To run the Goad installation/management script you will need :
@@ -1462,7 +1447,8 @@Python version
Be sure to use a python version between python3.8 and python 3.11. Others python versions are not supported by now due to incompatibility with the fixed version in the requirements.
Info
With this method ansible-core will not be installed locally on your venv
@@ -1489,6 +1475,9 @@./goad_docker.sh instead of ./goad.sh to install the dependencies without the ansible part (local and runner provisioning method will not be available)Welcome to GOAD (v3) documentation !
Game Of Active Directory is a free pentest active directory LAB(s) project (1).
The purpose of this tool is to give pentesters a vulnerable Active directory environment ready to use to practice usual attack techniques. The idea behind this project is to give you an environment where you can try and train your pentest skills without having the pain to build all by yourself. This repository was build for pentest practice
Note
GOAD main labs (GOAD/GOAD-Light/SCCM) are not pro labs environments (like those you can find on HTB). Theses labs give you an environment to practice a lot of vulnerability and missconfig exploitations. Sure you can use them like pro labs, but it will certainly be too easy due to the number of vulns. Consider more GOAD like a DVWA but for Active Directory. If you want a chall deploy the lab NHA.
Warning
This lab is extremely vulnerable, do not reuse recipe to build your production environment and do not deploy this environment on internet without isolation (this is a recommendation, use it as your own risk).
Windows Licenses
This lab use free windows VM only (180 days). After that delay enter a license on each server or rebuild all the lab (may be it's time for an update ;))
"},{"location":"changelog/","title":"Road Map","text":""},{"location":"changelog/#v1","title":"v1","text":"When you create a lab, goad will create an instance folder. All the instances are stored in the workspace/ folder inside goad.
workspace/\n .\n \u251c\u2500\u2500 6caf1a-goad-light-azure # Instance ID\n \u2502\u00a0\u00a0 \u251c\u2500\u2500 exchange_inventory # extension inventory\n \u2502\u00a0\u00a0 \u251c\u2500\u2500 instance.json # instance json file (name, status, etc..)\n \u2502\u00a0\u00a0 \u251c\u2500\u2500 inventory # provider inventory\n \u2502\u00a0\u00a0 \u251c\u2500\u2500 provider # provider folder\n \u2502\u00a0\u00a0 \u2502\u00a0\u00a0 \u251c\u2500\u2500 jumpbox.tf\n \u2502\u00a0\u00a0 \u2502\u00a0\u00a0 \u251c\u2500\u2500 linux.tf\n \u2502\u00a0\u00a0 \u2502\u00a0\u00a0 \u251c\u2500\u2500 main.tf\n \u2502\u00a0\u00a0 \u2502\u00a0\u00a0 \u251c\u2500\u2500 network.tf\n \u2502\u00a0\u00a0 \u2502\u00a0\u00a0 \u251c\u2500\u2500 outputs.tf\n \u2502\u00a0\u00a0 \u2502\u00a0\u00a0 \u251c\u2500\u2500 terraform.tfstate\n \u2502\u00a0\u00a0 \u2502\u00a0\u00a0 \u251c\u2500\u2500 terraform.tfstate.backup\n \u2502\u00a0\u00a0 \u2502\u00a0\u00a0 \u251c\u2500\u2500 variables.tf\n \u2502\u00a0\u00a0 \u2502\u00a0\u00a0 \u2514\u2500\u2500 windows.tf\n \u2502\u00a0\u00a0 \u2514\u2500\u2500 ssh_keys # the keys generated by this instance\n \u2502\u00a0\u00a0 \u2514\u2500\u2500 ubuntu-jumpbox.pem\n \u251c\u2500\u2500 7b12f1-goad-light-vmware # another instance\n \u2502\u00a0\u00a0 \u251c\u2500\u2500 instance.json\n \u2502\u00a0\u00a0 \u251c\u2500\u2500 inventory\n \u2502\u00a0\u00a0 \u251c\u2500\u2500 inventory_disable_vagrant\n \u2502\u00a0\u00a0 \u251c\u2500\u2500 provider\n \u2502\u00a0\u00a0 \u2502\u00a0\u00a0 \u2514\u2500\u2500 Vagrantfile\n \u2502\u00a0\u00a0 \u2514\u2500\u2500 ssh_keys\ninstall or create_empty), the provider files inside the template/ folder are copied into the instance. ad/<lab>/providers/<provider>/ folder and the datas inside extensions/<extension>/providers/<provider>/The merged result is present in the workspace/<instance_id>/provider/ folder and contain all the recipes to create the infrastructure
inventories files are also copied from ad/<lab>/provider/<provider>/inventory and extensions/<extension>/inventory (see provisioning for more information in provisioning)
This page describe how the provisioning is done with goad. The provisioning of the LABS is done with Ansible for all providers.
The data of each lab are stored in the json file : ad/<lab>/data/config.json, this file is loaded by each playbook to get all the lab variables (this is done by the data.yml playbook call by all the over playbooks)
If an extension need data it will be stored in extensions/<extension>/data/config.json but the loading must be done by extension install.yml playbook.
# read local configuration file\n- name: \"Read local config file\"\n hosts: domain:extensions\n connection: local\n vars_files:\n - \"../data/config.json\"\n tasks:\n - name: merge lab variable with local config\n set_fact:\n lab: \"{{ lab|combine(lab_extension, recursive=True) }}\"\nAnsible work with inventories. Inventories files contains all the hosts declaration and some variables.
The lab inventory file (ad/<lab>/data/inventory) is not modified/moved and contain all the main variables and hosts association, this file stay as this and is not modified. It contains the lab building logic.
The provider inventory file (ad/<lab>/provider/<provider>/inventory) is modified with the settings and copied into the workspace folder (workspace/<instance_id>/inventory) , this file contains variable specific to the provider and the host ip declaration
The extension(s) inventory file(s) (extensions/<extension>/inventory) is modified with the settings and copied into the workspace folder (workspace/<instance_id>/inventory_<extension>) , this file contains variable specific to the extension and the extension host ip declaration
The global inventory file globalsettings.inicontains some global variable with some user settings.
The inventory files are given to ansible in this order : - lab inventory file - workspace provider inventory file - workspace extension(s) inventory file(s) - globalsettings.ini file
The order is important as it determine the override order. hosts declarations are merged between all inventory and variables with the same name are override if the same variable is declared.
extension/<extension>/ansible/install.ymlThe extension folder can call the main goad roles by using a special ansible.cfg file.
Example of the exchange ansible.cfg file
[defaults]\n...\n; add default roles folder into roles_path\nroles_path = ./roles:../../../ansible/roles\nHow can i change the default keyboard layout ?
edit globalsettings.ini files and change the variable keyboard_layouts
How can i change the folder where vagrant download the boxes ?
vagrant download the boxes by default on ~/.vagrant.d/ folder. Set up the VAGRANT_HOME environment variable to change this location.
How can i change the folder where virtualbox create the box ?
Go to virtualbox preferences and change the virtualbox vm location folder.
I already got a lab installed with v2, is v3 will use it ?
Sorry no, the v3 of GOAD doesn't look for already installed lab. Best way to migrate is trash your old lab and build a new one.
Can i use goad to create a course for my student ?
Sure GOAD is a GPL project. Feel free to reuse it to give course. Just don't forget to give credits to the project ;)
"},{"location":"references/","title":"References","text":"\ud83d\udea7 TODO TO BE COMPLETED
Mayfly's blog :
NHA WriteUp :
Podcast
YouTube
And of course to all the project contributors !
"},{"location":"thx/#enterprise","title":"Enterprise","text":"Tip
In most case if you get errors during install, don't think. Select the failed instance \u0300load <instance_id> and just replay the install with provision_lab to relaunch all or provision_lab_from <playbook> if you know the last failed playbook (most of the errors which could came up are due to windows latency during installation, wait few minutes and replay the install)
\ud83d\udea7 TODO refresh me with new goad version :)
"},{"location":"troobleshoot/#vagrant-up-winrm-digest-initialization-failed-initialization-error","title":"vagrant up - WinRM - digest initialization failed : Initialization Error","text":"DC01: WinRM username: vagrant\nDC01: WinRM execution_time_limit: PT2H\nDC01: WinRM transport: negotiate\nAn error occurred executing a remote WinRM command.\n\nShell: Cmd\nCommand: hostname\nMessage: Digest initialization failed: initialization error\nconfig.winrm.transport = \"plaintext\"\nconfig.winrm.basic_auth_only = true\nsolution 2: allow legacy algorithm (https://github.com/Orange-Cyberdefense/GOAD/issues/11)
[provider_sect]\ndefault = default_sect\nlegacy = legacy_sect\n\n[default_sect]\nactivate = 1\n\n[legacy_sect]\nactivate = 1\nsolution 3: downgrade the vagrant version (sudo apt install vagrant=2.2.19)
<internal:/usr/lib/ruby/vendor_ruby/rubygems/core_ext/kernel_require.rb>:85:in `require': cannot load such file -- winrm (LoadError)\n from <internal:/usr/lib/ruby/vendor_ruby/rubygems/core_ext/kernel_require.rb>:85:in `require'\n from /usr/share/rubygems-integration/all/gems/vagrant-2.3.4/plugins/communicators/winrm/shell.rb:9:in `block in <top (required)>'\n from /usr/share/rubygems-integration/all/gems/vagrant-2.3.4/lib/vagrant/util/silence_warnings.rb:8:in `silence!'\ngem install winrmgem install winrm-fs<internal:/usr/lib/ruby/vendor_ruby/rubygems/core_ext/kernel_require.rb>:85:in `require': cannot load such file -- winrm-elevated (LoadError)\n from <internal:/usr/lib/ruby/vendor_ruby/rubygems/core_ext/kernel_require.rb>:85:in `require'\n from /usr/share/rubygems-integration/all/gems/vagrant-2.3.4/plugins/communicators/winrm/shell.rb:12:in `<top (required)>'\n ...\ngem install winrm-elevated# ansible_winrm_transport=basic\n# ansible_port=5985\nTASK [groups_domains : synchronizes all domains] *******************************************************************************************************************************************************************************************************************************\nchanged: [dc03]\nchanged: [dc01]\nfatal: [dc02]: FAILED! => {\"changed\": true, \"cmd\": \"repadmin /syncall /Ade\", \"delta\": \"0:00:01.090773\", \"end\": \"2023-10-18 09:30:26.016579\", \"msg\": \"non-zero return code\", \"rc\": 1, \"start\": \"2023-10-18 09:30:24.925805\", \"stderr\": \"\", \"stderr_lines\": [], \"stdout\": \"Syncing all NC's held on winterfell.\\r\\r\\nSyncing partition: DC=north,DC=sevenkingdoms,DC=local\\r\\r\\nCALLBACK MESSAGE: Error contacting server CN=NTDS Settings,CN=WINTERFELL,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=sevenkingdoms,DC=local (network error): 1722 (0x6ba):\\r\\r\\n The RPC server is unavailable.\\r\\r\\n\\r\\r\\nSyncAll exited with fatal Win32 error: 8440 (0x20f8):\\r\\r\\n The naming context specified for this replication operation is invalid.