venv /home/ubuntu/pyapps
  - sudo -u ubuntu python3.12 -m venv /home/ubuntu/plaso
  - sudo -u ubuntu /home/ubuntu/pyapps/bin/python3 -m pip install --upgrade pip
  - sudo -u ubuntu /home/ubuntu/plaso/bin/python3 -m pip install --upgrade pip
  - DEBIAN_FRONTEND=noninteractive apt-get install -y dotnet-runtime-6.0 || true
  - systemctl daemon-reload
  - systemctl enable banditlab-postdeploy.service
  - nohup /home/ubuntu/.lab/start-postdeploy-after-cloudinit.sh >> /var/log/banditlab-trigger.log 2>&1 &

final_message: |
  BanditLab cloud-init bootstrap complete after $UPTIME seconds.
  Tool deployment starts automatically once cloud-init finishes.
  Monitor: multipass exec banditlab -- tail -f /home/ubuntu/.lab/postdeploy.log
  Trigger log: multipass exec banditlab -- sudo tail -f /var/log/banditlab-trigger.log
  Manual start: multipass exec banditlab -- sudo systemctl start banditlab-postdeploy.service