From a10572287271f630abf33a8342219c147c2d737e Mon Sep 17 00:00:00 2001 From: Chris Long Date: Tue, 26 Jun 2018 23:48:11 -0700 Subject: [PATCH] Adding some small fixes --- Packer/scripts/debloat-windows.ps1 | 3 +++ Packer/scripts/vm-guest-tools.bat | 7 ++++++- Vagrant/Vagrantfile | 3 ++- Vagrant/scripts/configure-ou.ps1 | 7 +++---- Vagrant/scripts/fix-second-network.ps1 | 8 +++----- Vagrant/scripts/install-sysinternals.ps1 | 21 ++++++++++++--------- 6 files changed, 29 insertions(+), 20 deletions(-) diff --git a/Packer/scripts/debloat-windows.ps1 b/Packer/scripts/debloat-windows.ps1 index bae63da..686943c 100755 --- a/Packer/scripts/debloat-windows.ps1 +++ b/Packer/scripts/debloat-windows.ps1 @@ -14,6 +14,9 @@ if ($env:PACKER_BUILDER_TYPE -And $($env:PACKER_BUILDER_TYPE).startsWith("hyperv #. $env:TEMP\Debloat-Windows-10-master\scripts\block-telemetry.ps1 #Write-Host Disable services #. $env:TEMP\Debloat-Windows-10-master\scripts\disable-services.ps1 + Write-host Disable Windows Defender + #. $env:TEMP\Debloat-Windows-10-master\scripts\disable-windows-defender.ps1 + Uninstall-WindowsFeature Windows-Defender-Features Write-host Optimize Windows Update . $env:TEMP\Debloat-Windows-10-master\scripts\optimize-windows-update.ps1 #Write-host Disable Windows Update diff --git a/Packer/scripts/vm-guest-tools.bat b/Packer/scripts/vm-guest-tools.bat index aa1a74d..35a4860 100755 --- a/Packer/scripts/vm-guest-tools.bat +++ b/Packer/scripts/vm-guest-tools.bat @@ -18,7 +18,7 @@ if exist "C:\Users\vagrant\windows.iso" ( ) if not exist "C:\Windows\Temp\windows.iso" ( - powershell -Command "(New-Object System.Net.WebClient).DownloadFile('http://softwareupdate.vmware.com/cds/vmw-desktop/ws/14.1.1/7528167/windows/packages/tools-windows.tar', 'C:\Windows\Temp\vmware-tools.tar')" NUL +IF ERRORLEVEL 1060 cmd /c C:\Windows\Temp\VMWare\setup.exe /S /v"/qn REBOOT=R\" +sc query vmtools > NUL +IF ERRORLEVEL 1060 ECHO "Unable to install VMware Tools." & exit /b 1 + rd /Q "C:\Windows\Temp\vmware-tools.tar" rd /Q "C:\Windows\Temp\windows.iso" rd /S /Q "C:\Windows\Temp\VMware" diff --git a/Vagrant/Vagrantfile b/Vagrant/Vagrantfile index d268b86..722ef4f 100644 --- a/Vagrant/Vagrantfile +++ b/Vagrant/Vagrantfile @@ -31,7 +31,7 @@ Vagrant.configure("2") do |config| config.vm.define "dc" do |cfg| cfg.vm.box = "../Boxes/windows_2016_virtualbox.box" cfg.vm.hostname = "dc" - + cfg.vm.boot_timeout = 600 # use the plaintext WinRM transport and force it to use basic authentication. # NB this is needed because the default negotiate transport stops working # after the domain controller is installed. @@ -89,6 +89,7 @@ Vagrant.configure("2") do |config| config.vm.define "wef" do |cfg| cfg.vm.box = "../Boxes/windows_2016_virtualbox.box" cfg.vm.hostname = "wef" + cfg.vm.boot_timeout = 600 cfg.vm.communicator = "winrm" cfg.winrm.basic_auth_only = true cfg.winrm.timeout = 300 diff --git a/Vagrant/scripts/configure-ou.ps1 b/Vagrant/scripts/configure-ou.ps1 index 07ae82f..dc4e589 100644 --- a/Vagrant/scripts/configure-ou.ps1 +++ b/Vagrant/scripts/configure-ou.ps1 @@ -1,9 +1,8 @@ # Purpose: Sets up the Server and Workstations OUs -Write-Host "Sleeping for 30 seconds, then creating Server and Workstation OUs" -Start-Sleep 30 -Write-Host "Creating Servers OU" +Write-Host "Creating Server and Workstation OUs..." +Write-Host "Creating Servers OU..." if (!([ADSI]::Exists("LDAP://OU=Servers,DC=windomain,DC=local"))) -{ +{ New-ADOrganizationalUnit -Name "Servers" -Server "dc.windomain.local" } else diff --git a/Vagrant/scripts/fix-second-network.ps1 b/Vagrant/scripts/fix-second-network.ps1 index d716ae7..a032d15 100755 --- a/Vagrant/scripts/fix-second-network.ps1 +++ b/Vagrant/scripts/fix-second-network.ps1 @@ -5,24 +5,22 @@ if (! (Test-Path 'C:\Program Files\VMware\VMware Tools')) { Write-Host "Nothing to do for other providers than VMware." exit 0 } -Write-Host "Setting IP address and DNS information for the second network adapter" +Write-Host "Setting IP address and DNS information for the Ethernet1 interface" +Write-Host "If this step times out, it's because vagrant is connecting to the VM on the wrong interface" +Write-Host "See https://github.com/clong/DetectionLab/issues/114 for more information" $subnet = $ip -replace "\.