Major changes

ansible/ansible.cfg

@@ -1,5 +0,0 @@
-[defaults]
-roles_path	=	roles
-retry_files_enabled = False # Do not create them
-deprecation_warnings=False
-ask_pass=False

ansible/playbooks/windows_workstation.yml

@@ -1,15 +0,0 @@
-- hosts: all
-  gather_facts: True
-  vars:
-    ansible_connection: winrm
-    ansible_port: 5985
-    ansible_winrm_server_cert_validation: ignore
-    hostname: win-client
-  roles:
-    - windows_common
-    - windows_domain_client
-    - windows_universal_forwarder
-    - windows_aurora_agent
-    - windows_caldera_agent
-    - sysmon
-    - red_team_tools

ansible/roles/windows_common/tasks/install_7zip.yml

@@ -1,5 +0,0 @@
----
-
-- name: install 7zip
-  win_chocolatey:
-    name: 7zip

ansible/roles/windows_common/tasks/install_firefox.yml

@@ -1,5 +0,0 @@
----
-
-- name: install firefox
-  win_chocolatey:
-    name: firefox

ansible/roles/windows_common/tasks/install_git.yml

@@ -1,5 +0,0 @@
----
-
-- name: install git
-  win_chocolatey:
-    name: git

ansible/roles/windows_common/tasks/install_notepadplusplus.yml

@@ -1,5 +0,0 @@
----
-
-- name: install notepadplusplus
-  win_chocolatey:
-    name: notepadplusplus

ansible/roles/windows_common/tasks/main.yml

@@ -1,9 +0,0 @@
----
-- include: install_firefox.yml
-  ignore_errors: yes
-- include: install_notepadplusplus.yml
-  ignore_errors: yes
-- include: install_git.yml
-  ignore_errors: yes
-- include: install_7zip.yml
-  ignore_errors: yes

terraform/aws.tf

@@ -119,7 +119,7 @@ resource "aws_instance" "user-server" {
   create_duration = "900s"
 } */
 
