All things working

imager/imager.py

@@ -1,62 +0,0 @@
-#!/usr/bin/python
-
-# Borrowed code from https://github.com/xpn/DemoLab/tree/master/imager
-import winrm
-import boto3
-import time
-
-internal_domain_user = "tsankara"
-internal_domain_pass = "Password@1"
-
-class WinRMSession:
-    def __init__(self, host, username, password, use_ntlm=False):
-        self.host = host
-        self.username = username
-        self.password = password
-        self.use_ntlm = use_ntlm
-
-    def run_command(self, command, args=[]):
-        if self.use_ntlm:
-            s = winrm.Session(self.host, auth=(self.username, self.password), transport="ntlm")
-        else:
-            s = winrm.Session(self.host, auth=(self.username, self.password))
-
-        try:
-            r = s.run_cmd(command, args)
-
-            print("=====[ STDERR ]=====")
-            print(r.std_err.decode("ascii"))
-
-            print("=====[ STDOUT ]=====")
-            return r.std_out.decode("ascii")
-
-        except InvalidCredentialsError as e:
-            print("Error")
-
-def clean_windows_image(username, password, ip, domain_joined):
-    
-    print("====[ Cleaning {0} ]====".format(ip))
-
-    dsc = "Write-Output '[DscLocalConfigurationManager()]' 'Configuration Meta { Node localhost { Settings { RefreshMode = \'\'Disabled\'\' } } }' > C:\\windows\\temp\\meta.ps1"
-    
-    s = WinRMSession(ip, username, password, use_ntlm=domain_joined)
-    print(s.run_command('powershell', ['-c', 'Remove-DscConfigurationDocument -Stage Current -Force']))
-    print(s.run_command('powershell', ['-c', 'Remove-DscConfigurationDocument -Stage Previous -Force']))
-    print(s.run_command('powershell', ['-c', dsc]))
-    print(s.run_command('powershell', ['-ep', 'bypass', '-c', 'cd C:\\windows\\temp; . .\\meta.ps1; Meta; Set-DscLocalConfigurationManager -Path .\Meta']))
-
-# First we need to clean up Windows resources
-ec2 = boto3.resource('ec2')
-response = ec2.instances.filter(Filters=[{'Name': 'tag:Workspace', 'Values': ['imager']},{'Name': 'instance-state-name', 'Values': ['running']}])
-
-for instance in response:
-    if instance.platform == "windows":
-        clean_windows_image(internal_domain_user, internal_domain_pass, instance.public_ip_address, True)
-           
-# Now everything is cleaned up, we image
-for instance in response:
-    for kv in instance.tags:
-        if kv["Key"] == "Name": 
-            print("====[ Creating AMI For {0}]====".format(kv["Value"]))
-            name = kv["Value"] + "-{0}".format(time.time())
-            instance.create_image(Name=name,Description="Wakanda Imager")

imager/requirements.txt

@@ -1,19 +0,0 @@
-boto3==1.12.36
-botocore==1.15.36
-certifi==2020.4.5.1
-# cffi==1.14.0
-chardet==3.0.4
-cryptography==2.9
-docutils==0.15.2
-idna==2.9
-jmespath==0.9.5
-ntlm-auth==1.4.0
-pycparser==2.20
-python-dateutil==2.8.1
-pywinrm==0.4.1
-requests==2.23.0
-requests-ntlm==1.1.0
-s3transfer==0.3.3
-six==1.14.0
-urllib3==1.25.8
-xmltodict==0.12.0

terraform/aws.tf

@@ -72,7 +72,7 @@ resource "aws_vpc_dhcp_options_association" "bast-dhcp-assoc" {
   dhcp_options_id = aws_vpc_dhcp_options.bast-dhcp.id
 }
 
-# Domain Controller of the "bast.land" domain
+# Domain Controller of the bast domain
 resource "aws_instance" "baku-dc" {
   ami                         = data.aws_ami.latest-windows-server.image_id
   instance_type               = "t2.small"
@@ -115,7 +115,7 @@ resource "aws_instance" "nakia" {
 # A Windows 10 Pro development host providing RDP access for crafting and testing payloads
 resource "aws_instance" "ramonda" {
   ami                         = data.aws_ami.windows-client.image_id
-  instance_type               = "t2.medium"
+  instance_type               = "t3.medium"
   key_name                    = aws_key_pair.terraformkey.key_name
   associate_public_ip_address = true
   subnet_id                   = aws_subnet.bast-vpc-subnet.id
@@ -131,7 +131,7 @@ resource "aws_instance" "ramonda" {
     aws_security_group.bast-sg.id,
   ]
 
-  # Connect to the Win 10 with the Local Admin account and then activate the default Administrator account
+  # Connect to the Win 10 with the Local Admin account and then activate the default Local Administrator account
   provisioner "remote-exec" {
     inline = [
       "net user Administrator /active:yes",
@@ -183,49 +183,14 @@ resource "aws_instance" "ramonda" {
     }
   }
 
-  # Run the PowerShell scripts on the Remote Win 10 box to install tools
+  # Execute the PowerShell scripts on the Windows box to install tools, join Win 10 the bast domain and then reboot the box
   provisioner "remote-exec" {
     inline = [
-      "powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/rt-toolz.ps1"
+      "powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/rt-toolz.ps1",
+      "powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/join-domain.ps1",
+      "powershell -ExecutionPolicy Bypass Restart-Computer -Force",
     ]
 
