mirror of
https://github.com/elisspace/Wakanda-Forever.git
synced 2026-08-29 15:44:11 +00:00
Merge Dev Branch
This commit is contained in:
q0phi80
5
.gitignore
vendored
5
.gitignore
vendored
@@ -30,9 +30,10 @@ override.tf.json
|
||||
terraform/keys/*
|
||||
terraform/.terraform.lock.hcl
|
||||
terraform/.terraform/
|
||||
dsc/Lab/*
|
||||
dsc/land/*
|
||||
terraform/terraform*
|
||||
terraform/.terraform*
|
||||
|
||||
.env
|
||||
NOTES
|
||||
NOTES
|
||||
Lab
|
||||
20
README.md
20
README.md
@@ -1,7 +1,7 @@
|
||||
# Wakanda Land
|
||||
|
||||
## Purpose
|
||||
Wakanda Land is a Cyber Range deployment tool that uses ```terraform``` for automating the process of deploying an Adversarial Simulation lab infrastructure for practicing various offensive attacks. This project inherits from other people's work in the Cybersecurity Community and due credit has been provided in the Credit Section. I just added some additional sprinkles to their work from my other researches.
|
||||
Wakanda Land is a Cyber Range deployment tool that uses ```terraform``` for automating the process of deploying an Adversarial Simulation land infrastructure for practicing various offensive attacks. This project inherits from other people's work in the Cybersecurity Community and due credit has been provided in the Credit Section. I just added some additional sprinkles to their work from my other researches.
|
||||
|
||||
## Attack Techniques Covered
|
||||
- Kerberoasting
|
||||
@@ -60,12 +60,12 @@ DSC
|
||||
- Install-module -name activedirectorydsc
|
||||
- Install-module -name networkingdsc
|
||||
- Install-module -name ComputerManagementDsc
|
||||
2. Update the PowerShell script (adlab.ps1) with the following:
|
||||
2. Update the PowerShell script (adland.ps1) with the following:
|
||||
- Import-DscResource -ModuleName ActiveDirectoryDsc
|
||||
- Import-DscResource -ModuleName NetworkingDsc
|
||||
- Import-DscResource -ModuleName ComputerManagementDSC
|
||||
- Import-DscResource -ModuleName PSDesiredStateConfiguration
|
||||
3. Run the script (```. .\jungle.ps1```) from within the ```dsc``` directory to create the MOF files, which will be dumped into the ```Jungle``` folder
|
||||
3. Run the script (```. .\adland.ps1```) from within the ```dsc``` directory to create the MOF files, which will be dumped into the ```land``` folder
|
||||
|
||||
S3
|
||||
Create an S3 bucket for your account and modify the variable in terraform/vars.tf with your bucket name
|
||||
@@ -80,8 +80,8 @@ Can use this key pair to get the administrator default password from AWS
|
||||
|
||||
Once you run the terraform, it will take some time to provision everything, so give it about 30 mins to an hour and you should be good to go.
|
||||
```
|
||||
## Running the lab
|
||||
You can take the following steps in running the lab (must be ran from the terraform subfolder):
|
||||
## Running the land
|
||||
You can take the following steps in running the land (must be ran from the terraform subfolder):
|
||||
|
||||
### Initialize terraform
|
||||
```
|
||||
@@ -117,8 +117,8 @@ terraform apply --auto-approve
|
||||
- Once on Covenant C2, create a Listener and ensure the BindAddress and ConnectionAddress are set to the Kali's internal IP address
|
||||
- Create a PowerShell launcher
|
||||
- Open a new terminal window (or tab) in Kali and change directory into /toolz/impacket/examples (cd /toolz/impacket/examples)
|
||||
- Use Impacket's WMIEXEC script to obtain a shell on a victim's machine, simulating an initial foothold within the Active Directory environment (python3 wmiexec.py bast/wakandan:Password\@1@10.0.1.53)
|
||||
- Copy the PowerShell launcher from Covenant and paste it in the shell obtained on the victim's machine (e.g. 10.0.1.53)
|
||||
- Use Impacket's WMIEXEC script to obtain a shell on a victim's machine, simulating an initial foothold within the Active Directory environment (python3 wmiexec.py first/wakandan:Password\@1@10.0.1.50)
|
||||
- Copy the PowerShell launcher from Covenant and paste it in the shell obtained on the victim's machine (e.g. 10.0.1.50)
|
||||
- Confirm you have a connection (Grunt) back to your Covenant C2 framework
|
||||
- You can continue with other attack techniques via Covenant
|
||||
```
|
||||
@@ -128,9 +128,9 @@ terraform destroy --auto-approve
|
||||
```
|
||||
## Credits
|
||||
```
|
||||
- XPN: https://github.com/xpn/DemoLab
|
||||
- MDSec: https://www.mdsec.co.uk/2020/04/designing-the-adversary-simulation-lab/
|
||||
- Phil Keeble: https://github.com/PhilKeeble/AWS-RedTeam-ADLab
|
||||
- XPN: https://github.com/xpn/Demoland
|
||||
- MDSec: https://www.mdsec.co.uk/2020/04/designing-the-adversary-simulation-land/
|
||||
- Phil Keeble: https://github.com/PhilKeeble/AWS-RedTeam-ADland
|
||||
- Splunk: https://github.com/splunk/attack_range
|
||||
- oehrlis: https://github.com/oehrlis/guacamole
|
||||
- https://github.com/splunk/attack_range/wiki/Upload-Windows-10-AMI-to-AWS
|
||||
|
||||
BIN
dsc/Jungle/Bast.mof
Normal file
BIN
dsc/Jungle/Bast.mof
Normal file
Binary file not shown.
BIN
dsc/Jungle/Nakia.mof
Normal file
BIN
dsc/Jungle/Nakia.mof
Normal file
Binary file not shown.
BIN
dsc/Jungle/Ramonda.mof
Normal file
BIN
dsc/Jungle/Ramonda.mof
Normal file
Binary file not shown.
BIN
dsc/Jungle/Wakanda.mof
Normal file
BIN
dsc/Jungle/Wakanda.mof
Normal file
Binary file not shown.
1020
dsc/Jungle/jungle.ps1
Normal file
1020
dsc/Jungle/jungle.ps1
Normal file
File diff suppressed because it is too large
Load Diff
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
281
dsc/adlab.ps1
281
dsc/adlab.ps1
@@ -1,4 +1,4 @@
|
||||
configuration Lab {
|
||||
configuration land {
|
||||
|
||||
param
|
||||
(
|
||||
@@ -18,11 +18,12 @@ configuration Lab {
|
||||
Import-DscResource -ModuleName NetworkingDsc
|
||||
Import-DscResource -ModuleName ComputerManagementDSC
|
||||
Import-DscResource -ModuleName PSDesiredStateConfiguration
|
||||
Import-DscResource -Module nx
|
||||
|
||||
Node "First" {
|
||||
|
||||
Computer NewName {
|
||||
Name = "First-DC"
|
||||
Name = "baku-dc"
|
||||
}
|
||||
|
||||
WindowsFeature ADDSInstall {
|
||||
@@ -113,22 +114,22 @@ configuration Lab {
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
}
|
||||
|
||||
ADUser 'regular.user'
|
||||
ADUser 'wakandan'
|
||||
{
|
||||
Ensure = 'Present'
|
||||
UserName = 'regular.user'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("regular.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'first.local'
|
||||
UserName = 'wakandan'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("wakandan", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'bast.land'
|
||||
Path = 'CN=Users,DC=first,DC=local'
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
}
|
||||
|
||||
ADUser 'dnsadmin.user'
|
||||
ADUser 'Thoth'
|
||||
{
|
||||
Ensure = 'Present'
|
||||
UserName = 'dnsadmin.user'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("dnsadmin.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'first.local'
|
||||
UserName = 'Thoth'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("Thoth", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'bast.land'
|
||||
Path = 'CN=Users,DC=first,DC=local'
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
}
|
||||
@@ -136,57 +137,57 @@ configuration Lab {
|
||||
ADGroup DnsAdmin {
|
||||
Ensure = "Present"
|
||||
GroupName = "DnsAdmins"
|
||||
MembersToInclude = "dnsadmin.user"
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]dnsadmin.user"
|
||||
MembersToInclude = "Thoth"
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]Thoth"
|
||||
}
|
||||
|
||||
ADUser 'unconstrained.user'
|
||||
ADUser 'Kokou'
|
||||
{
|
||||
Ensure = 'Present'
|
||||
UserName = 'unconstrained.user'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("unconstrained.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'first.local'
|
||||
UserName = 'Kokou'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("Kokou", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'bast.land'
|
||||
Path = 'CN=Users,DC=first,DC=local'
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
}
|
||||
|
||||
Script "unconstrained.user Unconstrained Delegation Set"
|
||||
Script "Kokou Unconstrained Delegation Set"
|
||||
{
|
||||
SetScript = {
|
||||
Set-ADAccountControl -Identity "unconstrained.user" -TrustedForDelegation $True
|
||||
Set-ADAccountControl -Identity "Kokou" -TrustedForDelegation $True
|
||||
}
|
||||
TestScript = {
|
||||
$false
|
||||
}
|
||||
GetScript = {
|
||||
@{ Result = (Get-ADUser "unconstrained.user" ) }
|
||||
@{ Result = (Get-ADUser "Kokou" ) }
