diff --git a/ansible/ansible.cfg b/ansible/ansible.cfg deleted file mode 100644 index a4ebde2..0000000 --- a/ansible/ansible.cfg +++ /dev/null @@ -1,5 +0,0 @@ -[defaults] -roles_path = roles -retry_files_enabled = False # Do not create them -deprecation_warnings=False -ask_pass=False \ No newline at end of file diff --git a/ansible/playbooks/windows_workstation.yml b/ansible/playbooks/windows_workstation.yml deleted file mode 100644 index ea270af..0000000 --- a/ansible/playbooks/windows_workstation.yml +++ /dev/null @@ -1,15 +0,0 @@ -- hosts: all - gather_facts: True - vars: - ansible_connection: winrm - ansible_port: 5985 - ansible_winrm_server_cert_validation: ignore - hostname: win-client - roles: - - windows_common - - windows_domain_client - - windows_universal_forwarder - - windows_aurora_agent - - windows_caldera_agent - - sysmon - - red_team_tools \ No newline at end of file diff --git a/ansible/roles/windows_common/tasks/install_7zip.yml b/ansible/roles/windows_common/tasks/install_7zip.yml deleted file mode 100644 index 5bfb136..0000000 --- a/ansible/roles/windows_common/tasks/install_7zip.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- - -- name: install 7zip - win_chocolatey: - name: 7zip \ No newline at end of file diff --git a/ansible/roles/windows_common/tasks/install_firefox.yml b/ansible/roles/windows_common/tasks/install_firefox.yml deleted file mode 100644 index 14ff826..0000000 --- a/ansible/roles/windows_common/tasks/install_firefox.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- - -- name: install firefox - win_chocolatey: - name: firefox \ No newline at end of file diff --git a/ansible/roles/windows_common/tasks/install_git.yml b/ansible/roles/windows_common/tasks/install_git.yml deleted file mode 100644 index 8510cff..0000000 --- a/ansible/roles/windows_common/tasks/install_git.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- - -- name: install git - win_chocolatey: - name: git \ No newline at end of file diff --git a/ansible/roles/windows_common/tasks/install_notepadplusplus.yml b/ansible/roles/windows_common/tasks/install_notepadplusplus.yml deleted file mode 100644 index 7e9ace3..0000000 --- a/ansible/roles/windows_common/tasks/install_notepadplusplus.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- - -- name: install notepadplusplus - win_chocolatey: - name: notepadplusplus \ No newline at end of file diff --git a/ansible/roles/windows_common/tasks/main.yml b/ansible/roles/windows_common/tasks/main.yml deleted file mode 100644 index ddc420f..0000000 --- a/ansible/roles/windows_common/tasks/main.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -- include: install_firefox.yml - ignore_errors: yes -- include: install_notepadplusplus.yml - ignore_errors: yes -- include: install_git.yml - ignore_errors: yes -- include: install_7zip.yml - ignore_errors: yes \ No newline at end of file diff --git a/customized-ami/config-files/Allow-Remote-Connection-To-This-Computer.png b/customized-ami/img/Allow-Remote-Connection-To-This-Computer.png similarity index 100% rename from customized-ami/config-files/Allow-Remote-Connection-To-This-Computer.png rename to customized-ami/img/Allow-Remote-Connection-To-This-Computer.png diff --git a/customized-ami/config-files/Changing-Ethernet-Connection-To-Private.png b/customized-ami/img/Changing-Ethernet-Connection-To-Private.png similarity index 100% rename from customized-ami/config-files/Changing-Ethernet-Connection-To-Private.png rename to customized-ami/img/Changing-Ethernet-Connection-To-Private.png diff --git a/customized-ami/config-files/Create-EC2-AMI-From-S3-VHD-Image.png b/customized-ami/img/Create-EC2-AMI-From-S3-VHD-Image.png