\d+$", "" -write-host "debug 1" $name = (Get-NetIPAddress -AddressFamily IPv4 ` | Where-Object -FilterScript { ($_.IPAddress).StartsWith($subnet) } ` ).InterfaceAlias -write-host "debug 2" if (!$name) { $name = (Get-NetIPAddress -AddressFamily IPv4 ` | Where-Object -FilterScript { ($_.IPAddress).StartsWith("169.254.") } ` ).InterfaceAlias } -write-host "debug 3" if ($name) { Write-Host "Set IP address to $ip of interface $name" & netsh.exe int ip set address "$name" static $ip 255.255.255.0 "$subnet.1" -write-host "debug 4" if ($dns) { Write-Host "Set DNS server address to $dns of interface $name" & netsh.exe interface ipv4 add dnsserver "$name" address=$dns index=1 diff --git a/Vagrant/scripts/install-sysinternals.ps1 b/Vagrant/scripts/install-sysinternals.ps1 index 20695d3..00df8c5 100755 --- a/Vagrant/scripts/install-sysinternals.ps1 +++ b/Vagrant/scripts/install-sysinternals.ps1 @@ -24,25 +24,28 @@ $sysmonPath = "C:\Tools\Sysinternals\Sysmon64.exe" $tcpviewPath = "C:\Tools\Sysinternals\Tcpview.exe" $sysmonConfigPath = "$sysmonDir\sysmonConfig.xml" + +# Microsoft likes TLSv1.2 as well +[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 Write-Host "Downloading Autoruns64.exe..." -Invoke-WebRequest -Uri "https://live.sysinternals.com/Autoruns64.exe" -OutFile $autorunsPath +(New-Object System.Net.WebClient).DownloadFile('https://live.sysinternals.com/Autoruns64.exe', $autorunsPath) Write-Host "Downloading Procmon.exe..." -Invoke-WebRequest -Uri "https://live.sysinternals.com/Procmon.exe" -OutFile $procmonPath +(New-Object System.Net.WebClient).DownloadFile('https://live.sysinternals.com/Procmon.exe', $procmonPath) Write-Host "Downloading PsExec64.exe..." -Invoke-WebRequest -Uri "https://live.sysinternals.com/PsExec64.exe" -OutFile $psexecPath +(New-Object System.Net.WebClient).DownloadFile('https://live.sysinternals.com/PsExec64.exe', $psexecPath) Write-Host "Downloading procexp64.exe..." -Invoke-WebRequest -Uri "https://live.sysinternals.com/procexp64.exe" -OutFile $procexpPath +(New-Object System.Net.WebClient).DownloadFile('https://live.sysinternals.com/procexp64.exe', $procexpPath) Write-Host "Downloading Sysmon64.exe..." -Invoke-WebRequest -Uri "https://live.sysinternals.com/Sysmon64.exe" -Outfile $sysmonPath +(New-Object System.Net.WebClient).DownloadFile('https://live.sysinternals.com/Sysmon64.exe', $sysmonPath) Write-Host "Downloading Tcpview.exe..." -Invoke-WebRequest -Uri "https://live.sysinternals.com/Tcpview.exe" -Outfile $tcpviewPath +(New-Object System.Net.WebClient).DownloadFile('https://live.sysinternals.com/Tcpview.exe', $tcpviewPath) Copy-Item $sysmonPath $sysmonDir # Download SwiftOnSecurity's Sysmon config Write-Host "Downloading SwiftOnSecurity's Sysmon config..." -Invoke-WebRequest -Uri "https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/sysmonconfig-export.xml" -Outfile "$sysmonConfigPath" -# Alternative: Download Olaf Hartong's Sysmon config (more CPU intensive) -#Invoke-WebRequest -Uri "https://raw.githubusercontent.com/olafhartong/sysmon-modular/master/sysmonconfig.xml" -Outfile "$sysmonConfigPath" +(New-Object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/SwiftOnSecurity/sysmon-config/master/sysmonconfig-export.xml', "$sysmonConfigPath") +# Alternative: Download Olaf Hartongs Sysmon config (more CPU intensive) +# (New-Object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/olafhartong/sysmon-modular/master/sysmonconfig.xml, "$sysmonConfigPath" # Start Sysmon Write-Host "Starting Sysmon..."