More updates

.gitignore

@@ -34,4 +34,5 @@ dsc/Lab/*
 terraform/terraform*
 terraform/.terraform*
 
-.env
+.env
+NOTES

terraform/aws.tf

@@ -113,15 +113,8 @@ resource "aws_instance" "user-server" {
   ]
 }
 
-/* resource "time_sleep" "wait_15_minutes" {
-  depends_on = [aws_instance.first-dc]
-
-  create_duration = "900s"
-} */
-
 # A Windows 10 Pro development host providing RDP access for crafting and testing payloads
 resource "aws_instance" "user-workstation" {
-  #depends_on = [time_sleep.wait_15_minutes]
   ami                         = data.aws_ami.windows-client.image_id
   instance_type               = "t2.medium"
   key_name                    = aws_key_pair.terraformkey.key_name
@@ -130,7 +123,6 @@ resource "aws_instance" "user-workstation" {
   private_ip                  = var.USER_WORKSTATION_IP
   depends_on                  = [aws_instance.first-dc]
   iam_instance_profile        = aws_iam_instance_profile.ssm_instance_profile.name
-  # user_data                   = file("./scripts/choco.ps1")
   tags = {
     Workspace = "${terraform.workspace}"
     Name      = "${terraform.workspace}-User-Workstation"
@@ -140,11 +132,7 @@ resource "aws_instance" "user-workstation" {
     aws_security_group.first-sg.id,
   ]
 
-  root_block_device {
-    delete_on_termination = true
-    volume_size           = 100
-  }
-
+# Connect to the Win 10 with the Local Admin account and then activate the default Administrator account
   provisioner "remote-exec" {
     inline = [
       "net user Administrator /active:yes",
@@ -163,6 +151,7 @@ resource "aws_instance" "user-workstation" {
     }
   }
 
+# Push some PowerShell scripts from our local box unto the remote Win 10 box
   provisioner "file" {
     source      = "./scripts/rt-toolz.ps1"
     destination = "C:/Windows/Temp/rt-toolz.ps1"
@@ -195,30 +184,10 @@ resource "aws_instance" "user-workstation" {
     }
   }
 
-  /* provisioner "remote-exec" {
-    inline = [
-      "net user Administrator /active:yes",
-      "net user Administrator ${var.WinRM_PASSWORD}"
-      ]
-
-      connection {
-      type     = "winrm"
-      user     = "admin"
-      password = var.WinRM_PASSWORD
-      host     = aws_instance.user-workstation.public_ip
-      port     = 5985
-      insecure = true
-      https    = false
-      timeout  = "10m"
-    }
-  }
- */
-
+# Run the PowerShell scripts on the Remote Win 10 box to install tools and also join the Win 10 box to the domain
   provisioner "remote-exec" {
     inline = [
-      # "net user admin /active:no"
       "powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/rt-toolz.ps1", "powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/join-domain.ps1"
-      # "powershell -ExecutionPolicy Bypass Rename-Computer -NewName 'WIN-DEV'"
     ]
 
     connection {
@@ -233,25 +202,7 @@ resource "aws_instance" "user-workstation" {
     }
   }
 
-  /* provisioner "remote-exec" {
-    inline = [
-      # "net user admin /active:no"
-      "powershell -ExecutionPolicy Bypass -File C:/Windows/Temp/join-domain.ps1"
-      # "powershell -ExecutionPolicy Bypass Rename-Computer -NewName 'WIN-DEV'"
-    ]
-
-    connection {
-      type     = "winrm"
-      user     = "Administrator"
-      password = var.WinRM_PASSWORD
-      host     = aws_instance.user-workstation.public_ip
-      port     = 5985
-      insecure = true
-      https    = false
-      timeout  = "7m"
-    }
-  } */
-
+# Once the Win 10 box is joined to the domain, it will need to be restarted. Using this as a backup to make sure the box actually do reboot
   provisioner "remote-exec" {
     inline = [
       "powershell -ExecutionPolicy Bypass Restart-Computer -Force"
@@ -427,28 +378,27 @@ resource "null_resource" "guac-server-setup" {
 }
 