\\r\\r\\n\", \"stdout_lines\": [\"Syncing all NC's held on winterfell.\", \"\", \"Syncing partition: DC=north,DC=sevenkingdoms,DC=local\", \"\", \"CALLBACK MESSAGE: Error contacting server CN=NTDS Settings,CN=WINTERFELL,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=sevenkingdoms,DC=local (network error): 1722 (0x6ba):\", \"\", \" The RPC server is unavailable.\", \"\", \"\", \"\", \"SyncAll exited with fatal Win32 error: 8440 (0x20f8):\", \"\", \" The naming context specified for this replication operation is invalid.\", \"\"]}\n==> GOAD-SRV03: Configuring and enabling network interfaces...\nVagrant can't use the requested machine because it is locked! This\nmeans that another Vagrant process is currently reading or modifying\nthe machine. Please wait for that Vagrant process to end and try\nagain. Details about the machine are shown below:\ncd ~/GOAD/ad/GOAD/providers/virtualbox\nvagrant reload GOAD-SRV03 --provisioning\nAn exception occurred during task execution. To see the full traceback, use -vvv. The error was: at Microsoft.ActiveDirectory.Management.Commands.ADCmdletBase`1.BeginProcessing()\nfailed: [dc02] (item={'key': 'AcrossTheSea', 'value': ['essos.local\\\\daenerys.targaryen']}) => {\"ansible_loop_var\": \"item\", \"attempts\": 3, \"changed\": false, \"item\": {\"key\": \"AcrossTheSea\", \"value\": [\"essos.local\\\\daenerys.targaryen\"]}, \"msg\": \"Unhandled exception while executing module: The server has rejected the client credentials.\"}\nAn exception occurred during task execution. To see the full traceback, use -vvv. The error was: at Microsoft.ActiveDirectory.Management.Commands.ADCmdletBase`1.BeginProcessing()\nfailed: [192.168.56.xx] (item={'key': 'DragonsFriends', 'value': ['sevenkingdoms.local\\\\tyron.lannister', 'essos.local\\\\daenerys.targaryen']}) => {\"ansible_loop_var\": \"item\", \"attempts\": 3, \"changed\": false, \"item\": {\"key\": \"DragonsFriends\", \"value\": [\"north.sevenkingdoms.local\\\\jon.snow\", \"sevenkingdoms.local\\\\tyron.lannister\", \"essos.local\\\\daenerys.targaryen\"]}, \"msg\": \"Unhandled exception while executing module: Either the target name is incorrect or the server has rejected the client credentials.\"}\nAn exception occurred during task execution. To see the full traceback, use -vvv. The error was: at , : line 475\nfailed: [192.168.56.11] (item={'key': 'arya.stark', 'value': {'firstname': 'Arya', 'surname': 'Stark',\n...\n\"msg\": \"Unhandled exception while executing module: The term 'Add-Warning' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.\"}+\nfatal: [xxx]: FAILED! => {\n \"changed\": false,\n \"msg\": \"Problems installing XXXX module: A parameter cannot be found that matches parameter name 'AcceptLicense'.\",\n \"nuget_changed\": false,\n \"output\": \"\",\n \"repository_changed\": false\n}\nERROR! no action detected in task. This often indicates a misspelled module name, or incorrect module path.\n\nThe error appears to have been in '/home/hrrb0032/Documents/mission/GOAD/roles/domain_controller/tasks/main.yml': line 8, column 3, but maybe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n- name: disable enhanced exit codes\n^ here\nsolution : upgrade Ansible
"},{"location":"troobleshoot/#old-ansiblewindows-version","title":"old ansible.windows version","text":"ERROR! couldn't resolve module/action 'win_powershell'. This often indicates a misspelling, missing collection, or incorrect module path.\nansible-galaxy collection install ansible.windows --force\nPLAY [DC01 - kingslanding] *******************************************************\n\n\n\nTASK [Gathering Facts] ***********************************************************\nfatal: [192.168.56.10]: FAILED! => {\"msg\": \"winrm or requests is not installed: No module named winrm\"}\n\n\n\nPLAY RECAP ***********************************************************************\n192.168.56.10 : ok=0 changed=0 unreachable=0 failed=1 skipped=0 rescued=0 ignored=0 \nsolution : pip install pywinrm
"},{"location":"troobleshoot/#winrm-send-input-timeout","title":"winrm send input timeout","text":"TASK [Gathering Facts] ****************************************************************************************************************************************************\n[WARNING]: ERROR DURING WINRM SEND INPUT - attempting to recover: WinRMOperationTimeoutError\nok: [192.168.56.11]\nsolution : wait or if crashed then re-run install
"},{"location":"troobleshoot/#domain-controller-ensure-users-are-present","title":"Domain controller : ensure Users are present","text":"TASK [domain_controller : Ensure that Users presents in ou=<kingdom>,dc=SEVENKINGDOMS,dc=local] ***************************************************************************\nAn exception occurred during task execution. To see the full traceback, use -vvv. The error was: at Microsoft.ActiveDirectory.Management.Commands.ADCmdletBase`1.ProcessRecord()\nfailed: [192.168.56.10] (item={u'key': u'lord.varys', u'value': {u'city': u\"King's Landing\", u'password': u'_W1sper_$', u'name': u'Lord Varys', u'groups': u'Small Council', u'path': u'OU=Users,OU=Crownlands,OU=kingdoms,DC=SEVENKINGDOMS,DC=local'}}) => {\"ansible_loop_var\": \"item\", \"changed\": false, \"item\": {\"key\": \"lord.varys\", \"value\": {\"city\": \"King's Landing\", \"groups\": \"Small Council\", \"name\": \"Lord Varys\", \"password\": \"_W1sper_$\", \"path\": \"OU=Users,OU=Crownlands,OU=kingdoms,DC=SEVENKINGDOMS,DC=local\"}}, \"msg\": \"Unhandled exception while executing module: An unspecified error has occurred\"}\nTASK [mssql : Install the database]\nfatal: [192.168.56.22]: FAILED! => {\"attempts\": 3, \"changed\": true, \"cmd\": \"c:\\\\setup\\\\mssql\\\\sql_installer.exe /configurationfile=c:\\\\setup\\\\mssql\\\\sql_conf.ini /IACCEPTSQLSERVERLICENSETERMS /MEDIAPATH=c:\\\\setup\\\\mssql\\\\media /QUIET /HIDEPROGRESSBAR\", \"delta\": \"0:00:34.891185\", \"end\": \"2022-08-17 21:26:53.976793\", \"msg\": \"non-zero return code\", \"rc\": 2226323458, \"start\": \"2022-08-17 21:26:19.085608\", \"stderr\": \"\", \"stderr_lines\": [], \"stdout\": \"Microsoft (R) SQL Server Installer\\r\\nCopyright (c) 2019 Microsoft. All rights reserved.\\r\\n\\r\\nDownloading install package...\\r\\n\\r\\n\\r\\nOperation finished with result: Failure\\r\\n\\r\\nOops...\\r\\n\\r\\nUnable to install SQL Server (setup.exe).\\r\\n\\r\\n Exit code (Decimal): -2068643838\\r\\n Exit message: No features were installed during the setup execution. The requested features may already be installed. Please review the summary.txt log for further details.\\r\\n\\r\\n SQL SERVER INSTALL LOG FOLDER\\r\\n c:\\\\Program Files\\\\Microsoft SQL Server\\\\150\\\\Setup Bootstrap\\\\Log\\\\20220817_142624\\r\\n\\r\\n\", \"stdout_lines\": [\"Microsoft (R) SQL Server Installer\", \"Copyright (c) 2019 Microsoft. All rights reserved.\", \"\", \"Downloading install package...\", \"\", \"\", \"Operation finished with result: Failure\", \"\", \"Oops...\", \"\", \"Unable to install SQL Server (setup.exe).\", \"\", \" Exit code (Decimal): -2068643838\", \" Exit message: No features were installed during the setup execution. The requested features may already be installed. Please review the summary.txt log for further details.\", \"\", \" SQL SERVER INSTALL LOG FOLDER\", \" c:\\\\Program Files\\\\Microsoft SQL Server\\\\150\\\\Setup Bootstrap\\\\Log\\\\20220817_142624\", \"\"]}\nsolution : re-run installer
"},{"location":"troobleshoot/#vagrant-not-working-on-ubuntu-2204","title":"vagrant: Not working on Ubuntu 22.04","text":"I was using the version of Vagrant in the Ubuntu repo, and then tried to use the version 2.4.0 and 2.3.4 binaries from hashicorp, but kept on running into this error:
The guest machine entered an invalid state while waiting for it\nto boot. Valid states are 'starting, running'. The machine is in the\n'poweroff' state. Please verify everything is configured\nproperly and try again.\n\nIf the provider you're using has a GUI that comes with it,\nit is often helpful to open that and watch the machine, since the\nGUI often has more helpful error messages than Vagrant can retrieve.\nFor example, if you're using VirtualBox, run `vagrant up` while the\nVirtualBox GUI is open.\n\nThe primary issue for this error is that the provider you're using\nis not properly configured. This is very rarely a Vagrant issue.\nThe error may look similar to below:
==> proxmox-iso.windows: Error creating VM: error creating VM: 403 Permission check failed (/sdn/zones/localnetwork/vmbr3/10, SDN.Use), \nerror status: {\"data\":null} (params: ......\nIt may be fixed by delegating the SDN.Use privilege to the packer user
pveum role modify Packer -privs \"VM.Config.Disk VM.Config.CPU VM.Config.Memory Datastore.AllocateTemplate Datastore.Audit Datastore.AllocateSpace Sys.Modify VM.Config.Options VM.Allocate VM.Audit VM.Console VM.Config.CDROM VM.Config.Cloudinit VM.Config.Network VM.PowerMgmt VM.Config.HWType VM.Monitor SDN.Use\"\nThe error may look similar to below:
root@goadprovisioning:~/GOAD/packer/proxmox# packer build -var-file=windows_server2019_proxmox_cloudinit.pkvars.hcl .\nproxmox-iso.windows: output will be in this color.\n\n==> proxmox-iso.windows: Retrieving additional ISO\n==> proxmox-iso.windows: Trying ./iso/Autounattend_winserver2019_cloudinit.iso\n==> proxmox-iso.windows: Trying ./iso/Autounattend_winserver2019_cloudinit.iso?checksum=sha256%3A43857cb780de3a58696285f644034499d4b29608b3c511feb27e315832b696c4\n==> proxmox-iso.windows: ./iso/Autounattend_winserver2019_cloudinit.iso?checksum=sha256%3A43857cb780de3a58696285f644034499d4b29608b3c511feb27e315832b696c4 => /root/GOAD/packer/proxmox/iso/Autounattend_winserver2019_cloudinit.iso\n proxmox-iso.windows: Uploaded ISO to local:iso/Autounattend_winserver2019_cloudinit.iso\n==> proxmox-iso.windows: Creating VM\n==> proxmox-iso.windows: No VM ID given, getting next free from Proxmox\n==> proxmox-iso.windows: Error creating VM: error creating VM: unable to create VM 103 - unsupported format 'qcow2' at /usr/share/perl5/PVE/Storage/LvmThinPlugin.pm line 87., error status: (params: map[agent:1 args: boot: cores:2 cpu:kvm64 description:Packer ephemeral build VM hotplug: ide2:local:iso/windows_server_2019.iso,media=cdrom kvm:true machine: memory:4096 name:WinServer2019x64-cloudinit-qcow2 net0:virtio=5E:5D:24:C4:0F:DA,bridge=vmbr3,tag=10 numa:false onboot:false ostype:win10 pool:GOAD sata0:vms:40,discard=ignore,format=qcow2 scsihw:lsi sockets:1 startup: tags: vmid:103])......\nFilesystems such as ZFS (and others) do not support qcow2. From my reading the best approach is to use an ext4 filesystem and modify config.auto.pkrvars.hcl with the newly created ext4 volume.
