Fixed some things like "Change IP and Network Switch" and add ADCS vulnerabilities

Vagrantfile

@@ -67,28 +67,41 @@ Vagrant.configure("2") do |config|
       box.trigger.before :reload do |trigger|
         trigger.info = "Static IP configuration ready"
         trigger.run = {privileged: "true", inline: "powershell.exe -ep bypass -File scripts/static-ip-set.ps1 mad_#{vm[:name]}"}
-      end
 
-      box.trigger.after :"VagrantPlugins::HyperV::Action::Configure", type: :action do |trigger|
-        trigger.info = "If Static IP set force VM to use NATSwitch switch"
+        trigger.info = "IP set force VM to use NATSwitch switch"
         trigger.run = {privileged: "true", inline: "powershell.exe -ep bypass -File scripts/set-hyperv-switch.ps1 mad_#{vm[:name]}"}
       end
 
-      if box.vm.communicator == com_win
-        box.vm.provision "shell", path: "./scripts/configure-static-ip.ps1", args: ["#{vm[:ip]}", "#{vm[:interface_name]}"]
+      if box.vm.communicator == com_win && vm[:name] != "goku"
+        box.vm.provision "shell", path: "./scripts/configure-static-ip.ps1", args: ["#{vm[:ip]}", "#{vm[:interface_name]}", "10.10.10.5"]
+      elsif box.vm.communicator == com_win && vm[:name] == "goku"
+        box.vm.provision "shell", path: "./scripts/configure-static-ip.ps1", args: ["#{vm[:ip]}", "#{vm[:interface_name]}", "1.1.1.1"]
       elsif box.vm.communicator == "ssh" && box.vm.box == ubuntu22
         box.vm.provision "shell", path: "./scripts/configure-static-ip-ubuntu.sh", args: ["#{vm[:ip]}"]
       else
         box.vm.provision "shell", path: "./scripts/configure-static-ip-kali.sh", args: ["#{vm[:ip]}"]
       end
-      box.vm.provision :reload
+
+      box.trigger.after :provision do |trigger|
+        if box.vm.communicator == com_win
+          trigger.info = "Rebooting the Windows machine after configuration"
+          trigger.run = {privileged: "true", inline: "shutdown -r -t 0"}
+        else
+          trigger.info = "Rebooting the Linux machine after configuration"
+          trigger.run = {privileged: "true", inline: "sudo reboot"}
+        end
+
+        trigger.info = "Waiting for the machine to reboot..."
+        trigger.run = {inline: "sleep 90"}
+
+        trigger.info = "Updating Vagrant"
+        trigger.run = {inline: "vagrant reload"}
+      end
 
       box.vm.provision "ansible" do |ansible| 
         ansible.compatibility_mode = "2.0"
         ansible.playbook = "ansible/#{vm[:name]}.yml"
       end
     end
   end
-
-
 end

ansible/development.yml

@@ -7,6 +7,8 @@
     ethernet_adapter: "Ethernet 2"
     host_ip: "10.10.10.3"
     dns_server: "8.8.8.8"
+    vm_name: mad_development
+
   roles:
   - role: disable_rtm
   - role: activate_windows_wks

ansible/gohan.yml

@@ -7,10 +7,12 @@
     ethernet_adapter: "Ethernet"
     host_ip: "10.10.10.8"
     dns_server: "10.10.10.5"
+    vm_name: mad_gohan
+
   roles:
     - role: disable_rtm
+    - role: windows_ip
     - role: activate_windows_srv
     - role: joindomain
     - role: mssql
-    - role: windows_ip
     - role: local_admin_password

ansible/goku.yml

@@ -9,6 +9,7 @@
     host_ip: "10.10.10.5"
     dns_server: "127.0.0.1"
     ethernet_adapter: "Ethernet"
+    vm_name: mad_goku
   # tasks:
   # - name: Activate windows
   #   win_shell: cscript slmgr.vbs /rearm

ansible/krillin.yml

@@ -7,13 +7,15 @@
     ethernet_adapter: "Ethernet"
     host_ip: "10.10.10.6"
     dns_server: "10.10.10.5"
+    vm_name: mad_krillin
+
   roles:
     - role: disable_rtm
+    - role: windows_ip
     - role: activate_windows_srv
     - role: joindomain
     - role: vulnerable_service
     - role: install_office
-    - role: windows_ip
     - role: hacking_tools
     - role: local_admin_password
   tasks:

ansible/raditz.yml

@@ -7,11 +7,12 @@
     ethernet_adapter: "Ethernet"
     host_ip: "10.10.10.7"
     dns_server: "10.10.10.5"
+    vm_name: mad_raditz
 
   roles:
    - role: disable_rtm
+   - role: windows_ip
    - role: activate_windows_srv
    - role: joindomain
    - role: unconstrained_delegation
-   - role: windows_ip
    - role: local_admin_password

