codex-admin/Wakanda-Forever
1
0
Fork 0
mirror of https://github.com/elisspace/Wakanda-Forever.git synced 2026-08-29 15:44:11 +00:00
Code Issues Releases Wiki Activity

Dev Branch first commit

Browse Source
This commit is contained in:
q0phi80
2022-07-20 00:09:57 -04:00
parent e52593e28a
commit d9155f7977
18 changed files with 1388 additions and 364 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@@ -30,7 +30,7 @@ override.tf.json
terraform/keys/*
terraform/.terraform.lock.hcl
terraform/.terraform/
dsc/Lab/*
dsc/land/*
terraform/terraform*
terraform/.terraform*

18
README.md
View File

@@ -1,6 +1,6 @@
# Wakanda-Land
## Purpose
Wakanda Land is a Cyber Range deployment tool that uses ```terraform``` for automating the process of deploying an Adversarial Simulation lab infrastructure for practicing various offensive attacks. This project inherits from other people's work in the Cybersecurity Community and due credit has been provided in the Credit Section. I just added some additional sprinkles to their work from my other researches.
Wakanda Land is a Cyber Range deployment tool that uses ```terraform``` for automating the process of deploying an Adversarial Simulation land infrastructure for practicing various offensive attacks. This project inherits from other people's work in the Cybersecurity Community and due credit has been provided in the Credit Section. I just added some additional sprinkles to their work from my other researches.
## Attack Techniques Covered
- Kerberoasting
@@ -59,12 +59,12 @@ DSC
- Install-module -name activedirectorydsc
- Install-module -name networkingdsc
- Install-module -name ComputerManagementDsc
2. Update the PowerShell script (adlab.ps1) with the following:
2. Update the PowerShell script (adland.ps1) with the following:
- Import-DscResource -ModuleName ActiveDirectoryDsc
- Import-DscResource -ModuleName NetworkingDsc
- Import-DscResource -ModuleName ComputerManagementDSC
- Import-DscResource -ModuleName PSDesiredStateConfiguration
3. Run the script (```. .\adlab.ps1```) from within the ```dsc``` directory to create the MOF files, which will be dumped into the ```Lab``` folder
3. Run the script (```. .\adland.ps1```) from within the ```dsc``` directory to create the MOF files, which will be dumped into the ```land``` folder
S3
Create an S3 bucket for your account and modify the variable in terraform/vars.tf with your bucket name
@@ -79,8 +79,8 @@ Can use this key pair to get the administrator default password from AWS
Once you run the terraform, it will take some time to provision everything, so give it about 30 mins to an hour and you should be good to go.
```
## Running the lab
You can take the following steps in running the lab (must be ran from the terraform subfolder):
## Running the land
You can take the following steps in running the land (must be ran from the terraform subfolder):
### Initialize terraform
```
@@ -116,7 +116,7 @@ terraform apply --auto-approve
- Once on Covenant C2, create a Listener and ensure the BindAddress and ConnectionAddress are set to the Kali's internal IP address
- Create a PowerShell launcher
- Open a new terminal window (or tab) in Kali and change directory into /toolz/impacket/examples (cd /toolz/impacket/examples)
- Use Impacket's WMIEXEC script to obtain a shell on a victim's machine, simulating an initial foothold within the Active Directory environment (python3 wmiexec.py first/regular.user:Password\@1@10.0.1.50)
- Use Impacket's WMIEXEC script to obtain a shell on a victim's machine, simulating an initial foothold within the Active Directory environment (python3 wmiexec.py first/wakandan:Password\@1@10.0.1.50)
- Copy the PowerShell launcher from Covenant and paste it in the shell obtained on the victim's machine (e.g. 10.0.1.50)
- Confirm you have a connection (Grunt) back to your Covenant C2 framework
- You can continue with other attack techniques via Covenant
@@ -127,9 +127,9 @@ terraform destroy --auto-approve
```
## Credits
```
- XPN: https://github.com/xpn/DemoLab
- MDSec: https://www.mdsec.co.uk/2020/04/designing-the-adversary-simulation-lab/
- Phil Keeble: https://github.com/PhilKeeble/AWS-RedTeam-ADLab
- XPN: https://github.com/xpn/Demoland
- MDSec: https://www.mdsec.co.uk/2020/04/designing-the-adversary-simulation-land/
- Phil Keeble: https://github.com/PhilKeeble/AWS-RedTeam-ADland
- Splunk: https://github.com/splunk/attack_range
- oehrlis: https://github.com/oehrlis/guacamole
- https://github.com/splunk/attack_range/wiki/Upload-Windows-10-AMI-to-AWS

BIN
dsc/Jungle/Bast.mof Normal file
View File

Binary file not shown.

BIN
dsc/Jungle/Nakia.mof Normal file
View File

Binary file not shown.

BIN
dsc/Jungle/Ramonda.mof Normal file
View File

Binary file not shown.

BIN
dsc/Jungle/Wakanda.mof Normal file
View File

Binary file not shown.

1020
dsc/Jungle/jungle.ps1 Normal file
View File

File diff suppressed because it is too large Load Diff

BIN
dsc/Lab/First.mof
View File

Binary file not shown.

BIN
dsc/Lab/Second.mof
View File

Binary file not shown.

BIN
dsc/Lab/UserServer.mof
View File

Binary file not shown.

BIN
dsc/Lab/UserWorkstation.mof
View File

Binary file not shown.