root@goadprovisioning:~/GOAD/packer/proxmox# vi config.auto.pkrvars.hcl\n...\nproxmox_vm_storage = \"ext4-qcow2\"\n...\nroot@goadprovisioning:~/GOAD/packer/proxmox# packer build -var-file=windows_server2019_proxmox_cloudinit.pkvars.hcl .\nproxmox-iso.windows: output will be in this color.\n\n==> proxmox-iso.windows: Retrieving additional ISO\n==> proxmox-iso.windows: Trying ./iso/Autounattend_winserver2019_cloudinit.iso\n==> proxmox-iso.windows: Trying ./iso/Autounattend_winserver2019_cloudinit.iso?checksum=sha256%3A43857cb780de3a58696285f644034499d4b29608b3c511feb27e315832b696c4\n==> proxmox-iso.windows: ./iso/Autounattend_winserver2019_cloudinit.iso?checksum=sha256%3A43857cb780de3a58696285f644034499d4b29608b3c511feb27e315832b696c4 => /root/GOAD/packer/proxmox/iso/Autounattend_winserver2019_cloudinit.iso\n proxmox-iso.windows: Uploaded ISO to local:iso/Autounattend_winserver2019_cloudinit.iso\n==> proxmox-iso.windows: Creating VM\n==> proxmox-iso.windows: No VM ID given, getting next free from Proxmox\n==> proxmox-iso.windows: Starting VM\nproxmox_vm_storage = \"raw\"==> proxmox-iso.windows: Error creating VM: error creating VM: unable to create VM 116 - volume 'local:iso/windows_server2019_XXX_en-us.iso' does not exist, error status: (params: map[agent:1 args: boot: cores:2 cpu:kvm64 description:Packer ephemeral build VM hotplug\n: ide2:local:iso/windows_server2019_XXX_en-us.iso,media=cdrom kvm:true machine: memory:4096 name:WinServer2019x64-cloudinit-qcow2-uptodate net0:virtio=DA:CB:EB:85:08:0E,bridge=vmbr3,tag=10,firewall=false onboot:false ostype:win10 pool:Templates sata0:local:80,format=q\ncow2 scsihw:lsi sockets:1 startup: tags: vmid:116]) \nverify your iso files inside proxmox and be sure the iso you want to use exist in proxmox
"},{"location":"troobleshoot/#ansible-adapter-name-error","title":"ansible adapter name error","text":"No MSFT_NetAdapter objects found with property 'Name' equal to 'Ethernet'\n\nor \n\nNo MSFT_NetAdapter objects found with property 'Name' equal to 'Ethernet2 '\nfatal: [dc01]: UNREACHABLE! => {\"changed\": false, \"msg\": \"ssl: HTTPSConnectionPool(host='192.168.10.40', port=5986): Max retries exceeded with url: /wsman\nvulnerabilities
"},{"location":"developpers/provisioning/","title":"Provisioning","text":""},{"location":"developpers/provisioning/#provisioning","title":"Provisioning","text":"ad/\n labname/ # The lab name must be the same as the variable : domain_name from the data/inventory\n data/\n config.json # The json file containing all the variables and configuration of the lab\n inventory # The global lab inventory (provider independent) (this should no contains variables)\n files/ # This folder contains files you want to copy on your vms\n scripts/ # This folder contains ps1 scripts you want to play on your vm (Must be added in the \"scripts\" entries of your vms)\n providers/ # Your lab available provider\n vmware/\n inventory # specific vmware inventory\n Vagrantfile # specific vmware vagrantfile\n virtualbox/\n inventory # specific virtualbox inventory\n Vagrantfile # specific virtualbox vagrantfile\n proxmox/\n terraform/ # specific proxmox terraform recipe\n inventory # specific proxmox inventory\n azure/\n terraform/ # specific azure terraform recipe\n inventory # specific azure inventory\nelk*Add a machine : elk (ip_range.50)
Kibana is configured on http://{{ip_range}}.50:5601 to follow the lab events
You need sshpass for the elk installation
sudo apt install sshpass\nOn ludus prepare template :
ludus templates add -d ubuntu-22.04-x64-server\nludus templates build\nselect your instance
load <instance_id>\ninstall the elk extension
install_extension elk\nThanks!
Credits and huge thanks to aleemladha for his exchange role and his help to test the extension.
exchangeresources
Exchange is really HUGE, it will add a vm with at least 12Gb of RAM be sure your computer support it before install
impacts
Modify the ad schema and add a computer (warning the exchange machine is really heavy)
"},{"location":"extensions/exchange/#prerequisites","title":"Prerequisites","text":"select your instance
load <instance_id>\ninstall the exchange extension
install_extension exchange\nThanks!
Credits and huge thanks to aleemladha for the ansible role. https://github.com/Orange-Cyberdefense/GOAD/pull/215
wazuhimpacts
add a wazuh machine and a wazuh agent on all windows machine\"
"},{"location":"extensions/wazuh/#prerequisites","title":"Prerequisites","text":"On ludus prepare template :
ludus templates add -d ubuntu-22.04-x64-server\nludus templates build\nA lab installed
select your instance
load <instance_id>\ninstall the exchange extension
install_extension wazuh\nws01Providers : virtualbox/azure/vmware/aws/ludus/proxmox
Add a machine : {{lab_name}}-WS01 (casterlyrock.sevenkingdoms.local) (ip_range.31)
rearm
The vm is not armed by default (90 days trials), connect to the vm with vagrant/vagrant and run as admin slmgr -rearm to rearm the box. (need a restart)
aws
AWS doesn't got any windows 10 so for aws the vm is a windows server 2019
"},{"location":"extensions/ws01/#lab-info","title":"Lab info","text":"Lab infos:
Features :
GOAD or GOAD-Light installation
On ludus prepare template :
ludus templates add -d win10-21h1-x64-enterprise\nludus templates build\nselect your instance
load <instance_id>\ninstall the ws01 extension
install_extension ws01\nIn the last version, GOAD use no more bash for the installation/management script. The goad management script is now written in python to permit more flexibility and cover the needs to create a Windows WSL support.
First prepare you system for GOAD execution:
Installation depend of the provider you use, please follow the appropriate guide :
# Install vbox\nsudo apt install virtualbox\n\n# Install vagrant\nwget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg\necho \"deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main\" | sudo tee /etc/apt/sources.list.d/hashicorp.list\nsudo apt update && sudo apt install vagrant\n\n# Install Vagrant plugins\nvagrant plugin install vagrant-reload vagrant-vbguest winrm winrm-fs winrm-elevated\n\n# Add some dependencies\nsudo apt install sshpass lftp rsync openssh-client python3.10-venv\n\ngit clone https://github.com/Orange-Cyberdefense/GOAD.git\ncd GOAD\n# verify installation\n./goad.sh -t check -l GOAD -p virtualbox\n\n# install\n./goad.sh -t install -l GOAD -p virtualbox\n\n# launch goad in interactive mode\n./goad.sh\nrequirements.yml file on the root of the project.goad_docker.sh script instead of goad.sh. This will run the ansible with the docker method instead of local or runner.This are the python dependencies used by goad :
Mandatory for goad.py:
rich\npsutil\nJinja2\npyyaml\nMandatory for ansible inside goad (for provisioning method local or runner) :
# Ansible\nansible_runner\nansible-core==2.12.6\npywinrm\nMandatory for azure provider :
# AZURE\nazure-identity\nazure-mgmt-compute\nazure-mgmt-network\nMandatory for aws provider :
# AWS\nboto3\nMandatory for proxmox provider:
# Proxmox\nproxmoxer\nrequests\nYou can launch goad without installing all the pip package but for that you will have to disable some dependencies with the -d arguments:
-d vmware : disable vmware provider\n-d virtualbox : disable virtualbox provider\n-d azure : disable azure provider\n-d aws : disable azure provider\n-d proxmox : disable proxmox provider\n-d ludus : disable ludus provider\n-d local : disable local provisioning method (if you use docker only)\n-d runner : disable ansible runner provisioning method (if you use docker only)\n-d remote : disable remote provisioning method\n-d docker : disable docker provisioning method\nInstallation is in three parts :
GOAD script cover the providing and provisioning part
The install script take multiple parameters:
-p : the provider to use (vmware/virtualbox/proxmox/ludus/azure/aws)-l : the lab to install (GOAD/GOAD-Light/SCCM/NHA/MINILAB)-m : the method of installation (local/runner/docker/remote), most of the time don't change it-ip : the ip range to useThe easy way is just launch ./goad.sh and use help ?in the interactive prompt
On the first launch goad create a global configuration file at : $HOME/.goad/goad.ini this file contains some default configuration and some parameters needed by some providers.
If you change the [default] config it will change the default selection when goad start
[default]\n; lab: goad / goad-light / minilab / nha / sccm\nlab = GOAD\n; provider : virtualbox / vmware / aws / azure / proxmox\nprovider = vmware\n; provisioner method : local / remote\nprovisioner = local\n; ip_range (3 first ip digits)\nip_range = 192.168.56\n\n[aws]\naws_region = eu-west-3\naws_zone = eu-west-3c\n\n[azure]\naz_location = westeurope\n\n[proxmox]\npm_api_url = https://192.168.1.1:8006/api2/json\npm_user = infra_as_code@pve\npm_node = GOAD\npm_pool = GOAD\npm_full_clone = false\npm_storage = local\npm_vlan = 10\npm_network_bridge = vmbr3\npm_network_model = e1000\n\n[proxmox_templates_id]\nwinserver2019_x64 = 102\nwinserver2016_x64 = 103\nwinserver2019_x64_utd = 104\nwindows10_22h2_x64 = 105\n\n[ludus]\n; api key must not have % if you have a % in it, change it by a %%\nludus_api_key = change_me\nuse_impersonation = yes\nglobalsettings.ini used by the ansible provisioningVagrant
Virtualbox
sudo apt install virtualbox\nInstall vagrant plugins
vagrant plugin install vagrant-reload vagrant-vbguest winrm winrm-fs winrm-elevated\nDisk space
The lab takes about 77GB (but you have to get the space for the vms vagrant images windows server 2016 (22GB) / windows server 2019 (14GB) / ubuntu 18.04 (502M)) The total space needed for the lab is ~115 GB (depend on the lab you use and it will take more space if you take snapshots), be sure you have enough disk space before install.
RAM
Depending on the lab you will need a lot of ram to run all the virtual machines. Be sure to have at least 20GB for GOAD-Light and 24GB for GOAD.
Tip
Vmware workstation is now free for personal use !
Vagrant
Vmware workstation
Install vagrant vmware utility : https://developer.hashicorp.com/vagrant/install/vmware
Install the following vagrant plugins:
vagrant plugin install vagrant-reload vagrant-vmware-desktop winrm winrm-fs winrm-elevated\nDisk space
The lab takes about 77GB (but you have to get the space for the vms vagrant images windows server 2016 (22GB) / windows server 2019 (14GB) / ubuntu 18.04 (502M)) The total space needed for the lab is ~115 GB (depend on the lab you use and it will take more space if you take snapshots), be sure you have enough disk space before install.
RAM
Depending on the lab you will need a lot of ram to run all the virtual machines. Be sure to have at least 20GB for GOAD-Light and 24GB for GOAD.
az login\nAWS CLI
[goad]\naws_access_key_id = changeme\naws_secret_access_key = changeme\nCreate an aws access key and secret for goad usage
credentials in plain text
Storing credentials in plain text is always a bad idea, but aws cli work like that be sure to restrain the right access to this file
Terraform
By now goad can work only directly on the server and not from a workstation client.
Install Ludus : https://docs.ludus.cloud/docs/quick-start/install-ludus/
Be sure to create an administrator user and keep his api key
Once your installation is complete on ludus server (debian 12) and your user is created do :
git clone https://github.com/Orange-Cyberdefense/GOAD.git\ncd GOAD\nsudo apt install python3.11-venv\n./goad.sh\n...>exit\nvim ~/.goad/goad.ini # add the api_key in the config file (keep impersonate to yes and use an admin user)\n./goad.sh -p ludus\n...>set_lab XXX # GOAD/GOAD-Light/NHA/SCCM\n...>install\nTo run the Goad installation/management script you will need :
Install the python3-venv corresponding to your python version
sudo apt install python<version>-venv\nsudo apt install python3.10-venv\nPython version
Be sure to use a python version between python3.8 and python 3.11. Others python versions are not supported by now due to incompatibility with the fixed version in the requirements.