|
||||
}
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]unconstrained.user"
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]Kokou"
|
||||
}
|
||||
|
||||
ADUser 'constrained.user'
|
||||
ADUser 'Mujaji'
|
||||
{
|
||||
Ensure = 'Present'
|
||||
UserName = 'constrained.user'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("constrained.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'first.local'
|
||||
UserName = 'Mujaji'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("Mujaji", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'bast.land'
|
||||
Path = 'CN=Users,DC=first,DC=local'
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
}
|
||||
|
||||
Script "constrained.user constrained Delegation Set"
|
||||
Script "Mujaji constrained Delegation Set"
|
||||
{
|
||||
SetScript = {
|
||||
$user = (Get-ADUser -Identity "constrained.user").DistinguishedName
|
||||
Set-ADObject -Identity $user -Add @{"msDS-AllowedToDelegateTo" = @("CIFS/First-DC","CIFS/First-DC.First.local","CIFS/First-DC.first.local/first.local")}
|
||||
$user = (Get-ADUser -Identity "Mujaji").DistinguishedName
|
||||
Set-ADObject -Identity $user -Add @{"msDS-AllowedToDelegateTo" = @("CIFS/baku-dc","CIFS/baku-dc.bast.land","CIFS/baku-dc.bast.land/bast.land")}
|
||||
}
|
||||
TestScript = {
|
||||
$false
|
||||
}
|
||||
GetScript = {
|
||||
@{ Result = (Get-ADUser "constrained.user" ) }
|
||||
@{ Result = (Get-ADUser "Mujaji" ) }
|
||||
}
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]constrained.user"
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]Mujaji"
|
||||
}
|
||||
|
||||
ADComputer "Constrained.Computer"
|
||||
@@ -201,7 +202,7 @@ configuration Lab {
|
||||
{
|
||||
SetScript = {
|
||||
$comp = (Get-ADComputer -Identity "Suspicious-PC").DistinguishedName
|
||||
Set-ADObject -Identity $comp -Add @{"msDS-AllowedToDelegateTo" = @("HTTP/First-DC","HTTP/First-DC.First.local","HTTP/First-DC.first.local/first.local")}
|
||||
Set-ADObject -Identity $comp -Add @{"msDS-AllowedToDelegateTo" = @("HTTP/baku-dc","HTTP/baku-dc.bast.land","HTTP/baku-dc.bast.land/bast.land")}
|
||||
}
|
||||
TestScript = {
|
||||
$false
|
||||
@@ -212,21 +213,21 @@ configuration Lab {
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
}
|
||||
|
||||
ADUser 'userwrite.user'
|
||||
ADUser 'Sobek'
|
||||
{
|
||||
Ensure = 'Present'
|
||||
UserName = 'userwrite.user'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("userwrite.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'first.local'
|
||||
UserName = 'Sobek'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("Sobek", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'bast.land'
|
||||
Path = 'CN=Users,DC=first,DC=local'
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
}
|
||||
|
||||
Script "userwrite.user Write Permissions on User Node"
|
||||
Script "Sobek Write Permissions on User Node"
|
||||
{
|
||||
SetScript = {
|
||||
$Destination = (Get-ADUser -Identity "constrained.user").DistinguishedName
|
||||
$Source = (Get-ADUser -Identity "userwrite.user").sid
|
||||
$Destination = (Get-ADUser -Identity "Mujaji").DistinguishedName
|
||||
$Source = (Get-ADUser -Identity "Sobek").sid
|
||||
$Rights = "GenericWrite"
|
||||
$ADObject = [ADSI]("LDAP://" + $Destination)
|
||||
$identity = $Source
|
||||
@@ -241,26 +242,26 @@ configuration Lab {
|
||||
$false
|
||||
}
|
||||
GetScript = {
|
||||
@{ Result = (Get-ADUser "userwrite.user" ) }
|
||||
@{ Result = (Get-ADUser "Sobek" ) }
|
||||
}
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]userwrite.user"
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]Sobek"
|
||||
}
|
||||
|
||||
ADUser 'userall.user'
|
||||
ADUser 'Ghekre'
|
||||
{
|
||||
Ensure = 'Present'
|
||||
UserName = 'userall.user'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("userall.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'first.local'
|
||||
UserName = 'Ghekre'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("Ghekre", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'bast.land'
|
||||
Path = 'CN=Users,DC=first,DC=local'
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
}
|
||||
|
||||
Script "userall.user GenericAll Permissions on User Node"
|
||||
Script "Ghekre GenericAll Permissions on User Node"
|
||||
{
|
||||
SetScript = {
|
||||
$Destination = (Get-ADUser -Identity "userwrite.user").DistinguishedName
|
||||
$Source = (Get-ADUser -Identity "userall.user").sid
|
||||
$Destination = (Get-ADUser -Identity "Sobek").DistinguishedName
|
||||
$Source = (Get-ADUser -Identity "Ghekre").sid
|
||||
$Rights = "GenericAll"
|
||||
$ADObject = [ADSI]("LDAP://" + $Destination)
|
||||
$identity = $Source
|
||||
@@ -275,26 +276,26 @@ configuration Lab {
|
||||
$false
|
||||
}
|
||||
GetScript = {
|
||||
@{ Result = (Get-ADUser "userall.user" ) }
|
||||
@{ Result = (Get-ADUser "Ghekre" ) }
|
||||
}
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]userall.user"
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]Ghekre"
|
||||
}
|
||||
|
||||
ADUser 'compwrite.user'
|
||||
ADUser 'Ngi'
|
||||
{
|
||||
Ensure = 'Present'
|
||||
UserName = 'compwrite.user'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("compwrite.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'first.local'
|
||||
UserName = 'Ngi'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("Ngi", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'bast.land'
|
||||
Path = 'CN=Users,DC=first,DC=local'
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
}
|
||||
|
||||
Script "compwrite.user Write Permissions on Comp Node"
|
||||
Script "Ngi Write Permissions on Comp Node"
|
||||
{
|
||||
SetScript = {
|
||||
$Destination = (Get-ADComputer -Identity "First-DC").DistinguishedName
|
||||
$Source = (Get-ADUser -Identity "compwrite.user").sid
|
||||
$Destination = (Get-ADComputer -Identity "baku-dc").DistinguishedName
|
||||
$Source = (Get-ADUser -Identity "Ngi").sid
|
||||
$Rights = "GenericWrite"
|
||||
$ADObject = [ADSI]("LDAP://" + $Destination)
|
||||
$identity = $Source
|
||||
@@ -309,61 +310,61 @@ configuration Lab {
|
||||
$false
|
||||
}
|
||||
GetScript = {
|
||||
@{ Result = (Get-ADUser "compwrite.user" ) }
|
||||
@{ Result = (Get-ADUser "Ngi" ) }
|
||||
}
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]compwrite.user"
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]Ngi"
|
||||
}
|
||||
|
||||
ADUser "gpowrite.user"
|
||||
ADUser "Hadari-Yao"
|
||||
{
|
||||
Ensure = 'Present'
|
||||
UserName = 'gpowrite.user'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("gpowrite.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'first.local'
|
||||
UserName = 'Hadari-Yao'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("Hadari-Yao", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'bast.land'
|
||||
Path = 'CN=Users,DC=first,DC=local'
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
}
|
||||
|
||||
Script "gpowrite.user Write Permissions on GPO"
|
||||
Script "Hadari-Yao Write Permissions on GPO"
|
||||
{
|
||||
SetScript = {
|
||||
Set-GPPermission -Name "Default Domain Controllers Policy" -TargetName "gpowrite.user" -TargetType "User" -PermissionLevel "GpoEdit"
|
||||
Set-GPPermission -Name "Default Domain Controllers Policy" -TargetName "Hadari-Yao" -TargetType "User" -PermissionLevel "GpoEdit"
|
||||
}
|
||||
TestScript = {
|
||||
$false
|
||||
}
|
||||
GetScript = {
|
||||
@{ Result = (Get-ADUser "gpowrite.user" ) }
|
||||
@{ Result = (Get-ADUser "Hadari-Yao" ) }
|
||||
}
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]gpowrite.user"
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]Hadari-Yao"
|
||||
}
|
||||
|
||||
ADUser 'lapsread.user'
|
||||
ADUser 'Yaounde'
|
||||
{
|
||||
Ensure = 'Present'
|
||||
UserName = 'lapsread.user'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("lapsread.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'first.local'
|
||||
UserName = 'Yaounde'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("Yaounde", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'bast.land'
|
||||
Path = 'CN=Users,DC=first,DC=local'
|
||||
Description = 'LAPS yet to be implemented'
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
}
|
||||
|
||||
ADUser 'groupwrite.user'
|
||||
ADUser 'Baoule'
|
||||
{
|
||||
Ensure = 'Present'
|
||||
UserName = 'groupwrite.user'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("groupwrite.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'first.local'
|
||||
UserName = 'Baoule'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("Baoule", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'bast.land'