281
dsc/adlab.ps1
View File

@@ -1,4 +1,4 @@
configuration Lab {
configuration land {
param
(
@@ -18,11 +18,12 @@ configuration Lab {
Import-DscResource -ModuleName NetworkingDsc
Import-DscResource -ModuleName ComputerManagementDSC
Import-DscResource -ModuleName PSDesiredStateConfiguration
Import-DscResource -Module nx
Node "First" {
Computer NewName {
Name = "First-DC"
Name = "baku-dc"
}
WindowsFeature ADDSInstall {
@@ -113,22 +114,22 @@ configuration Lab {
DependsOn = "[WaitForADDomain]waitFirstDomain"
}
ADUser 'regular.user'
ADUser 'wakandan'
{
Ensure = 'Present'
UserName = 'regular.user'
Password = (New-Object System.Management.Automation.PSCredential("regular.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'first.local'
UserName = 'wakandan'
Password = (New-Object System.Management.Automation.PSCredential("wakandan", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'bast.land'
Path = 'CN=Users,DC=first,DC=local'
DependsOn = "[WaitForADDomain]waitFirstDomain"
}
ADUser 'dnsadmin.user'
ADUser 'Thoth'
{
Ensure = 'Present'
UserName = 'dnsadmin.user'
Password = (New-Object System.Management.Automation.PSCredential("dnsadmin.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'first.local'
UserName = 'Thoth'
Password = (New-Object System.Management.Automation.PSCredential("Thoth", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'bast.land'
Path = 'CN=Users,DC=first,DC=local'
DependsOn = "[WaitForADDomain]waitFirstDomain"
}
@@ -136,57 +137,57 @@ configuration Lab {
ADGroup DnsAdmin {
Ensure = "Present"
GroupName = "DnsAdmins"
MembersToInclude = "dnsadmin.user"
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]dnsadmin.user"
MembersToInclude = "Thoth"
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]Thoth"
}
ADUser 'unconstrained.user'
ADUser 'Kokou'
{
Ensure = 'Present'
UserName = 'unconstrained.user'
Password = (New-Object System.Management.Automation.PSCredential("unconstrained.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'first.local'
UserName = 'Kokou'
Password = (New-Object System.Management.Automation.PSCredential("Kokou", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'bast.land'
Path = 'CN=Users,DC=first,DC=local'
DependsOn = "[WaitForADDomain]waitFirstDomain"
}
Script "unconstrained.user Unconstrained Delegation Set"
Script "Kokou Unconstrained Delegation Set"
{
SetScript = {
Set-ADAccountControl -Identity "unconstrained.user" -TrustedForDelegation $True
Set-ADAccountControl -Identity "Kokou" -TrustedForDelegation $True
}
TestScript = {
$false
}
GetScript = {
@{ Result = (Get-ADUser "unconstrained.user" ) }
@{ Result = (Get-ADUser "Kokou" ) }
}
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]unconstrained.user"
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]Kokou"
}
ADUser 'constrained.user'
ADUser 'Mujaji'
{
Ensure = 'Present'
UserName = 'constrained.user'
Password = (New-Object System.Management.Automation.PSCredential("constrained.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'first.local'
UserName = 'Mujaji'
Password = (New-Object System.Management.Automation.PSCredential("Mujaji", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'bast.land'
Path = 'CN=Users,DC=first,DC=local'
DependsOn = "[WaitForADDomain]waitFirstDomain"
}
Script "constrained.user constrained Delegation Set"
Script "Mujaji constrained Delegation Set"
{
SetScript = {
$user = (Get-ADUser -Identity "constrained.user").DistinguishedName
Set-ADObject -Identity $user -Add @{"msDS-AllowedToDelegateTo" = @("CIFS/First-DC","CIFS/First-DC.First.local","CIFS/First-DC.first.local/first.local")}
$user = (Get-ADUser -Identity "Mujaji").DistinguishedName
Set-ADObject -Identity $user -Add @{"msDS-AllowedToDelegateTo" = @("CIFS/baku-dc","CIFS/baku-dc.bast.land","CIFS/baku-dc.bast.land/bast.land")}
}
TestScript = {
$false
}
GetScript = {
@{ Result = (Get-ADUser "constrained.user" ) }
@{ Result = (Get-ADUser "Mujaji" ) }
}
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]constrained.user"
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]Mujaji"
}
ADComputer "Constrained.Computer"
@@ -201,7 +202,7 @@ configuration Lab {
{
SetScript = {
$comp = (Get-ADComputer -Identity "Suspicious-PC").DistinguishedName
Set-ADObject -Identity $comp -Add @{"msDS-AllowedToDelegateTo" = @("HTTP/First-DC","HTTP/First-DC.First.local","HTTP/First-DC.first.local/first.local")}
Set-ADObject -Identity $comp -Add @{"msDS-AllowedToDelegateTo" = @("HTTP/baku-dc","HTTP/baku-dc.bast.land","HTTP/baku-dc.bast.land/bast.land")}
}
TestScript = {
$false
@@ -212,21 +213,21 @@ configuration Lab {
DependsOn = "[WaitForADDomain]waitFirstDomain"
}
ADUser 'userwrite.user'
ADUser 'Sobek'
{
Ensure = 'Present'
UserName = 'userwrite.user'
Password = (New-Object System.Management.Automation.PSCredential("userwrite.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'first.local'
UserName = 'Sobek'
Password = (New-Object System.Management.Automation.PSCredential("Sobek", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'bast.land'
Path = 'CN=Users,DC=first,DC=local'
DependsOn = "[WaitForADDomain]waitFirstDomain"
}
Script "userwrite.user Write Permissions on User Node"
Script "Sobek Write Permissions on User Node"
{
SetScript = {
$Destination = (Get-ADUser -Identity "constrained.user").DistinguishedName
$Source = (Get-ADUser -Identity "userwrite.user").sid
$Destination = (Get-ADUser -Identity "Mujaji").DistinguishedName
$Source = (Get-ADUser -Identity "Sobek").sid
$Rights = "GenericWrite"
$ADObject = [ADSI]("LDAP://" + $Destination)
$identity = $Source
@@ -241,26 +242,26 @@ configuration Lab {
$false
}
GetScript = {
@{ Result = (Get-ADUser "userwrite.user" ) }
@{ Result = (Get-ADUser "Sobek" ) }
}
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]userwrite.user"
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]Sobek"
}
ADUser 'userall.user'
ADUser 'Ghekre'
{
Ensure = 'Present'
UserName = 'userall.user'
Password = (New-Object System.Management.Automation.PSCredential("userall.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'first.local'
UserName = 'Ghekre'
Password = (New-Object System.Management.Automation.PSCredential("Ghekre", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'bast.land'
Path = 'CN=Users,DC=first,DC=local'
DependsOn = "[WaitForADDomain]waitFirstDomain"
}
Script "userall.user GenericAll Permissions on User Node"
Script "Ghekre GenericAll Permissions on User Node"
{
SetScript = {
$Destination = (Get-ADUser -Identity "userwrite.user").DistinguishedName
$Source = (Get-ADUser -Identity "userall.user").sid
$Destination = (Get-ADUser -Identity "Sobek").DistinguishedName
$Source = (Get-ADUser -Identity "Ghekre").sid
$Rights = "GenericAll"
$ADObject = [ADSI]("LDAP://" + $Destination)
$identity = $Source
@@ -275,26 +276,26 @@ configuration Lab {
$false
}
GetScript = {
@{ Result = (Get-ADUser "userall.user" ) }
@{ Result = (Get-ADUser "Ghekre" ) }
}
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]userall.user"
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]Ghekre"
}
ADUser 'compwrite.user'
ADUser 'Ngi'
{
Ensure = 'Present'
UserName = 'compwrite.user'
Password = (New-Object System.Management.Automation.PSCredential("compwrite.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'first.local'
UserName = 'Ngi'
Password = (New-Object System.Management.Automation.PSCredential("Ngi", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'bast.land'
Path = 'CN=Users,DC=first,DC=local'
DependsOn = "[WaitForADDomain]waitFirstDomain"
}
Script "compwrite.user Write Permissions on Comp Node"
Script "Ngi Write Permissions on Comp Node"
{
SetScript = {
$Destination = (Get-ADComputer -Identity "First-DC").DistinguishedName
$Source = (Get-ADUser -Identity "compwrite.user").sid
$Destination = (Get-ADComputer -Identity "baku-dc").DistinguishedName
$Source = (Get-ADUser -Identity "Ngi").sid
$Rights = "GenericWrite"
$ADObject = [ADSI]("LDAP://" + $Destination)
$identity = $Source
@@ -309,61 +310,61 @@ configuration Lab {
$false
}
GetScript = {
@{ Result = (Get-ADUser "compwrite.user" ) }
@{ Result = (Get-ADUser "Ngi" ) }
}
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]compwrite.user"
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]Ngi"
}
ADUser "gpowrite.user"
ADUser "Hadari-Yao"
{
Ensure = 'Present'
UserName = 'gpowrite.user'
Password = (New-Object System.Management.Automation.PSCredential("gpowrite.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'first.local'
UserName = 'Hadari-Yao'
Password = (New-Object System.Management.Automation.PSCredential("Hadari-Yao", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'bast.land'
Path = 'CN=Users,DC=first,DC=local'
DependsOn = "[WaitForADDomain]waitFirstDomain"
}
Script "gpowrite.user Write Permissions on GPO"
Script "Hadari-Yao Write Permissions on GPO"
{
SetScript = {
Set-GPPermission -Name "Default Domain Controllers Policy" -TargetName "gpowrite.user" -TargetType "User" -PermissionLevel "GpoEdit"
Set-GPPermission -Name "Default Domain Controllers Policy" -TargetName "Hadari-Yao" -TargetType "User" -PermissionLevel "GpoEdit"
}
TestScript = {
$false
}
GetScript = {
@{ Result = (Get-ADUser "gpowrite.user" ) }
@{ Result = (Get-ADUser "Hadari-Yao" ) }
}
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]gpowrite.user"
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]Hadari-Yao"
}
ADUser 'lapsread.user'
ADUser 'Yaounde'
{
Ensure = 'Present'
UserName = 'lapsread.user'
Password = (New-Object System.Management.Automation.PSCredential("lapsread.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'first.local'
UserName = 'Yaounde'
Password = (New-Object System.Management.Automation.PSCredential("Yaounde", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'bast.land'
Path = 'CN=Users,DC=first,DC=local'
Description = 'LAPS yet to be implemented'
DependsOn = "[WaitForADDomain]waitFirstDomain"
}
ADUser 'groupwrite.user'
ADUser 'Baoule'
{
Ensure = 'Present'
UserName = 'groupwrite.user'
Password = (New-Object System.Management.Automation.PSCredential("groupwrite.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'first.local'
UserName = 'Baoule'