"},{"location":"installation/linux/#prepare-your-python-environment-for-goadpy-and-provisioning-with-docker","title":"Prepare your python environment for goad.py and provisioning with docker","text":"Info
With this method ansible-core will not be installed locally on your venv
To run the Goad installation/management script you will need :
Install the python3-venv corresponding to your python version
sudo apt install python<version>-venv\nsudo apt install python3.10-venv\n./goad_docker.sh instead of ./goad.sh to install the dependencies without the ansible part (local and runner provisioning method will not be available)Info
To use GOAD on windows you will need WSL.
If you want to use virtualbox as an hypervisor to create your vm.
VAGRANT
If you want to create the lab on your windows computer you will need vagrant. Vagrant will be responsible to automate the process of vm download and creation.
Virtualbox
Install virtualbox <= 7.0 (vagrant support only to vbox7.0 at the time of writing) : https://www.virtualbox.org/wiki/Download_Old_Builds_7_0
Install the following vagrant plugins:
vagrant.exe plugin install vagrant-reload vagrant-vbguest winrm winrm-fs winrm-elevated\nDisk space
The lab takes about 77GB (but you have to get the space for the vms vagrant images windows server 2016 (22GB) / windows server 2019 (14GB) / ubuntu 18.04 (502M)) The total space needed for the lab is ~115 GB (depend on the lab you use and it will take more space if you take snapshots), be sure you have enough disk space before install.
RAM
Depending on the lab you will need a lot of ram to run all the virtual machines. Be sure to have at least 20GB for GOAD-Light and 24GB for GOAD.
If you want to use vmware workstation as an hypervisor to create your vm.
Tip
Vmware workstation is now free for personal use !
VAGRANT
If you want to create the lab on your windows computer you will need vagrant. Vagrant will be responsible to automate the process of vm download and creation.
Vmware Workstation
vmware workstation install bug
if you got an error about groups and permission during vmware workstation install consider running this in an administrator cmd prompt:
net localgroup /add \"Users\"\nnet localgroup /add \"Authenticated Users\"\nInstall vagrant vmware utility : https://developer.hashicorp.com/vagrant/install/vmware
Install the following vagrant plugins:
vagrant.exe plugin install vagrant-reload vagrant-vmware-desktop winrm winrm-fs winrm-elevated\nDisk space
The lab takes about 77GB (but you have to get the space for the vms vagrant images windows server 2016 (22GB) / windows server 2019 (14GB) / ubuntu 18.04 (502M)) The total space needed for the lab is ~115 GB (depend on the lab you use and it will take more space if you take snapshots), be sure you have enough disk space before install.
RAM
Depending on the lab you will need a lot of ram to run all the virtual machines. Be sure to have at least 20GB for GOAD-Light and 24GB for GOAD.
Nothing to prepare on windows host, install and prepare wsl and next follow linux install from your wsl console : see aws linux install
Nothing to prepare on windows host, install and prepare wsl and next linux install from your wsl console see azure linux install
Not supported, you will have to create a provisioning machine on your proxmox and run goad from then (see proxmox linux install)
Not supported, you will have to act from your ludus server (see ludus linux install)
"},{"location":"installation/windows/#prepare-wsl-environment","title":"Prepare WSL environment","text":"Now your host environment is ready for virtual machine creation. Now we will install WSL to run the goad installation script.
"},{"location":"installation/windows/#install-wsl","title":"Install WSL","text":"Open debian console then :
Verify you are using python version <= 11
python3 --version\nInstall python packages
sudo apt update\nsudo apt install python3 python3-pip python3-venv libpython3-dev\nNext you can clone and run goad
cd /mnt/c/whatever_folder_you_want\ngit clone https://github.com/Orange-Cyberdefense/GOAD.git\ncd GOAD\n./goad.sh\nPractice lab(s) :
Challenge lab :
POC lab :
This is a light version of goad without the essos domain. This lab was build for computer with less performance (min ~20GB).
Missing scenarios:
This lab is actually composed of five virtual machines:
domain : sevenkingdoms.local
domain : north.sevenkingdoms.local
NORTH.SEVENKINGDOMS.LOCAL
SEVENKINGDOMS.LOCAL
SEVENKINGDOMS
NORTH
DC02 : winterfell.north.sevenkingdoms.local (Windows Server 2019) (NORTH DC)
SRV02 : castelblack.essos.local (Windows Server 2019) (IIS, MSSQL, SMB share)
GOAD is the first and main lab of this project. It contains 3 domains and 2 forest.
"},{"location":"labs/GOAD/#servers","title":"Servers","text":"This lab is actually composed of five virtual machines:
domain sevenkingdoms.local
domain north.sevenkingdoms.local
domain essos.local
SEVENKINGDOMS / sevenkingdoms.local
NORTH / north.sevenkingdoms.local
DC02 : winterfell.north.sevenkingdoms.local (Windows Server 2019) (NORTH DC)
SRV02 : castelblack.essos.local (Windows Server 2019) (IIS, MSSQL, SMB share)
ESSOS / essos.local
DC03 : meereen.essos.local (Windows Server 2016) (ESSOS DC)
SRV03 : braavos.essos.local (Windows Server 2016) (MSSQL, SMB share)
NORTH.SEVENKINGDOMS.LOCAL
SEVENKINGDOMS.LOCAL
ESSOS.LOCAL
Starting point is on srv01 : 192.168.58.21
Flags are disposed on each machine, try to grab all. Be careful all the machines are up to date with defender enabled.
Obviously do not cheat by looking at the passwords and flags in the recipe files, the lab must start without user to full compromise.
Install :
./goad.sh -t install -l NHA -p virtualbox -m docker\n./goad.sh -t disablevagrant -l NHA -p virtualbox -m docker\n./goad.sh -t stop -l NHA -p virtualbox -m docker\n./goad.sh -t start -l NHA -p virtualbox -m docker\nAnd you are ready to play ! :)
./goad.sh -t enablevagrant -l NHA -p virtualbox -m docker\nTip
No bruteforce, if not in rockyou do not waste your time and your cpu/gpu cycle.
"},{"location":"labs/SCCM/","title":"SCCM lab","text":"Thanks!
Thanks a lot to my colleague Issam (@KenjiEndo15), who start the project and provide me a lot of ansible roles to start from !
"},{"location":"labs/SCCM/#servers","title":"Servers","text":"4 virtual machines with Windows Server 2019
All vms got defender activated
"},{"location":"labs/SCCM/#prerequisites","title":"Prerequisites","text":"1) create a template with the windows_server2019_proxmox_cloudinit_uptodate.pkvars.hcl packer file (guide here: https://mayfly277.github.io/posts/GOAD-on-proxmox-part2-packer/) (note the id after the creation)
2) create the variable file (ad/SCCM/providers/proxmox/terraform/variables.tf) by coping the template (ad/SCCM/providers/proxmox/terraform/variables.tf.template) and change the value according to your proxmox environnement
3) on the provisioning computer :
./goad.sh -t check -l SCCM -p proxmox -m local\n./goad.sh -t install -l SCCM -p proxmox -m local\n4) if something goes wrong (restart of the vms during install, etc...), you can rerun only ansible with -a
./goad.sh -t install -l SCCM -p proxmox -m local -a\nProviders are used to create and deploy the lab virtual machine.
Goad actually support the following providers:
On your own computer :
Cloud :
Hypervisor :
The architecture is slightly different depending on the provider. Please consult the provider you use to understand the behavior.
"},{"location":"providers/aws/","title":"Aws","text":"Thanks!
Thx to @ArnC_CarN for the initial work on the aws provider
The architecture is quite the same than the Azure deployment.
Warning
LLMNR, NBTNS and other poisoning network attacks will not work in aws environment. Only network coerce attacks will work.
"},{"location":"providers/aws/#prerequisites","title":"Prerequisites","text":"You need to configre AWS cli. Use a key with enough privileges on the tenant.
aws configure\nCreate an aws access key and secret for goad usage
[goad]\naws_access_key_id = changeme\naws_secret_access_key = changeme\ncredentials in plain text
Storing credentials in plain text is always a bad idea, but aws cli work like that be sure to restrain the right access to this file
# ~/.goad/goad.ini\n...\n[aws]\naws_region = eu-west-3\naws_zone = eu-west-3c\n# check prerequisites\n./goad.sh -t check -l GOAD -p aws\n# Install\n./goad.sh -t install -l GOAD -p aws\nor from the interactive console :
GOAD/aws/remote/192.168.56.X > install\nstatusstart and stopad/<lab>/providers/aws/windows.tf\"dc01\" = {\n name = \"dc01\"\n domain = \"sevenkingdoms.local\"\n windows_sku = \"2019-Datacenter\"\n ami = \"ami-018ebfbd6b0a4c605\"\n instance_type = \"t2.medium\"\n private_ip_address = \"{{ip_range}}.10\"\n password = \"8dCT-DJjgScp\"\n}\ngoad/workspaces/<instance_folder>ssh and rsyncgoad/workspaces/<instance_folder>/ssh_keysGOAD/aws/remote/192.168.56.X > create_empty # create empty instance\nGOAD/aws/remote/192.168.56.X > load <instance_id>\nGOAD/aws/remote/192.168.56.X (<instance_id>) > provide # play terraform\nGOAD/aws/remote/192.168.56.X (<instance_id>) > sync_source_jumpbox # sync jumpbox source\nGOAD/aws/remote/192.168.56.X (<instance_id>) > prepare_jumpbox # install dependencies on jumpbox\nGOAD/aws/remote/192.168.56.X (<instance_id>) > provision_lab # run ansible\nssh_jumpbox in the goad interactive consolessh_jumpbox_proxy <proxy_port> in the goad interactive console<lab_name>-<lab_instance_id>Thanks!
Thx to Julien Arault for the initial work on the azure provider
Warning
LLMNR, NBTNS and other poisoning network attacks will not work in azure environment. Only network coerce attacks will work.
"},{"location":"providers/azure/#prerequisites","title":"Prerequisites","text":"You need to login to Azure with the CLI.
az login\n# ~/.goad/goad.ini\n...\n[azure]\naz_location = westeurope\n# check prerequisites\n./goad.sh -t check -l GOAD -p azure\n# Install\n./goad.sh -t install -l GOAD -p azure\nor from the interactive console :
GOAD/azure/remote/192.168.56.X > install\nstatusstart and stopInfo
The command stop use deallocate, it take a long time to run but it is not only stopping the vms, it will deallocate them. By doing that, you will stop paying from them (but you still paying storage) and can save some money.
ad/<lab>/providers/azure/windows.tf\"dc01\" = {\n name = \"dc01\"\n publisher = \"MicrosoftWindowsServer\"\n offer = \"WindowsServer\"\n windows_sku = \"2019-Datacenter\"\n windows_version = \"17763.4377.230505\"\n private_ip_address = \"{{ip_range}}.10\"\n password = \"8dCT-DJjgScp\"\n size = \"Standard_B2s\"\n}\ngoad/workspaces/<instance_folder>ssh and rsyncgoad/workspaces/<instance_folder>/ssh_keysGOAD/azure/remote/192.168.56.X > create_empty # create empty instance\nGOAD/azure/remote/192.168.56.X > load <instance_id>\nGOAD/azure/remote/192.168.56.X (<instance_id>) > provide # play terraform\nGOAD/azure/remote/192.168.56.X (<instance_id>) > sync_source_jumpbox # sync jumpbox source\nGOAD/azure/remote/192.168.56.X (<instance_id>) > prepare_jumpbox # install dependencies on jumpbox\nGOAD/azure/remote/192.168.56.X (<instance_id>) > provision_lab # run ansible\nssh_jumpbox in the goad interactive consoleTo setup a socks proxy you can use ssh_jumpbox_proxy <proxy_port> in the goad interactive console
If the command destroy or delete fails, you can delete the resource group using the CLI
az group delete --name GOAD\nThanks!