similarity index 100% rename from customized-ami/config-files/Create-EC2-AMI-From-S3-VHD-Image.png rename to customized-ami/img/Create-EC2-AMI-From-S3-VHD-Image.png diff --git a/customized-ami/config-files/Creating-Virtual-Machine.png b/customized-ami/img/Creating-Virtual-Machine.png similarity index 100% rename from customized-ami/config-files/Creating-Virtual-Machine.png rename to customized-ami/img/Creating-Virtual-Machine.png diff --git a/customized-ami/config-files/Import-Status.png b/customized-ami/img/Import-Status.png similarity index 100% rename from customized-ami/config-files/Import-Status.png rename to customized-ami/img/Import-Status.png diff --git a/customized-ami/config-files/Upload-Image-To-S3.png b/customized-ami/img/Upload-Image-To-S3.png similarity index 100% rename from customized-ami/config-files/Upload-Image-To-S3.png rename to customized-ami/img/Upload-Image-To-S3.png diff --git a/customized-ami/config-files/WinRM-Setup-Configuration-1.png b/customized-ami/img/WinRM-Setup-Configuration-1.png similarity index 100% rename from customized-ami/config-files/WinRM-Setup-Configuration-1.png rename to customized-ami/img/WinRM-Setup-Configuration-1.png diff --git a/customized-ami/config-files/WinRM-Setup-Configuration-2.png b/customized-ami/img/WinRM-Setup-Configuration-2.png similarity index 100% rename from customized-ami/config-files/WinRM-Setup-Configuration-2.png rename to customized-ami/img/WinRM-Setup-Configuration-2.png diff --git a/customized-ami/config-files/WinRM-Setup-Configuration-3.png b/customized-ami/img/WinRM-Setup-Configuration-3.png similarity index 100% rename from customized-ami/config-files/WinRM-Setup-Configuration-3.png rename to customized-ami/img/WinRM-Setup-Configuration-3.png diff --git a/terraform/aws.tf b/terraform/aws.tf index 1681dbe..3952745 100644 --- a/terraform/aws.tf +++ b/terraform/aws.tf @@ -119,7 +119,7 @@ resource "aws_instance" "user-server" { create_duration = "900s" } */ -# A Windows 10 Pro workstation +# A Windows 10 Pro development host providing RDP access for crafting and testing payloads resource "aws_instance" "user-workstation" { #depends_on = [time_sleep.wait_15_minutes] ami = data.aws_ami.windows-client.image_id @@ -128,14 +128,9 @@ resource "aws_instance" "user-workstation" { associate_public_ip_address = true subnet_id = aws_subnet.first-vpc-subnet.id private_ip = var.USER_WORKSTATION_IP + depends_on = [aws_instance.first-dc] iam_instance_profile = aws_iam_instance_profile.ssm_instance_profile.name - #user_data = file("./scripts/chocolatey.ps1") - user_data = < -Add-Computer -DomainName 'first.local' -NewName 'WKSTN001' -Credential (New-Object -TypeName PSCredential -ArgumentList "admin",(ConvertTo-SecureString -String 'Password@1' -AsPlainText -Force)[0]) -Restart - -EOF - + # user_data = file("./scripts/choco.ps1") tags = { Workspace = "${terraform.workspace}" Name = "${terraform.workspace}-User-Workstation" @@ -144,6 +139,136 @@ EOF vpc_security_group_ids = [ aws_security_group.first-sg.id, ] + + root_block_device { + delete_on_termination = true + volume_size = 100 + } + + provisioner "remote-exec" { + inline = [ + "net user Administrator /active:yes", + "net user Administrator ${var.WinRM_PASSWORD}" + ] + + connection { + type = "winrm" + user = "admin" + password = var.WinRM_PASSWORD + host = aws_instance.user-workstation.public_ip + port = 5985 + insecure = true + https = false + timeout = "10m" + } + } + + provisioner "file" { + source = "./scripts/rt-toolz.ps1" + destination = "C:/Windows/Temp/rt-toolz.ps1" + + connection { + type = "winrm" + user = "Administrator" + password = var.WinRM_PASSWORD + host = aws_instance.user-workstation.public_ip + port = 5985 + insecure = true + https = false + timeout = "7m" + } + } + + provisioner "file" { + source = "./scripts/join-domain.ps1" + destination = "C:/Windows/Temp/join-domain.ps1" + + connection { + type = "winrm" + user = "Administrator" + password = var.WinRM_PASSWORD + host = aws_instance.user-workstation.public_ip + port = 5985 + insecure = true + https = false + timeout = "7m" + } + } + + /* provisioner "remote-exec" { + inline = [ + "net user Administrator /active:yes", + "net user Administrator ${var.WinRM_PASSWORD}" + ] + + connection { + type = "winrm" + user = "admin" + password = var.WinRM_PASSWORD + host = aws_instance.user-workstation.public_ip + port = 5985 + insecure = true + https = false + timeout = "10m" + } + } + */ + + provisioner "remote-exec" { + inline = [ + # "net user admin /active:no" + "powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/rt-toolz.ps1", "powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/join-domain.ps1" + # "powershell -ExecutionPolicy Bypass Rename-Computer -NewName 'WIN-DEV'" + ] + + connection { + type = "winrm" + user = "Administrator" + password = var.WinRM_PASSWORD + host = aws_instance.user-workstation.public_ip + port = 5985 + insecure = true + https = false + timeout = "7m" + } + } + + /* provisioner "remote-exec" { + inline = [ + # "net user admin /active:no" + "powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/join-domain.ps1" + # "powershell -ExecutionPolicy Bypass Rename-Computer -NewName 'WIN-DEV'" + ] + + connection { + type = "winrm" + user = "Administrator" + password = var.WinRM_PASSWORD + host = aws_instance.user-workstation.public_ip + port = 5985 + insecure = true + https = false + timeout = "7m" + } + } */ + + provisioner "remote-exec" { + inline = [ + "powershell -ExecutionPolicy Bypass Restart-Computer -Force" + ] + on_failure = continue + + connection { + type = "winrm" + user = "Administrator" + password = var.WinRM_PASSWORD + host = aws_instance.user-workstation.public_ip + port = 5985 + insecure = true + https = false + timeout = "7m" + } + } } # First Web Server in the first domain @@ -301,6 +426,32 @@ resource "null_resource" "guac-server-setup" { } } +resource "null_resource" "guacozy-server-setup" { + connection { + type = "ssh" + host = aws_instance.guac-server.public_ip + user = var.SSH_USER + port = "22" + private_key = file(var.PATH_TO_PRIVATE_KEY) + agent = false + # depends_on = null_resource.guacamole-server-setup + } + + provisioner "file" { + source = "./scripts/guacozy.sh" + destination = "/tmp/guacozy.sh" + } + + provisioner "remote-exec" { + inline = [ + "sleep 10", + "sudo chmod +x /tmp/guacozy.sh", + "sudo /tmp/guacozy.sh", + ] + # on_failure = continue + } +} + # Kali Linux Installation and setup resource "aws_instance" "attacker-kali" { #count = "1" ? 1 : 0 diff --git a/terraform/files/docker-compose.yml b/terraform/files/docker-compose.yml new file mode 100644 index 0000000..4a52839 --- /dev/null +++ b/terraform/files/docker-compose.yml @@ -0,0 +1,30 @@ +# docker-compose.yml + +version: '3' +services: + server: + image: guacozy/guacozy-server + restart: always + depends_on: + - db + environment: + - DJANGO_SECRET_KEY=abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz + - FIELD_ENCRYPTION_KEY=qjq4ObsXMqiqQyfKgD-jjEGm4ep8RaHKGRg4ohGCi1A= + - DJANGO_DB_URL=postgres://postgres@db:5432/postgres + - DJANGO_ALLOWED_HOSTS=* + - DJANGO_TIME_ZONE=US/Eastern + - SUPERUSER_NAME=fluffy + - SUPERUSER_EMAIL=fluffy@email.com + - SUPERUSER_PASSWORD=Fluffy123! + ports: + - 443:443 + guacd: + image: linuxserver/guacd + restart: always + db: + image: postgres:10.4-alpine + restart: always + volumes: + - postgres-data:/var/lib/postgresql/data +volumes: + postgres-data: \ No newline at end of file diff --git a/terraform/outputs.tf b/terraform/outputs.tf index 5925ec0..a769f2e 100644 --- a/terraform/outputs.tf +++ b/terraform/outputs.tf @@ -1,7 +1,13 @@ -output "guacamole-login-url" { +output "Guacamole-Dashboard-Access" { value = "http://${aws_instance.guac-server.public_ip}:8080/guacamole" description = "URL of Guacamole Dashboard. Access this at " } + +output "Guacozy-Dashboard-Access" { + value = "https://${aws_instance.guac-server.public_ip}" + description = "URL of Guacozy Dashboard. Access this at " +} + output "timestamp" { value = formatdate("hh:mm", timestamp()) } \ No newline at end of file diff --git a/terraform/scripts/choco.ps1 b/terraform/scripts/choco.ps1 index a02bb7e..8d907d0 100644 --- a/terraform/scripts/choco.ps1 +++ b/terraform/scripts/choco.ps1 @@ -17,6 +17,6 @@ Set-ExecutionPolicy Bypass -Scope Process -Force; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1')) # Install some stuff -choco install git -y -choco install googlechrome -y +choco install git googlechrome processhacker python burp-suite-free-edition zap autopsy 7zip adobereader adexplorer apimonitor apktool netfx-4.8 cutter dnspy ghidra golang ida-free javadecompiler-gui -Y --force + \ No newline at end of file diff --git a/terraform/scripts/chocolatey.ps1 b/terraform/scripts/chocolatey.ps1 deleted file mode 100644 index 8b2696a..0000000 --- a/terraform/scripts/chocolatey.ps1 +++ /dev/null @@ -1,29 +0,0 @@ - -# Create a directory on the C drive to store tools -New-Item -Path 'C:\toolz' -ItemType Directory - -# Set directory for installation - Chocolatey does not lock -# down the directory if not the default -$InstallDir='C:\ProgramData\chocoportable' -$env:ChocolateyInstall="$InstallDir" - -# If your PowerShell Execution policy is restrictive, you may -# not be able to get around that. Try setting your session to -# Bypass. -Set-ExecutionPolicy Bypass -Scope Process -Force; - -# All install options - offline, proxy, etc at -# https://chocolatey.org/install -iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1')) - -# Install some stuff -choco install git googlechrome processhacker python burp-suite-free-edition zap autopsy 7zip adobereader adexplorer apimonitor apktool netfx-4.8 cutter dnspy ghidra golang ida-free javadecompiler-gui -y - -# Pause for 10 seconds -Start-Sleep -Seconds 60 -git clone https://github.com/r3motecontrol/Ghostpack-CompiledBinaries.git C:\toolz\Ghostpack -git clone https://github.com/danielmiessler/SecLists.git C:\toolz\SecLists - -#change the computer's name -# Rename-Computer -NewName "WKSTN-001" -Restart -Force - \ No newline at end of file diff --git a/terraform/scripts/guac-setup.sh b/terraform/scripts/guac-setup.sh index a80eb6f..3438dba 100644 --- a/terraform/scripts/guac-setup.sh +++ b/terraform/scripts/guac-setup.sh @@ -11,7 +11,7 @@ apt install -y python3-pip sudo curl -L https://github.com/docker/compose/releases/download/1.25.3/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose sudo chmod +x /usr/local/bin/docker-compose -# Setup Guacamole environment +# Setup Guacamole and run it git clone https://github.com/q0phi80/guacamole.git cd guacamole sudo ./bin/prepare_initdb.sh diff --git a/terraform/scripts/guacozy.sh b/terraform/scripts/guacozy.sh new file mode 100644 index 0000000..812bebd --- /dev/null +++ b/terraform/scripts/guacozy.sh @@ -0,0 +1,38 @@ +#!