diff --git a/imager/imager.py b/imager/imager.py deleted file mode 100644 index b1e10d1..0000000 --- a/imager/imager.py +++ /dev/null @@ -1,62 +0,0 @@ -#!/usr/bin/python - -# Borrowed code from https://github.com/xpn/DemoLab/tree/master/imager -import winrm -import boto3 -import time - -internal_domain_user = "tsankara" -internal_domain_pass = "Password@1" - -class WinRMSession: - def __init__(self, host, username, password, use_ntlm=False): - self.host = host - self.username = username - self.password = password - self.use_ntlm = use_ntlm - - def run_command(self, command, args=[]): - if self.use_ntlm: - s = winrm.Session(self.host, auth=(self.username, self.password), transport="ntlm") - else: - s = winrm.Session(self.host, auth=(self.username, self.password)) - - try: - r = s.run_cmd(command, args) - - print("=====[ STDERR ]=====") - print(r.std_err.decode("ascii")) - - print("=====[ STDOUT ]=====") - return r.std_out.decode("ascii") - - except InvalidCredentialsError as e: - print("Error") - -def clean_windows_image(username, password, ip, domain_joined): - - print("====[ Cleaning {0} ]====".format(ip)) - - dsc = "Write-Output '[DscLocalConfigurationManager()]' 'Configuration Meta { Node localhost { Settings { RefreshMode = \'\'Disabled\'\' } } }' > C:\\windows\\temp\\meta.ps1" - - s = WinRMSession(ip, username, password, use_ntlm=domain_joined) - print(s.run_command('powershell', ['-c', 'Remove-DscConfigurationDocument -Stage Current -Force'])) - print(s.run_command('powershell', ['-c', 'Remove-DscConfigurationDocument -Stage Previous -Force'])) - print(s.run_command('powershell', ['-c', dsc])) - print(s.run_command('powershell', ['-ep', 'bypass', '-c', 'cd C:\\windows\\temp; . .\\meta.ps1; Meta; Set-DscLocalConfigurationManager -Path .\Meta'])) - -# First we need to clean up Windows resources -ec2 = boto3.resource('ec2') -response = ec2.instances.filter(Filters=[{'Name': 'tag:Workspace', 'Values': ['imager']},{'Name': 'instance-state-name', 'Values': ['running']}]) - -for instance in response: - if instance.platform == "windows": - clean_windows_image(internal_domain_user, internal_domain_pass, instance.public_ip_address, True) - -# Now everything is cleaned up, we image -for instance in response: - for kv in instance.tags: - if kv["Key"] == "Name": - print("====[ Creating AMI For {0}]====".format(kv["Value"])) - name = kv["Value"] + "-{0}".format(time.time()) - instance.create_image(Name=name,Description="Wakanda Imager") diff --git a/imager/requirements.txt b/imager/requirements.txt deleted file mode 100644 index e2e062c..0000000 --- a/imager/requirements.txt +++ /dev/null @@ -1,19 +0,0 @@ -boto3==1.12.36 -botocore==1.15.36 -certifi==2020.4.5.1 -# cffi==1.14.0 -chardet==3.0.4 -cryptography==2.9 -docutils==0.15.2 -idna==2.9 -jmespath==0.9.5 -ntlm-auth==1.4.0 -pycparser==2.20 -python-dateutil==2.8.1 -pywinrm==0.4.1 -requests==2.23.0 -requests-ntlm==1.1.0 -s3transfer==0.3.3 -six==1.14.0 -urllib3==1.25.8 -xmltodict==0.12.0 diff --git a/terraform/aws.tf b/terraform/aws.tf index 9443d29..237aeec 100644 --- a/terraform/aws.tf +++ b/terraform/aws.tf @@ -72,7 +72,7 @@ resource "aws_vpc_dhcp_options_association" "bast-dhcp-assoc" { dhcp_options_id = aws_vpc_dhcp_options.bast-dhcp.id } -# Domain Controller of the "bast.land" domain +# Domain Controller of the bast domain resource "aws_instance" "baku-dc" { ami = data.aws_ami.latest-windows-server.image_id instance_type = "t2.small" @@ -115,7 +115,7 @@ resource "aws_instance" "nakia" { # A Windows 10 Pro development host providing RDP access for crafting and testing payloads resource "aws_instance" "ramonda" { ami = data.aws_ami.windows-client.image_id - instance_type = "t2.medium" + instance_type = "t3.medium" key_name = aws_key_pair.terraformkey.key_name associate_public_ip_address = true subnet_id = aws_subnet.bast-vpc-subnet.id @@ -131,7 +131,7 @@ resource "aws_instance" "ramonda" { aws_security_group.bast-sg.id, ] - # Connect to the Win 10 with the Local Admin account and then activate the default Administrator account + # Connect to the Win 10 with the Local Admin account and then activate the default Local Administrator account provisioner "remote-exec" { inline = [ "net user Administrator /active:yes", @@ -183,49 +183,14 @@ resource "aws_instance" "ramonda" { } } - # Run the PowerShell scripts on the Remote Win 10 box to install tools + # Execute the PowerShell scripts on the Windows box to install tools, join Win 10 the bast domain and then reboot the box provisioner "remote-exec" { inline = [ - "powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/rt-toolz.ps1" + "powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/rt-toolz.ps1", + "powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/join-domain.ps1", + "powershell -ExecutionPolicy Bypass Restart-Computer -Force", ] - connection { - type = "winrm" - user = "Administrator" - password = var.WinRM_PASSWORD - host = aws_instance.ramonda.public_ip - port = 5985 - insecure = true - https = false - timeout = "7m" - } - } - -# Join the Windows 10 box to the domain bast - provisioner "remote-exec" { - inline = [ - "powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/join-domain.ps1" - ] - - connection { - type = "winrm" - user = "Administrator" - password = var.WinRM_PASSWORD - host = aws_instance.ramonda.public_ip - port = 5985 - insecure = true - https = false - timeout = "7m" - } - } - - # Once the Win 10 box is joined to the domain, it will need to be restarted. Using this as a backup to make sure the box actually do reboot - provisioner "remote-exec" { - inline = [ - "powershell -ExecutionPolicy Bypass Restart-Computer -Force" - ] - on_failure = continue - connection { type = "winrm" user = "Administrator" @@ -330,7 +295,7 @@ resource "null_resource" "soninke-setup" { } } -# Domain Controller of the "wakanda.land" domain +# Domain Controller of the wakanda domain resource "aws_instance" "challa-dc" { ami = data.aws_ami.latest-windows-server.image_id instance_type = "t2.small" @@ -350,7 +315,7 @@ resource "aws_instance" "challa-dc" { ] } -# Guacamole Server providing a dashboard access to Kali and Windows boxes for attacks and developments +# Guacamole Server providing a dashboard access to Kali and Windows 10 resource "aws_instance" "guac-server" { ami = data.aws_ami.latest-debian.image_id instance_type = "t2.small" @@ -385,11 +350,6 @@ resource "null_resource" "guac-server-setup" { destination = "/tmp/guac-setup.sh" } - provisioner "file" { - source = "./files/playbook.yml" - destination = "/tmp/playbook.yml" - } - provisioner "file" { source = "./files/docker-compose.yml" destination = "/tmp/docker-compose.yml" @@ -777,5 +737,4 @@ resource "aws_ssm_association" "ramonda" { MofsToApply = "s3:${var.SSM_S3_BUCKET}:Jungle/Ramonda.mof" RebootBehavior = "Immediately" } - -} +} \ No newline at end of file diff --git a/terraform/files/playbook.yml b/terraform/files/playbook.yml index 3882977..834bba8 100644 --- a/terraform/files/playbook.yml +++ b/terraform/files/playbook.yml @@ -3,11 +3,6 @@ hosts: localhost name: Run Guacozy docker tasks: - # - copy: - # src: ./files/docker-compose.yml - # dest: /tmp/docker-compose.yml - - name: Change into the tmp folder and run docker-compose become: true - shell: sudo docker-compose -f /tmp/docker-compose.yml up -d - #chdir: /tmp/ \ No newline at end of file + shell: sudo docker-compose -f /tmp/docker-compose.yml up -d \ No newline at end of file diff --git a/terraform/scripts/join-domain.ps1 b/terraform/scripts/join-domain.ps1 index 936e308..5c48e81 100644 --- a/terraform/scripts/join-domain.ps1 +++ b/terraform/scripts/join-domain.ps1 @@ -1,4 +1,6 @@ # Join the Windows 10 to the domain + +# First, wait for 3 minutes (you can manipulate this for give the host some briefing room after installing toolz) Start-Sleep -Seconds 180 $domain = "bast.land" $password = ConvertTo-SecureString "Password@1" -asPlainText -Force @@ -6,5 +8,4 @@ $username = "tsankara@bast.land" $credential = New-Object System.Management.Automation.PSCredential($username,$password) Add-Computer -DomainName $domain -NewName "Ramonda" -Credential $credential Invoke-Command -Scriptblock {net localgroup "Remote Desktop Users" "bast\domain users" /add} -Invoke-Command -Scriptblock {net localgroup "Administrators" "bast\Wakandan" /add} -# Restart-Computer -Force \ No newline at end of file +Invoke-Command -Scriptblock {net localgroup "Administrators" "bast\Wakandan" /add} \ No newline at end of file diff --git a/terraform/scripts/rt-toolz.ps1 b/terraform/scripts/rt-toolz.ps1 index 5259b29..498fe13 100644 --- a/terraform/scripts/rt-toolz.ps1 +++ b/terraform/scripts/rt-toolz.ps1 @@ -1,15 +1,8 @@ -# Create a directory on the C drive to store tools +# Create a directory on the C drive to store toolz New-Item -Path 'C:\toolz' -ItemType Directory +# Install chocolatey Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1')) -# Install some stuff +# Install some toolz choco install git googlechrome processhacker python burp-suite-free-edition zap autopsy 7zip adobereader adexplorer apimonitor apktool netfx-4.8 cutter dnspy ghidra golang ida-free javadecompiler-gui firefox wget -y - -# Pause for 60 seconds -# Start-Sleep -Seconds 60 -# Set-Location C:\toolz -# wget https://github.com/r3motecontrol/Ghostpack-CompiledBinaries/archive/refs/heads/master.zip -# wget https://github.com/danielmiessler/SecLists/archive/refs/heads/master.zip -# git clone https://github.com/r3motecontrol/Ghostpack-CompiledBinaries.git -# git clone https://github.com/danielmiessler/SecLists.git