Aurora-demos v2.0 — env0 emulation testbed VMs (attacker + victim OVAs)

Pre-built virtual machine images for the env0 emulation testbed used by the Aurora-demos attack-chain dataset (v2.0 release). CONTENTS - kali-attacker.ova (7.4 GB) — Kali Linux 2025.3, provisioned with Sliver C2 server, Metasploit Framework, and attack-executor 0.3.0 pre-installed under ~/Aurora-executor/.- env0-victim-windows-server-2022.ova (6.6 GB) — Windows Server 2022 Standard Evaluation, with env0-specific local accounts (Administrator, useradmin, user), OpenSSH on port 22, VirtualBox Guest Additions, Windows Defender real-time monitoring disabled. USAGE Import both OVAs into VirtualBox (or any hypervisor that reads the OVA/OVF format), attach both machines to a host-only network, then follow the "quick-start" instructions at: https://github.com/LexusWang/Aurora-demos/tree/main/environments/env0/quick-start SHA256 CHECKSUMS 08cf61bf0c8734dea22f6040687785c4789f6755c663bb501467f0023d8309b6 kali-attacker.ova 35e3bd58d58505a4de5c409438667132e6caec53789c3a5c20d2373439dbb7e2 env0-victim-windows-server-2022.ova Companion GitHub repository (chain definitions, docs, from-scratch setup scripts): https://github.com/LexusWang/Aurora-demos LEGAL - kali-attacker.ova contains Kali Linux, distributed under the Kali Linux license (GPL-derived, freely redistributable).- env0-victim-windows-server-2022.ova contains Microsoft Windows Server 2022 Standard Evaluation, distributed under Microsoft's evaluation EULA (180-day trial from first activation; re-import the OVA to reset the trial timer).- We do not modify Windows binaries. Provisioning changes are limited to account creation, Defender configuration, and Guest Additions install, all documented in the companion repository. CITATION If you use these VMs or the Aurora-demos dataset in academic work, please cite: Wang, Lingzhi et al. "From Sands to Mansions: Towards Automated Cyberattack Emulation with Classical Planning and Large Language Models." arXiv:2407.16928 (2024). Accepted to ACNS 2026.