-# A Windows 10 Pro workstation
+# A Windows 10 Pro development host providing RDP access for crafting and testing payloads
 resource "aws_instance" "user-workstation" {
   #depends_on = [time_sleep.wait_15_minutes]
   ami                         = data.aws_ami.windows-client.image_id
@@ -128,14 +128,9 @@ resource "aws_instance" "user-workstation" {
   associate_public_ip_address = true
   subnet_id                   = aws_subnet.first-vpc-subnet.id
   private_ip                  = var.USER_WORKSTATION_IP
+  depends_on                  = [aws_instance.first-dc]
   iam_instance_profile        = aws_iam_instance_profile.ssm_instance_profile.name
-  #user_data                   = file("./scripts/chocolatey.ps1")
-  user_data                   = <<EOF
-<powershell>
-Add-Computer -DomainName 'first.local' -NewName 'WKSTN001' -Credential (New-Object -TypeName PSCredential -ArgumentList "admin",(ConvertTo-SecureString -String 'Password@1' -AsPlainText -Force)[0]) -Restart
-</powershell>
-EOF
-
+  # user_data                   = file("./scripts/choco.ps1")
   tags = {
     Workspace = "${terraform.workspace}"
     Name      = "${terraform.workspace}-User-Workstation"
@@ -144,6 +139,136 @@ EOF
   vpc_security_group_ids = [
     aws_security_group.first-sg.id,
   ]
+
+  root_block_device {
+    delete_on_termination = true
+    volume_size           = 100
+  }
+
+  provisioner "remote-exec" {
+    inline = [
+      "net user Administrator /active:yes",
+      "net user Administrator ${var.WinRM_PASSWORD}"
+      ]
+
+      connection {
+      type     = "winrm"
+      user     = "admin"
+      password = var.WinRM_PASSWORD
+      host     = aws_instance.user-workstation.public_ip
+      port     = 5985
+      insecure = true
+      https    = false
+      timeout  = "10m"
+    }
+  }
+
+  provisioner "file" {
+    source      = "./scripts/rt-toolz.ps1"
+    destination = "C:/Windows/Temp/rt-toolz.ps1"
+
+    connection {
+      type     = "winrm"
+      user     = "Administrator"
+      password = var.WinRM_PASSWORD
+      host     = aws_instance.user-workstation.public_ip
+      port     = 5985
+      insecure = true
+      https    = false
+      timeout  = "7m"
+    }
+  }
+
+  provisioner "file" {
+    source      = "./scripts/join-domain.ps1"
+    destination = "C:/Windows/Temp/join-domain.ps1"
+
+    connection {
+      type     = "winrm"
+      user     = "Administrator"
+      password = var.WinRM_PASSWORD
+      host     = aws_instance.user-workstation.public_ip
+      port     = 5985
+      insecure = true
+      https    = false
+      timeout  = "7m"
+    }
+  }
+
+  /* provisioner "remote-exec" {
+    inline = [
+      "net user Administrator /active:yes",
+      "net user Administrator ${var.WinRM_PASSWORD}"
+      ]
+
+      connection {
+      type     = "winrm"
+      user     = "admin"
+      password = var.WinRM_PASSWORD
+      host     = aws_instance.user-workstation.public_ip
+      port     = 5985
+      insecure = true
+      https    = false
+      timeout  = "10m"
+    }
+  }
+ */
+
+  provisioner "remote-exec" {
+    inline = [
+      # "net user admin /active:no"
+      "powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/rt-toolz.ps1", "powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/join-domain.ps1"
+      # "powershell -ExecutionPolicy Bypass Rename-Computer -NewName 'WIN-DEV'"
+    ]
+
+    connection {
+      type     = "winrm"
+      user     = "Administrator"
+      password = var.WinRM_PASSWORD
+      host     = aws_instance.user-workstation.public_ip
+      port     = 5985
+      insecure = true
+      https    = false
+      timeout  = "7m"
+    }
+  }
+
+  /* provisioner "remote-exec" {
+    inline = [
+      # "net user admin /active:no"
+      "powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/join-domain.ps1"
+      # "powershell -ExecutionPolicy Bypass Rename-Computer -NewName 'WIN-DEV'"
+    ]
+
+    connection {
+      type     = "winrm"
+      user     = "Administrator"
+      password = var.WinRM_PASSWORD
+      host     = aws_instance.user-workstation.public_ip
+      port     = 5985
+      insecure = true
+      https    = false
+      timeout  = "7m"
+    }
+  } */
+
+  provisioner "remote-exec" {
+    inline = [
+      "powershell -ExecutionPolicy Bypass Restart-Computer -Force"
+    ]
+    on_failure = continue
+
+    connection {
+      type     = "winrm"
+      user     = "Administrator"
+      password = var.WinRM_PASSWORD
+      host     = aws_instance.user-workstation.public_ip
+      port     = 5985
+      insecure = true
+      https    = false
+      timeout  = "7m"
+    }
+  }
 }
 
 # First Web Server in the first domain
@@ -301,6 +426,32 @@ resource "null_resource" "guac-server-setup" {
   }
 }
 
+resource "null_resource" "guacozy-server-setup" {
+  connection {
+    type        = "ssh"
+    host        = aws_instance.guac-server.public_ip
+    user        = var.SSH_USER
+    port        = "22"
+    private_key = file(var.PATH_TO_PRIVATE_KEY)
+    agent       = false
+    # depends_on  = null_resource.guacamole-server-setup
+  }
+
+  provisioner "file" {
+    source      = "./scripts/guacozy.sh"
+    destination = "/tmp/guacozy.sh"
+  }
+
+  provisioner "remote-exec" {
+    inline = [
+      "sleep 10",
+      "sudo chmod +x /tmp/guacozy.sh",
+      "sudo /tmp/guacozy.sh",
+    ]
+    # on_failure = continue
+  }
+}
+
 # Kali Linux Installation and setup
 resource "aws_instance" "attacker-kali" {
   #count						  = "1" ? 1 : 0

