Luckystrike

v2.0Curi0usJack (community, archived)

A PowerShell generator for malicious Excel/Word documents — macro payloads, embedded objects, template injection — used by red teams to test whether the mail gateway and endpoint controls catch a document lure. The range produces the document metadata and the telemetry, so blue teams can practice the triage.

Category: Social engineering & phishing simulation
Package: Luckystrike
Runs on: Windows
Commands: luckystrike

Generates inert document descriptions and matching telemetry. No macro, payload or file capable of executing is produced.

Install it

The scripts below install the real Curi0usJack (community, archived) package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-luckystrike.sh

No Linux build. Run this one on a Windows host in the range.

Windows installer (PowerShell)

Install-luckystrike.ps1

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

No Linux build. Run this one on a Windows host in the range.

On Windows

PowerShell Gallery

Allow signed modules for this session

Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned

Install Luckystrike

Install-Module -Name Luckystrike -Scope CurrentUser -Force

Load it
```
Import-Module Luckystrike
```

Check it worked

Confirm it resolves
```
where luckystrike
```
Check the version
```
luckystrike --version
```
The range reports 2.0.

Remove it

Take it off again
```
Uninstall-Module -Name Luckystrike
```

Inside the range

Tick it on the launch screen
Under Luckystrike's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
winget install --id Luckystrike -e
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Luckystrike

Pentest: Authorized Phishing SimulationClone the customer's SSO portal, send a hundred lures against a pre-agreed roster, watch clicks and credentials land in the C2, and file a template-plus-training finding without ever holding a real password.