run.ps1

#####
#
# PowerShell script per la configurazione degli strumenti di analisi e disativazione della protezione in tempo reale
#
#####

# Richiede permessi amministrativi
if (-not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))
{
    Write-Output "Esegui questo script come amministratore."
    exit
}

# Disabilita Microsoft Defender Antivirus
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender" -Name "DisableAntiSpyware" -Value 1
Write-Output "Microsoft Defender Antivirus è stato disabilitato."

# Disabilita la Protezione in Tempo Reale
$realTimeProtectionPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection"
if (!(Test-Path $realTimeProtectionPath)) {
    New-Item -Path $realTimeProtectionPath -Force | Out-Null
}

Set-ItemProperty -Path $realTimeProtectionPath -Name "DisableRealtimeMonitoring" -Value 1
Write-Output "La protezione in tempo reale è stata disabilitata."

# Riavvia il sistema per applicare completamente le modifiche
Write-Output "Per completare la disattivazione, riavvia il computer."
Restart-Computer -Force

# Installazione di Chocolatey
Set-ExecutionPolicy Bypass -Scope Process -Force
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072
iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))

choco feature enable -n allowGlobalConfirmation

cinst boxstarter

powershell -Command "Set-ExecutionPolicy RemoteSigned; iex ((New-Object System.Net.WebClient).DownloadString('https://boxstarter.org/bootstrapper.ps1')); get-boxstarter -Force"
powershell -Command "Disable-UAC"

# Lista tool
$tools = @(
    "hackfont",
    "vim",
    "firefox",
    "googlechrome",
    "wget",
    "python3",
    "7zip",
    "tor-browser",
    "wireshark",
    "git",
    "cmder",
    "ollydbg",
    "processhacker",
    "explorersuite",
    "procexp",
    "md5deep",
    "hashdeep",
    "file",
    "strings",
    "regshot",
    "sysinternal",
    "exeinfo",
    "virustotaluploader",
    "vt-cli",
    "radare2",
    "mitmproxy",
    "fiddler",
    "hxd",
    "exiftool"
)

# Installa i tool
foreach ($tool in $tools) {
    if (-not (choco list --local-only | Select-String $tool)) {
        Write-Output "Sto installando $tool..."
        choco install $tool -y
    } else {
        Write-Output "$tool è già installato."
    }
}

# Configurazioni aggiuntive
New-Item -Path "HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Force
Set-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" -Name "NoAutoUpdate" -Value 1

powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"

powershell -Command "Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False"