|
||||
Path = 'CN=Users,DC=first,DC=local'
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
}
|
||||
|
||||
Script "groupwrite.user Write Permissions on Group"
|
||||
Script "Baoule Write Permissions on Group"
|
||||
{
|
||||
SetScript = {
|
||||
$Destination = (Get-ADGroup -Identity "Domain Admins").DistinguishedName
|
||||
$Source = (Get-ADUser -Identity "groupwrite.user").sid
|
||||
$Source = (Get-ADUser -Identity "Baoule").sid
|
||||
$Rights = "GenericAll"
|
||||
$ADObject = [ADSI]("LDAP://" + $Destination)
|
||||
$identity = $Source
|
||||
@@ -378,26 +379,26 @@ configuration Lab {
|
||||
$false
|
||||
}
|
||||
GetScript = {
|
||||
@{ Result = (Get-ADUser "groupwrite.user" ) }
|
||||
@{ Result = (Get-ADUser "Baoule" ) }
|
||||
}
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]groupwrite.user"
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]Baoule"
|
||||
}
|
||||
|
||||
ADUser 'writedacldc.user'
|
||||
ADUser 'Hanuman'
|
||||
{
|
||||
Ensure = 'Present'
|
||||
UserName = 'writedacldc.user'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("writedacldc.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'first.local'
|
||||
UserName = 'Hanuman'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("Hanuman", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'bast.land'
|
||||
Path = 'CN=Users,DC=first,DC=local'
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
}
|
||||
|
||||
Script "writedacldc.user WriteDACL Permissions on DC"
|
||||
Script "Hanuman WriteDACL Permissions on DC"
|
||||
{
|
||||
SetScript = {
|
||||
$Destination = (Get-ADComputer -Identity "First-DC").DistinguishedName
|
||||
$Source = (Get-ADUser -Identity "writedacldc.user").sid
|
||||
$Destination = (Get-ADComputer -Identity "baku-dc").DistinguishedName
|
||||
$Source = (Get-ADUser -Identity "Hanuman").sid
|
||||
$Rights = "WriteDACL"
|
||||
$ADObject = [ADSI]("LDAP://" + $Destination)
|
||||
$identity = $Source
|
||||
@@ -412,123 +413,123 @@ configuration Lab {
|
||||
$false
|
||||
}
|
||||
GetScript = {
|
||||
@{ Result = (Get-ADUser "writedacldc.user" ) }
|
||||
@{ Result = (Get-ADUser "Hanuman" ) }
|
||||
}
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]writedacldc.user"
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]Hanuman"
|
||||
}
|
||||
|
||||
ADUser 'readgmsa.user'
|
||||
ADUser 'Akamba'
|
||||
{
|
||||
Ensure = 'Present'
|
||||
UserName = 'readgmsa.user'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("readgmsa.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'first.local'
|
||||
UserName = 'Akamba'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("Akamba", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'bast.land'
|
||||
Path = 'CN=Users,DC=first,DC=local'
|
||||
Description = 'GMSA yet to be implemented'
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
}
|
||||
|
||||
ADUser 'clearpass.user'
|
||||
ADUser 'Mmusa'
|
||||
{
|
||||
Ensure = 'Present'
|
||||
UserName = 'clearpass.user'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("clearpass.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'first.local'
|
||||
UserName = 'Mmusa'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("Mmusa", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'bast.land'
|
||||
Path = 'CN=Users,DC=first,DC=local'
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
}
|
||||
|
||||
Script "clearpass.user Password in AD"
|
||||
Script "Mmusa Password in AD"
|
||||
{
|
||||
SetScript = {
|
||||
Set-ADUser -Identity "clearpass.user" -Description "Remember to remove this! Password@1"
|
||||
Set-ADUser -Identity "Mmusa" -Description "Remember to remove this! Password@1"
|
||||
}
|
||||
TestScript = {
|
||||
$false
|
||||
}
|
||||
GetScript = {
|
||||
@{ Result = (Get-ADUser "clearpass.user" ) }
|
||||
@{ Result = (Get-ADUser "Mmusa" ) }
|
||||
}
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]clearpass.user"
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]Mmusa"
|
||||
}
|
||||
|
||||
ADUser 'roast.user'
|
||||
ADUser 'Plumumba'
|
||||
{
|
||||
Ensure = 'Present'
|
||||
UserName = 'roast.user'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("roast.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'first.local'
|
||||
UserName = 'Plumumba'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("Plumumba", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'bast.land'
|
||||
Path = 'CN=Users,DC=first,DC=local'
|
||||
ServicePrincipalNames = "MSSQL/sql.first.local"
|
||||
ServicePrincipalNames = "MSSQL/sql.bast.land"
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
}
|
||||
|
||||
ADUser asrep
|
||||
{
|
||||
Ensure = 'Present'
|
||||
UserName = 'asrep.user'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("asrep.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'first.local'
|
||||
UserName = 'Knkrumah'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("Knkrumah", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'bast.land'
|
||||
Path = 'CN=Users,DC=first,DC=local'
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
}
|
||||
|
||||
Script "asrep.user PreAuth Disable"
|
||||
Script "Knkrumah PreAuth Disable"
|
||||
{
|
||||
SetScript = {
|
||||
Set-ADAccountControl -Identity "asrep.user" -DoesNotRequirePreAuth $true
|
||||
Set-ADAccountControl -Identity "Knkrumah" -DoesNotRequirePreAuth $true
|
||||
}
|
||||
TestScript = {
|
||||
$false
|
||||
}
|
||||
GetScript = {
|
||||
@{ Result = (Get-ADUser "asrep.user" ) }
|
||||
@{ Result = (Get-ADUser "Knkrumah" ) }
|
||||
}
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]asrep"
|
||||
}
|
||||
|
||||
Script "User-Server-RDP"
|
||||
Script "nakia-RDP"
|
||||
{
|
||||
SetScript = {
|
||||
Start-Sleep -Seconds 300
|
||||
Invoke-Command -ComputerName "User-Server" -Scriptblock {net localgroup "Remote Desktop Users" "first\domain users" /add}
|
||||
Invoke-Command -ComputerName "nakia" -Scriptblock {net localgroup "Remote Desktop Users" "first\domain users" /add}
|
||||
}
|
||||
TestScript = {
|
||||
$false
|
||||
}
|
||||
GetScript = {
|
||||
@{ Result = (Get-ADComputer "User-Server" ) }
|
||||
@{ Result = (Get-ADComputer "nakia" ) }
|
||||
}
|
||||
PsDscRunAsCredential = $firstDomainCred
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
}
|
||||
|
||||
Script "User-Workstation-RDP" {
|
||||
Script "ramonda-RDP" {
|
||||
SetScript = {
|
||||
Start-Sleep -Seconds 300
|
||||
Invoke-Command -ComputerName "User-Workstation" -Scriptblock { net localgroup "Remote Desktop Users" "first\domain users" /add }
|
||||
Invoke-Command -ComputerName "ramonda" -Scriptblock { net localgroup "Remote Desktop Users" "first\domain users" /add }
|
||||
}
|
||||
TestScript = {
|
||||
$false
|
||||
}
|
||||
GetScript = {
|
||||
@{ Result = (Get-ADComputer "User-Workstation" ) }
|
||||
@{ Result = (Get-ADComputer "ramonda" ) }
|
||||
}
|
||||
PsDscRunAsCredential = $firstDomainCred
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
}
|
||||
|
||||
Script "User-Server constrained Delegation Set"
|
||||
Script "nakia constrained Delegation Set"
|
||||
{
|
||||
SetScript = {
|
||||
$comp = (Get-ADComputer -Identity "User-Server").DistinguishedName
|
||||
Set-ADObject -Identity $comp -Add @{"msDS-AllowedToDelegateTo" = @("HOST/First-DC","HOST/First-DC.First.local","HOST/First-DC.first.local/first.local")}
|
||||
$comp = (Get-ADComputer -Identity "nakia").DistinguishedName
|
||||
Set-ADObject -Identity $comp -Add @{"msDS-AllowedToDelegateTo" = @("HOST/baku-dc","HOST/baku-dc.bast.land","HOST/baku-dc.bast.land/bast.land")}
|
||||
}
|
||||
TestScript = {
|
||||
$false
|
||||
}
|
||||
GetScript = {
|
||||
@{ Result = (Get-ADComputer "User-Server" ) }
|
||||
@{ Result = (Get-ADComputer "nakia" ) }
|
||||
}
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
}
|
||||
@@ -573,7 +574,7 @@ configuration Lab {
|
||||
WaitForAll DC
|
||||
{
|
||||
ResourceName = '[ADUser]asrep'
|
||||
NodeName = 'First-DC'
|
||||
NodeName = 'baku-dc'
|
||||
RetryIntervalSec = 60
|
||||
RetryCount = 15
|
||||
}
|
||||
@@ -670,7 +671,7 @@ configuration Lab {
|
||||
}
|
||||
|
||||
Computer JoinDomain {
|
||||
Name = "User-Server"
|
||||
Name = "nakia"
|
||||
DomainName = $firstDomainName
|
||||
Credential = $firstDomainCred
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
@@ -682,7 +683,7 @@ configuration Lab {
|
||||
WaitForAll DC
|
||||
{
|
||||
ResourceName = '[ADUser]asrep'
|
||||
NodeName = 'First-DC'
|
||||
NodeName = 'baku-dc'
|
||||
RetryIntervalSec = 60
|
||||
RetryCount = 15
|
||||
