Add Atomic Red Team, Poll Packet for Provisioning, Fixes

Vagrant/bootstrap.sh

@@ -129,10 +129,13 @@ install_splunk() {
     sed -i.bak 's/max_memtable_bytes = 10000000/max_memtable_bytes = 30000000/g' /opt/splunk/etc/system/local/limits.conf
 
     # Skip Splunk Tour and Change Password Dialog
+    echo "Disabling the Splunk tour prompt..."
     touch /opt/splunk/etc/.ui_login
+    mkdir /opt/splunk/etc/users/admin/search/local
+    echo -e "[search-tour]\nviewed = 1" > /opt/splunk/etc/users/admin/search/local/ui-tour.conf
+    
     # Enable SSL Login for Splunk
-    echo '[settings]
-    enableSplunkWebSSL = true' > /opt/splunk/etc/system/local/web.conf
+    echo -e "[settings]\nenableSplunkWebSSL = true" > /opt/splunk/etc/system/local/web.conf
     # Reboot Splunk to make changes take effect
     /opt/splunk/bin/splunk restart
     /opt/splunk/bin/splunk enable boot-start

Vagrant/scripts/install-choco-extras.ps1

@@ -10,7 +10,7 @@ If (-not (Test-Path "C:\ProgramData\chocolatey")) {
 }
 
 Write-Host "Installing Chocolatey extras..."
-choco install -y --limit-output wireshark
-choco install -y --limit-output winpcap
+choco install -y --limit-output --no-progress wireshark
+choco install -y --limit-output --no-progress winpcap
 
 Write-Host "Choco addons complete!"

Vagrant/scripts/install-osquery.ps1

@@ -4,7 +4,7 @@
 
 Write-Host "Installing osquery"
 $packsDir = "c:\programdata\osquery\packs"
-choco install -y osquery | Out-String  # Apparently Out-String makes the process wait
+choco install -y --limit-output --no-progress osquery | Out-String  # Apparently Out-String makes the process wait
 $service = Get-WmiObject -Class Win32_Service -Filter "Name='osqueryd'"
 If (-not ($service)) {
   Write-Host "Setting osquery to run as a service"

Vagrant/scripts/install-redteam.ps1

@@ -35,4 +35,17 @@ if (-not (Test-Path $powersploitRepoPath)) {
   Write-Host "PowerSploit was already installed. Moving On."
 }
 
+# Download and unzip a copy of Atomic Red Team
+Write-Host "Downloading Atomic Red Team..."
+# GitHub requires TLS 1.2 as of 2/27
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+$atomicRedTeamDownloadUrl = "https://github.com/redcanaryco/atomic-red-team/archive/master.zip"
+$atomicRedTeamRepoPath = "C:\Users\vagrant\AppData\Local\Temp\atomic_red_team.zip"
+if (-not (Test-Path $atomicRedTeamRepoPath)) {
+  Invoke-WebRequest -Uri "$atomicRedTeamDownloadUrl" -OutFile "$atomicRedTeamRepoPath"
+  Expand-Archive -path "$atomicRedTeamRepoPath" -destinationpath 'c:\Tools\Atomic Red Team' -Force
+} else {
+  Write-Host "Atomic Red Team was already installed. Moving On."
+}
+
 Write-Host "Red Team tooling installation complete!"

Vagrant/scripts/install-utilities.ps1

@@ -10,11 +10,11 @@ If (-not (Test-Path "C:\ProgramData\chocolatey")) {
 Write-Host "Installing utilities..."
 If ($(hostname) -eq "win10") {
   # Because the Windows10 start menu sucks
-  choco install -y --limit-output classic-shell -installArgs ADDLOCAL=ClassicStartMenu
+  choco install -y --limit-output --no-progress classic-shell -installArgs ADDLOCAL=ClassicStartMenu
   & "C:\Program Files\Classic Shell\ClassicStartMenu.exe" "-xml" "c:\vagrant\resources\windows\MenuSettings.xml"
 }
-choco install -y --limit-output NotepadPlusPlus
-choco install -y --limit-output GoogleChrome
-choco install -y --limit-output WinRar
+choco install -y --limit-output --no-progress NotepadPlusPlus
+choco install -y --limit-output --no-progress GoogleChrome
+choco install -y --limit-output --no-progress WinRar
 
 Write-Host "Utilties installation complete!"

Vagrant/scripts/provision.ps1

@@ -11,7 +11,7 @@ if ($env:COMPUTERNAME -imatch 'vagrant') {
 
   Write-Host 'Hostname is still the original one, skip provisioning for reboot'
 
-  Write-Host 'Install bginfo'
+  Write-Host 'Installing bginfo...'
   . c:\vagrant\scripts\install-bginfo.ps1
 
   Write-Host -fore red 'Hint: vagrant reload' $box '--provision'
@@ -23,6 +23,11 @@ if ($env:COMPUTERNAME -imatch 'vagrant') {
   if (!(Test-Path 'c:\Program Files\sysinternals\bginfo.exe')) {
     Write-Host 'Install bginfo'
     . c:\vagrant\scripts\install-bginfo.ps1
+    # Set background to be "fitted" instead of "tiled"
+    Set-ItemProperty 'HKCU:\Control Panel\Desktop' -Name TileWallpaper -Value '0'
+    Set-ItemProperty 'HKCU:\Control Panel\Desktop' -Name WallpaperStyle -Value '6'
+    # Set Task Manager prefs
+    reg import "c:\vagrant\resources\windows\TaskManager.reg" 2>&1 | out-null
   }
 
   if ($env:COMPUTERNAME -imatch 'dc') {
@@ -41,8 +46,5 @@ if ($env:COMPUTERNAME -imatch 'vagrant') {
     . c:\vagrant\scripts\install-bginfo.ps1
   }
 
-  Write-Host 'Provisioning after joining domain'
-
-  # $script = "c:\vagrant\scripts\provision-" + $box + ".ps1"
-  # . $script
+  Write-Host 'Provisioning after joining domain...'
 }