Password = (New-Object System.Management.Automation.PSCredential("Baoule", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'bast.land'
Path = 'CN=Users,DC=first,DC=local'
DependsOn = "[WaitForADDomain]waitFirstDomain"
}
Script "groupwrite.user Write Permissions on Group"
Script "Baoule Write Permissions on Group"
{
SetScript = {
$Destination = (Get-ADGroup -Identity "Domain Admins").DistinguishedName
$Source = (Get-ADUser -Identity "groupwrite.user").sid
$Source = (Get-ADUser -Identity "Baoule").sid
$Rights = "GenericAll"
$ADObject = [ADSI]("LDAP://" + $Destination)
$identity = $Source
@@ -378,26 +379,26 @@ configuration Lab {
$false
}
GetScript = {
@{ Result = (Get-ADUser "groupwrite.user" ) }
@{ Result = (Get-ADUser "Baoule" ) }
}
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]groupwrite.user"
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]Baoule"
}
ADUser 'writedacldc.user'
ADUser 'Hanuman'
{
Ensure = 'Present'
UserName = 'writedacldc.user'
Password = (New-Object System.Management.Automation.PSCredential("writedacldc.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'first.local'
UserName = 'Hanuman'
Password = (New-Object System.Management.Automation.PSCredential("Hanuman", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'bast.land'
Path = 'CN=Users,DC=first,DC=local'
DependsOn = "[WaitForADDomain]waitFirstDomain"
}
Script "writedacldc.user WriteDACL Permissions on DC"
Script "Hanuman WriteDACL Permissions on DC"
{
SetScript = {
$Destination = (Get-ADComputer -Identity "First-DC").DistinguishedName
$Source = (Get-ADUser -Identity "writedacldc.user").sid
$Destination = (Get-ADComputer -Identity "baku-dc").DistinguishedName
$Source = (Get-ADUser -Identity "Hanuman").sid
$Rights = "WriteDACL"
$ADObject = [ADSI]("LDAP://" + $Destination)
$identity = $Source
@@ -412,123 +413,123 @@ configuration Lab {
$false
}
GetScript = {
@{ Result = (Get-ADUser "writedacldc.user" ) }
@{ Result = (Get-ADUser "Hanuman" ) }
}
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]writedacldc.user"
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]Hanuman"
}
ADUser 'readgmsa.user'
ADUser 'Akamba'
{
Ensure = 'Present'
UserName = 'readgmsa.user'
Password = (New-Object System.Management.Automation.PSCredential("readgmsa.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'first.local'
UserName = 'Akamba'
Password = (New-Object System.Management.Automation.PSCredential("Akamba", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'bast.land'
Path = 'CN=Users,DC=first,DC=local'
Description = 'GMSA yet to be implemented'
DependsOn = "[WaitForADDomain]waitFirstDomain"
}
ADUser 'clearpass.user'
ADUser 'Mmusa'
{
Ensure = 'Present'
UserName = 'clearpass.user'
Password = (New-Object System.Management.Automation.PSCredential("clearpass.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'first.local'
UserName = 'Mmusa'
Password = (New-Object System.Management.Automation.PSCredential("Mmusa", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'bast.land'
Path = 'CN=Users,DC=first,DC=local'
DependsOn = "[WaitForADDomain]waitFirstDomain"
}
Script "clearpass.user Password in AD"
Script "Mmusa Password in AD"
{
SetScript = {
Set-ADUser -Identity "clearpass.user" -Description "Remember to remove this! Password@1"
Set-ADUser -Identity "Mmusa" -Description "Remember to remove this! Password@1"
}
TestScript = {
$false
}
GetScript = {
@{ Result = (Get-ADUser "clearpass.user" ) }
@{ Result = (Get-ADUser "Mmusa" ) }
}
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]clearpass.user"
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]Mmusa"
}
ADUser 'roast.user'
ADUser 'Plumumba'
{
Ensure = 'Present'
UserName = 'roast.user'
Password = (New-Object System.Management.Automation.PSCredential("roast.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'first.local'
UserName = 'Plumumba'
Password = (New-Object System.Management.Automation.PSCredential("Plumumba", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'bast.land'
Path = 'CN=Users,DC=first,DC=local'
ServicePrincipalNames = "MSSQL/sql.first.local"
ServicePrincipalNames = "MSSQL/sql.bast.land"
DependsOn = "[WaitForADDomain]waitFirstDomain"
}
ADUser asrep
{
Ensure = 'Present'
UserName = 'asrep.user'
Password = (New-Object System.Management.Automation.PSCredential("asrep.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'first.local'
UserName = 'Knkrumah'
Password = (New-Object System.Management.Automation.PSCredential("Knkrumah", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'bast.land'
Path = 'CN=Users,DC=first,DC=local'
DependsOn = "[WaitForADDomain]waitFirstDomain"
}
Script "asrep.user PreAuth Disable"
Script "Knkrumah PreAuth Disable"
{
SetScript = {
Set-ADAccountControl -Identity "asrep.user" -DoesNotRequirePreAuth $true
Set-ADAccountControl -Identity "Knkrumah" -DoesNotRequirePreAuth $true
}
TestScript = {
$false
}
GetScript = {
@{ Result = (Get-ADUser "asrep.user" ) }
@{ Result = (Get-ADUser "Knkrumah" ) }
}
DependsOn = "[WaitForADDomain]waitFirstDomain", "[ADUser]asrep"
}
Script "User-Server-RDP"
Script "nakia-RDP"
{
SetScript = {
Start-Sleep -Seconds 300
Invoke-Command -ComputerName "User-Server" -Scriptblock {net localgroup "Remote Desktop Users" "first\domain users" /add}
Invoke-Command -ComputerName "nakia" -Scriptblock {net localgroup "Remote Desktop Users" "first\domain users" /add}
}
TestScript = {
$false
}
GetScript = {
@{ Result = (Get-ADComputer "User-Server" ) }
@{ Result = (Get-ADComputer "nakia" ) }
}
PsDscRunAsCredential = $firstDomainCred
DependsOn = "[WaitForADDomain]waitFirstDomain"
}
Script "User-Workstation-RDP" {
Script "ramonda-RDP" {
SetScript = {
Start-Sleep -Seconds 300
Invoke-Command -ComputerName "User-Workstation" -Scriptblock { net localgroup "Remote Desktop Users" "first\domain users" /add }
Invoke-Command -ComputerName "ramonda" -Scriptblock { net localgroup "Remote Desktop Users" "first\domain users" /add }
}
TestScript = {
$false
}
GetScript = {
@{ Result = (Get-ADComputer "User-Workstation" ) }
@{ Result = (Get-ADComputer "ramonda" ) }
}
PsDscRunAsCredential = $firstDomainCred
DependsOn = "[WaitForADDomain]waitFirstDomain"
}
Script "User-Server constrained Delegation Set"
Script "nakia constrained Delegation Set"
{
SetScript = {
$comp = (Get-ADComputer -Identity "User-Server").DistinguishedName
Set-ADObject -Identity $comp -Add @{"msDS-AllowedToDelegateTo" = @("HOST/First-DC","HOST/First-DC.First.local","HOST/First-DC.first.local/first.local")}
$comp = (Get-ADComputer -Identity "nakia").DistinguishedName
Set-ADObject -Identity $comp -Add @{"msDS-AllowedToDelegateTo" = @("HOST/baku-dc","HOST/baku-dc.bast.land","HOST/baku-dc.bast.land/bast.land")}
}
TestScript = {
$false
}
GetScript = {
@{ Result = (Get-ADComputer "User-Server" ) }
@{ Result = (Get-ADComputer "nakia" ) }
}
DependsOn = "[WaitForADDomain]waitFirstDomain"
}
@@ -573,7 +574,7 @@ configuration Lab {
WaitForAll DC
{
ResourceName = '[ADUser]asrep'
NodeName = 'First-DC'
NodeName = 'baku-dc'
RetryIntervalSec = 60
RetryCount = 15
}
@@ -670,7 +671,7 @@ configuration Lab {
}
Computer JoinDomain {
Name = "User-Server"
Name = "nakia"
DomainName = $firstDomainName
Credential = $firstDomainCred
DependsOn = "[WaitForADDomain]waitFirstDomain"
@@ -682,7 +683,7 @@ configuration Lab {
WaitForAll DC
{
ResourceName = '[ADUser]asrep'
NodeName = 'First-DC'
NodeName = 'baku-dc'
RetryIntervalSec = 60
RetryCount = 15
}
@@ -793,7 +794,7 @@ configuration Lab {
}
Computer JoinDomain {
Name = "User-Workstation"
Name = "ramonda"
DomainName = $firstDomainName
Credential = $firstDomainCred
DependsOn = "[WaitForADDomain]waitFirstDomain"
@@ -803,7 +804,7 @@ configuration Lab {
Node "Second" {
Computer NewName {
Name = "Second-DC"
Name = "challa-dc"
}
WindowsFeature ADDSInstall {
@@ -892,33 +893,33 @@ configuration Lab {
DependsOn = "[WaitForADDomain]waitSecondDomain"
}
ADUser 'regular.user'
ADUser 'wakandan'
{
Ensure = 'Present'
UserName = 'regular.user'
Password = (New-Object System.Management.Automation.PSCredential("regular.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'second.local'
UserName = 'wakandan'
Password = (New-Object System.Management.Automation.PSCredential("wakandan", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'wakanda.land'
Path = 'CN=Users,DC=second,DC=local'
DependsOn = "[WaitForADDomain]waitSecondDomain"
}
ADUser 'roast.user'
ADUser 'Plumumba'
{
Ensure = 'Present'
UserName = 'roast.user'
Password = (New-Object System.Management.Automation.PSCredential("roast.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'second.local'
UserName = 'Plumumba'
Password = (New-Object System.Management.Automation.PSCredential("Plumumba", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'wakanda.land'
Path = 'CN=Users,DC=second,DC=local'
ServicePrincipalNames = "MSSQL/sql.second.local"
ServicePrincipalNames = "MSSQL/sql.wakanda.land"
DependsOn = "[WaitForADDomain]waitSecondDomain"
}
ADUser 'asrep.user'
ADUser 'Knkrumah'
{
Ensure = 'Present'
UserName = 'asrep.user'
Password = (New-Object System.Management.Automation.PSCredential("asrep.user", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'second.local'
UserName = 'Knkrumah'
Password = (New-Object System.Management.Automation.PSCredential("Knkrumah", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))
DomainName = 'wakanda.land'
Path = 'CN=Users,DC=second,DC=local'
DependsOn = "[WaitForADDomain]waitSecondDomain"
}
@@ -1012,9 +1013,9 @@ $ConfigData = @{
)
}
Lab -ConfigurationData $ConfigData `
-firstDomainName "first.local" `
-secondDomainName "second.local" `
land -ConfigurationData $ConfigData `
-firstDomainName "bast.land" `
-secondDomainName "wakanda.land" `
-domainCred (New-Object System.Management.Automation.PSCredential("admin", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force))) `
-safemodeAdministratorCred (New-Object System.Management.Automation.PSCredential("admin", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force))) `
-firstDomainCred (New-Object System.Management.Automation.PSCredential("first-admin", (ConvertTo-SecureString "DoesntMatter" -AsPlainText -Force)))