/usr/bin/env bash +cd /tmp +touch dc.yml +var=/tmp/dc.yml +cat << EOF >> $var +version: '3' +services: + server: + image: guacozy/guacozy-server + restart: always + depends_on: + - db + environment: + - DJANGO_SECRET_KEY=abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz + - FIELD_ENCRYPTION_KEY=qjq4ObsXMqiqQyfKgD-jjEGm4ep8RaHKGRg4ohGCi1A= + - DJANGO_DB_URL=postgres://postgres@db:5432/postgres + - DJANGO_ALLOWED_HOSTS=* + - DJANGO_TIME_ZONE=US/Eastern + - SUPERUSER_NAME=fluffy + - SUPERUSER_EMAIL=fluffy@email.com + - SUPERUSER_PASSWORD=Fluffy123! + ports: + - 443:443 + guacd: + image: linuxserver/guacd + restart: always + db: + image: postgres:10.4-alpine + restart: always + volumes: + - postgres-data:/var/lib/postgresql/data +volumes: + postgres-data: +EOF + +sudo docker-compose -f dc.yml up -d + +#sudo docker-compose up -d \ No newline at end of file diff --git a/terraform/scripts/join-domain.ps1 b/terraform/scripts/join-domain.ps1 index fb49a78..1e7153a 100644 --- a/terraform/scripts/join-domain.ps1 +++ b/terraform/scripts/join-domain.ps1 @@ -1,10 +1,9 @@ - # Join the Windows 10 to the domain +# Start-Sleep -Seconds 300 $domain = "first.local" $password = ConvertTo-SecureString "Password@1" -asPlainText -Force -$username = "admin" +$username = "admin@first.local" $credential = New-Object System.Management.Automation.PSCredential($username,$password) -Add-Computer -DomainName $domain -NewName "Wkstn-1" -Credential $credential +Add-Computer -DomainName $domain -NewName "WKSTN-001" -Credential $credential Invoke-Command -Scriptblock {net localgroup "Remote Desktop Users" "first\domain users" /add} -Restart-Computer -Force - \ No newline at end of file +Restart-Computer -Force \ No newline at end of file diff --git a/terraform/scripts/juice-shop-setup.sh b/terraform/scripts/juice-shop-setup.sh index 14a350f..af7bd39 100644 --- a/terraform/scripts/juice-shop-setup.sh +++ b/terraform/scripts/juice-shop-setup.sh @@ -10,6 +10,6 @@ apt install git -y apt-get update -y apt install -y python3-pip -# Setup the vulnerable web application +# Setup and run the vulnerable web application sudo docker pull bkimminich/juice-shop sudo docker run -d -p 3000:3000 bkimminich/juice-shop \ No newline at end of file diff --git a/terraform/scripts/kali-setup.sh b/terraform/scripts/kali-setup.sh index dcf75f5..2bc330a 100644 --- a/terraform/scripts/kali-setup.sh +++ b/terraform/scripts/kali-setup.sh @@ -28,5 +28,5 @@ cd ../ # Get Covenant C2 framework git clone --recurse-submodules https://github.com/cobbr/Covenant -cd toolz/Covenant/Covenant && sudo dotnet run +# cd toolz/Covenant/Covenant && sudo dotnet run # Navigate to https://127.0.0.1:7443 in a browser \ No newline at end of file diff --git a/terraform/scripts/rt-toolz.ps1 b/terraform/scripts/rt-toolz.ps1 new file mode 100644 index 0000000..a0a72c1 --- /dev/null +++ b/terraform/scripts/rt-toolz.ps1 @@ -0,0 +1,13 @@ +# Create a directory on the C drive to store tools +New-Item -Path 'C:\toolz' -ItemType Directory + +Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1')) + +# Install some stuff +choco install git googlechrome processhacker python burp-suite-free-edition zap autopsy 7zip adobereader adexplorer apimonitor apktool netfx-4.8 cutter dnspy ghidra golang ida-free javadecompiler-gui -y + +# Pause for 60 seconds +<# Start-Sleep -Seconds 60 +Set-Location C:\toolz +git clone https://github.com/r3motecontrol/Ghostpack-CompiledBinaries.git +git clone https://github.com/danielmiessler/SecLists.git #> diff --git a/terraform/vars.tf b/terraform/vars.tf index 522804d..7f111e5 100644 --- a/terraform/vars.tf +++ b/terraform/vars.tf @@ -156,6 +156,7 @@ data "aws_ami" "latest-kali-linux" { data "aws_ami" "windows-client" { # Count owners = ["104743148836"] + #owners = ["self"] filter { name = "name"