Huge shootout to @badsectorlabs for Ludus and Erik for his support and tests during the ludus provider creation
Install on ludus server only
To add GOAD on Ludus please use goad directly on the server. By now goad can work only directly on the server and not from a workstation client.
Install Ludus : https://docs.ludus.cloud/docs/quick-start/install-ludus/
Be sure to create an admin user and keep his api key
git clone https://github.com/Orange-Cyberdefense/GOAD.git\ncd GOAD\nsudo apt install python3.11-venv\n./goad.sh\nexit\n# ~/.goad/goad.ini\n...\n[ludus]\nludus_api_key = changeme\nuse_impersonation = yes\n./goad.sh -p ludus\nGOAD/ludus/local > set_lab XXX # GOAD/GOAD-Light/NHA/SCCM\nGOAD/ludus/local > install\nlab_name<6alphanumeric_digit>Info
On ludus the config ip_range is not used and is ignored. The ips will be setup automatically during the lab installation
"},{"location":"providers/proxmox/","title":"Proxmox","text":"And once your prerequisites are ready see https://mayfly277.github.io/posts/GOAD-on-proxmox-part2-packer/ to prepare the template for proxmox
You can run the automatic installation
# check prerequisites\n./goad.sh -t check -l GOAD -p proxmox\n# Install\n./goad.sh -t install -l GOAD -p proxmox\nProviding
Provisioning
./goad.sh -p virtualbox\nGOAD/virtualbox/local/192.168.56.X > check\nInfo
If there is some missing dependencies goes to the installation chapter and follow the guide according to your os.
Note
check give mandatory dependencies in red and non mandatory in yellow (but you should be compliant with them too depending one your operating system)
"},{"location":"providers/virtualbox/#install","title":"Install","text":"./goad.sh -p virtualbox\nGOAD/virtualbox/local/192.168.56.X > set_lab <lab> # here choose the lab you want (GOAD/GOAD-Light/NHA/SCCM)\nGOAD/virtualbox/local/192.168.56.X > set_ip_range <ip_range> # here choose the ip range you want to use ex: 192.168.56\nGOAD/virtualbox/local/192.168.56.X > install\n./goad.sh -t install -p virtualbox -l <lab> -ip <ip_range_to_use>\nQuote
\"Virtualbox c'est no way\" @mpgn
"},{"location":"providers/vmware/#prerequisites","title":"Prerequisites","text":"Providing
Provisioning
./goad.sh -p vmware\nGOAD/vmware/local/192.168.56.X > check\nInfo
If there is some missing dependencies goes to the installation chapter and follow the guide according to your os.
Note
check give mandatory dependencies in red and non mandatory in yellow (but you should be compliant with them too depending one your operating system)
"},{"location":"providers/vmware/#install","title":"Install","text":"./goad.sh -p vmware\nGOAD/vmware/local/192.168.56.X > set_lab <lab> # here choose the lab you want (GOAD/GOAD-Light/NHA/SCCM)\nGOAD/vmware/local/192.168.56.X > set_ip_range <ip_range> # here choose the ip range you want to use ex: 192.168.56 (only the first three digits)\nGOAD/vmware/local/192.168.56.X > install\n./goad.sh -t install -p vmware -l <lab> -ip <ip_range_to_use>\nGoad script can be run in two ways.
The easy way to use goad is just launch ./goad.sh and use ? in the interactive console to get some help.
usage: goad.py [-h] [-t TASK] [-l LAB] [-p PROVIDER] [-ip IP_RANGE] [-m METHOD] [-i INSTANCE] [-e EXTENSIONS] [-a ANSIBLE_ONLY] [-r RUN_PLAYBOOK]\n\nDescription : goad lab management console.\n\noptional arguments:\n -h, --help show this help message and exit\n -t TASK, --task TASK tasks available : (install/start/stop/restart/destroy/status/show)\n -l LAB, --lab LAB lab to use (default: GOAD)\n -p PROVIDER, --provider PROVIDER\n provider to use (default: vmware)\n -ip IP_RANGE, --ip_range IP_RANGE\n ip range to use (default: 192.168.56)\n -m METHOD, --method METHOD\n deploy method to use (default: local)\n -i INSTANCE, --instance INSTANCE\n use a specific instance (use default if not selected)\n -e EXTENSIONS, --extensions EXTENSIONS\n extensions to use\n -a ANSIBLE_ONLY, --ansible_only ANSIBLE_ONLY\n run only provisioning (ansible) on instance (-i) (for task install only)\n -r RUN_PLAYBOOK, --run_playbook RUN_PLAYBOOK\n run only one ansible playbook on instance (-i) (for task install only)\n\nExample :\n - Install GOAD on virtualbox : python3 goad.py -t install -l GOAD -p virtualbox\n - Launch GOAD interactive console : python3 goad.py\nLaunch goad interactive mode
"},{"location":"usage/goad_console/#enter-interactive-mode","title":"Enter interactive mode","text":"To enter interactive mode just launch goad without the -t parameter
./goad.sh\n*** Lab Instances ***\ncheck ................................... check dependencies before creation\ninstall / create ........................ install the selected lab and create a lab instance\ncreate_empty ............................ prepare a lab instance folder without providing and provisioning\nlist .................................... list lab instances\nload <instance_id> ...................... load a lab instance\n\n*** Configuration ***\nconfig .................................. show current configuration\nlabs .................................... show all labs and available providers\nset_lab <lab> ........................... set the lab to use\nset_provider <provider> ................. set the provider to use\nset_provisioning_method <method> ........ set the provisioning method\nset_ip_range <range> .................... set the 3 first digit of the ip to use (ex: 192.168.56)\nWill check the lab dependencies
check\nInstall the lab with the current select config
install\nCreate an empty instance folder (into the workspaces/ folder)
create_empty\nList instances
alias : ls
list\nSelect an instance by his name
alias : use, cd
load <instance name>\nshow current configuration
config\nshow available labs
labs\nChoose the lab to use (GOAD/GOAD-Light/NHA/SCCM/MINILAB)
set_lab <lab_name>\nChoose the provider to use (virtualbox/vmware/aws/azure/ludus/proxmox)
set_provider <lab_name>\nChoose the provisioning method (local/runner/docker/remote) (most of the time you don't have to change it)
set_provisioning <provisioning_method>\nsudo docker build -t goadansible .)Set the ip range you want to use (Three first digit, example : 192.168.10)
set_ip_range <ip_range>\n*** Manage Lab instance commands ***\nstatus .................................. show current status\nstart ................................... start lab\nstop .................................... stop lab\ndestroy ................................. destroy lab\n\n*** Manage one vm commands ***\nstart_vm <vm_name> ...................... start selected virtual machine\nstop_vm <vm_name> ....................... stop selected virtual machine\nrestart_vm <vm_name> .................... restart selected virtual machine\ndestroy_vm <vm_name> .................... destroy selected virtual machine\n\n*** Extensions ***\nlist_extensions ......................... list extensions\ninstall_extension <extension> ........... install extension (providing + provisioning)\nprovision_extension <extension> ......... provision extension (provisioning only)\n\n*** JumpBox ***\nprepare_jumpbox ......................... install package on the jumpbox for provisioning\nsync_source_jumpbox ..................... sync source of the jumpbox\nssh_jumpbox ............................. connect to jump box with ssh\nssh_jumpbox_proxy <proxy_port> .......... connect to jump box with ssh and start a socks proxy\n\n*** Providing (Vagrant/Terrafom) ***\nprovide ................................. run only the providing (vagrant/terraform)\n\n*** Provisioning (Ansible) ***\nprovision <playbook> .................... run specific ansible playbook\nprovision_lab ........................... run all the current lab ansible playbooks\nprovision_lab_from <playbook> ........... run all the current lab ansible playbooks from specific playbook to the end\n\n*** Lab Instances ***\ncheck ................................... check dependencies before creation\ninstall ................................. install the current instance (provide + prepare_jumpbox + provision_lab\nset_as_default .......................... set instance as default\nupdate_instance_files ................... update lab instance files\nlist .................................... list lab instances\nload <instance_id> ...................... load a lab instance\n\n*** Configuration ***\nconfig .................................. show current configuration\nunload .................................. unload current instance\ndelete .................................. delete the currently selected lab instance\nGive the current lab status
status\nStart the current lab instance
start\nStop the current lab instance
stop\nDanger
Destroy the current lab instance vms
destroy\nStart a vm
start_vm <vm_name>\nStop a vm
stop_vm <vm_name>\nRestart a vm (start and stop)
restart_vm <vm_name>\nDanger
Destroy a vm
destroy_vm <vm_name>\nList available extensions
list_extensions\nAdd an extension to the lab (providing + provisioning)
Warning
An installed extension can't be deleted
install_extension <extension_name>\nLaunch provisioning (ansible) for the extension
provision_extension <extension_name>\nPrepare jumpbox : run the preparation script on the jumpbox (install dependencies)
prepare_jumpbox\nRsync goad source with the jumpbox
sync_source_jumpbox\nSSH into the jumpbox
ssh_jumpbox\nSSH into the jumpbox with a socks proxy option (-D)
ssh_jumpbox_proxy <socks_proxy_port>\nLaunch providing (machine creation)
provide\nLaunch specific playbook (use playbook in ansible/ folder)
provision <playbook.yml>\nLaunch all the lab provisioning (install labs on machines with ansible)
provision_lab\nLaunch the lab provisioning from a specific playbook (use playbook in ansible/ folder)
Tip
useful if the install crash to not redo all the provisioning
provision_lab_from <playbook.yml>\nLaunch the check (same as without instance)
check\nLaunch the install (useful if you created an empty instance)
install\nSet the current instance as default (automatically loaded on goad start)
set_as_defualt\nRecreate the files inside the workspace folder
update_instance_files\nList instances
alias : ls
list\nSelect an instance by his name (here change the current instance)
alias : use, cd
load <instance name>\nShow current configuration
config\nUnload the instance (alias cd ..)
unload\nDanger
delete the current instance lab and vms
delete\nWelcome to GOAD (v3) documentation !
Game Of Active Directory is a free pentest active directory LAB(s) project (1).
The purpose of this tool is to give pentesters a vulnerable Active directory environment ready to use to practice usual attack techniques. The idea behind this project is to give you an environment where you can try and train your pentest skills without having the pain to build all by yourself. This repository was build for pentest practice
Note
GOAD main labs (GOAD/GOAD-Light/SCCM) are not pro labs environments (like those you can find on HTB). Theses labs give you an environment to practice a lot of vulnerability and missconfig exploitations. Sure you can use them like pro labs, but it will certainly be too easy due to the number of vulns. Consider more GOAD like a DVWA but for Active Directory. If you want a chall deploy the lab NHA.
Warning
This lab is extremely vulnerable, do not reuse recipe to build your production environment and do not deploy this environment on internet without isolation (this is a recommendation, use it as your own risk).