388
terraform/aws.tf
View File

@@ -5,134 +5,134 @@ provider "aws" {
region = "us-east-1"
}
# Our AWS keypair
# AWS keypair
resource "aws_key_pair" "terraformkey" {
key_name = "${terraform.workspace}-terraform-lab"
key_name = "${terraform.workspace}-wakanda-land"
public_key = file(var.PATH_TO_PUBLIC_KEY)
}
# Our VPC definition, using a default IP range of 10.0.0.0/16
resource "aws_vpc" "lab-vpc" {
# VPC definition, using a default IP range of 10.0.0.0/16
resource "aws_vpc" "land-vpc" {
cidr_block = var.VPC_CIDR
enable_dns_support = true
enable_dns_hostnames = true
}
# Default route required for the VPC to push traffic via gateway
resource "aws_route" "first-internet-route" {
route_table_id = aws_vpc.lab-vpc.main_route_table_id
resource "aws_route" "bast-internet-route" {
route_table_id = aws_vpc.land-vpc.main_route_table_id
destination_cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.lab-vpc-gateway.id
gateway_id = aws_internet_gateway.land-vpc-gateway.id
}
# Gateway which allows outbound and inbound internet access to the VPC
resource "aws_internet_gateway" "lab-vpc-gateway" {
vpc_id = aws_vpc.lab-vpc.id
resource "aws_internet_gateway" "land-vpc-gateway" {
vpc_id = aws_vpc.land-vpc.id
}
# Create our first subnet (Defaults to 10.0.1.0/24)
resource "aws_subnet" "first-vpc-subnet" {
vpc_id = aws_vpc.lab-vpc.id
resource "aws_subnet" "bast-vpc-subnet" {
vpc_id = aws_vpc.land-vpc.id
cidr_block = var.FIRST_SUBNET_CIDR
cidr_block = var.BAST_SUBNET_CIDR
availability_zone = "us-east-1a"
tags = {
Name = "First Subnet"
Name = "Bast Subnet"
}
}
# Create our second subnet (Defaults to 10.0.2.0/24)
resource "aws_subnet" "second-vpc-subnet" {
vpc_id = aws_vpc.lab-vpc.id
resource "aws_subnet" "wakanda-vpc-subnet" {
vpc_id = aws_vpc.land-vpc.id
cidr_block = var.SECOND_SUBNET_CIDR
cidr_block = var.WAKANDA_SUBNET_CIDR
availability_zone = "us-east-1a"
tags = {
Name = "Second Subnet"
Name = "Wakanda Subnet"
}
}
# Set DHCP options for delivering things such as DNS servers
resource "aws_vpc_dhcp_options" "first-dhcp" {
domain_name = "first.local"
domain_name_servers = [var.FIRST_DC_IP, var.PUBLIC_DNS]
ntp_servers = [var.FIRST_DC_IP]
netbios_name_servers = [var.FIRST_DC_IP]
resource "aws_vpc_dhcp_options" "bast-dhcp" {
domain_name = "bast.land"
domain_name_servers = [var.BAKU_DC_IP, var.PUBLIC_DNS]
ntp_servers = [var.BAKU_DC_IP]
netbios_name_servers = [var.BAKU_DC_IP]
netbios_node_type = 2
tags = {
Name = "First DHCP"
Name = "Bast DHCP"
}
}
# Associate our DHCP configuration with our VPC
resource "aws_vpc_dhcp_options_association" "first-dhcp-assoc" {
vpc_id = aws_vpc.lab-vpc.id
dhcp_options_id = aws_vpc_dhcp_options.first-dhcp.id
resource "aws_vpc_dhcp_options_association" "bast-dhcp-assoc" {
vpc_id = aws_vpc.land-vpc.id
dhcp_options_id = aws_vpc_dhcp_options.bast-dhcp.id
}
# Our first Domain Controller of the "first.local" domain
resource "aws_instance" "first-dc" {
# Domain Controller of the "bast.land" domain
resource "aws_instance" "baku-dc" {
ami = data.aws_ami.latest-windows-server.image_id
instance_type = "t2.small"
key_name = aws_key_pair.terraformkey.key_name
associate_public_ip_address = true
subnet_id = aws_subnet.first-vpc-subnet.id
private_ip = var.FIRST_DC_IP
subnet_id = aws_subnet.bast-vpc-subnet.id
private_ip = var.BAKU_DC_IP
iam_instance_profile = aws_iam_instance_profile.ssm_instance_profile.name
tags = {
Workspace = "${terraform.workspace}"
Name = "${terraform.workspace}-First-DC"
Name = "${terraform.workspace}-baku-dc"
}
vpc_security_group_ids = [
aws_security_group.first-sg.id,
aws_security_group.bast-sg.id,
]
}
# Windows Server in the first domain
resource "aws_instance" "user-server" {
# Windows Server in the bast domain
resource "aws_instance" "nakia" {
ami = data.aws_ami.latest-windows-server.image_id
instance_type = "t2.small"
key_name = aws_key_pair.terraformkey.key_name
associate_public_ip_address = true
subnet_id = aws_subnet.first-vpc-subnet.id
private_ip = var.USER_SERVER_IP
subnet_id = aws_subnet.bast-vpc-subnet.id
private_ip = var.NAKIA_IP
iam_instance_profile = aws_iam_instance_profile.ssm_instance_profile.name
tags = {
Workspace = "${terraform.workspace}"
Name = "${terraform.workspace}-User-Server"
Name = "${terraform.workspace}-nakia"
}
vpc_security_group_ids = [
aws_security_group.first-sg.id,
aws_security_group.bast-sg.id,
]
}
# A Windows 10 Pro development host providing RDP access for crafting and testing payloads
resource "aws_instance" "user-workstation" {
resource "aws_instance" "ramonda" {
ami = data.aws_ami.windows-client.image_id
instance_type = "t2.medium"
key_name = aws_key_pair.terraformkey.key_name
associate_public_ip_address = true
subnet_id = aws_subnet.first-vpc-subnet.id
private_ip = var.USER_WORKSTATION_IP
depends_on = [aws_instance.first-dc]
subnet_id = aws_subnet.bast-vpc-subnet.id
private_ip = var.RAMONDA_IP
depends_on = [aws_instance.baku-dc]
iam_instance_profile = aws_iam_instance_profile.ssm_instance_profile.name
tags = {
Workspace = "${terraform.workspace}"
Name = "${terraform.workspace}-User-Workstation"
Name = "${terraform.workspace}-ramonda"
}
vpc_security_group_ids = [
aws_security_group.first-sg.id,
aws_security_group.bast-sg.id,
]
# Connect to the Win 10 with the Local Admin account and then activate the default Administrator account
# Connect to the Win 10 with the Local Admin account and then activate the default Administrator account
provisioner "remote-exec" {
inline = [
"net user Administrator /active:yes",
@@ -143,7 +143,7 @@ resource "aws_instance" "user-workstation" {
type = "winrm"
user = "admin"
password = var.WinRM_PASSWORD
host = aws_instance.user-workstation.public_ip
host = aws_instance.ramonda.public_ip
port = 5985
insecure = true
https = false
@@ -151,7 +151,7 @@ resource "aws_instance" "user-workstation" {
}
}
# Push some PowerShell scripts from our local box unto the remote Win 10 box
# Push some PowerShell scripts from our local box unto the remote Win 10 box
provisioner "file" {
source = "./scripts/rt-toolz.ps1"
destination = "C:/Windows/Temp/rt-toolz.ps1"
@@ -160,7 +160,7 @@ resource "aws_instance" "user-workstation" {