terraform/files/docker-compose.yml

@@ -0,0 +1,30 @@
+# docker-compose.yml
+
+version: '3'  
+services:
+  server:
+    image: guacozy/guacozy-server
+    restart: always
+    depends_on:
+      - db
+    environment:
+      - DJANGO_SECRET_KEY=abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz
+      - FIELD_ENCRYPTION_KEY=qjq4ObsXMqiqQyfKgD-jjEGm4ep8RaHKGRg4ohGCi1A=
+      - DJANGO_DB_URL=postgres://postgres@db:5432/postgres
+      - DJANGO_ALLOWED_HOSTS=*
+      - DJANGO_TIME_ZONE=US/Eastern
+      - SUPERUSER_NAME=fluffy
+      - SUPERUSER_EMAIL=fluffy@email.com
+      - SUPERUSER_PASSWORD=Fluffy123!
+    ports:
+      - 443:443
+  guacd:
+    image: linuxserver/guacd
+    restart: always
+  db:
+    image: postgres:10.4-alpine
+    restart: always
+    volumes:
+    - postgres-data:/var/lib/postgresql/data
+volumes:
+  postgres-data:

terraform/outputs.tf

@@ -1,7 +1,13 @@
-output "guacamole-login-url" {
+output "Guacamole-Dashboard-Access" {
   value       = "http://${aws_instance.guac-server.public_ip}:8080/guacamole"
   description = "URL of Guacamole Dashboard. Access this at <ip-address:8080/guacamole>"
 }
+
+output "Guacozy-Dashboard-Access" {
+  value       = "https://${aws_instance.guac-server.public_ip}"
+  description = "URL of Guacozy Dashboard. Access this at <https:ip-address>"
+}
+
 output "timestamp" {
   value = formatdate("hh:mm", timestamp())
 }

terraform/scripts/choco.ps1

@@ -17,6 +17,6 @@ Set-ExecutionPolicy Bypass -Scope Process -Force;
 iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
 
 # Install some stuff
-choco install git -y
-choco install googlechrome -y
+choco install git googlechrome processhacker python burp-suite-free-edition zap autopsy 7zip adobereader adexplorer apimonitor apktool netfx-4.8 cutter dnspy ghidra golang ida-free javadecompiler-gui -Y --force
+
 </powershell>

terraform/scripts/chocolatey.ps1

@@ -1,29 +0,0 @@
-<powershell>
-# Create a directory on the C drive to store tools
-New-Item -Path 'C:\toolz' -ItemType Directory
-
-# Set directory for installation - Chocolatey does not lock
-# down the directory if not the default
-$InstallDir='C:\ProgramData\chocoportable'
-$env:ChocolateyInstall="$InstallDir"
-
-# If your PowerShell Execution policy is restrictive, you may
-# not be able to get around that. Try setting your session to
-# Bypass.
-Set-ExecutionPolicy Bypass -Scope Process -Force;
-
-# All install options - offline, proxy, etc at
-# https://chocolatey.org/install
-iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
-
-# Install some stuff
-choco install git googlechrome processhacker python burp-suite-free-edition zap autopsy 7zip adobereader adexplorer apimonitor apktool netfx-4.8 cutter dnspy ghidra golang ida-free javadecompiler-gui -y
-
-# Pause for 10 seconds
-Start-Sleep -Seconds 60
-git clone https://github.com/r3motecontrol/Ghostpack-CompiledBinaries.git C:\toolz\Ghostpack
-git clone https://github.com/danielmiessler/SecLists.git C:\toolz\SecLists
-
-#change the computer's name
-# Rename-Computer -NewName "WKSTN-001" -Restart -Force
-</powershell>

terraform/scripts/guac-setup.sh

@@ -11,7 +11,7 @@ apt install -y python3-pip
 sudo curl -L https://github.com/docker/compose/releases/download/1.25.3/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose
 sudo chmod +x /usr/local/bin/docker-compose
 