}
|
||||
@@ -793,7 +794,7 @@ configuration Lab {
|
||||
}
|
||||
|
||||
Computer JoinDomain {
|
||||
Name = "User-Workstation"
|
||||
Name = "ramonda"
|
||||
DomainName = $firstDomainName
|
||||
Credential = $firstDomainCred
|
||||
DependsOn = "[WaitForADDomain]waitFirstDomain"
|
||||
@@ -803,7 +804,7 @@ configuration Lab {
|
||||
Node "Second" {
|
||||
|
||||
Computer NewName {
|
||||
Name = "Second-DC"
|
||||
Name = "challa-dc"
|
||||
}
|
||||
|
||||
WindowsFeature ADDSInstall {
|
||||
@@ -892,33 +893,33 @@ configuration Lab {
|
||||
DependsOn = "[WaitForADDomain]waitSecondDomain"
|
||||
}
|
||||
|
||||
ADUser 'regular.user'
|
||||
ADUser 'wakandan'
|
||||
{
|
||||
Ensure = 'Present'
|
||||
UserName = 'regular.user'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("regular.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'second.local'
|
||||
UserName = 'wakandan'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("wakandan", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'wakanda.land'
|
||||
Path = 'CN=Users,DC=second,DC=local'
|
||||
DependsOn = "[WaitForADDomain]waitSecondDomain"
|
||||
}
|
||||
|
||||
ADUser 'roast.user'
|
||||
ADUser 'Plumumba'
|
||||
{
|
||||
Ensure = 'Present'
|
||||
UserName = 'roast.user'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("roast.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'second.local'
|
||||
UserName = 'Plumumba'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("Plumumba", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'wakanda.land'
|
||||
Path = 'CN=Users,DC=second,DC=local'
|
||||
ServicePrincipalNames = "MSSQL/sql.second.local"
|
||||
ServicePrincipalNames = "MSSQL/sql.wakanda.land"
|
||||
DependsOn = "[WaitForADDomain]waitSecondDomain"
|
||||
}
|
||||
|
||||
ADUser 'asrep.user'
|
||||
ADUser 'Knkrumah'
|
||||
{
|
||||
Ensure = 'Present'
|
||||
UserName = 'asrep.user'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("asrep.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'second.local'
|
||||
UserName = 'Knkrumah'
|
||||
Password = (New-Object System.Management.Automation.PSCredential("Knkrumah", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
DomainName = 'wakanda.land'
|
||||
Path = 'CN=Users,DC=second,DC=local'
|
||||
DependsOn = "[WaitForADDomain]waitSecondDomain"
|
||||
}
|
||||
@@ -1012,9 +1013,9 @@ $ConfigData = @{
|
||||
)
|
||||
}
|
||||
|
||||
Lab -ConfigurationData $ConfigData `
|
||||
-firstDomainName "first.local" `
|
||||
-secondDomainName "second.local" `
|
||||
land -ConfigurationData $ConfigData `
|
||||
-firstDomainName "bast.land" `
|
||||
-secondDomainName "wakanda.land" `
|
||||
-domainCred (New-Object System.Management.Automation.PSCredential("admin", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force))) `
|
||||
-safemodeAdministratorCred (New-Object System.Management.Automation.PSCredential("admin", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force))) `
|
||||
-firstDomainCred (New-Object System.Management.Automation.PSCredential("first-admin", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
|
||||
|
||||
419
terraform/aws.tf
419
terraform/aws.tf
@@ -5,134 +5,134 @@ provider "aws" {
|
||||
region = "us-east-1"
|
||||
}
|
||||
|
||||
# Our AWS keypair
|
||||
# AWS keypair
|
||||
resource "aws_key_pair" "terraformkey" {
|
||||
key_name = "${terraform.workspace}-terraform-lab"
|
||||
key_name = "${terraform.workspace}-wakanda-land"
|
||||
public_key = file(var.PATH_TO_PUBLIC_KEY)
|
||||
}
|
||||
|
||||
# Our VPC definition, using a default IP range of 10.0.0.0/16
|
||||
resource "aws_vpc" "lab-vpc" {
|
||||
# VPC definition, using a default IP range of 10.0.0.0/16
|
||||
resource "aws_vpc" "land-vpc" {
|
||||
cidr_block = var.VPC_CIDR
|
||||
enable_dns_support = true
|
||||
enable_dns_hostnames = true
|
||||
}
|
||||
|
||||
# Default route required for the VPC to push traffic via gateway
|
||||
resource "aws_route" "first-internet-route" {
|
||||
route_table_id = aws_vpc.lab-vpc.main_route_table_id
|
||||
resource "aws_route" "bast-internet-route" {
|
||||
route_table_id = aws_vpc.land-vpc.main_route_table_id
|
||||
destination_cidr_block = "0.0.0.0/0"
|
||||
gateway_id = aws_internet_gateway.lab-vpc-gateway.id
|
||||
gateway_id = aws_internet_gateway.land-vpc-gateway.id
|
||||
}
|
||||
|
||||
# Gateway which allows outbound and inbound internet access to the VPC
|
||||
resource "aws_internet_gateway" "lab-vpc-gateway" {
|
||||
vpc_id = aws_vpc.lab-vpc.id
|
||||
resource "aws_internet_gateway" "land-vpc-gateway" {
|
||||
vpc_id = aws_vpc.land-vpc.id
|
||||
}
|
||||
|
||||
# Create our first subnet (Defaults to 10.0.1.0/24)
|
||||
resource "aws_subnet" "first-vpc-subnet" {
|
||||
vpc_id = aws_vpc.lab-vpc.id
|
||||
resource "aws_subnet" "bast-vpc-subnet" {
|
||||
vpc_id = aws_vpc.land-vpc.id
|
||||
|
||||
cidr_block = var.FIRST_SUBNET_CIDR
|
||||
cidr_block = var.BAST_SUBNET_CIDR
|
||||
availability_zone = "us-east-1a"
|
||||
|
||||
tags = {
|
||||
Name = "First Subnet"
|
||||
Name = "Bast Subnet"
|
||||
}
|
||||
}
|
||||
|
||||
# Create our second subnet (Defaults to 10.0.2.0/24)
|
||||
resource "aws_subnet" "second-vpc-subnet" {
|
||||
vpc_id = aws_vpc.lab-vpc.id
|
||||
resource "aws_subnet" "wakanda-vpc-subnet" {
|
||||
vpc_id = aws_vpc.land-vpc.id
|
||||
|
||||
cidr_block = var.SECOND_SUBNET_CIDR
|
||||
cidr_block = var.WAKANDA_SUBNET_CIDR
|
||||
availability_zone = "us-east-1a"
|
||||
|
||||
tags = {
|
||||
Name = "Second Subnet"
|
||||
Name = "Wakanda Subnet"
|
||||
}
|
||||
}
|
||||
|
||||
# Set DHCP options for delivering things such as DNS servers
|
||||
resource "aws_vpc_dhcp_options" "first-dhcp" {
|
||||
domain_name = "first.local"
|
||||
domain_name_servers = [var.FIRST_DC_IP, var.PUBLIC_DNS]
|
||||
ntp_servers = [var.FIRST_DC_IP]
|
||||
netbios_name_servers = [var.FIRST_DC_IP]
|
||||
resource "aws_vpc_dhcp_options" "bast-dhcp" {
|
||||
domain_name = "bast.land"
|
||||
domain_name_servers = [var.BAKU_DC_IP, var.PUBLIC_DNS]
|
||||
ntp_servers = [var.BAKU_DC_IP]
|
||||
netbios_name_servers = [var.BAKU_DC_IP]
|
||||
netbios_node_type = 2
|
||||
|
||||
tags = {
|
||||
Name = "First DHCP"
|
||||
Name = "Bast DHCP"
|
||||
}
|
||||
}
|
||||
|
||||
# Associate our DHCP configuration with our VPC
|
||||
resource "aws_vpc_dhcp_options_association" "first-dhcp-assoc" {
|
||||
vpc_id = aws_vpc.lab-vpc.id
|
||||
dhcp_options_id = aws_vpc_dhcp_options.first-dhcp.id
|
||||
resource "aws_vpc_dhcp_options_association" "bast-dhcp-assoc" {
|
||||
vpc_id = aws_vpc.land-vpc.id
|
||||
dhcp_options_id = aws_vpc_dhcp_options.bast-dhcp.id
|
||||
}
|
||||
|
||||
# Our first Domain Controller of the "first.local" domain
|
||||
resource "aws_instance" "first-dc" {
|
||||
# Domain Controller of the "bast.land" domain
|
||||
resource "aws_instance" "baku-dc" {
|
||||
ami = data.aws_ami.latest-windows-server.image_id
|
||||
instance_type = "t2.small"
|
||||
key_name = aws_key_pair.terraformkey.key_name
|
||||
associate_public_ip_address = true
|
||||
subnet_id = aws_subnet.first-vpc-subnet.id
|
||||
private_ip = var.FIRST_DC_IP
|
||||
subnet_id = aws_subnet.bast-vpc-subnet.id
|
||||
private_ip = var.BAKU_DC_IP
|
||||
iam_instance_profile = aws_iam_instance_profile.ssm_instance_profile.name
|
||||
|
||||
tags = {
|
||||
Workspace = "${terraform.workspace}"
|
||||
Name = "${terraform.workspace}-First-DC"
|
||||
Name = "${terraform.workspace}-baku-dc"
|
||||
}
|
||||
|
||||
vpc_security_group_ids = [
|
||||
aws_security_group.first-sg.id,
|
||||
aws_security_group.bast-sg.id,
|
||||
]
|
||||
}
|
||||
|
||||
# Windows Server in the first domain
|
||||
resource "aws_instance" "user-server" {
|
||||
# Windows Server in the bast domain
|
||||
resource "aws_instance" "nakia" {
|
||||
ami = data.aws_ami.latest-windows-server.image_id
|
||||
instance_type = "t2.small"
|
||||
key_name = aws_key_pair.terraformkey.key_name
|
||||
associate_public_ip_address = true
|
||||
subnet_id = aws_subnet.first-vpc-subnet.id
|
||||
private_ip = var.USER_SERVER_IP
|
||||
subnet_id = aws_subnet.bast-vpc-subnet.id
|
||||
private_ip = var.NAKIA_IP
|
||||
iam_instance_profile = aws_iam_instance_profile.ssm_instance_profile.name
|
||||
|
||||
tags = {
|
||||
Workspace = "${terraform.workspace}"
|
||||
Name = "${terraform.workspace}-User-Server"
|
||||
Name = "${terraform.workspace}-nakia"
|
||||
}
|
||||
|
||||
vpc_security_group_ids = [
|
||||
aws_security_group.first-sg.id,
|
||||
aws_security_group.bast-sg.id,
|
||||
]
|
||||
}
|
||||
|
||||
# A Windows 10 Pro development host providing RDP access for crafting and testing payloads
|