ansible/roles/activate_windows_srv/tasks/main.yml

@@ -1,4 +1,8 @@
 ---
+  - name: Update the machine IP in the inventory
+    set_fact:
+      ansible_host: "{{host_ip}}"
+
   - name: Upload Windows Activation Script
     ansible.windows.win_copy:
       src: "files/activate_srv.bat"

ansible/roles/activate_windows_wks/tasks/main.yml

@@ -1,5 +1,9 @@
 ---
 # https://blog.51sec.org/2023/01/how-to-upgrade-windows-10-evaluation.html
+  - name: Update the machine IP in the inventory
+    set_fact:
+      ansible_host: "{{host_ip}}"
+
   - name: Upload Windows Workstation Activation File
     ansible.windows.win_copy:
       src: "files/skus-Windows-10.zip"

ansible/roles/kali/tasks/main.yml

@@ -64,6 +64,6 @@
       src: "files/WiredConnection1"
       dest: "/etc/NetworkManager/system-connections/Wired\ connection\ 1.nmconnection"
 
-  - name: Kali | Reboot the machine
-    reboot:
-      reboot_timeout: 100
+  #- name: Kali | Reboot the machine
+  #  reboot:
+  #    reboot_timeout: 100

ansible/roles/kms/tasks/main.yml

@@ -15,6 +15,6 @@
       src: "files/00-installer-config.yaml"
       dest: "/etc/netplan/00-installer-config.yaml"
 
-  - name: KMS | Reboot the machine
-    reboot:
-      reboot_timeout: 100
+  #- name: KMS | Reboot the machine
+  #  reboot:
+  #    reboot_timeout: 100

ansible/roles/promotedc/tasks/main.yml

@@ -27,7 +27,10 @@
 
   - name: Reboot server after domain install
     win_reboot:
-      test_command: 'exit (Get-Service -Name LanmanServer).Status -ne "Running"'
+      reboot_timeout: 0
+    ignore_errors: yes
+    async: 1
+    poll: 0
     when: domain_create.reboot_required
 
   - name: Wait for domain controller to be ready

ansible/roles/promotedc/templates/vulnadplus.ps1

@@ -553,7 +553,82 @@ function VulnAD-PublicSMBShare {
 
 function VulnAD-FirewallOff {
 	netsh advfirewall set allprofiles state off
-} 
+}
+
+function VulnAD-ADCS {
+    # Parámetros de configuración
+    $CAName = "VulnerableCA"
+    $TemplateName = "VulnTemplate"
+    $DomainAdminGroup = "Domain Admins"
+
+    # Importar módulo ADCS si no está disponible
+    if (-not (Get-Module -Name ActiveDirectory -ListAvailable)) {
+        Install-WindowsFeature -Name RSAT-AD-Tools
+        Import-Module ActiveDirectory
+    }
+
+    # Crear una nueva CA si no existe
+    if (-not (Get-ADObject -Filter "Name -eq '$CAName'" -SearchBase "CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=contoso,DC=local")) {
+        Install-AdcsCertificationAuthority -CAType EnterpriseRootCA -CACommonName $CAName -KeyLength 2048 -HashAlgorithm SHA1 -Force
+    }
+
+    # Configurar ADCS para hacerlo vulnerable
+    $RootCA = (Get-CertificationAuthority -Name $CAName)
+
+    # **ESC1: Plantilla vulnerable con Client Authentication**
+    New-CertificationAuthorityTemplate -Name $TemplateName -Subject "CN=VulnUser" -ValidityPeriod 5 -EnrollAuto -ClientAuth
+
+    # **ESC2: Inscripción de certificados sin autenticación**
+    Set-CertificationAuthorityProperty -Name $CAName -AllowUserSuppliedSubject True
+
+    # **ESC3: Delegación de control en plantillas**
+    $TemplateObject = Get-CertificationAuthorityTemplate -Name $TemplateName
+    $TemplateObject | Grant-ObjectACL -Principal "Authenticated Users" -Access Rights -Write
+
+    # **ESC4: Servicio de ADCS ejecutándose como SYSTEM**
+    Set-Service -Name CertSvc -StartupType Automatic
+    Start-Service -Name CertSvc
+
+    # **ESC5: Vulnerabilidad de inscripción basada en Web (Web Enrollment)**
+    Install-AdcsWebEnrollment -CACommonName $CAName -Force
+    Set-CertificationAuthorityProperty -Name $CAName -WebEnrollmentEnabled $true
+
+    # **ESC6: Habilitar inscripción de certificados de Administrador sin restricción**
+    $TemplateObject | Grant-ObjectACL -Principal "Domain Admins" -Access Enroll, Autoenroll
+
+    # **ESC7: Certificados sin validación de identidad**
+    Set-CertificationAuthorityProperty -Name $CAName -RequireStrongAuthentication $false
+
+    # **ESC8: Certificados con claves exportables**
+    $TemplateObject | Set-CertificationAuthorityTemplateProperty -Property KeyExportable -Value $true
+
+    # **ESC9: Uso de certificados en blanco**
+    $TemplateObject | Set-CertificationAuthorityTemplateProperty -Property AllowBlankSubject -Value $true
+
+    # **ESC10: Permitir plantillas heredadas inseguras**
+    Set-CertificationAuthorityProperty -Name $CAName -AllowLegacyTemplates $true
+
+    # **ESC11: Delegación en usuarios no administrativos**
+    $TemplateObject | Grant-ObjectACL -Principal "Domain Users" -Access Enroll
+
+    # **ESC12: Plantilla vulnerable con Server Authentication**
+    New-CertificationAuthorityTemplate -Name "VulnServerTemplate" -Subject "CN=CompromisedServer" -ValidityPeriod 5 -EnrollAuto -ServerAuth
+
+    # **ESC13: Permitir inscripción de certificados de usuario sin restricción**
+    Set-CertificationAuthorityProperty -Name $CAName -AllowUnrestrictedUserEnrollment $true
+
+    # **ESC14: No requerir auditoría en emisión de certificados**
+    Set-CertificationAuthorityProperty -Name $CAName -AuditRequired $false
+
+    # **ESC15: Permitir inscripción con credenciales comprometidas**
+    Set-CertificationAuthorityProperty -Name $CAName -AllowWeakCredentials $true
+
+    # Reiniciar servicios para aplicar cambios
+    Restart-Service CertSvc -Force
+
+    Write-Output "✅ ADCS configurado con vulnerabilidades desde ESC1 hasta ESC15"
+
+}
 