 resource "null_resource" "guacozy-server-setup" {
-  connection {
+    connection {
     type        = "ssh"
     host        = aws_instance.guac-server.public_ip
     user        = var.SSH_USER
     port        = "22"
     private_key = file(var.PATH_TO_PRIVATE_KEY)
     agent       = false
-    # depends_on  = null_resource.guacamole-server-setup
   }
 
   provisioner "file" {
-    source      = "./scripts/guacozy.sh"
-    destination = "/tmp/guacozy.sh"
+    source      = "./files/docker-compose.yml"
+    destination = "/tmp/docker-compose.yml"
   }
 
   provisioner "remote-exec" {
     inline = [
-      "sleep 10",
-      "sudo chmod +x /tmp/guacozy.sh",
-      "/tmp/guacozy.sh",
+      "sleep 60",
+      "cd /tmp/",
+      "sudo docker-compose up > /dev/null 2>&1",
     ]
-    # on_failure = continue
+    on_failure = continue
   }
 }
 

terraform/scripts/guacozy.sh

@@ -1,8 +1,10 @@
 #!/usr/bin/env bash
 cd /tmp
-touch dc.yml
-var=/tmp/dc.yml
-cat << EOF >> $var
+mkdir guacozy
+cd guacozy
+touch docker-compose.yml
+
+cat << EOF >> docker-compose.yml
 version: '3'  
 services:
   server:
@@ -33,6 +35,35 @@ volumes:
   postgres-data:
 EOF
 
-sudo docker-compose -f dc.yml up -d
+# Check if docker-compose.yml exists
+init_check () { # Check whether vulhub folder exists
+    if [[ ! -f docker-compose.yml ]]
+    then
+        echo "The docker-compose.yml file doesn't exit"
+        exit 1
+    fi
+}
+
+start () {
+	docker-compose -f docker-compose.yml up -d
+}
+
+stop () {
+	docker-compose -f docker-dompose.yml down -v
+}
+
+if [[ $1 == "start" ]]
+then
+    init_check
+    echo "Starting all docker containers..."
+    start
+elif [[ $1 == "stop" ]]
+then
+    init_check
+    echo "Stopping all docker containers ..."
+    stop
+else
+    echo -e "Usage: $0 [start or stop]\n"
+fi
 
 #sudo docker-compose up -d

terraform/scripts/join-domain.ps1

@@ -4,6 +4,6 @@ $domain = "first.local"
 $password = ConvertTo-SecureString "Password@1" -asPlainText -Force
 $username = "admin@first.local"
 $credential = New-Object System.Management.Automation.PSCredential($username,$password)
-Add-Computer -DomainName $domain -NewName "WKSTN001" -Credential $credential
+Add-Computer -DomainName $domain -NewName "Ulysses" -Credential $credential
 Invoke-Command -Scriptblock {net localgroup "Remote Desktop Users" "first\domain users" /add}
-Restart-Computer -Force
+# Restart-Computer -Force

terraform/scripts/rt-toolz.ps1

@@ -4,7 +4,9 @@ New-Item -Path 'C:\toolz' -ItemType Directory
 Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
 
 # Install some stuff
-choco install git googlechrome processhacker python burp-suite-free-edition zap autopsy 7zip adobereader adexplorer apimonitor apktool netfx-4.8 cutter dnspy ghidra golang ida-free javadecompiler-gui -y
+choco install git googlechrome processhacker python burp-suite-free-edition zap -y
+<# 
+autopsy 7zip adobereader adexplorer apimonitor apktool netfx-4.8 cutter dnspy ghidra golang ida-free javadecompiler-gui#>
 