type = "winrm"
user = "Administrator"
password = var.WinRM_PASSWORD
host = aws_instance.user-workstation.public_ip
host = aws_instance.ramonda.public_ip
port = 5985
insecure = true
https = false
@@ -176,7 +176,7 @@ resource "aws_instance" "user-workstation" {
type = "winrm"
user = "Administrator"
password = var.WinRM_PASSWORD
host = aws_instance.user-workstation.public_ip
host = aws_instance.ramonda.public_ip
port = 5985
insecure = true
https = false
@@ -184,7 +184,7 @@ resource "aws_instance" "user-workstation" {
}
}
# Run the PowerShell scripts on the Remote Win 10 box to install tools and also join the Win 10 box to the domain
# Run the PowerShell scripts on the Remote Win 10 box to install tools and also join the Win 10 box to the domain
provisioner "remote-exec" {
inline = [
"powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/rt-toolz.ps1", "powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/join-domain.ps1"
@@ -194,7 +194,7 @@ resource "aws_instance" "user-workstation" {
type = "winrm"
user = "Administrator"
password = var.WinRM_PASSWORD
host = aws_instance.user-workstation.public_ip
host = aws_instance.ramonda.public_ip
port = 5985
insecure = true
https = false
@@ -202,7 +202,7 @@ resource "aws_instance" "user-workstation" {
}
}
# Once the Win 10 box is joined to the domain, it will need to be restarted. Using this as a backup to make sure the box actually do reboot
# Once the Win 10 box is joined to the domain, it will need to be restarted. Using this as a backup to make sure the box actually do reboot
provisioner "remote-exec" {
inline = [
"powershell -ExecutionPolicy Bypass Restart-Computer -Force"
@@ -213,7 +213,7 @@ resource "aws_instance" "user-workstation" {
type = "winrm"
user = "Administrator"
password = var.WinRM_PASSWORD
host = aws_instance.user-workstation.public_ip
host = aws_instance.ramonda.public_ip
port = 5985
insecure = true
https = false
@@ -222,30 +222,30 @@ resource "aws_instance" "user-workstation" {
}
}
# First Web Server in the first domain
resource "aws_instance" "web-server-1" {
# 1st Web Server in the bast domain
resource "aws_instance" "okoye" {
ami = data.aws_ami.latest-debian.image_id
instance_type = "t2.small"
key_name = aws_key_pair.terraformkey.key_name
associate_public_ip_address = true
subnet_id = aws_subnet.first-vpc-subnet.id
private_ip = var.WEB_SERVER_1_IP
subnet_id = aws_subnet.bast-vpc-subnet.id
private_ip = var.OKOYE_IP
iam_instance_profile = aws_iam_instance_profile.ssm_instance_profile.name
tags = {
Workspace = "${terraform.workspace}"
Name = "${terraform.workspace}-Web-Server-1"
Name = "${terraform.workspace}-okoye"
}
vpc_security_group_ids = [
aws_security_group.first-sg.id,
aws_security_group.bast-sg.id,
]
}
resource "null_resource" "web-server-1-setup" {
resource "null_resource" "okoye-setup" {
connection {
type = "ssh"
host = aws_instance.web-server-1.public_ip
host = aws_instance.okoye.public_ip
user = var.SSH_USER
port = "22"
private_key = file(var.PATH_TO_PRIVATE_KEY)
@@ -265,23 +265,23 @@ resource "null_resource" "web-server-1-setup" {
}
}
# Second Web Server in the first domain
resource "aws_instance" "web-server-2" {
# A 2nd Web Server in the bast domain
resource "aws_instance" "soninke" {
ami = data.aws_ami.latest-debian.image_id
instance_type = "t2.small"
key_name = aws_key_pair.terraformkey.key_name
associate_public_ip_address = true
subnet_id = aws_subnet.first-vpc-subnet.id
private_ip = var.WEB_SERVER_2_IP
subnet_id = aws_subnet.bast-vpc-subnet.id
private_ip = var.SONINKE_IP
iam_instance_profile = aws_iam_instance_profile.ssm_instance_profile.name
tags = {
Workspace = "${terraform.workspace}"
Name = "${terraform.workspace}-Web-Server-2"
Name = "${terraform.workspace}-soninke"
}
vpc_security_group_ids = [
aws_security_group.first-sg.id,
aws_security_group.bast-sg.id,
]
root_block_device {
delete_on_termination = true
@@ -289,10 +289,10 @@ resource "aws_instance" "web-server-2" {
}
}
resource "null_resource" "web-server-2-setup" {
resource "null_resource" "soninke-setup" {
connection {
type = "ssh"
host = aws_instance.web-server-2.public_ip
host = aws_instance.soninke.public_ip
user = var.SSH_USER
port = "22"
private_key = file(var.PATH_TO_PRIVATE_KEY)
@@ -313,23 +313,23 @@ resource "null_resource" "web-server-2-setup" {
}
}
# Our second Domain Controller of the "second.local" domain
resource "aws_instance" "second-dc" {
# Domain Controller of the "wakanda.land" domain
resource "aws_instance" "challa-dc" {
ami = data.aws_ami.latest-windows-server.image_id
instance_type = "t2.small"
key_name = aws_key_pair.terraformkey.key_name
associate_public_ip_address = true
subnet_id = aws_subnet.second-vpc-subnet.id
private_ip = var.SECOND_DC_IP
subnet_id = aws_subnet.wakanda-vpc-subnet.id
private_ip = var.CHALLA_DC_IP
iam_instance_profile = aws_iam_instance_profile.ssm_instance_profile.name
tags = {
Workspace = "${terraform.workspace}"
Name = "${terraform.workspace}-Second-DC"
Name = "${terraform.workspace}-challa-dc"
}
vpc_security_group_ids = [
aws_security_group.second-sg.id,
aws_security_group.wakanda-sg.id,
]
}
@@ -339,7 +339,7 @@ resource "aws_instance" "guac-server" {
instance_type = "t2.small"
key_name = aws_key_pair.terraformkey.key_name
associate_public_ip_address = true
subnet_id = aws_subnet.first-vpc-subnet.id
subnet_id = aws_subnet.bast-vpc-subnet.id
private_ip = var.GUAC_SERVER_IP
iam_instance_profile = aws_iam_instance_profile.ssm_instance_profile.name
@@ -349,7 +349,7 @@ resource "aws_instance" "guac-server" {
}
vpc_security_group_ids = [
aws_security_group.first-sg.id,
aws_security_group.bast-sg.id,
]
}
@@ -378,7 +378,7 @@ resource "null_resource" "guac-server-setup" {
}
resource "null_resource" "guacozy-server-setup" {
connection {
connection {
type = "ssh"
host = aws_instance.guac-server.public_ip
user = var.SSH_USER
@@ -403,23 +403,23 @@ resource "null_resource" "guacozy-server-setup" {
}
# Kali Linux Installation and setup
resource "aws_instance" "attacker-kali" {
resource "aws_instance" "ulysses" {
#count = "1" ? 1 : 0
ami = data.aws_ami.latest-kali-linux.image_id
instance_type = "t3.medium"