 function Invoke-VulnAD {
     Param(
@@ -601,4 +676,8 @@ function Invoke-VulnAD {
     Write-Good "Created Public SMB Share"
     VulnAD-FirewallOff
     Write-Good "Firewall Turned Off"
+    VulnAD-ADC
+    Write-Good "ADCS ESC1-15 vulnerabilities"
+   #Start-Process -Verb RunAs -FilePath 'C:\Windows\System32\cmd.exe' -ArgumentList "/C C:\ip.bat"
+   #Write-Good "Set Static IP Address to 10.10.10.5"
 }

ansible/roles/windows_ip/tasks/main.yml

@@ -18,4 +18,21 @@
       ipv4_addresses:
         - "{{dns_server}}"
         - 1.1.1.1
-    register: dns_setup
+    register: dns_setup
+
+  - name: Reboot server after change network configurations
+    win_shell: shutdown /r /t 0
+    async: 1
+    poll: 0
+    failed_when: false
+    when: dns_setup.changed
+
+  - name: Waiting 2 minutes for the machine bootup
+    pause:
+      minutes: 2
+
+  - name: Cambiar adaptador de red a NATSwitch en Hyper-V
+    ansible.builtin.shell: >
+      /mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe -Command
+      "Connect-VMNetworkAdapter -VMName '{{ vm_name }}' -SwitchName 'NATSwitch'"
+    delegate_to: localhost

ansible/tien.yml

@@ -7,12 +7,14 @@
     ethernet_adapter: "Ethernet 2"
     host_ip: "10.10.10.9"
     dns_server: "10.10.10.5"
+    vm_name: mad_tien
+
   roles:
   - role: disable_rtm
+  - role: windows_ip
   - role: activate_windows_wks
   - role: install_office
   - role: joindomain
-  - role: windows_ip
   - role: disable_vagrant_user
   - role: local_admin_password
 

scripts/configure-static-ip.ps1

@@ -15,13 +15,13 @@ if (-not $InterfaceName) {
 
 $ipBatContent = @"
 netsh interface ipv4 set address name="$InterfaceName" static $IPAddress 255.255.255.0 10.10.10.1
-netsh interface ipv4 set dns name="$InterfaceName" static 8.8.8.8
-netsh interface ipv4 add dns name="$InterfaceName" 8.8.4.4 index=2
+netsh interface ipv4 set dns name="$InterfaceName" static 10.10.10.5
+netsh interface ipv4 add dns name="$InterfaceName" 8.8.8.8 index=2
 schtasks /delete /tn "FixIpScript" /f
 "@
 
 Set-Content -Path "C:\ip.bat" -Value $ipBatContent
 
 # New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce" -Name "StaticIp" -Value "C:\ip.bat" -PropertyType "String" -Force
 
-schtasks /create /tn "FixIpScript" /tr "C:\ip.bat" /sc onstart /ru System
+#schtasks /create /tn "FixIpScript" /tr "C:\ip.bat" /sc onstart /ru System