-    connection {
-      type     = "winrm"
-      user     = "Administrator"
-      password = var.WinRM_PASSWORD
-      host     = aws_instance.ramonda.public_ip
-      port     = 5985
-      insecure = true
-      https    = false
-      timeout  = "7m"
-    }
-  }
-
-# Join the Windows 10 box to the domain bast
-  provisioner "remote-exec" {
-    inline = [
-      "powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/join-domain.ps1"
-    ]
-
-    connection {
-      type     = "winrm"
-      user     = "Administrator"
-      password = var.WinRM_PASSWORD
-      host     = aws_instance.ramonda.public_ip
-      port     = 5985
-      insecure = true
-      https    = false
-      timeout  = "7m"
-    }
-  }
-
-  # Once the Win 10 box is joined to the domain, it will need to be restarted. Using this as a backup to make sure the box actually do reboot
-  provisioner "remote-exec" {
-    inline = [
-      "powershell -ExecutionPolicy Bypass Restart-Computer -Force"
-    ]
-    on_failure = continue
-
     connection {
       type     = "winrm"
       user     = "Administrator"
@@ -330,7 +295,7 @@ resource "null_resource" "soninke-setup" {
   }
 }
 
-# Domain Controller of the "wakanda.land" domain
+# Domain Controller of the wakanda domain
 resource "aws_instance" "challa-dc" {
   ami                         = data.aws_ami.latest-windows-server.image_id
   instance_type               = "t2.small"
@@ -350,7 +315,7 @@ resource "aws_instance" "challa-dc" {
   ]
 }
 
-# Guacamole Server providing a dashboard access to Kali and Windows boxes for attacks and developments
+# Guacamole Server providing a dashboard access to Kali and Windows 10
 resource "aws_instance" "guac-server" {
   ami                         = data.aws_ami.latest-debian.image_id
   instance_type               = "t2.small"
@@ -385,11 +350,6 @@ resource "null_resource" "guac-server-setup" {
     destination = "/tmp/guac-setup.sh"
   }
 
-  provisioner "file" {
-    source      = "./files/playbook.yml"
-    destination = "/tmp/playbook.yml"
-  }
-
   provisioner "file" {
     source      = "./files/docker-compose.yml"
     destination = "/tmp/docker-compose.yml"
@@ -777,5 +737,4 @@ resource "aws_ssm_association" "ramonda" {
     MofsToApply    = "s3:${var.SSM_S3_BUCKET}:Jungle/Ramonda.mof"
     RebootBehavior = "Immediately"
   }
-
-}
+}

terraform/files/playbook.yml

@@ -3,11 +3,6 @@
   hosts: localhost
   name: Run Guacozy docker
   tasks:
-    # - copy:
-    #     src: ./files/docker-compose.yml
-    #     dest: /tmp/docker-compose.yml
-
     - name: Change into the tmp folder and run docker-compose
       become: true
-      shell: sudo docker-compose -f /tmp/docker-compose.yml up -d
-      #chdir: /tmp/
+      shell: sudo docker-compose -f /tmp/docker-compose.yml up -d

terraform/scripts/join-domain.ps1

@@ -1,4 +1,6 @@
 # Join the Windows 10 to the domain
+
+# First, wait for 3 minutes (you can manipulate this for give the host some briefing room after installing toolz)
 Start-Sleep -Seconds 180
 $domain = "bast.land"
 $password = ConvertTo-SecureString "Password@1" -asPlainText -Force
@@ -6,5 +8,4 @@ $username = "tsankara@bast.land"
 $credential = New-Object System.Management.Automation.PSCredential($username,$password)
 Add-Computer -DomainName $domain -NewName "Ramonda" -Credential $credential
 Invoke-Command -Scriptblock {net localgroup "Remote Desktop Users" "bast\domain users" /add}
-Invoke-Command -Scriptblock {net localgroup "Administrators" "bast\Wakandan" /add}
-# Restart-Computer -Force
+Invoke-Command -Scriptblock {net localgroup "Administrators" "bast\Wakandan" /add}

terraform/scripts/rt-toolz.ps1

@@ -1,15 +1,8 @@
-# Create a directory on the C drive to store tools
+# Create a directory on the C drive to store toolz
 New-Item -Path 'C:\toolz' -ItemType Directory
 
+# Install chocolatey
 Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
 
-# Install some stuff
+# Install some toolz
 choco install git googlechrome processhacker python burp-suite-free-edition zap autopsy 7zip adobereader adexplorer apimonitor apktool netfx-4.8 cutter dnspy ghidra golang ida-free javadecompiler-gui firefox wget -y
-
-# Pause for 60 seconds
-# Start-Sleep -Seconds 60
-# Set-Location C:\toolz
-# wget https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/archive/refs/heads/master.zip
-# wget https://github.com/danielmiessler/SecLists/archive/refs/heads/master.zip
-# git clone https://github.com/r3motecontrol/Ghostpack-CompiledBinaries.git
-# git clone https://github.com/danielmiessler/SecLists.git