 # Pause for 60 seconds
 <# Start-Sleep -Seconds 60

terraform/scripts/vuln-install.sh

@@ -25,14 +25,14 @@ git clone https://github.com/vulhub/vulhub.git
 
 for i in ${CONTAINERS[@]}; do sudo docker-compose -f $i up -d; done
 
-init_check () { # Check whether vulhub folder exists
+init_check () { # Check if vulhub folder exists
     if [[ ! -d vulhub ]]
     then
         echo "The vulhub folder was not found. Download from https://github.com/vulhub/vulhub"
         exit 1
     fi
 
-    # Check whether docker is installed
+    # Check if docker is installed
     docker --version > /dev/null 2>&1
     if [[ $? -ne 0 ]]
     then
@@ -40,7 +40,7 @@ init_check () { # Check whether vulhub folder exists
         exit 3
     fi
 
-    # Check whether docker-compose is installed
+    # Check if docker-compose is installed
     docker-compose version > /dev/null 2>&1
     if [[ $? -ne 0 ]]
     then
@@ -87,7 +87,7 @@ then
 elif [[ $1 == "list" ]]
 then
     echo -e "Listing all available Docker containers from vulhub."
-    # TODO: List all the available Docker containers. Check if they are running.
+    
 else
     echo -e "\n\e[31m\e[1mVulnerables\e[0m: a quick and simple way of starting multiple Docker containers from vulhub.\n"
     echo -e "Usage: $0 [start or stop]\n"

terraform/scripts/vulns-install.sh

@@ -1,27 +0,0 @@
-#!/usr/bin/env bash
-# Install Docker and related stuff
-
-export DEBIAN_FRONTEND=noninteractive
-apt-get -qy -o "Dpkg::Options::=--force-confdef" -o "Dpkg::Options::=--force-confold" upgrade
-apt-get remove docker docker-engine docker.io containerd runc
-curl -fsSL https://get.docker.com -o get-docker.sh
-sh get-docker.sh
-apt install git -y
-apt-get update -y
-apt install -y python3-pip
-sudo curl -L https://github.com/docker/compose/releases/download/1.25.3/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose
-sudo chmod +x /usr/local/bin/docker-compose
-
-# Pull the vulnerable Docker images
-DIRECTORY="vulhub"
-CONTAINERS[0]="$DIRECTORY/coldfusion/CVE-2017-3066/docker-compose.yml" # port 8500
-CONTAINERS[1]="$DIRECTORY/jboss/JMXInvokerServlet-deserialization/docker-compose.yml" # port 8080
-CONTAINERS[2]="$DIRECTORY/activemq/CVE-2016-3088/docker-compose.yml" # port 8161
-CONTAINERS[3]="$DIRECTORY/samba/CVE-2017-7494/docker-compose.yml" # port 445
-CONTAINERS[4]="$DIRECTORY/couchdb/CVE-2017-12636/docker-compose.yml" # port 5984
-CONTAINERS[5]="$DIRECTORY/supervisor/CVE-2017-11610/docker-compose.yml" # port 9001
-CONTAINERS[6]="$DIRECTORY/weblogic/ssrf/docker-compose.yml" # port 7001
-git clone https://github.com/vulhub/vulhub.git
-
-# Run each of the vulneble Docker images
-for i in ${CONTAINERS[@]}; do sudo docker-compose -f $i up -d; done

terraform/vars.tf

@@ -151,10 +151,9 @@ data "aws_ami" "latest-kali-linux" {
 }
 
 # My Customized Windows 10 Pro for Workstation AMI Image
-# https://github.com/splunk/attack_range/wiki/Upload-Windows-10-AMI-to-AWS
+# Borrowed from https://github.com/splunk/attack_range/wiki/Upload-Windows-10-AMI-to-AWS and
 # https://www.rickgouin.com/run-a-windows-10-instance-in-aws-ec2/
 data "aws_ami" "windows-client" {
-  # Count
   owners = ["104743148836"]
   #owners = ["self"]