||||
resource "aws_instance" "user-workstation" {
|
||||
resource "aws_instance" "ramonda" {
|
||||
ami = data.aws_ami.windows-client.image_id
|
||||
instance_type = "t2.medium"
|
||||
key_name = aws_key_pair.terraformkey.key_name
|
||||
associate_public_ip_address = true
|
||||
subnet_id = aws_subnet.first-vpc-subnet.id
|
||||
private_ip = var.USER_WORKSTATION_IP
|
||||
depends_on = [aws_instance.first-dc]
|
||||
subnet_id = aws_subnet.bast-vpc-subnet.id
|
||||
private_ip = var.RAMONDA_IP
|
||||
depends_on = [aws_instance.baku-dc]
|
||||
iam_instance_profile = aws_iam_instance_profile.ssm_instance_profile.name
|
||||
tags = {
|
||||
Workspace = "${terraform.workspace}"
|
||||
Name = "${terraform.workspace}-User-Workstation"
|
||||
Name = "${terraform.workspace}-ramonda"
|
||||
}
|
||||
|
||||
vpc_security_group_ids = [
|
||||
aws_security_group.first-sg.id,
|
||||
aws_security_group.bast-sg.id,
|
||||
]
|
||||
|
||||
# Connect to the Win 10 with the Local Admin account and then activate the default Administrator account
|
||||
# Connect to the Win 10 with the Local Admin account and then activate the default Administrator account
|
||||
provisioner "remote-exec" {
|
||||
inline = [
|
||||
"net user Administrator /active:yes",
|
||||
@@ -143,7 +143,7 @@ resource "aws_instance" "user-workstation" {
|
||||
type = "winrm"
|
||||
user = "admin"
|
||||
password = var.WinRM_PASSWORD
|
||||
host = aws_instance.user-workstation.public_ip
|
||||
host = aws_instance.ramonda.public_ip
|
||||
port = 5985
|
||||
insecure = true
|
||||
https = false
|
||||
@@ -151,7 +151,7 @@ resource "aws_instance" "user-workstation" {
|
||||
}
|
||||
}
|
||||
|
||||
# Push some PowerShell scripts from our local box unto the remote Win 10 box
|
||||
# Push some PowerShell scripts from our local box unto the remote Win 10 box
|
||||
provisioner "file" {
|
||||
source = "./scripts/rt-toolz.ps1"
|
||||
destination = "C:/Windows/Temp/rt-toolz.ps1"
|
||||
@@ -160,7 +160,7 @@ resource "aws_instance" "user-workstation" {
|
||||
type = "winrm"
|
||||
user = "Administrator"
|
||||
password = var.WinRM_PASSWORD
|
||||
host = aws_instance.user-workstation.public_ip
|
||||
host = aws_instance.ramonda.public_ip
|
||||
port = 5985
|
||||
insecure = true
|
||||
https = false
|
||||
@@ -176,7 +176,7 @@ resource "aws_instance" "user-workstation" {
|
||||
type = "winrm"
|
||||
user = "Administrator"
|
||||
password = var.WinRM_PASSWORD
|
||||
host = aws_instance.user-workstation.public_ip
|
||||
host = aws_instance.ramonda.public_ip
|
||||
port = 5985
|
||||
insecure = true
|
||||
https = false
|
||||
@@ -184,17 +184,17 @@ resource "aws_instance" "user-workstation" {
|
||||
}
|
||||
}
|
||||
|
||||
# Run the PowerShell scripts on the Remote Win 10 box to install tools and also join the Win 10 box to the domain
|
||||
# Run the PowerShell scripts on the Remote Win 10 box to install tools
|
||||
provisioner "remote-exec" {
|
||||
inline = [
|
||||
"powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/rt-toolz.ps1", "powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/join-domain.ps1"
|
||||
"powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/rt-toolz.ps1"
|
||||
]
|
||||
|
||||
connection {
|
||||
type = "winrm"
|
||||
user = "Administrator"
|
||||
password = var.WinRM_PASSWORD
|
||||
host = aws_instance.user-workstation.public_ip
|
||||
host = aws_instance.ramonda.public_ip
|
||||
port = 5985
|
||||
insecure = true
|
||||
https = false
|
||||
@@ -202,7 +202,25 @@ resource "aws_instance" "user-workstation" {
|
||||
}
|
||||
}
|
||||
|
||||
# Once the Win 10 box is joined to the domain, it will need to be restarted. Using this as a backup to make sure the box actually do reboot
|
||||
# Join the Windows 10 box to the domain bast
|
||||
provisioner "remote-exec" {
|
||||
inline = [
|
||||
"powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/join-domain.ps1"
|
||||
]
|
||||
|
||||
connection {
|
||||
type = "winrm"
|
||||
user = "Administrator"
|
||||
password = var.WinRM_PASSWORD
|
||||
host = aws_instance.ramonda.public_ip
|
||||
port = 5985
|
||||
insecure = true
|
||||
https = false
|
||||
timeout = "7m"
|
||||
}
|
||||
}
|
||||
|
||||
# Once the Win 10 box is joined to the domain, it will need to be restarted. Using this as a backup to make sure the box actually do reboot
|
||||
provisioner "remote-exec" {
|
||||
inline = [
|
||||
"powershell -ExecutionPolicy Bypass Restart-Computer -Force"
|
||||
@@ -213,7 +231,7 @@ resource "aws_instance" "user-workstation" {
|
||||
type = "winrm"
|
||||
user = "Administrator"
|
||||
password = var.WinRM_PASSWORD
|
||||
host = aws_instance.user-workstation.public_ip
|
||||
host = aws_instance.ramonda.public_ip
|
||||
port = 5985
|
||||
insecure = true
|
||||
https = false
|
||||
@@ -222,30 +240,30 @@ resource "aws_instance" "user-workstation" {
|
||||
}
|
||||
}
|
||||
|
||||
# First Web Server in the first domain
|
||||
resource "aws_instance" "web-server-1" {
|
||||
# 1st Web Server in the bast domain
|
||||
resource "aws_instance" "okoye" {
|
||||
ami = data.aws_ami.latest-debian.image_id
|
||||
instance_type = "t2.small"
|
||||
key_name = aws_key_pair.terraformkey.key_name
|
||||
associate_public_ip_address = true
|
||||
subnet_id = aws_subnet.first-vpc-subnet.id
|
||||
private_ip = var.WEB_SERVER_1_IP
|
||||
subnet_id = aws_subnet.bast-vpc-subnet.id
|
||||
private_ip = var.OKOYE_IP
|
||||
iam_instance_profile = aws_iam_instance_profile.ssm_instance_profile.name
|
||||
|
||||
tags = {
|
||||
Workspace = "${terraform.workspace}"
|
||||
Name = "${terraform.workspace}-Web-Server-1"
|
||||
Name = "${terraform.workspace}-okoye"
|
||||
}
|
||||
|
||||
vpc_security_group_ids = [
|
||||
aws_security_group.first-sg.id,
|
||||
aws_security_group.bast-sg.id,
|
||||
]
|
||||
}
|
||||
|
||||
resource "null_resource" "web-server-1-setup" {
|
||||
resource "null_resource" "okoye-setup" {
|
||||
connection {
|
||||
type = "ssh"
|
||||
host = aws_instance.web-server-1.public_ip
|
||||
host = aws_instance.okoye.public_ip
|
||||
user = var.SSH_USER
|
||||
port = "22"
|
||||
private_key = file(var.PATH_TO_PRIVATE_KEY)
|
||||
@@ -265,23 +283,23 @@ resource "null_resource" "web-server-1-setup" {
|
||||
}
|
||||
}
|
||||
|
||||
# Second Web Server in the first domain
|
||||
resource "aws_instance" "web-server-2" {
|
||||
# A 2nd Web Server in the bast domain
|
||||
resource "aws_instance" "soninke" {
|
||||
ami = data.aws_ami.latest-debian.image_id
|
||||
instance_type = "t2.small"
|
||||
key_name = aws_key_pair.terraformkey.key_name
|
||||
associate_public_ip_address = true
|
||||
subnet_id = aws_subnet.first-vpc-subnet.id
|
||||
private_ip = var.WEB_SERVER_2_IP
|
||||
subnet_id = aws_subnet.bast-vpc-subnet.id
|
||||
private_ip = var.SONINKE_IP
|
||||
iam_instance_profile = aws_iam_instance_profile.ssm_instance_profile.name
|
||||
|
||||
tags = {
|
||||
Workspace = "${terraform.workspace}"
|
||||
Name = "${terraform.workspace}-Web-Server-2"
|
||||
Name = "${terraform.workspace}-soninke"
|
||||
}
|
||||
|
||||
vpc_security_group_ids = [
|
||||
aws_security_group.first-sg.id,
|
||||
aws_security_group.bast-sg.id,
|
||||
]
|
||||
root_block_device {
|
||||
delete_on_termination = true
|
||||
@@ -289,10 +307,10 @@ resource "aws_instance" "web-server-2" {
|
||||
}
|
||||
}
|
||||
|
||||
resource "null_resource" "web-server-2-setup" {
|
||||
resource "null_resource" "soninke-setup" {
|
||||
connection {
|
||||
type = "ssh"
|
||||
host = aws_instance.web-server-2.public_ip
|
||||
host = aws_instance.soninke.public_ip
|
||||
user = var.SSH_USER
|
||||
port = "22"
|
||||
private_key = file(var.PATH_TO_PRIVATE_KEY)
|
||||
@@ -313,23 +331,23 @@ resource "null_resource" "web-server-2-setup" {
|
||||
}
|
||||
}
|
||||
|
||||
# Our second Domain Controller of the "second.local" domain
|
||||
resource "aws_instance" "second-dc" {
|
||||
# Domain Controller of the "wakanda.land" domain
|
||||
resource "aws_instance" "challa-dc" {
|
||||
ami = data.aws_ami.latest-windows-server.image_id
|
||||
instance_type = "t2.small"
|
||||
key_name = aws_key_pair.terraformkey.key_name
|
||||
associate_public_ip_address = true
|
||||
subnet_id = aws_subnet.second-vpc-subnet.id
|
||||
private_ip = var.SECOND_DC_IP
|
||||
subnet_id = aws_subnet.wakanda-vpc-subnet.id
|
||||
private_ip = var.CHALLA_DC_IP
|
||||
iam_instance_profile = aws_iam_instance_profile.ssm_instance_profile.name
|
||||
|
||||
tags = {
|
||||
Workspace = "${terraform.workspace}"
|
||||
Name = "${terraform.workspace}-Second-DC"
|
||||
Name = "${terraform.workspace}-challa-dc"
|
||||
}
|
