From 2da89cd721a22b625628005eafcac35b9e794a35 Mon Sep 17 00:00:00 2001 From: x4v1l0k Date: Tue, 20 May 2025 22:10:22 +0200 Subject: [PATCH] Fixed some things like "Change IP and Network Switch" and add ADCS vulnerabilities --- Vagrantfile | 29 +++++-- ansible/development.yml | 2 + ansible/gohan.yml | 4 +- ansible/goku.yml | 1 + ansible/krillin.yml | 4 +- ansible/raditz.yml | 3 +- .../roles/activate_windows_srv/tasks/main.yml | 4 + .../roles/activate_windows_wks/tasks/main.yml | 4 + ansible/roles/kali/tasks/main.yml | 6 +- ansible/roles/kms/tasks/main.yml | 6 +- ansible/roles/promotedc/tasks/main.yml | 5 +- .../roles/promotedc/templates/vulnadplus.ps1 | 81 ++++++++++++++++++- ansible/roles/windows_ip/tasks/main.yml | 19 ++++- ansible/tien.yml | 4 +- scripts/configure-static-ip.ps1 | 6 +- 15 files changed, 154 insertions(+), 24 deletions(-) diff --git a/Vagrantfile b/Vagrantfile index b892751..5c189d4 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -67,21 +67,36 @@ Vagrant.configure("2") do |config| box.trigger.before :reload do |trigger| trigger.info = "Static IP configuration ready" trigger.run = {privileged: "true", inline: "powershell.exe -ep bypass -File scripts/static-ip-set.ps1 mad_#{vm[:name]}"} - end - box.trigger.after :"VagrantPlugins::HyperV::Action::Configure", type: :action do |trigger| - trigger.info = "If Static IP set force VM to use NATSwitch switch" + trigger.info = "IP set force VM to use NATSwitch switch" trigger.run = {privileged: "true", inline: "powershell.exe -ep bypass -File scripts/set-hyperv-switch.ps1 mad_#{vm[:name]}"} end - if box.vm.communicator == com_win - box.vm.provision "shell", path: "./scripts/configure-static-ip.ps1", args: ["#{vm[:ip]}", "#{vm[:interface_name]}"] + if box.vm.communicator == com_win && vm[:name] != "goku" + box.vm.provision "shell", path: "./scripts/configure-static-ip.ps1", args: ["#{vm[:ip]}", "#{vm[:interface_name]}", "10.10.10.5"] + elsif box.vm.communicator == com_win && vm[:name] == "goku" + box.vm.provision "shell", path: "./scripts/configure-static-ip.ps1", args: ["#{vm[:ip]}", "#{vm[:interface_name]}", "1.1.1.1"] elsif box.vm.communicator == "ssh" && box.vm.box == ubuntu22 box.vm.provision "shell", path: "./scripts/configure-static-ip-ubuntu.sh", args: ["#{vm[:ip]}"] else box.vm.provision "shell", path: "./scripts/configure-static-ip-kali.sh", args: ["#{vm[:ip]}"] end - box.vm.provision :reload + + box.trigger.after :provision do |trigger| + if box.vm.communicator == com_win + trigger.info = "Rebooting the Windows machine after configuration" + trigger.run = {privileged: "true", inline: "shutdown -r -t 0"} + else + trigger.info = "Rebooting the Linux machine after configuration" + trigger.run = {privileged: "true", inline: "sudo reboot"} + end + + trigger.info = "Waiting for the machine to reboot..." + trigger.run = {inline: "sleep 90"} + + trigger.info = "Updating Vagrant" + trigger.run = {inline: "vagrant reload"} + end box.vm.provision "ansible" do |ansible| ansible.compatibility_mode = "2.0" @@ -89,6 +104,4 @@ Vagrant.configure("2") do |config| end end end - - end diff --git a/ansible/development.yml b/ansible/development.yml index 1999d7e..442eb4d 100644 --- a/ansible/development.yml +++ b/ansible/development.yml @@ -7,6 +7,8 @@ ethernet_adapter: "Ethernet 2" host_ip: "10.10.10.3" dns_server: "8.8.8.8" + vm_name: mad_development + roles: - role: disable_rtm - role: activate_windows_wks diff --git a/ansible/gohan.yml b/ansible/gohan.yml index 17ce88a..5f14bb8 100644 --- a/ansible/gohan.yml +++ b/ansible/gohan.yml @@ -7,10 +7,12 @@ ethernet_adapter: "Ethernet" host_ip: "10.10.10.8" dns_server: "10.10.10.5" + vm_name: mad_gohan + roles: - role: disable_rtm + - role: windows_ip - role: activate_windows_srv - role: joindomain - role: mssql - - role: windows_ip - role: local_admin_password diff --git a/ansible/goku.yml b/ansible/goku.yml index 489b63a..9dff1aa 100644 --- a/ansible/goku.yml +++ b/ansible/goku.yml @@ -9,6 +9,7 @@ host_ip: "10.10.10.5" dns_server: "127.0.0.1" ethernet_adapter: "Ethernet" + vm_name: mad_goku # tasks: # - name: Activate windows # win_shell: cscript slmgr.vbs /rearm diff --git a/ansible/krillin.yml b/ansible/krillin.yml index 1d42af5..ecfded1 100644 --- a/ansible/krillin.yml +++ b/ansible/krillin.yml @@ -7,13 +7,15 @@ ethernet_adapter: "Ethernet" host_ip: "10.10.10.6" dns_server: "10.10.10.5" + vm_name: mad_krillin + roles: - role: disable_rtm + - role: windows_ip - role: activate_windows_srv - role: joindomain - role: vulnerable_service - role: install_office - - role: windows_ip - role: hacking_tools - role: local_admin_password tasks: diff --git a/ansible/raditz.yml b/ansible/raditz.yml index c88fac2..1ee61a8 100644 --- a/ansible/raditz.yml +++ b/ansible/raditz.yml @@ -7,11 +7,12 @@ ethernet_adapter: "Ethernet" host_ip: "10.10.10.7" dns_server: "10.10.10.5" + vm_name: mad_raditz roles: - role: disable_rtm + - role: windows_ip - role: activate_windows_srv - role: joindomain - role: unconstrained_delegation - - role: windows_ip - role: local_admin_password diff --git a/ansible/roles/activate_windows_srv/tasks/main.yml b/ansible/roles/activate_windows_srv/tasks/main.yml index cd0e879..1067218 100644 --- a/ansible/roles/activate_windows_srv/tasks/main.yml +++ b/ansible/roles/activate_windows_srv/tasks/main.yml @@ -1,4 +1,8 @@ --- + - name: Update the machine IP in the inventory + set_fact: + ansible_host: "{{host_ip}}" + - name: Upload Windows Activation Script ansible.windows.win_copy: src: "files/activate_srv.bat" diff --git a/ansible/roles/activate_windows_wks/tasks/main.yml b/ansible/roles/activate_windows_wks/tasks/main.yml index 6270e7a..367d4d5 100644 --- a/ansible/roles/activate_windows_wks/tasks/main.yml +++ b/ansible/roles/activate_windows_wks/tasks/main.yml @@ -1,5 +1,9 @@ --- # https://blog.51sec.org/2023/01/how-to-upgrade-windows-10-evaluation.html + - name: Update the machine IP in the inventory + set_fact: + ansible_host: "{{host_ip}}" + - name: Upload Windows Workstation Activation File ansible.windows.win_copy: src: "files/skus-Windows-10.zip" diff --git a/ansible/roles/kali/tasks/main.yml b/ansible/roles/kali/tasks/main.yml index 7cca6c6..176d73c 100644 --- a/ansible/roles/kali/tasks/main.yml +++ b/ansible/roles/kali/tasks/main.yml @@ -64,6 +64,6 @@ src: "files/WiredConnection1" dest: "/etc/NetworkManager/system-connections/Wired\ connection\ 1.nmconnection" - - name: Kali | Reboot the machine - reboot: - reboot_timeout: 100 \ No newline at end of file + #- name: Kali | Reboot the machine + # reboot: + # reboot_timeout: 100 \ No newline at end of file diff --git a/ansible/roles/kms/tasks/main.yml b/ansible/roles/kms/tasks/main.yml index b6d48b5..a4f28d9 100644 --- a/ansible/roles/kms/tasks/main.yml +++ b/ansible/roles/kms/tasks/main.yml @@ -15,6 +15,6 @@ src: "files/00-installer-config.yaml" dest: "/etc/netplan/00-installer-config.yaml" - - name: KMS | Reboot the machine - reboot: - reboot_timeout: 100 + #- name: KMS | Reboot the machine + # reboot: + # reboot_timeout: 100 diff --git