Windows Licenses
This lab use free windows VM only (180 days). After that delay enter a license on each server or rebuild all the lab (may be it's time for an update ;))
"},{"location":"changelog/","title":"Road Map","text":""},{"location":"changelog/#v1","title":"v1","text":"When you create a lab, goad will create an instance folder. All the instances are stored in the workspace/ folder inside goad.
workspace/\n .\n \u251c\u2500\u2500 6caf1a-goad-light-azure # Instance ID\n \u2502\u00a0\u00a0 \u251c\u2500\u2500 exchange_inventory # extension inventory\n \u2502\u00a0\u00a0 \u251c\u2500\u2500 instance.json # instance json file (name, status, etc..)\n \u2502\u00a0\u00a0 \u251c\u2500\u2500 inventory # provider inventory\n \u2502\u00a0\u00a0 \u251c\u2500\u2500 provider # provider folder\n \u2502\u00a0\u00a0 \u2502\u00a0\u00a0 \u251c\u2500\u2500 jumpbox.tf\n \u2502\u00a0\u00a0 \u2502\u00a0\u00a0 \u251c\u2500\u2500 linux.tf\n \u2502\u00a0\u00a0 \u2502\u00a0\u00a0 \u251c\u2500\u2500 main.tf\n \u2502\u00a0\u00a0 \u2502\u00a0\u00a0 \u251c\u2500\u2500 network.tf\n \u2502\u00a0\u00a0 \u2502\u00a0\u00a0 \u251c\u2500\u2500 outputs.tf\n \u2502\u00a0\u00a0 \u2502\u00a0\u00a0 \u251c\u2500\u2500 terraform.tfstate\n \u2502\u00a0\u00a0 \u2502\u00a0\u00a0 \u251c\u2500\u2500 terraform.tfstate.backup\n \u2502\u00a0\u00a0 \u2502\u00a0\u00a0 \u251c\u2500\u2500 variables.tf\n \u2502\u00a0\u00a0 \u2502\u00a0\u00a0 \u2514\u2500\u2500 windows.tf\n \u2502\u00a0\u00a0 \u2514\u2500\u2500 ssh_keys # the keys generated by this instance\n \u2502\u00a0\u00a0 \u2514\u2500\u2500 ubuntu-jumpbox.pem\n \u251c\u2500\u2500 7b12f1-goad-light-vmware # another instance\n \u2502\u00a0\u00a0 \u251c\u2500\u2500 instance.json\n \u2502\u00a0\u00a0 \u251c\u2500\u2500 inventory\n \u2502\u00a0\u00a0 \u251c\u2500\u2500 inventory_disable_vagrant\n \u2502\u00a0\u00a0 \u251c\u2500\u2500 provider\n \u2502\u00a0\u00a0 \u2502\u00a0\u00a0 \u2514\u2500\u2500 Vagrantfile\n \u2502\u00a0\u00a0 \u2514\u2500\u2500 ssh_keys\ninstall or create_empty), the provider files inside the template/ folder are copied into the instance. ad/<lab>/providers/<provider>/ folder and the datas inside extensions/<extension>/providers/<provider>/The merged result is present in the workspace/<instance_id>/provider/ folder and contain all the recipes to create the infrastructure
inventories files are also copied from ad/<lab>/provider/<provider>/inventory and extensions/<extension>/inventory (see provisioning for more information in provisioning)
This page describe how the provisioning is done with goad. The provisioning of the LABS is done with Ansible for all providers.
The data of each lab are stored in the json file : ad/<lab>/data/config.json, this file is loaded by each playbook to get all the lab variables (this is done by the data.yml playbook call by all the over playbooks)
If an extension need data it will be stored in extensions/<extension>/data/config.json but the loading must be done by extension install.yml playbook.
# read local configuration file\n- name: \"Read local config file\"\n hosts: domain:extensions\n connection: local\n vars_files:\n - \"../data/config.json\"\n tasks:\n - name: merge lab variable with local config\n set_fact:\n lab: \"{{ lab|combine(lab_extension, recursive=True) }}\"\nAnsible work with inventories. Inventories files contains all the hosts declaration and some variables.
The lab inventory file (ad/<lab>/data/inventory) is not modified/moved and contain all the main variables and hosts association, this file stay as this and is not modified. It contains the lab building logic.
The provider inventory file (ad/<lab>/provider/<provider>/inventory) is modified with the settings and copied into the workspace folder (workspace/<instance_id>/inventory) , this file contains variable specific to the provider and the host ip declaration
The extension(s) inventory file(s) (extensions/<extension>/inventory) is modified with the settings and copied into the workspace folder (workspace/<instance_id>/inventory_<extension>) , this file contains variable specific to the extension and the extension host ip declaration
The global inventory file globalsettings.inicontains some global variable with some user settings.
The inventory files are given to ansible in this order : - lab inventory file - workspace provider inventory file - workspace extension(s) inventory file(s) - globalsettings.ini file
The order is important as it determine the override order. hosts declarations are merged between all inventory and variables with the same name are override if the same variable is declared.
extension/<extension>/ansible/install.ymlThe extension folder can call the main goad roles by using a special ansible.cfg file.
Example of the exchange ansible.cfg file
[defaults]\n...\n; add default roles folder into roles_path\nroles_path = ./roles:../../../ansible/roles\nHow can i change the default keyboard layout ?
edit globalsettings.ini files and change the variable keyboard_layouts
How can i change the folder where vagrant download the boxes ?
vagrant download the boxes by default on ~/.vagrant.d/ folder. Set up the VAGRANT_HOME environment variable to change this location.
How can i change the folder where virtualbox create the box ?
Go to virtualbox preferences and change the virtualbox vm location folder.
I already got a lab installed with v2, is v3 will use it ?
Sorry no, the v3 of GOAD doesn't look for already installed lab. Best way to migrate is trash your old lab and build a new one.
Can i use goad to create a course for my student ?
Sure GOAD is a GPL project. Feel free to reuse it to give course. Just don't forget to give credits to the project ;)
"},{"location":"references/","title":"References","text":"\ud83d\udea7 TODO TO BE COMPLETED
Mayfly's blog :
NHA WriteUp :
Podcast
YouTube
And of course to all the project contributors !
"},{"location":"thx/#enterprise","title":"Enterprise","text":"Tip
In most case if you get errors during install, don't think. Select the failed instance \u0300load <instance_id> and just replay the install with provision_lab to relaunch all or provision_lab_from <playbook> if you know the last failed playbook (most of the errors which could came up are due to windows latency during installation, wait few minutes and replay the install)
\ud83d\udea7 TODO refresh me with new goad version :)
"},{"location":"troobleshoot/#vagrant-up-winrm-digest-initialization-failed-initialization-error","title":"vagrant up - WinRM - digest initialization failed : Initialization Error","text":"DC01: WinRM username: vagrant\nDC01: WinRM execution_time_limit: PT2H\nDC01: WinRM transport: negotiate\nAn error occurred executing a remote WinRM command.\n\nShell: Cmd\nCommand: hostname\nMessage: Digest initialization failed: initialization error\nconfig.winrm.transport = \"plaintext\"\nconfig.winrm.basic_auth_only = true\nsolution 2: allow legacy algorithm (https://github.com/Orange-Cyberdefense/GOAD/issues/11)
[provider_sect]\ndefault = default_sect\nlegacy = legacy_sect\n\n[default_sect]\nactivate = 1\n\n[legacy_sect]\nactivate = 1\nsolution 3: downgrade the vagrant version (sudo apt install vagrant=2.2.19)
<internal:/usr/lib/ruby/vendor_ruby/rubygems/core_ext/kernel_require.rb>:85:in `require': cannot load such file -- winrm (LoadError)\n from <internal:/usr/lib/ruby/vendor_ruby/rubygems/core_ext/kernel_require.rb>:85:in `require'\n from /usr/share/rubygems-integration/all/gems/vagrant-2.3.4/plugins/communicators/winrm/shell.rb:9:in `block in <top (required)>'\n from /usr/share/rubygems-integration/all/gems/vagrant-2.3.4/lib/vagrant/util/silence_warnings.rb:8:in `silence!'\ngem install winrmgem install winrm-fs<internal:/usr/lib/ruby/vendor_ruby/rubygems/core_ext/kernel_require.rb>:85:in `require': cannot load such file -- winrm-elevated (LoadError)\n from <internal:/usr/lib/ruby/vendor_ruby/rubygems/core_ext/kernel_require.rb>:85:in `require'\n from /usr/share/rubygems-integration/all/gems/vagrant-2.3.4/plugins/communicators/winrm/shell.rb:12:in `<top (required)>'\n ...\ngem install winrm-elevated# ansible_winrm_transport=basic\n# ansible_port=5985\nTASK [groups_domains : synchronizes all domains] *******************************************************************************************************************************************************************************************************************************\nchanged: [dc03]\nchanged: [dc01]\nfatal: [dc02]: FAILED! => {\"changed\": true, \"cmd\": \"repadmin /syncall /Ade\", \"delta\": \"0:00:01.090773\", \"end\": \"2023-10-18 09:30:26.016579\", \"msg\": \"non-zero return code\", \"rc\": 1, \"start\": \"2023-10-18 09:30:24.925805\", \"stderr\": \"\", \"stderr_lines\": [], \"stdout\": \"Syncing all NC's held on winterfell.\\r\\r\\nSyncing partition: DC=north,DC=sevenkingdoms,DC=local\\r\\r\\nCALLBACK MESSAGE: Error contacting server CN=NTDS Settings,CN=WINTERFELL,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=sevenkingdoms,DC=local (network error): 1722 (0x6ba):\\r\\r\\n The RPC server is unavailable.\\r\\r\\n\\r\\r\\nSyncAll exited with fatal Win32 error: 8440 (0x20f8):\\r\\r\\n The naming context specified for this replication operation is invalid.\\r\\r\\n\", \"stdout_lines\": [\"Syncing all NC's held on winterfell.\", \"\", \"Syncing partition: DC=north,DC=sevenkingdoms,DC=local\", \"\", \"CALLBACK MESSAGE: Error contacting server CN=NTDS Settings,CN=WINTERFELL,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=sevenkingdoms,DC=local (network error): 1722 (0x6ba):\", \"\", \" The RPC server is unavailable.\", \"\", \"\", \"\", \"SyncAll exited with fatal Win32 error: 8440 (0x20f8):\", \"\", \" The naming context specified for this replication operation is invalid.\", \"\"]}\n==> GOAD-SRV03: Configuring and enabling network interfaces...\nVagrant can't use the requested machine because it is locked! This\nmeans that another Vagrant process is currently reading or modifying\nthe machine. Please wait for that Vagrant process to end and try\nagain. Details about the machine are shown below:\ncd ~/GOAD/ad/GOAD/providers/virtualbox\nvagrant reload GOAD-SRV03 --provisioning\nAn exception occurred during task execution. To see the full traceback, use -vvv. The error was: at Microsoft.ActiveDirectory.Management.Commands.ADCmdletBase`1.BeginProcessing()\nfailed: [dc02] (item={'key': 'AcrossTheSea', 'value': ['essos.local\\\\daenerys.targaryen']}) => {\"ansible_loop_var\": \"item\", \"attempts\": 3, \"changed\": false, \"item\": {\"key\": \"AcrossTheSea\", \"value\": [\"essos.local\\\\daenerys.targaryen\"]}, \"msg\": \"Unhandled exception while executing module: The server has rejected the client credentials.\"}\nAn exception occurred during task execution. To see the full traceback, use -vvv. The error was: at Microsoft.ActiveDirectory.Management.Commands.ADCmdletBase`1.BeginProcessing()\nfailed: [192.168.56.xx] (item={'key': 'DragonsFriends', 'value': ['sevenkingdoms.local\\\\tyron.lannister', 'essos.local\\\\daenerys.targaryen']}) => {\"ansible_loop_var\": \"item\", \"attempts\": 3, \"changed\": false, \"item\": {\"key\": \"DragonsFriends\", \"value\": [\"north.sevenkingdoms.local\\\\jon.snow\", \"sevenkingdoms.local\\\\tyron.lannister\", \"essos.local\\\\daenerys.targaryen\"]}, \"msg\": \"Unhandled exception while executing module: Either the target name is incorrect or the server has rejected the client credentials.\"}\nAn exception occurred during task execution. To see the full traceback, use -vvv. The error was: at , : line 475\nfailed: [192.168.56.11] (item={'key': 'arya.stark', 'value': {'firstname': 'Arya', 'surname': 'Stark',\n...\n\"msg\": \"Unhandled exception while executing module: The term 'Add-Warning' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.\"}+\nfatal: [xxx]: FAILED! => {\n \"changed\": false,\n \"msg\": \"Problems installing XXXX module: A parameter cannot be found that matches parameter name 'AcceptLicense'.\",\n \"nuget_changed\": false,\n \"output\": \"\",\n \"repository_changed\": false\n}\nERROR! no action detected in task. This often indicates a misspelled module name, or incorrect module path.\n\nThe error appears to have been in '/home/hrrb0032/Documents/mission/GOAD/roles/domain_controller/tasks/main.yml': line 8, column 3, but maybe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n- name: disable enhanced exit codes\n^ here\nsolution : upgrade Ansible