||||
|
||||
vpc_security_group_ids = [
|
||||
aws_security_group.second-sg.id,
|
||||
aws_security_group.wakanda-sg.id,
|
||||
]
|
||||
}
|
||||
|
||||
@@ -339,7 +357,7 @@ resource "aws_instance" "guac-server" {
|
||||
instance_type = "t2.small"
|
||||
key_name = aws_key_pair.terraformkey.key_name
|
||||
associate_public_ip_address = true
|
||||
subnet_id = aws_subnet.first-vpc-subnet.id
|
||||
subnet_id = aws_subnet.bast-vpc-subnet.id
|
||||
private_ip = var.GUAC_SERVER_IP
|
||||
iam_instance_profile = aws_iam_instance_profile.ssm_instance_profile.name
|
||||
|
||||
@@ -349,7 +367,7 @@ resource "aws_instance" "guac-server" {
|
||||
}
|
||||
|
||||
vpc_security_group_ids = [
|
||||
aws_security_group.first-sg.id,
|
||||
aws_security_group.bast-sg.id,
|
||||
]
|
||||
}
|
||||
|
||||
@@ -378,7 +396,7 @@ resource "null_resource" "guac-server-setup" {
|
||||
}
|
||||
|
||||
resource "null_resource" "guacozy-server-setup" {
|
||||
connection {
|
||||
connection {
|
||||
type = "ssh"
|
||||
host = aws_instance.guac-server.public_ip
|
||||
user = var.SSH_USER
|
||||
@@ -392,34 +410,39 @@ resource "null_resource" "guacozy-server-setup" {
|
||||
destination = "/tmp/docker-compose.yml"
|
||||
}
|
||||
|
||||
provisioner "file" {
|
||||
source = "./scripts/guacozy.sh"
|
||||
destination = "/tmp/guacozy.sh"
|
||||
}
|
||||
|
||||
provisioner "remote-exec" {
|
||||
inline = [
|
||||
"sleep 60",
|
||||
"cd /tmp/",
|
||||
"sudo docker-compose up > /dev/null 2>&1",
|
||||
"sleep 120",
|
||||
"sudo chmod +x /tmp/guacozy.sh",
|
||||
"sudo /tmp/guacozy.sh"
|
||||
]
|
||||
on_failure = continue
|
||||
}
|
||||
}
|
||||
|
||||
# Kali Linux Installation and setup
|
||||
resource "aws_instance" "attacker-kali" {
|
||||
resource "aws_instance" "ulysses" {
|
||||
#count = "1" ? 1 : 0
|
||||
ami = data.aws_ami.latest-kali-linux.image_id
|
||||
instance_type = "t3.medium"
|
||||
key_name = aws_key_pair.terraformkey.key_name
|
||||
associate_public_ip_address = true
|
||||
subnet_id = aws_subnet.first-vpc-subnet.id
|
||||
private_ip = var.ATTACKER_KALI_IP
|
||||
subnet_id = aws_subnet.bast-vpc-subnet.id
|
||||
private_ip = var.ULYSSES_IP
|
||||
iam_instance_profile = aws_iam_instance_profile.ssm_instance_profile.name
|
||||
|
||||
tags = {
|
||||
Workspace = "${terraform.workspace}"
|
||||
Name = "${terraform.workspace}-Attacker-Kali"
|
||||
Name = "${terraform.workspace}-ulysses"
|
||||
}
|
||||
|
||||
vpc_security_group_ids = [
|
||||
aws_security_group.first-sg.id,
|
||||
aws_security_group.bast-sg.id,
|
||||
]
|
||||
root_block_device {
|
||||
delete_on_termination = true
|
||||
@@ -427,10 +450,10 @@ resource "aws_instance" "attacker-kali" {
|
||||
}
|
||||
}
|
||||
|
||||
resource "null_resource" "attacker-kali-setup" {
|
||||
resource "null_resource" "ulysses-setup" {
|
||||
connection {
|
||||
type = "ssh"
|
||||
host = aws_instance.attacker-kali.public_ip
|
||||
host = aws_instance.ulysses.public_ip
|
||||
user = "kali"
|
||||
port = "22"
|
||||
private_key = file(var.PATH_TO_PRIVATE_KEY)
|
||||
@@ -481,9 +504,9 @@ resource "aws_iam_instance_profile" "ssm_instance_profile" {
|
||||
role = aws_iam_role.ssm_role.0.name
|
||||
}
|
||||
|
||||
# Security group for first.local
|
||||
resource "aws_security_group" "first-sg" {
|
||||
vpc_id = aws_vpc.lab-vpc.id
|
||||
# Security group for bast.land
|
||||
resource "aws_security_group" "bast-sg" {
|
||||
vpc_id = aws_vpc.land-vpc.id
|
||||
|
||||
# WinRM access from anywhere
|
||||
ingress {
|
||||
@@ -493,17 +516,17 @@ resource "aws_security_group" "first-sg" {
|
||||
cidr_blocks = ["0.0.0.0/0"]
|
||||
}
|
||||
|
||||
# Allow second zone to first
|
||||
# Allow wakanda zone to bast
|
||||
ingress {
|
||||
protocol = "-1"
|
||||
cidr_blocks = [var.SECOND_SUBNET_CIDR]
|
||||
cidr_blocks = [var.WAKANDA_SUBNET_CIDR]
|
||||
from_port = 0
|
||||
to_port = 0
|
||||
}
|
||||
|
||||
ingress {
|
||||
protocol = "-1"
|
||||
cidr_blocks = [var.FIRST_SUBNET_CIDR]
|
||||
cidr_blocks = [var.BAST_SUBNET_CIDR]
|
||||
from_port = 0
|
||||
to_port = 0
|
||||
}
|
||||
@@ -525,21 +548,21 @@ resource "aws_security_group" "first-sg" {
|
||||
}
|
||||
}
|
||||
|
||||
# Security group for second.local
|
||||
resource "aws_security_group" "second-sg" {
|
||||
vpc_id = aws_vpc.lab-vpc.id
|
||||
# Security group for wakanda.land
|
||||
resource "aws_security_group" "wakanda-sg" {
|
||||
vpc_id = aws_vpc.land-vpc.id
|
||||
|
||||
# Allow secure zone to first
|
||||
# Allow bast zone to wakanda
|
||||
ingress {
|
||||
protocol = "-1"
|
||||
cidr_blocks = [var.FIRST_SUBNET_CIDR]
|
||||
cidr_blocks = [var.BAST_SUBNET_CIDR]
|
||||
from_port = 0
|
||||
to_port = 0
|
||||
}
|
||||
|
||||
ingress {
|
||||
protocol = "-1"
|
||||
cidr_blocks = [var.SECOND_SUBNET_CIDR]
|
||||
cidr_blocks = [var.WAKANDA_SUBNET_CIDR]
|
||||
from_port = 0
|
||||
to_port = 0
|
||||
}
|
||||
@@ -561,215 +584,215 @@ resource "aws_security_group" "second-sg" {
|
||||
}
|
||||
}
|
||||
|
||||
# Add first.local MOF's to S3
|
||||
resource "aws_s3_object" "first-dc-mof" {
|
||||
# Add bast.land MOF's to S3
|
||||
resource "aws_s3_object" "baku-dc-mof" {
|
||||
bucket = var.SSM_S3_BUCKET
|
||||
key = "Lab/First.mof"
|
||||
source = "../dsc/Lab/First.mof"
|
||||
etag = filemd5("../dsc/Lab/First.mof")
|
||||
key = "Jungle/Bast.mof"
|
||||
source = "../dsc/Jungle/Bast.mof"
|
||||
etag = filemd5("../dsc/Jungle/Bast.mof")
|
||||
}
|
||||
|
||||
# Add second.local MOF's to S3
|
||||
resource "aws_s3_object" "second-dc-mof" {
|
||||
# Add wakanda.land MOF's to S3
|
||||
resource "aws_s3_object" "challa-dc-mof" {
|
||||
bucket = var.SSM_S3_BUCKET
|
||||
key = "Lab/Second.mof"
|
||||
source = "../dsc/Lab/Second.mof"
|
||||
etag = filemd5("../dsc/Lab/Second.mof")
|
||||
key = "Jungle/Wakanda.mof"
|
||||
source = "../dsc/Jungle/Wakanda.mof"
|
||||
etag = filemd5("../dsc/Jungle/Wakanda.mof")
|
||||
}
|
||||
|
||||
# Add userserver MOF's to S3
|
||||
resource "aws_s3_object" "user-server-mof" {
|
||||
# Add nakia MOF's to S3
|
||||
resource "aws_s3_object" "nakia-mof" {
|
||||
bucket = var.SSM_S3_BUCKET
|
||||
key = "Lab/UserServer.mof"
|
||||
source = "../dsc/Lab/UserServer.mof"
|
||||
etag = filemd5("../dsc/Lab/UserServer.mof")
|
||||
key = "Jungle/Nakia.mof"
|
||||
source = "../dsc/Jungle/Nakia.mof"
|
||||
etag = filemd5("../dsc/Jungle/Nakia.mof")
|
||||
}
|
||||
|
||||
# Add userworkstation MOF's to S3
|
||||
resource "aws_s3_object" "user-workstation-mof" {
|
||||
# Add ramonda MOF's to S3
|
||||
resource "aws_s3_object" "ramonda-mof" {
|
||||
bucket = var.SSM_S3_BUCKET
|
||||
key = "Lab/UserWorkstation.mof"
|
||||
source = "../dsc/Lab/UserWorkstation.mof"
|
||||
etag = filemd5("../dsc/Lab/UserWorkstation.mof")
|
||||
key = "Jungle/Ramonda.mof"
|
||||
source = "../dsc/Jungle/Ramonda.mof"
|
||||
etag = filemd5("../dsc/Jungle/Ramonda.mof")
|
||||
}
|
||||
# SSM parameters used by DSC
|
||||
resource "aws_ssm_parameter" "admin-ssm-parameter" {
|
||||
name = "admin"
|
||||
resource "aws_ssm_parameter" "tsankara-ssm-parameter" {
|
||||
name = "tsankara"
|
||||
type = "SecureString"
|
||||
value = "{\"Username\":\"admin\", \"Password\":\"Password@1\"}"
|
||||
value = "{\"Username\":\"tsankara\", \"Password\":\"Password@1\"}"
|
||||
}
|
||||
|
||||
resource "aws_ssm_parameter" "local-user-ssm-parameter" {
|
||||
name = "local-user"
|
||||
resource "aws_ssm_parameter" "land-user-ssm-parameter" {
|
||||
name = "land-user"
|
||||
type = "SecureString"
|
||||
value = "{\"Username\":\"local-user\", \"Password\":\"Password@1\"}"
|
||||
value = "{\"Username\":\"land-user\", \"Password\":\"Password@1\"}"
|
||||
}
|
||||
|
||||
resource "aws_ssm_parameter" "first-admin-ssm-parameter" {
|
||||
name = "first-admin"
|
||||
resource "aws_ssm_parameter" "bast-tsankara-ssm-parameter" {
|
||||
name = "bast-tsankara"
|
||||
type = "SecureString"
|
||||
value = "{\"Username\":\"first.local\\\\admin\", \"Password\":\"Password@1\"}"
|
||||
value = "{\"Username\":\"bast.land\\\\tsankara\", \"Password\":\"Password@1\"}"
|
||||
}
|
||||
|
||||
resource "aws_ssm_parameter" "regular-user-ssm-parameter" {
|
||||
name = "regular.user"
|
||||
resource "aws_ssm_parameter" "wakandan-ssm-parameter" {
|
||||
name = "Wakandan"
|
||||
type = "SecureString"
|
||||
value = "{\"Username\":\"regular.user\", \"Password\":\"Password@1\"}"
|
||||
value = "{\"Username\":\"Wakandan\", \"Password\":\"Password@1\"}"
|
||||
}
|
||||
|
||||
resource "aws_ssm_parameter" "dnsadmin-user-ssm-parameter" {
|
||||
name = "dnsadmin.user"
|
||||
resource "aws_ssm_parameter" "thoth-ssm-parameter" {
|
||||
name = "Thoth"
|
||||