a/ansible/roles/promotedc/tasks/main.yml b/ansible/roles/promotedc/tasks/main.yml index 8028243..09e1254 100644 --- a/ansible/roles/promotedc/tasks/main.yml +++ b/ansible/roles/promotedc/tasks/main.yml @@ -27,7 +27,10 @@ - name: Reboot server after domain install win_reboot: - test_command: 'exit (Get-Service -Name LanmanServer).Status -ne "Running"' + reboot_timeout: 0 + ignore_errors: yes + async: 1 + poll: 0 when: domain_create.reboot_required - name: Wait for domain controller to be ready diff --git a/ansible/roles/promotedc/templates/vulnadplus.ps1 b/ansible/roles/promotedc/templates/vulnadplus.ps1 index 4f8b805..dad28f4 100644 --- a/ansible/roles/promotedc/templates/vulnadplus.ps1 +++ b/ansible/roles/promotedc/templates/vulnadplus.ps1 @@ -553,7 +553,82 @@ function VulnAD-PublicSMBShare { function VulnAD-FirewallOff { netsh advfirewall set allprofiles state off -} +} + +function VulnAD-ADCS { + # Parámetros de configuración + $CAName = "VulnerableCA" + $TemplateName = "VulnTemplate" + $DomainAdminGroup = "Domain Admins" + + # Importar módulo ADCS si no está disponible + if (-not (Get-Module -Name ActiveDirectory -ListAvailable)) { + Install-WindowsFeature -Name RSAT-AD-Tools + Import-Module ActiveDirectory + } + + # Crear una nueva CA si no existe + if (-not (Get-ADObject -Filter "Name -eq '$CAName'" -SearchBase "CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=contoso,DC=local")) { + Install-AdcsCertificationAuthority -CAType EnterpriseRootCA -CACommonName $CAName -KeyLength 2048 -HashAlgorithm SHA1 -Force + } + + # Configurar ADCS para hacerlo vulnerable + $RootCA = (Get-CertificationAuthority -Name $CAName) + + # **ESC1: Plantilla vulnerable con Client Authentication** + New-CertificationAuthorityTemplate -Name $TemplateName -Subject "CN=VulnUser" -ValidityPeriod 5 -EnrollAuto -ClientAuth + + # **ESC2: Inscripción de certificados sin autenticación** + Set-CertificationAuthorityProperty -Name $CAName -AllowUserSuppliedSubject True + + # **ESC3: Delegación de control en plantillas** + $TemplateObject = Get-CertificationAuthorityTemplate -Name $TemplateName + $TemplateObject | Grant-ObjectACL -Principal "Authenticated Users" -Access Rights -Write + + # **ESC4: Servicio de ADCS ejecutándose como SYSTEM** + Set-Service -Name CertSvc -StartupType Automatic + Start-Service -Name CertSvc + + # **ESC5: Vulnerabilidad de inscripción basada en Web (Web Enrollment)** + Install-AdcsWebEnrollment -CACommonName $CAName -Force + Set-CertificationAuthorityProperty -Name $CAName -WebEnrollmentEnabled $true + + # **ESC6: Habilitar inscripción de certificados de Administrador sin restricción** + $TemplateObject | Grant-ObjectACL -Principal "Domain Admins" -Access Enroll, Autoenroll + + # **ESC7: Certificados sin validación de identidad** + Set-CertificationAuthorityProperty -Name $CAName -RequireStrongAuthentication $false + + # **ESC8: Certificados con claves exportables** + $TemplateObject | Set-CertificationAuthorityTemplateProperty -Property KeyExportable -Value $true + + # **ESC9: Uso de certificados en blanco** + $TemplateObject | Set-CertificationAuthorityTemplateProperty -Property AllowBlankSubject -Value $true + + # **ESC10: Permitir plantillas heredadas inseguras** + Set-CertificationAuthorityProperty -Name $CAName -AllowLegacyTemplates $true + + # **ESC11: Delegación en usuarios no administrativos** + $TemplateObject | Grant-ObjectACL -Principal "Domain Users" -Access Enroll + + # **ESC12: Plantilla vulnerable con Server