"},{"location":"troobleshoot/#old-ansiblewindows-version","title":"old ansible.windows version","text":"ERROR! couldn't resolve module/action 'win_powershell'. This often indicates a misspelling, missing collection, or incorrect module path.\nansible-galaxy collection install ansible.windows --force\nPLAY [DC01 - kingslanding] *******************************************************\n\n\n\nTASK [Gathering Facts] ***********************************************************\nfatal: [192.168.56.10]: FAILED! => {\"msg\": \"winrm or requests is not installed: No module named winrm\"}\n\n\n\nPLAY RECAP ***********************************************************************\n192.168.56.10 : ok=0 changed=0 unreachable=0 failed=1 skipped=0 rescued=0 ignored=0 \nsolution : pip install pywinrm
"},{"location":"troobleshoot/#winrm-send-input-timeout","title":"winrm send input timeout","text":"TASK [Gathering Facts] ****************************************************************************************************************************************************\n[WARNING]: ERROR DURING WINRM SEND INPUT - attempting to recover: WinRMOperationTimeoutError\nok: [192.168.56.11]\nsolution : wait or if crashed then re-run install
"},{"location":"troobleshoot/#domain-controller-ensure-users-are-present","title":"Domain controller : ensure Users are present","text":"TASK [domain_controller : Ensure that Users presents in ou=<kingdom>,dc=SEVENKINGDOMS,dc=local] ***************************************************************************\nAn exception occurred during task execution. To see the full traceback, use -vvv. The error was: at Microsoft.ActiveDirectory.Management.Commands.ADCmdletBase`1.ProcessRecord()\nfailed: [192.168.56.10] (item={u'key': u'lord.varys', u'value': {u'city': u\"King's Landing\", u'password': u'_W1sper_$', u'name': u'Lord Varys', u'groups': u'Small Council', u'path': u'OU=Users,OU=Crownlands,OU=kingdoms,DC=SEVENKINGDOMS,DC=local'}}) => {\"ansible_loop_var\": \"item\", \"changed\": false, \"item\": {\"key\": \"lord.varys\", \"value\": {\"city\": \"King's Landing\", \"groups\": \"Small Council\", \"name\": \"Lord Varys\", \"password\": \"_W1sper_$\", \"path\": \"OU=Users,OU=Crownlands,OU=kingdoms,DC=SEVENKINGDOMS,DC=local\"}}, \"msg\": \"Unhandled exception while executing module: An unspecified error has occurred\"}\nTASK [mssql : Install the database]\nfatal: [192.168.56.22]: FAILED! => {\"attempts\": 3, \"changed\": true, \"cmd\": \"c:\\\\setup\\\\mssql\\\\sql_installer.exe /configurationfile=c:\\\\setup\\\\mssql\\\\sql_conf.ini /IACCEPTSQLSERVERLICENSETERMS /MEDIAPATH=c:\\\\setup\\\\mssql\\\\media /QUIET /HIDEPROGRESSBAR\", \"delta\": \"0:00:34.891185\", \"end\": \"2022-08-17 21:26:53.976793\", \"msg\": \"non-zero return code\", \"rc\": 2226323458, \"start\": \"2022-08-17 21:26:19.085608\", \"stderr\": \"\", \"stderr_lines\": [], \"stdout\": \"Microsoft (R) SQL Server Installer\\r\\nCopyright (c) 2019 Microsoft. All rights reserved.\\r\\n\\r\\nDownloading install package...\\r\\n\\r\\n\\r\\nOperation finished with result: Failure\\r\\n\\r\\nOops...\\r\\n\\r\\nUnable to install SQL Server (setup.exe).\\r\\n\\r\\n Exit code (Decimal): -2068643838\\r\\n Exit message: No features were installed during the setup execution. The requested features may already be installed. Please review the summary.txt log for further details.\\r\\n\\r\\n SQL SERVER INSTALL LOG FOLDER\\r\\n c:\\\\Program Files\\\\Microsoft SQL Server\\\\150\\\\Setup Bootstrap\\\\Log\\\\20220817_142624\\r\\n\\r\\n\", \"stdout_lines\": [\"Microsoft (R) SQL Server Installer\", \"Copyright (c) 2019 Microsoft. All rights reserved.\", \"\", \"Downloading install package...\", \"\", \"\", \"Operation finished with result: Failure\", \"\", \"Oops...\", \"\", \"Unable to install SQL Server (setup.exe).\", \"\", \" Exit code (Decimal): -2068643838\", \" Exit message: No features were installed during the setup execution. The requested features may already be installed. Please review the summary.txt log for further details.\", \"\", \" SQL SERVER INSTALL LOG FOLDER\", \" c:\\\\Program Files\\\\Microsoft SQL Server\\\\150\\\\Setup Bootstrap\\\\Log\\\\20220817_142624\", \"\"]}\nsolution : re-run installer
"},{"location":"troobleshoot/#vagrant-not-working-on-ubuntu-2204","title":"vagrant: Not working on Ubuntu 22.04","text":"I was using the version of Vagrant in the Ubuntu repo, and then tried to use the version 2.4.0 and 2.3.4 binaries from hashicorp, but kept on running into this error:
The guest machine entered an invalid state while waiting for it\nto boot. Valid states are 'starting, running'. The machine is in the\n'poweroff' state. Please verify everything is configured\nproperly and try again.\n\nIf the provider you're using has a GUI that comes with it,\nit is often helpful to open that and watch the machine, since the\nGUI often has more helpful error messages than Vagrant can retrieve.\nFor example, if you're using VirtualBox, run `vagrant up` while the\nVirtualBox GUI is open.\n\nThe primary issue for this error is that the provider you're using\nis not properly configured. This is very rarely a Vagrant issue.\nThe error may look similar to below:
==> proxmox-iso.windows: Error creating VM: error creating VM: 403 Permission check failed (/sdn/zones/localnetwork/vmbr3/10, SDN.Use), \nerror status: {\"data\":null} (params: ......\nIt may be fixed by delegating the SDN.Use privilege to the packer user
pveum role modify Packer -privs \"VM.Config.Disk VM.Config.CPU VM.Config.Memory Datastore.AllocateTemplate Datastore.Audit Datastore.AllocateSpace Sys.Modify VM.Config.Options VM.Allocate VM.Audit VM.Console VM.Config.CDROM VM.Config.Cloudinit VM.Config.Network VM.PowerMgmt VM.Config.HWType VM.Monitor SDN.Use\"\nThe error may look similar to below:
root@goadprovisioning:~/GOAD/packer/proxmox# packer build -var-file=windows_server2019_proxmox_cloudinit.pkvars.hcl .\nproxmox-iso.windows: output will be in this color.\n\n==> proxmox-iso.windows: Retrieving additional ISO\n==> proxmox-iso.windows: Trying ./iso/Autounattend_winserver2019_cloudinit.iso\n==> proxmox-iso.windows: Trying ./iso/Autounattend_winserver2019_cloudinit.iso?checksum=sha256%3A43857cb780de3a58696285f644034499d4b29608b3c511feb27e315832b696c4\n==> proxmox-iso.windows: ./iso/Autounattend_winserver2019_cloudinit.iso?checksum=sha256%3A43857cb780de3a58696285f644034499d4b29608b3c511feb27e315832b696c4 => /root/GOAD/packer/proxmox/iso/Autounattend_winserver2019_cloudinit.iso\n proxmox-iso.windows: Uploaded ISO to local:iso/Autounattend_winserver2019_cloudinit.iso\n==> proxmox-iso.windows: Creating VM\n==> proxmox-iso.windows: No VM ID given, getting next free from Proxmox\n==> proxmox-iso.windows: Error creating VM: error creating VM: unable to create VM 103 - unsupported format 'qcow2' at /usr/share/perl5/PVE/Storage/LvmThinPlugin.pm line 87., error status: (params: map[agent:1 args: boot: cores:2 cpu:kvm64 description:Packer ephemeral build VM hotplug: ide2:local:iso/windows_server_2019.iso,media=cdrom kvm:true machine: memory:4096 name:WinServer2019x64-cloudinit-qcow2 net0:virtio=5E:5D:24:C4:0F:DA,bridge=vmbr3,tag=10 numa:false onboot:false ostype:win10 pool:GOAD sata0:vms:40,discard=ignore,format=qcow2 scsihw:lsi sockets:1 startup: tags: vmid:103])......\nFilesystems such as ZFS (and others) do not support qcow2. From my reading the best approach is to use an ext4 filesystem and modify config.auto.pkrvars.hcl with the newly created ext4 volume.
root@goadprovisioning:~/GOAD/packer/proxmox# vi config.auto.pkrvars.hcl\n...\nproxmox_vm_storage = \"ext4-qcow2\"\n...\nroot@goadprovisioning:~/GOAD/packer/proxmox# packer build -var-file=windows_server2019_proxmox_cloudinit.pkvars.hcl .\nproxmox-iso.windows: output will be in this color.\n\n==> proxmox-iso.windows: Retrieving additional ISO\n==> proxmox-iso.windows: Trying ./iso/Autounattend_winserver2019_cloudinit.iso\n==> proxmox-iso.windows: Trying ./iso/Autounattend_winserver2019_cloudinit.iso?checksum=sha256%3A43857cb780de3a58696285f644034499d4b29608b3c511feb27e315832b696c4\n==> proxmox-iso.windows: ./iso/Autounattend_winserver2019_cloudinit.iso?checksum=sha256%3A43857cb780de3a58696285f644034499d4b29608b3c511feb27e315832b696c4 => /root/GOAD/packer/proxmox/iso/Autounattend_winserver2019_cloudinit.iso\n proxmox-iso.windows: Uploaded ISO to local:iso/Autounattend_winserver2019_cloudinit.iso\n==> proxmox-iso.windows: Creating VM\n==> proxmox-iso.windows: No VM ID given, getting next free from Proxmox\n==> proxmox-iso.windows: Starting VM\nproxmox_vm_storage = \"raw\"==> proxmox-iso.windows: Error creating VM: error creating VM: unable to create VM 116 - volume 'local:iso/windows_server2019_XXX_en-us.iso' does not exist, error status: (params: map[agent:1 args: boot: cores:2 cpu:kvm64 description:Packer ephemeral build VM hotplug\n: ide2:local:iso/windows_server2019_XXX_en-us.iso,media=cdrom kvm:true machine: memory:4096 name:WinServer2019x64-cloudinit-qcow2-uptodate net0:virtio=DA:CB:EB:85:08:0E,bridge=vmbr3,tag=10,firewall=false onboot:false ostype:win10 pool:Templates sata0:local:80,format=q\ncow2 scsihw:lsi sockets:1 startup: tags: vmid:116]) \nverify your iso files inside proxmox and be sure the iso you want to use exist in proxmox
"},{"location":"troobleshoot/#ansible-adapter-name-error","title":"ansible adapter name error","text":"No MSFT_NetAdapter objects found with property 'Name' equal to 'Ethernet'\n\nor \n\nNo MSFT_NetAdapter objects found with property 'Name' equal to 'Ethernet2 '\nfatal: [dc01]: UNREACHABLE! => {\"changed\": false, \"msg\": \"ssl: HTTPSConnectionPool(host='192.168.10.40', port=5986): Max retries exceeded with url: /wsman\nvulnerabilities
"},{"location":"developpers/provisioning/","title":"Provisioning","text":""},{"location":"developpers/provisioning/#provisioning","title":"Provisioning","text":"ad/\n labname/ # The lab name must be the same as the variable : domain_name from the data/inventory\n data/\n config.json # The json file containing all the variables and configuration of the lab\n inventory # The global lab inventory (provider independent) (this should no contains variables)\n files/ # This folder contains files you want to copy on your vms\n scripts/ # This folder contains ps1 scripts you want to play on your vm (Must be added in the \"scripts\" entries of your vms)\n providers/ # Your lab available provider\n vmware/\n inventory # specific vmware inventory\n Vagrantfile # specific vmware vagrantfile\n virtualbox/\n inventory # specific virtualbox inventory\n Vagrantfile # specific virtualbox vagrantfile\n proxmox/\n terraform/ # specific proxmox terraform recipe\n inventory # specific proxmox inventory\n azure/\n terraform/ # specific azure terraform recipe\n inventory # specific azure inventory\nelk*Add a machine : elk (ip_range.50)
Kibana is configured on http://{{ip_range}}.50:5601 to follow the lab events
You need sshpass for the elk installation
sudo apt install sshpass\nOn ludus prepare template :
ludus templates add -d ubuntu-22.04-x64-server\nludus templates build\nselect your instance
load <instance_id>\ninstall the elk extension
install_extension elk\nThanks!