key_name = aws_key_pair.terraformkey.key_name
associate_public_ip_address = true
subnet_id = aws_subnet.first-vpc-subnet.id
private_ip = var.ATTACKER_KALI_IP
subnet_id = aws_subnet.bast-vpc-subnet.id
private_ip = var.ULYSSES_IP
iam_instance_profile = aws_iam_instance_profile.ssm_instance_profile.name
tags = {
Workspace = "${terraform.workspace}"
Name = "${terraform.workspace}-Attacker-Kali"
Name = "${terraform.workspace}-ulysses"
}
vpc_security_group_ids = [
aws_security_group.first-sg.id,
aws_security_group.bast-sg.id,
]
root_block_device {
delete_on_termination = true
@@ -427,10 +427,10 @@ resource "aws_instance" "attacker-kali" {
}
}
resource "null_resource" "attacker-kali-setup" {
resource "null_resource" "ulysses-setup" {
connection {
type = "ssh"
host = aws_instance.attacker-kali.public_ip
host = aws_instance.ulysses.public_ip
user = "kali"
port = "22"
private_key = file(var.PATH_TO_PRIVATE_KEY)
@@ -481,9 +481,9 @@ resource "aws_iam_instance_profile" "ssm_instance_profile" {
role = aws_iam_role.ssm_role.0.name
}
# Security group for first.local
resource "aws_security_group" "first-sg" {
vpc_id = aws_vpc.lab-vpc.id
# Security group for bast.land
resource "aws_security_group" "bast-sg" {
vpc_id = aws_vpc.land-vpc.id
# WinRM access from anywhere
ingress {
@@ -493,17 +493,17 @@ resource "aws_security_group" "first-sg" {
cidr_blocks = ["0.0.0.0/0"]
}
# Allow second zone to first
# Allow wakanda zone to bast
ingress {
protocol = "-1"
cidr_blocks = [var.SECOND_SUBNET_CIDR]
cidr_blocks = [var.WAKANDA_SUBNET_CIDR]
from_port = 0
to_port = 0
}
ingress {
protocol = "-1"
cidr_blocks = [var.FIRST_SUBNET_CIDR]
cidr_blocks = [var.BAST_SUBNET_CIDR]
from_port = 0
to_port = 0
}
@@ -525,21 +525,21 @@ resource "aws_security_group" "first-sg" {
}
}
# Security group for second.local
resource "aws_security_group" "second-sg" {
vpc_id = aws_vpc.lab-vpc.id
# Security group for wakanda.land
resource "aws_security_group" "wakanda-sg" {
vpc_id = aws_vpc.land-vpc.id
# Allow secure zone to first
# Allow bast zone to wakanda
ingress {
protocol = "-1"
cidr_blocks = [var.FIRST_SUBNET_CIDR]
cidr_blocks = [var.BAST_SUBNET_CIDR]
from_port = 0
to_port = 0
}
ingress {
protocol = "-1"
cidr_blocks = [var.SECOND_SUBNET_CIDR]
cidr_blocks = [var.WAKANDA_SUBNET_CIDR]
from_port = 0
to_port = 0
}
@@ -561,215 +561,215 @@ resource "aws_security_group" "second-sg" {
}
}
# Add first.local MOF's to S3
resource "aws_s3_object" "first-dc-mof" {
# Add bast.land MOF's to S3
resource "aws_s3_object" "baku-dc-mof" {
bucket = var.SSM_S3_BUCKET
key = "Lab/First.mof"
source = "../dsc/Lab/First.mof"
etag = filemd5("../dsc/Lab/First.mof")
key = "Jungle/Bast.mof"
source = "../dsc/Jungle/Bast.mof"
etag = filemd5("../dsc/Jungle/Bast.mof")
}
# Add second.local MOF's to S3
resource "aws_s3_object" "second-dc-mof" {
# Add wakanda.land MOF's to S3
resource "aws_s3_object" "challa-dc-mof" {
bucket = var.SSM_S3_BUCKET
key = "Lab/Second.mof"
source = "../dsc/Lab/Second.mof"
etag = filemd5("../dsc/Lab/Second.mof")
key = "Jungle/Wakanda.mof"
source = "../dsc/Jungle/Wakanda.mof"
etag = filemd5("../dsc/Jungle/Wakanda.mof")
}
# Add userserver MOF's to S3
resource "aws_s3_object" "user-server-mof" {
# Add nakia MOF's to S3
resource "aws_s3_object" "nakia-mof" {
bucket = var.SSM_S3_BUCKET
key = "Lab/UserServer.mof"
source = "../dsc/Lab/UserServer.mof"
etag = filemd5("../dsc/Lab/UserServer.mof")
key = "Jungle/Nakia.mof"
source = "../dsc/Jungle/Nakia.mof"
etag = filemd5("../dsc/Jungle/Nakia.mof")
}
# Add userworkstation MOF's to S3
resource "aws_s3_object" "user-workstation-mof" {
# Add ramonda MOF's to S3
resource "aws_s3_object" "ramonda-mof" {
bucket = var.SSM_S3_BUCKET
key = "Lab/UserWorkstation.mof"
source = "../dsc/Lab/UserWorkstation.mof"
etag = filemd5("../dsc/Lab/UserWorkstation.mof")
key = "Jungle/Ramonda.mof"
source = "../dsc/Jungle/Ramonda.mof"
etag = filemd5("../dsc/Jungle/Ramonda.mof")
}
# SSM parameters used by DSC
resource "aws_ssm_parameter" "admin-ssm-parameter" {
name = "admin"
resource "aws_ssm_parameter" "tsankara-ssm-parameter" {
name = "tsankara"
type = "SecureString"
value = "{\"Username\":\"admin\", \"Password\":\"Password@1\"}"
value = "{\"Username\":\"tsankara\", \"Password\":\"Password@1\"}"
}
resource "aws_ssm_parameter" "local-user-ssm-parameter" {
name = "local-user"
resource "aws_ssm_parameter" "land-user-ssm-parameter" {
name = "land-user"
type = "SecureString"
value = "{\"Username\":\"local-user\", \"Password\":\"Password@1\"}"
value = "{\"Username\":\"land-user\", \"Password\":\"Password@1\"}"
}
resource "aws_ssm_parameter" "first-admin-ssm-parameter" {
name = "first-admin"
resource "aws_ssm_parameter" "bast-tsankara-ssm-parameter" {
name = "bast-tsankara"
type = "SecureString"
value = "{\"Username\":\"first.local\\\\admin\", \"Password\":\"Password@1\"}"
value = "{\"Username\":\"bast.land\\\\tsankara\", \"Password\":\"Password@1\"}"
}
resource "aws_ssm_parameter" "regular-user-ssm-parameter" {
name = "regular.user"
resource "aws_ssm_parameter" "wakandan-ssm-parameter" {
name = "Wakandan"
type = "SecureString"
value = "{\"Username\":\"regular.user\", \"Password\":\"Password@1\"}"
value = "{\"Username\":\"Wakandan\", \"Password\":\"Password@1\"}"
}
resource "aws_ssm_parameter" "dnsadmin-user-ssm-parameter" {
name = "dnsadmin.user"
resource "aws_ssm_parameter" "thoth-ssm-parameter" {
name = "Thoth"
type = "SecureString"
value = "{\"Username\":\"dnsadmin.user\", \"Password\":\"Password@1\"}"
value = "{\"Username\":\"Thoth\", \"Password\":\"Password@1\"}"
}
resource "aws_ssm_parameter" "unconstrainer-user-ssm-parameter" {
name = "unconstrained.user"
resource "aws_ssm_parameter" "kokou-ssm-parameter" {
name = "Kokou"
type = "SecureString"
value = "{\"Username\":\"unconstrained.user\", \"Password\":\"Password@1\"}"
value = "{\"Username\":\"Kokou\", \"Password\":\"Password@1\"}"
}
resource "aws_ssm_parameter" "constrained-user-ssm-parameter" {
name = "constrained.user"
resource "aws_ssm_parameter" "mujaji-ssm-parameter" {
name = "Mujaji"
type = "SecureString"
value = "{\"Username\":\"constrained.user\", \"Password\":\"Password@1\"}"