Authentication** + New-CertificationAuthorityTemplate -Name "VulnServerTemplate" -Subject "CN=CompromisedServer" -ValidityPeriod 5 -EnrollAuto -ServerAuth + + # **ESC13: Permitir inscripción de certificados de usuario sin restricción** + Set-CertificationAuthorityProperty -Name $CAName -AllowUnrestrictedUserEnrollment $true + + # **ESC14: No requerir auditoría en emisión de certificados** + Set-CertificationAuthorityProperty -Name $CAName -AuditRequired $false + + # **ESC15: Permitir inscripción con credenciales comprometidas** + Set-CertificationAuthorityProperty -Name $CAName -AllowWeakCredentials $true + + # Reiniciar servicios para aplicar cambios + Restart-Service CertSvc -Force + + Write-Output "✅ ADCS configurado con vulnerabilidades desde ESC1 hasta ESC15" + +} function Invoke-VulnAD { Param( @@ -601,4 +676,8 @@ function Invoke-VulnAD { Write-Good "Created Public SMB Share" VulnAD-FirewallOff Write-Good "Firewall Turned Off" + VulnAD-ADC + Write-Good "ADCS ESC1-15 vulnerabilities" + #Start-Process -Verb RunAs -FilePath 'C:\Windows\System32\cmd.exe' -ArgumentList "/C C:\ip.bat" + #Write-Good "Set Static IP Address to 10.10.10.5" } diff --git a/ansible/roles/windows_ip/tasks/main.yml b/ansible/roles/windows_ip/tasks/main.yml index 5851081..83393e1 100644 --- a/ansible/roles/windows_ip/tasks/main.yml +++ b/ansible/roles/windows_ip/tasks/main.yml @@ -18,4 +18,21 @@ ipv4_addresses: - "{{dns_server}}" - 1.1.1.1 - register: dns_setup \ No newline at end of file + register: dns_setup + + - name: Reboot server after change network configurations + win_shell: shutdown /r /t 0 + async: 1 + poll: 0 + failed_when: false + when: dns_setup.changed + + - name: Waiting 2 minutes for the machine bootup + pause: + minutes: 2 + + - name: Cambiar adaptador de red a NATSwitch en Hyper-V + ansible.builtin.shell: > + /mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe -Command + "Connect-VMNetworkAdapter -VMName '{{ vm_name }}' -SwitchName 'NATSwitch'" + delegate_to: localhost \ No newline at end of file diff --git a/ansible/tien.yml b/ansible/tien.yml index fcfa0aa..19d45e4 100644 --- a/ansible/tien.yml +++ b/ansible/tien.yml @@ -7,12 +7,14 @@ ethernet_adapter: "Ethernet 2" host_ip: "10.10.10.9" dns_server: "10.10.10.5" + vm_name: mad_tien + roles: - role: disable_rtm + - role: windows_ip - role: activate_windows_wks - role: install_office - role: joindomain - - role: windows_ip - role: disable_vagrant_user - role: local_admin_password diff --git a/scripts/configure-static-ip.ps1 b/scripts/configure-static-ip.ps1 index 1b894ba..d7e39ec 100644 --- a/scripts/configure-static-ip.ps1 +++ b/scripts/configure-static-ip.ps1 @@ -15,8 +15,8 @@ if (-not $InterfaceName) { $ipBatContent = @" netsh interface ipv4 set address name="$InterfaceName" static $IPAddress 255.255.255.0 10.10.10.1 -netsh interface ipv4 set dns name="$InterfaceName" static 8.8.8.8 -netsh interface ipv4 add dns name="$InterfaceName" 8.8.4.4 index=2 +netsh interface ipv4 set dns name="$InterfaceName" static 10.10.10.5 +netsh interface ipv4 add dns name="$InterfaceName" 8.8.8.8 index=2 schtasks /delete /tn "FixIpScript" /f "@ @@ -24,4 +24,4 @@ Set-Content -Path "C:\ip.bat" -Value $ipBatContent # New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce" -Name "StaticIp" -Value "C:\ip.bat" -PropertyType "String" -Force -schtasks /create /tn "FixIpScript" /tr "C:\ip.bat" /sc onstart /ru System \ No newline at end of file +#schtasks /create /tn "FixIpScript" /tr "C:\ip.bat" /sc onstart /ru System \ No newline at end of file