type = "SecureString"
|
||||
value = "{\"Username\":\"dnsadmin.user\", \"Password\":\"Password@1\"}"
|
||||
value = "{\"Username\":\"Thoth\", \"Password\":\"Password@1\"}"
|
||||
}
|
||||
|
||||
resource "aws_ssm_parameter" "unconstrainer-user-ssm-parameter" {
|
||||
name = "unconstrained.user"
|
||||
resource "aws_ssm_parameter" "kokou-ssm-parameter" {
|
||||
name = "Kokou"
|
||||
type = "SecureString"
|
||||
value = "{\"Username\":\"unconstrained.user\", \"Password\":\"Password@1\"}"
|
||||
value = "{\"Username\":\"Kokou\", \"Password\":\"Password@1\"}"
|
||||
}
|
||||
|
||||
resource "aws_ssm_parameter" "constrained-user-ssm-parameter" {
|
||||
name = "constrained.user"
|
||||
resource "aws_ssm_parameter" "mujaji-ssm-parameter" {
|
||||
name = "Mujaji"
|
||||
type = "SecureString"
|
||||
value = "{\"Username\":\"constrained.user\", \"Password\":\"Password@1\"}"
|
||||
value = "{\"Username\":\"Mujaji\", \"Password\":\"Password@1\"}"
|
||||
}
|
||||
|
||||
resource "aws_ssm_parameter" "userwrite-user-ssm-parameter" {
|
||||
name = "userwrite.user"
|
||||
resource "aws_ssm_parameter" "sobek-ssm-parameter" {
|
||||
name = "Sobek"
|
||||
type = "SecureString"
|
||||
value = "{\"Username\":\"userwrite.user\", \"Password\":\"Password@1\"}"
|
||||
value = "{\"Username\":\"Sobek\", \"Password\":\"Password@1\"}"
|
||||
}
|
||||
|
||||
resource "aws_ssm_parameter" "userall-user-ssm-parameter" {
|
||||
name = "userall.user"
|
||||
resource "aws_ssm_parameter" "ghekre-ssm-parameter" {
|
||||
name = "Ghekre"
|
||||
type = "SecureString"
|
||||
value = "{\"Username\":\"userall.user\", \"Password\":\"Password@1\"}"
|
||||
value = "{\"Username\":\"Ghekre\", \"Password\":\"Password@1\"}"
|
||||
}
|
||||
|
||||
resource "aws_ssm_parameter" "compwrite-user-ssm-parameter" {
|
||||
name = "compwrite.user"
|
||||
resource "aws_ssm_parameter" "ngi-ssm-parameter" {
|
||||
name = "Ngi"
|
||||
type = "SecureString"
|
||||
value = "{\"Username\":\"compwrite.user\", \"Password\":\"Password@1\"}"
|
||||
value = "{\"Username\":\"Ngi\", \"Password\":\"Password@1\"}"
|
||||
}
|
||||
|
||||
resource "aws_ssm_parameter" "gpowrite-user-ssm-parameter" {
|
||||
name = "gpowrite.user"
|
||||
resource "aws_ssm_parameter" "hadari-yao-ssm-parameter" {
|
||||
name = "Hadari-Yao"
|
||||
type = "SecureString"
|
||||
value = "{\"Username\":\"gpowrite.user\", \"Password\":\"Password@1\"}"
|
||||
value = "{\"Username\":\"Hadari-Yao\", \"Password\":\"Password@1\"}"
|
||||
}
|
||||
|
||||
resource "aws_ssm_parameter" "lapsread-user-ssm-parameter" {
|
||||
name = "lapsread.user"
|
||||
resource "aws_ssm_parameter" "yaounde-ssm-parameter" {
|
||||
name = "Yaounde"
|
||||
type = "SecureString"
|
||||
value = "{\"Username\":\"lapsread.user\", \"Password\":\"Password@1\"}"
|
||||
value = "{\"Username\":\"Yaounde\", \"Password\":\"Password@1\"}"
|
||||
}
|
||||
|
||||
resource "aws_ssm_parameter" "groupwrite-user-ssm-parameter" {
|
||||
name = "groupwrite.user"
|
||||
resource "aws_ssm_parameter" "baoule-ssm-parameter" {
|
||||
name = "Baoule"
|
||||
type = "SecureString"
|
||||
value = "{\"Username\":\"groupwrite.user\", \"Password\":\"Password@1\"}"
|
||||
value = "{\"Username\":\"Baoule\", \"Password\":\"Password@1\"}"
|
||||
}
|
||||
|
||||
resource "aws_ssm_parameter" "writedacldc-user-ssm-parameter" {
|
||||
name = "writedacldc.user"
|
||||
resource "aws_ssm_parameter" "hanuman-ssm-parameter" {
|
||||
name = "Hanuman"
|
||||
type = "SecureString"
|
||||
value = "{\"Username\":\"writedacldc.user\", \"Password\":\"Password@1\"}"
|
||||
value = "{\"Username\":\"Hanuman\", \"Password\":\"Password@1\"}"
|
||||
}
|
||||
|
||||
resource "aws_ssm_parameter" "readgmsa-user-ssm-parameter" {
|
||||
name = "readgmsa.user"
|
||||
resource "aws_ssm_parameter" "akamba-ssm-parameter" {
|
||||
name = "Akamba"
|
||||
type = "SecureString"
|
||||
value = "{\"Username\":\"readgmsa.user\", \"Password\":\"Password@1\"}"
|
||||
value = "{\"Username\":\"Akamba\", \"Password\":\"Password@1\"}"
|
||||
}
|
||||
|
||||
resource "aws_ssm_parameter" "clearpass-user-ssm-parameter" {
|
||||
name = "clearpass.user"
|
||||
resource "aws_ssm_parameter" "mmusa-ssm-parameter" {
|
||||
name = "Mmusa"
|
||||
type = "SecureString"
|
||||
value = "{\"Username\":\"clearpass.user\", \"Password\":\"Password@1\"}"
|
||||
value = "{\"Username\":\"Mmusa\", \"Password\":\"Password@1\"}"
|
||||
}
|
||||
|
||||
resource "aws_ssm_parameter" "dcsync-user-ssm-parameter" {
|
||||
name = "dcsync.user"
|
||||
resource "aws_ssm_parameter" "jabari-ssm-parameter" {
|
||||
name = "Jabari"
|
||||
type = "SecureString"
|
||||
value = "{\"Username\":\"dcsync.user\", \"Password\":\"Password@1\"}"
|
||||
value = "{\"Username\":\"Jabari\", \"Password\":\"Password@1\"}"
|
||||
}
|
||||
|
||||
resource "aws_ssm_parameter" "roast-user-ssm-parameter" {
|
||||
name = "roast.user"
|
||||
resource "aws_ssm_parameter" "plumumba-ssm-parameter" {
|
||||
name = "Plumumba"
|
||||
type = "SecureString"
|
||||
value = "{\"Username\":\"roast.user\", \"Password\":\"Password@1\"}"
|
||||
value = "{\"Username\":\"Plumumba\", \"Password\":\"Password@1\"}"
|
||||
}
|
||||
|
||||
resource "aws_ssm_parameter" "asrep-user-ssm-parameter" {
|
||||
name = "asrep.user"
|
||||
resource "aws_ssm_parameter" "knkrumah-ssm-parameter" {
|
||||
name = "Knkrumah"
|
||||
type = "SecureString"
|
||||
value = "{\"Username\":\"asrep.user\", \"Password\":\"Password@1\"}"
|
||||
value = "{\"Username\":\"Knkrumah\", \"Password\":\"Password@1\"}"
|
||||
}
|
||||
|
||||
# Apply our DSC via SSM to first.local
|
||||
resource "aws_ssm_association" "first-dc" {
|
||||
# Apply DSC via SSM to bast.land
|
||||
resource "aws_ssm_association" "baku-dc" {
|
||||
name = "AWS-ApplyDSCMofs"
|
||||
association_name = "${terraform.workspace}-First-DC"
|
||||
association_name = "${terraform.workspace}-baku-dc"
|
||||
|
||||
targets {
|
||||
key = "InstanceIds"
|
||||
values = [aws_instance.first-dc.id]
|
||||
values = [aws_instance.baku-dc.id]
|
||||
}
|
||||
|
||||
parameters = {
|
||||
MofsToApply = "s3:${var.SSM_S3_BUCKET}:Lab/First.mof"
|
||||
MofsToApply = "s3:${var.SSM_S3_BUCKET}:Jungle/Bast.mof"
|
||||
RebootBehavior = "Immediately"
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
# Apply our DSC via SSM to second.local
|
||||
resource "aws_ssm_association" "second-dc" {
|
||||
# Apply DSC via SSM to wakanda.land
|
||||
resource "aws_ssm_association" "challa-dc" {
|
||||
name = "AWS-ApplyDSCMofs"
|
||||
association_name = "${terraform.workspace}-Second-DC"
|
||||
association_name = "${terraform.workspace}-challa-dc"
|
||||
|
||||
targets {
|
||||
key = "InstanceIds"
|
||||
values = [aws_instance.second-dc.id]
|
||||
values = [aws_instance.challa-dc.id]
|
||||
}
|
||||
|
||||
parameters = {
|
||||
MofsToApply = "s3:${var.SSM_S3_BUCKET}:Lab/Second.mof"
|
||||
MofsToApply = "s3:${var.SSM_S3_BUCKET}:Jungle/Wakanda.mof"
|
||||
RebootBehavior = "Immediately"
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
# Apply our DSC via SSM to User-Server
|
||||
resource "aws_ssm_association" "user-server" {
|
||||
# Apply DSC via SSM to nakia
|
||||
resource "aws_ssm_association" "nakia" {
|
||||
name = "AWS-ApplyDSCMofs"
|
||||
association_name = "${terraform.workspace}-User-Server"
|
||||
association_name = "${terraform.workspace}-nakia"
|
||||
|
||||
targets {
|
||||
key = "InstanceIds"
|
||||
values = [aws_instance.user-server.id]
|
||||
values = [aws_instance.nakia.id]
|
||||
}
|
||||
|
||||
parameters = {
|
||||
MofsToApply = "s3:${var.SSM_S3_BUCKET}:Lab/UserServer.mof"
|
||||
MofsToApply = "s3:${var.SSM_S3_BUCKET}:Jungle/Nakia.mof"
|
||||
RebootBehavior = "Immediately"
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
# Apply our DSC via SSM to User-Workstation
|
||||
resource "aws_ssm_association" "user-workstation" {
|
||||
# Apply DSC via SSM to ramonda
|
||||
resource "aws_ssm_association" "ramonda" {
|
||||
name = "AWS-ApplyDSCMofs"
|
||||
association_name = "${terraform.workspace}-User-Workstation"
|
||||
association_name = "${terraform.workspace}-ramonda"
|
||||
|
||||
targets {
|
||||
key = "InstanceIds"
|
||||
values = [aws_instance.user-workstation.id]
|
||||
values = [aws_instance.ramonda.id]
|
||||
}
|
||||
|
||||
parameters = {
|
||||
MofsToApply = "s3:${var.SSM_S3_BUCKET}:Lab/UserWorkstation.mof"
|
||||
MofsToApply = "s3:${var.SSM_S3_BUCKET}:Jungle/Ramonda.mof"
|
||||
RebootBehavior = "Immediately"
|
||||
}
|
||||
|
||||
|
||||
@@ -292,7 +292,7 @@ do_install() {
|
||||
else
|
||||
cat >&2 <<-'EOF'
|
||||
Error: this installer needs the ability to run commands as root.