value = "{\"Username\":\"Mujaji\", \"Password\":\"Password@1\"}"
}
resource "aws_ssm_parameter" "userwrite-user-ssm-parameter" {
name = "userwrite.user"
resource "aws_ssm_parameter" "sobek-ssm-parameter" {
name = "Sobek"
type = "SecureString"
value = "{\"Username\":\"userwrite.user\", \"Password\":\"Password@1\"}"
value = "{\"Username\":\"Sobek\", \"Password\":\"Password@1\"}"
}
resource "aws_ssm_parameter" "userall-user-ssm-parameter" {
name = "userall.user"
resource "aws_ssm_parameter" "ghekre-ssm-parameter" {
name = "Ghekre"
type = "SecureString"
value = "{\"Username\":\"userall.user\", \"Password\":\"Password@1\"}"
value = "{\"Username\":\"Ghekre\", \"Password\":\"Password@1\"}"
}
resource "aws_ssm_parameter" "compwrite-user-ssm-parameter" {
name = "compwrite.user"
resource "aws_ssm_parameter" "ngi-ssm-parameter" {
name = "Ngi"
type = "SecureString"
value = "{\"Username\":\"compwrite.user\", \"Password\":\"Password@1\"}"
value = "{\"Username\":\"Ngi\", \"Password\":\"Password@1\"}"
}
resource "aws_ssm_parameter" "gpowrite-user-ssm-parameter" {
name = "gpowrite.user"
resource "aws_ssm_parameter" "hadari-yao-ssm-parameter" {
name = "Hadari-Yao"
type = "SecureString"
value = "{\"Username\":\"gpowrite.user\", \"Password\":\"Password@1\"}"
value = "{\"Username\":\"Hadari-Yao\", \"Password\":\"Password@1\"}"
}
resource "aws_ssm_parameter" "lapsread-user-ssm-parameter" {
name = "lapsread.user"
resource "aws_ssm_parameter" "yaounde-ssm-parameter" {
name = "Yaounde"
type = "SecureString"
value = "{\"Username\":\"lapsread.user\", \"Password\":\"Password@1\"}"
value = "{\"Username\":\"Yaounde\", \"Password\":\"Password@1\"}"
}
resource "aws_ssm_parameter" "groupwrite-user-ssm-parameter" {
name = "groupwrite.user"
resource "aws_ssm_parameter" "baoule-ssm-parameter" {
name = "Baoule"
type = "SecureString"
value = "{\"Username\":\"groupwrite.user\", \"Password\":\"Password@1\"}"
value = "{\"Username\":\"Baoule\", \"Password\":\"Password@1\"}"
}
resource "aws_ssm_parameter" "writedacldc-user-ssm-parameter" {
name = "writedacldc.user"
resource "aws_ssm_parameter" "hanuman-ssm-parameter" {
name = "Hanuman"
type = "SecureString"
value = "{\"Username\":\"writedacldc.user\", \"Password\":\"Password@1\"}"
value = "{\"Username\":\"Hanuman\", \"Password\":\"Password@1\"}"
}
resource "aws_ssm_parameter" "readgmsa-user-ssm-parameter" {
name = "readgmsa.user"
resource "aws_ssm_parameter" "akamba-ssm-parameter" {
name = "Akamba"
type = "SecureString"
value = "{\"Username\":\"readgmsa.user\", \"Password\":\"Password@1\"}"
value = "{\"Username\":\"Akamba\", \"Password\":\"Password@1\"}"
}
resource "aws_ssm_parameter" "clearpass-user-ssm-parameter" {
name = "clearpass.user"
resource "aws_ssm_parameter" "mmusa-ssm-parameter" {
name = "Mmusa"
type = "SecureString"
value = "{\"Username\":\"clearpass.user\", \"Password\":\"Password@1\"}"
value = "{\"Username\":\"Mmusa\", \"Password\":\"Password@1\"}"
}
resource "aws_ssm_parameter" "dcsync-user-ssm-parameter" {
name = "dcsync.user"
resource "aws_ssm_parameter" "jabari-ssm-parameter" {
name = "Jabari"
type = "SecureString"
value = "{\"Username\":\"dcsync.user\", \"Password\":\"Password@1\"}"
value = "{\"Username\":\"Jabari\", \"Password\":\"Password@1\"}"
}
resource "aws_ssm_parameter" "roast-user-ssm-parameter" {
name = "roast.user"
resource "aws_ssm_parameter" "plumumba-ssm-parameter" {
name = "Plumumba"
type = "SecureString"
value = "{\"Username\":\"roast.user\", \"Password\":\"Password@1\"}"
value = "{\"Username\":\"Plumumba\", \"Password\":\"Password@1\"}"
}
resource "aws_ssm_parameter" "asrep-user-ssm-parameter" {
name = "asrep.user"
resource "aws_ssm_parameter" "knkrumah-ssm-parameter" {
name = "Knkrumah"
type = "SecureString"
value = "{\"Username\":\"asrep.user\", \"Password\":\"Password@1\"}"
value = "{\"Username\":\"Knkrumah\", \"Password\":\"Password@1\"}"
}
# Apply our DSC via SSM to first.local
resource "aws_ssm_association" "first-dc" {
# Apply DSC via SSM to bast.land
resource "aws_ssm_association" "baku-dc" {
name = "AWS-ApplyDSCMofs"
association_name = "${terraform.workspace}-First-DC"
association_name = "${terraform.workspace}-baku-dc"
targets {
key = "InstanceIds"
values = [aws_instance.first-dc.id]
values = [aws_instance.baku-dc.id]
}
parameters = {
MofsToApply = "s3:${var.SSM_S3_BUCKET}:Lab/First.mof"
MofsToApply = "s3:${var.SSM_S3_BUCKET}:Jungle/Bast.mof"
RebootBehavior = "Immediately"
}
}
# Apply our DSC via SSM to second.local
resource "aws_ssm_association" "second-dc" {
# Apply DSC via SSM to wakanda.land
resource "aws_ssm_association" "challa-dc" {
name = "AWS-ApplyDSCMofs"
association_name = "${terraform.workspace}-Second-DC"
association_name = "${terraform.workspace}-challa-dc"
targets {
key = "InstanceIds"
values = [aws_instance.second-dc.id]
values = [aws_instance.challa-dc.id]
}
parameters = {
MofsToApply = "s3:${var.SSM_S3_BUCKET}:Lab/Second.mof"
MofsToApply = "s3:${var.SSM_S3_BUCKET}:Jungle/Wakanda.mof"
RebootBehavior = "Immediately"
}
}
# Apply our DSC via SSM to User-Server
resource "aws_ssm_association" "user-server" {
# Apply DSC via SSM to nakia
resource "aws_ssm_association" "nakia" {
name = "AWS-ApplyDSCMofs"
association_name = "${terraform.workspace}-User-Server"
association_name = "${terraform.workspace}-nakia"
targets {
key = "InstanceIds"
values = [aws_instance.user-server.id]
values = [aws_instance.nakia.id]
}
parameters = {
MofsToApply = "s3:${var.SSM_S3_BUCKET}:Lab/UserServer.mof"
MofsToApply = "s3:${var.SSM_S3_BUCKET}:Jungle/Nakia.mof"
RebootBehavior = "Immediately"
}
}
# Apply our DSC via SSM to User-Workstation
resource "aws_ssm_association" "user-workstation" {
# Apply DSC via SSM to ramonda
resource "aws_ssm_association" "ramonda" {
name = "AWS-ApplyDSCMofs"
association_name = "${terraform.workspace}-User-Workstation"
association_name = "${terraform.workspace}-ramonda"
targets {
key = "InstanceIds"
values = [aws_instance.user-workstation.id]
values = [aws_instance.ramonda.id]
}
parameters = {
MofsToApply = "s3:${var.SSM_S3_BUCKET}:Lab/UserWorkstation.mof"
MofsToApply = "s3:${var.SSM_S3_BUCKET}:Jungle/Ramonda.mof"
RebootBehavior = "Immediately"
}