-# Setup Guacamole environment
+# Setup Guacamole and run it
 git clone https://github.com/q0phi80/guacamole.git
 cd guacamole
 sudo ./bin/prepare_initdb.sh

terraform/scripts/guacozy.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+cd /tmp
+touch dc.yml
+var=/tmp/dc.yml
+cat << EOF >> $var
+version: '3'  
+services:
+  server:
+    image: guacozy/guacozy-server
+    restart: always
+    depends_on:
+      - db
+    environment:
+      - DJANGO_SECRET_KEY=abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz
+      - FIELD_ENCRYPTION_KEY=qjq4ObsXMqiqQyfKgD-jjEGm4ep8RaHKGRg4ohGCi1A=
+      - DJANGO_DB_URL=postgres://postgres@db:5432/postgres
+      - DJANGO_ALLOWED_HOSTS=*
+      - DJANGO_TIME_ZONE=US/Eastern
+      - SUPERUSER_NAME=fluffy
+      - SUPERUSER_EMAIL=fluffy@email.com
+      - SUPERUSER_PASSWORD=Fluffy123!
+    ports:
+      - 443:443
+  guacd:
+    image: linuxserver/guacd
+    restart: always
+  db:
+    image: postgres:10.4-alpine
+    restart: always
+    volumes:
+    - postgres-data:/var/lib/postgresql/data
+volumes:
+  postgres-data:
+EOF
+
+sudo docker-compose -f dc.yml up -d
+
+#sudo docker-compose up -d

terraform/scripts/join-domain.ps1

@@ -1,10 +1,9 @@
-<powershell>
 # Join the Windows 10 to the domain
+# Start-Sleep -Seconds 300
 $domain = "first.local"
 $password = ConvertTo-SecureString "Password@1" -asPlainText -Force
-$username = "admin"
+$username = "admin@first.local"
 $credential = New-Object System.Management.Automation.PSCredential($username,$password)
-Add-Computer -DomainName $domain -NewName "Wkstn-1" -Credential $credential
+Add-Computer -DomainName $domain -NewName "WKSTN-001" -Credential $credential
 Invoke-Command -Scriptblock {net localgroup "Remote Desktop Users" "first\domain users" /add}
 Restart-Computer -Force
-</powershell>

terraform/scripts/juice-shop-setup.sh

@@ -10,6 +10,6 @@ apt install git -y
 apt-get update -y
 apt install -y python3-pip
 
-# Setup the vulnerable web application
+# Setup and run the vulnerable web application
 sudo docker pull bkimminich/juice-shop
 sudo docker run -d -p 3000:3000 bkimminich/juice-shop

terraform/scripts/kali-setup.sh

@@ -28,5 +28,5 @@ cd ../
 
 # Get Covenant C2 framework
 git clone --recurse-submodules https://github.com/cobbr/Covenant
-cd toolz/Covenant/Covenant && sudo dotnet run
+# cd toolz/Covenant/Covenant && sudo dotnet run
 # Navigate to https://127.0.0.1:7443 in a browser

terraform/scripts/rt-toolz.ps1

@@ -0,0 +1,13 @@
+# Create a directory on the C drive to store tools
+New-Item -Path 'C:\toolz' -ItemType Directory
+
+Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
+
+# Install some stuff
+choco install git googlechrome processhacker python burp-suite-free-edition zap autopsy 7zip adobereader adexplorer apimonitor apktool netfx-4.8 cutter dnspy ghidra golang ida-free javadecompiler-gui -y
+
+# Pause for 60 seconds
+<# Start-Sleep -Seconds 60
+Set-Location C:\toolz
+git clone https://github.com/r3motecontrol/Ghostpack-CompiledBinaries.git
+git clone https://github.com/danielmiessler/SecLists.git #>

terraform/vars.tf

@@ -156,6 +156,7 @@ data "aws_ami" "latest-kali-linux" {
 data "aws_ami" "windows-client" {
   # Count
   owners = ["104743148836"]
+  #owners = ["self"]
 
   filter {
     name   = "name"