|
||||
We are unable to find either "sudo" or "su" available to make this happen.
|
||||
We are unable to find either "sudo" or "su" availandle to make this happen.
|
||||
EOF
|
||||
exit 1
|
||||
fi
|
||||
@@ -448,7 +448,7 @@ do_install() {
|
||||
fi
|
||||
$sh_c "DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends $pkgs >/dev/null"
|
||||
if version_gte "20.10"; then
|
||||
# Install docker-ce-rootless-extras without "--no-install-recommends", so as to install slirp4netns when available
|
||||
# Install docker-ce-rootless-extras without "--no-install-recommends", so as to install slirp4netns when availandle
|
||||
$sh_c "DEBIAN_FRONTEND=noninteractive apt-get install -y -qq docker-ce-rootless-extras${pkg_version%=} >/dev/null"
|
||||
fi
|
||||
)
|
||||
@@ -457,7 +457,7 @@ do_install() {
|
||||
;;
|
||||
centos|fedora|rhel)
|
||||
if [ "$(uname -m)" != "s390x" ] && [ "$lsb_dist" = "rhel" ]; then
|
||||
echo "Packages for RHEL are currently only available for s390x."
|
||||
echo "Packages for RHEL are currently only availandle for s390x."
|
||||
exit 1
|
||||
fi
|
||||
yum_repo="$DOWNLOAD_URL/linux/$lsb_dist/$REPO_FILE"
|
||||
@@ -545,7 +545,7 @@ do_install() {
|
||||
;;
|
||||
sles)
|
||||
if [ "$(uname -m)" != "s390x" ]; then
|
||||
echo "Packages for SLES are currently only available for s390x"
|
||||
echo "Packages for SLES are currently only availandle for s390x"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
||||
File diff suppressed because one or more lines are too long
@@ -1,69 +1,3 @@
|
||||
#!/usr/bin/env bash
|
||||
cd /tmp
|
||||
mkdir guacozy
|
||||
cd guacozy
|
||||
touch docker-compose.yml
|
||||
|
||||
cat << EOF >> docker-compose.yml
|
||||
version: '3'
|
||||
services:
|
||||
server:
|
||||
image: guacozy/guacozy-server
|
||||
restart: always
|
||||
depends_on:
|
||||
- db
|
||||
environment:
|
||||
- DJANGO_SECRET_KEY=abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz
|
||||
- FIELD_ENCRYPTION_KEY=qjq4ObsXMqiqQyfKgD-jjEGm4ep8RaHKGRg4ohGCi1A=
|
||||
- DJANGO_DB_URL=postgres://postgres@db:5432/postgres
|
||||
- DJANGO_ALLOWED_HOSTS=*
|
||||
- DJANGO_TIME_ZONE=US/Eastern
|
||||
- SUPERUSER_NAME=fluffy
|
||||
- SUPERUSER_EMAIL=fluffy@email.com
|
||||
- SUPERUSER_PASSWORD=Fluffy123!
|
||||
ports:
|
||||
- 443:443
|
||||
guacd:
|
||||
image: linuxserver/guacd
|
||||
restart: always
|
||||
db:
|
||||
image: postgres:10.4-alpine
|
||||
restart: always
|
||||
volumes:
|
||||
- postgres-data:/var/lib/postgresql/data
|
||||
volumes:
|
||||
postgres-data:
|
||||
EOF
|
||||
|
||||
# Check if docker-compose.yml exists
|
||||
init_check () { # Check whether vulhub folder exists
|
||||
if [[ ! -f docker-compose.yml ]]
|
||||
then
|
||||
echo "The docker-compose.yml file doesn't exit"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
start () {
|
||||
docker-compose -f docker-compose.yml up -d
|
||||
}
|
||||
|
||||
stop () {
|
||||
docker-compose -f docker-dompose.yml down -v
|
||||
}
|
||||
|
||||
if [[ $1 == "start" ]]
|
||||
then
|
||||
init_check
|
||||
echo "Starting all docker containers..."
|
||||
start
|
||||
elif [[ $1 == "stop" ]]
|
||||
then
|
||||
init_check
|
||||
echo "Stopping all docker containers ..."
|
||||
stop
|
||||
else
|
||||
echo -e "Usage: $0 [start or stop]\n"
|
||||
fi
|
||||
|
||||
#sudo docker-compose up -d
|
||||
cd /tmp/
|
||||
sudo docker-compose -f docker-compose.yml up -d
|
||||
@@ -1,9 +1,10 @@
|
||||
# Join the Windows 10 to the domain
|
||||
Start-Sleep -Seconds 300
|
||||
$domain = "first.local"
|
||||
$domain = "bast.land"
|
||||
$password = ConvertTo-SecureString "Password@1" -asPlainText -Force
|
||||
$username = "admin@first.local"
|
||||
$username = "tsankara@bast.land"
|
||||
$credential = New-Object System.Management.Automation.PSCredential($username,$password)
|
||||
Add-Computer -DomainName $domain -NewName "Ulysses" -Credential $credential
|
||||
Invoke-Command -Scriptblock {net localgroup "Remote Desktop Users" "first\domain users" /add}
|
||||
Add-Computer -DomainName $domain -NewName "Ramonda" -Credential $credential
|
||||
Invoke-Command -Scriptblock {net localgroup "Remote Desktop Users" "bast\domain users" /add}
|
||||
Invoke-Command -Scriptblock {net localgroup "Administrators" "bast\Wakandan" /add}
|
||||
# Restart-Computer -Force
|
||||
@@ -4,12 +4,12 @@ New-Item -Path 'C:\toolz' -ItemType Directory
|
||||
Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
|
||||
|
||||
# Install some stuff
|
||||
choco install git googlechrome processhacker python burp-suite-free-edition zap -y
|
||||
<#
|
||||
autopsy 7zip adobereader adexplorer apimonitor apktool netfx-4.8 cutter dnspy ghidra golang ida-free javadecompiler-gui#>
|
||||
choco install git googlechrome processhacker python burp-suite-free-edition zap autopsy 7zip adobereader adexplorer apimonitor apktool netfx-4.8 cutter dnspy ghidra golang ida-free javadecompiler-gui firefox wget -y
|
||||
|
||||
# Pause for 60 seconds
|
||||
<# Start-Sleep -Seconds 60
|
||||
Start-Sleep -Seconds 60
|
||||
Set-Location C:\toolz
|
||||
git clone https://github.com/r3motecontrol/Ghostpack-CompiledBinaries.git
|
||||
git clone https://github.com/danielmiessler/SecLists.git #>
|
||||
wget https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/archive/refs/heads/master.zip
|
||||
wget https://github.com/danielmiessler/SecLists/archive/refs/heads/master.zip
|
||||
# git clone https://github.com/r3motecontrol/Ghostpack-CompiledBinaries.git
|
||||
# git clone https://github.com/danielmiessler/SecLists.git
|
||||
|
||||
@@ -86,7 +86,7 @@ then
|
||||
stop
|
||||
elif [[ $1 == "list" ]]
|
||||
then
|
||||
echo -e "Listing all available Docker containers from vulhub."
|
||||
echo -e "Listing all availandle Docker containers from vulhub."
|
||||
|
||||
else
|
||||
echo -e "\n\e[31m\e[1mVulnerables\e[0m: a quick and simple way of starting multiple Docker containers from vulhub.\n"
|
||||
|
||||
@@ -13,41 +13,48 @@ variable "PATH_TO_PRIVATE_KEY" {
|
||||
variable "SSH_USER" {
|
||||
default = "admin"
|
||||
}
|
||||
|
||||
variable "WinRM_USER" {
|
||||
default = "admin@first.local"
|
||||
default = "admin@bast.land"
|
||||
}
|
||||
|
||||
variable "Domain_Admin" {
|
||||
default = "tsankara@bast.land"
|
||||
}
|
||||
|
||||
variable "WinRM_PASSWORD" {
|
||||
default = "Password@1"
|
||||
}
|
||||
|
||||
variable "VPC_CIDR" {
|
||||
default = "10.0.0.0/16"
|
||||
}
|
||||
|
||||
variable "FIRST_SUBNET_CIDR" {
|
||||
variable "BAST_SUBNET_CIDR" {
|
||||
default = "10.0.1.0/24"
|
||||
}
|
||||
|
||||
variable "SECOND_SUBNET_CIDR" {
|
||||
variable "WAKANDA_SUBNET_CIDR" {
|
||||
default = "10.0.2.0/24"
|
||||
}
|
||||
|
||||
variable "FIRST_DC_IP" {
|
||||
variable "BAKU_DC_IP" {
|
||||
default = "10.0.1.100"
|
||||
}
|
||||
|
||||
variable "USER_SERVER_IP" {
|
||||
variable "NAKIA_IP" {
|
||||
default = "10.0.1.50"
|
||||
}
|
||||
|
||||
variable "WEB_SERVER_1_IP" {
|
||||
variable "OKOYE_IP" {
|
||||
default = "10.0.1.51"
|
||||
}
|
||||
|
||||
variable "WEB_SERVER_2_IP" {
|
||||
variable "SONINKE_IP" {
|
||||
default = "10.0.1.52"
|
||||
}
|
||||
|
||||
variable "USER_WORKSTATION_IP" {
|
||||
variable "RAMONDA_IP" {
|
||||
default = "10.0.1.53"
|
||||
}
|
||||
|
||||
@@ -55,11 +62,11 @@ variable "GUAC_SERVER_IP" {
|
||||
default = "10.0.1.10"
|
||||
}
|
||||
|
||||
variable "ATTACKER_KALI_IP" {
|
||||
variable "ULYSSES_IP" {
|
||||
default = "10.0.1.11"
|
||||
}
|
||||
|
||||
variable "SECOND_DC_IP" {
|
||||
variable "CHALLA_DC_IP" {
|
||||
default = "10.0.2.100"
|
||||
}
|
||||
|
||||
@@ -159,7 +166,8 @@ data "aws_ami" "windows-client" {
|
||||
|
||||
filter {
|
||||
name = "name"
|
||||
values = ["import-ami-06e8283e371f14e87"]
|
||||
values = ["import-ami-07b944fe8b0a37493"]
|
||||
#values = ["import-ami-06104ffaf2a9d8fda"]
|
||||
}
|
||||
|
||||
most_recent = true
|
||||
|
||||
Reference in New Issue
Block a user