8
terraform/get-docker.sh
View File

@@ -292,7 +292,7 @@ do_install() {
else
cat >&2 <<-'EOF'
Error: this installer needs the ability to run commands as root.
We are unable to find either "sudo" or "su" available to make this happen.
We are unable to find either "sudo" or "su" availandle to make this happen.
EOF
exit 1
fi
@@ -448,7 +448,7 @@ do_install() {
fi
$sh_c "DEBIAN_FRONTEND=noninteractive apt-get install -y -qq --no-install-recommends $pkgs >/dev/null"
if version_gte "20.10"; then
# Install docker-ce-rootless-extras without "--no-install-recommends", so as to install slirp4netns when available
# Install docker-ce-rootless-extras without "--no-install-recommends", so as to install slirp4netns when availandle
$sh_c "DEBIAN_FRONTEND=noninteractive apt-get install -y -qq docker-ce-rootless-extras${pkg_version%=} >/dev/null"
fi
)
@@ -457,7 +457,7 @@ do_install() {
;;
centos|fedora|rhel)
if [ "$(uname -m)" != "s390x" ] && [ "$lsb_dist" = "rhel" ]; then
echo "Packages for RHEL are currently only available for s390x."
echo "Packages for RHEL are currently only availandle for s390x."
exit 1
fi
yum_repo="$DOWNLOAD_URL/linux/$lsb_dist/$REPO_FILE"
@@ -545,7 +545,7 @@ do_install() {
;;
sles)
if [ "$(uname -m)" != "s390x" ]; then
echo "Packages for SLES are currently only available for s390x"
echo "Packages for SLES are currently only availandle for s390x"
exit 1
fi

2
terraform/infracost-base.json
View File

File diff suppressed because one or more lines are too long

8
terraform/scripts/join-domain.ps1
View File

@@ -1,9 +1,9 @@
# Join the Windows 10 to the domain
Start-Sleep -Seconds 300
$domain = "first.local"
$domain = "bast.land"
$password = ConvertTo-SecureString "Password@1" -asPlainText -Force
$username = "admin@first.local"
$username = "tsankara@bast.land"
$credential = New-Object System.Management.Automation.PSCredential($username,$password)
Add-Computer -DomainName $domain -NewName "Ulysses" -Credential $credential
Invoke-Command -Scriptblock {net localgroup "Remote Desktop Users" "first\domain users" /add}
Add-Computer -DomainName $domain -NewName "Ramonda" -Credential $credential
Invoke-Command -Scriptblock {net localgroup "Remote Desktop Users" "bast\domain users" /add}
# Restart-Computer -Force

2
terraform/scripts/vuln-install.sh
View File

@@ -86,7 +86,7 @@ then
stop
elif [[ $1 == "list" ]]
then
echo -e "Listing all available Docker containers from vulhub."
echo -e "Listing all availandle Docker containers from vulhub."
else
echo -e "\n\e[31m\e[1mVulnerables\e[0m: a quick and simple way of starting multiple Docker containers from vulhub.\n"

23
terraform/vars.tf
View File

@@ -14,7 +14,10 @@ variable "SSH_USER" {
default = "admin"
}
variable "WinRM_USER" {
default = "admin@first.local"
default = "admin@bast.land"
}
variable "Domain_Admin" {
default = "tsankara@bast.land"
}
variable "WinRM_PASSWORD" {
default = "Password@1"
@@ -23,31 +26,31 @@ variable "VPC_CIDR" {
default = "10.0.0.0/16"
}
variable "FIRST_SUBNET_CIDR" {
variable "BAST_SUBNET_CIDR" {
default = "10.0.1.0/24"
}
variable "SECOND_SUBNET_CIDR" {
variable "WAKANDA_SUBNET_CIDR" {
default = "10.0.2.0/24"
}
variable "FIRST_DC_IP" {
variable "BAKU_DC_IP" {
default = "10.0.1.100"
}
variable "USER_SERVER_IP" {
variable "NAKIA_IP" {
default = "10.0.1.50"
}
variable "WEB_SERVER_1_IP" {
variable "OKOYE_IP" {
default = "10.0.1.51"
}
variable "WEB_SERVER_2_IP" {
variable "SONINKE_IP" {
default = "10.0.1.52"
}
variable "USER_WORKSTATION_IP" {
variable "RAMONDA_IP" {
default = "10.0.1.53"
}
@@ -55,11 +58,11 @@ variable "GUAC_SERVER_IP" {
default = "10.0.1.10"
}
variable "ATTACKER_KALI_IP" {
variable "ULYSSES_IP" {
default = "10.0.1.11"
}
variable "SECOND_DC_IP" {
variable "CHALLA_DC_IP" {
default = "10.0.2.100"
}