Credits and huge thanks to aleemladha for his exchange role and his help to test the extension.
exchangeresources
Exchange is really HUGE, it will add a vm with at least 12Gb of RAM be sure your computer support it before install
impacts
Modify the ad schema and add a computer (warning the exchange machine is really heavy)
"},{"location":"extensions/exchange/#prerequisites","title":"Prerequisites","text":"select your instance
load <instance_id>\ninstall the exchange extension
install_extension exchange\nThanks!
Credits and huge thanks to aleemladha for the ansible role. https://github.com/Orange-Cyberdefense/GOAD/pull/215
wazuhimpacts
add a wazuh machine and a wazuh agent on all windows machine\"
"},{"location":"extensions/wazuh/#prerequisites","title":"Prerequisites","text":"On ludus prepare template :
ludus templates add -d ubuntu-22.04-x64-server\nludus templates build\nA lab installed
select your instance
load <instance_id>\ninstall the exchange extension
install_extension wazuh\nws01Providers : virtualbox/azure/vmware/aws/ludus/proxmox
Add a machine : {{lab_name}}-WS01 (casterlyrock.sevenkingdoms.local) (ip_range.31)
rearm
The vm is not armed by default (90 days trials), connect to the vm with vagrant/vagrant and run as admin slmgr -rearm to rearm the box. (need a restart)
aws
AWS doesn't got any windows 10 so for aws the vm is a windows server 2019
"},{"location":"extensions/ws01/#lab-info","title":"Lab info","text":"Lab infos:
Features :
GOAD or GOAD-Light installation
On ludus prepare template :
ludus templates add -d win10-21h1-x64-enterprise\nludus templates build\nselect your instance
load <instance_id>\ninstall the ws01 extension
install_extension ws01\nIn the last version, GOAD use no more bash for the installation/management script. The goad management script is now written in python to permit more flexibility and cover the needs to create a Windows WSL support.
First prepare you system for GOAD execution:
Installation depend of the provider you use, please follow the appropriate guide :
# Install vbox\nsudo apt install virtualbox\n\n# Install vagrant\nwget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg\necho \"deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main\" | sudo tee /etc/apt/sources.list.d/hashicorp.list\nsudo apt update && sudo apt install vagrant\n\n# Install Vagrant plugins\nvagrant plugin install vagrant-reload vagrant-vbguest winrm winrm-fs winrm-elevated\n\n# Add some dependencies\nsudo apt install sshpass lftp rsync openssh-client python3.10-venv\n\ngit clone https://github.com/Orange-Cyberdefense/GOAD.git\ncd GOAD\n# verify installation\n./goad.sh -t check -l GOAD -p virtualbox\n\n# install\n./goad.sh -t install -l GOAD -p virtualbox\n\n# launch goad in interactive mode\n./goad.sh\nrequirements.yml file on the root of the project.goad_docker.sh script instead of goad.sh. This will run the ansible with the docker method instead of local or runner.This are the python dependencies used by goad :
Mandatory for goad.py:
rich\npsutil\nJinja2\npyyaml\nMandatory for ansible inside goad (for provisioning method local or runner) :
# Ansible\nansible_runner\nansible-core==2.12.6\npywinrm\nMandatory for azure provider :
# AZURE\nazure-identity\nazure-mgmt-compute\nazure-mgmt-network\nMandatory for aws provider :
# AWS\nboto3\nMandatory for proxmox provider:
# Proxmox\nproxmoxer\nrequests\nYou can launch goad without installing all the pip package but for that you will have to disable some dependencies with the -d arguments:
-d vmware : disable vmware provider\n-d virtualbox : disable virtualbox provider\n-d azure : disable azure provider\n-d aws : disable azure provider\n-d proxmox : disable proxmox provider\n-d ludus : disable ludus provider\n-d local : disable local provisioning method (if you use docker only)\n-d runner : disable ansible runner provisioning method (if you use docker only)\n-d remote : disable remote provisioning method\n-d docker : disable docker provisioning method\nInstallation is in three parts :
GOAD script cover the providing and provisioning part
The install script take multiple parameters:
-p : the provider to use (vmware/virtualbox/proxmox/ludus/azure/aws)-l : the lab to install (GOAD/GOAD-Light/SCCM/NHA/MINILAB)-m : the method of installation (local/runner/docker/remote), most of the time don't change it-ip : the ip range to useThe easy way is just launch ./goad.sh and use help ?in the interactive prompt
On the first launch goad create a global configuration file at : $HOME/.goad/goad.ini this file contains some default configuration and some parameters needed by some providers.
If you change the [default] config it will change the default selection when goad start
[default]\n; lab: goad / goad-light / minilab / nha / sccm\nlab = GOAD\n; provider : virtualbox / vmware / aws / azure / proxmox\nprovider = vmware\n; provisioner method : local / remote\nprovisioner = local\n; ip_range (3 first ip digits)\nip_range = 192.168.56\n\n[aws]\naws_region = eu-west-3\naws_zone = eu-west-3c\n\n[azure]\naz_location = westeurope\n\n[proxmox]\npm_api_url = https://192.168.1.1:8006/api2/json\npm_user = infra_as_code@pve\npm_node = GOAD\npm_pool = GOAD\npm_full_clone = false\npm_storage = local\npm_vlan = 10\npm_network_bridge = vmbr3\npm_network_model = e1000\n\n[proxmox_templates_id]\nwinserver2019_x64 = 102\nwinserver2016_x64 = 103\nwinserver2019_x64_utd = 104\nwindows10_22h2_x64 = 105\n\n[ludus]\n; api key must not have % if you have a % in it, change it by a %%\nludus_api_key = change_me\nuse_impersonation = yes\nglobalsettings.ini used by the ansible provisioningVagrant
Virtualbox
sudo apt install virtualbox\nInstall vagrant plugins
vagrant plugin install vagrant-reload vagrant-vbguest winrm winrm-fs winrm-elevated\nDisk space
The lab takes about 77GB (but you have to get the space for the vms vagrant images windows server 2016 (22GB) / windows server 2019 (14GB) / ubuntu 18.04 (502M)) The total space needed for the lab is ~115 GB (depend on the lab you use and it will take more space if you take snapshots), be sure you have enough disk space before install.
RAM
Depending on the lab you will need a lot of ram to run all the virtual machines. Be sure to have at least 20GB for GOAD-Light and 24GB for GOAD.
Tip
Vmware workstation is now free for personal use !
Vagrant
Vmware workstation
Install vagrant vmware utility : https://developer.hashicorp.com/vagrant/install/vmware
Install the following vagrant plugins:
vagrant plugin install vagrant-reload vagrant-vmware-desktop winrm winrm-fs winrm-elevated\nDisk space
The lab takes about 77GB (but you have to get the space for the vms vagrant images windows server 2016 (22GB) / windows server 2019 (14GB) / ubuntu 18.04 (502M)) The total space needed for the lab is ~115 GB (depend on the lab you use and it will take more space if you take snapshots), be sure you have enough disk space before install.
RAM
Depending on the lab you will need a lot of ram to run all the virtual machines. Be sure to have at least 20GB for GOAD-Light and 24GB for GOAD.
az login\nAWS CLI
[goad]\naws_access_key_id = changeme\naws_secret_access_key = changeme\nCreate an aws access key and secret for goad usage
credentials in plain text
Storing credentials in plain text is always a bad idea, but aws cli work like that be sure to restrain the right access to this file
Terraform
By now goad can work only directly on the server and not from a workstation client.
Install Ludus : https://docs.ludus.cloud/docs/quick-start/install-ludus/
Be sure to create an administrator user and keep his api key
Once your installation is complete on ludus server (debian 12) and your user is created do :
git clone https://github.com/Orange-Cyberdefense/GOAD.git\ncd GOAD\nsudo apt install python3.11-venv\n./goad.sh\n...>exit\nvim ~/.goad/goad.ini # add the api_key in the config file (keep impersonate to yes and use an admin user)\n./goad.sh -p ludus\n...>set_lab XXX # GOAD/GOAD-Light/NHA/SCCM\n...>install\nTo run the Goad installation/management script you will need :
Install the python3-venv corresponding to your python version
sudo apt install python<version>-venv\nsudo apt install python3.10-venv\nPython version
Be sure to use a python version between python3.8 and python 3.11. Others python versions are not supported by now due to incompatibility with the fixed version in the requirements.
Info
With this method ansible-core will not be installed locally on your venv
To run the Goad installation/management script you will need :
Install the python3-venv corresponding to your python version
sudo apt install python<version>-venv\nsudo apt install python3.10-venv\n./goad_docker.sh instead of ./goad.sh to install the dependencies without the ansible part (local and runner provisioning method will not be available)Info
To use GOAD on windows you will need WSL.
If you want to use virtualbox as an hypervisor to create your vm.
VAGRANT
If you want to create the lab on your windows computer you will need vagrant. Vagrant will be responsible to automate the process of vm download and creation.
Virtualbox
Install virtualbox <= 7.0 (vagrant support only to vbox7.0 at the time of writing) : https://www.virtualbox.org/wiki/Download_Old_Builds_7_0
Install the following vagrant plugins:
vagrant.exe plugin install vagrant-reload vagrant-vbguest winrm winrm-fs winrm-elevated\nDisk space
The lab takes about 77GB (but you have to get the space for the vms vagrant images windows server 2016 (22GB) / windows server 2019 (14GB) / ubuntu 18.04 (502M)) The total space needed for the lab is ~115 GB (depend on the lab you use and it will take more space if you take snapshots), be sure you have enough disk space before install.
RAM
Depending on the lab you will need a lot of ram to run all the virtual machines. Be sure to have at least 20GB for GOAD-Light and 24GB for GOAD.
If you want to use vmware workstation as an hypervisor to create your vm.
Tip
Vmware workstation is now free for personal use !
VAGRANT
If you want to create the lab on your windows computer you will need vagrant. Vagrant will be responsible to automate the process of vm download and creation.
Vmware Workstation
vmware workstation install bug
if you got an error about groups and permission during vmware workstation install consider running this in an administrator cmd prompt:
net localgroup /add \"Users\"\nnet localgroup /add \"Authenticated Users\"\nInstall vagrant vmware utility : https://developer.hashicorp.com/vagrant/install/vmware
Install the following vagrant plugins:
vagrant.exe plugin install vagrant-reload vagrant-vmware-desktop winrm winrm-fs winrm-elevated\nDisk space
The lab takes about 77GB (but you have to get the space for the vms vagrant images windows server 2016 (22GB) / windows server 2019 (14GB) / ubuntu 18.04 (502M)) The total space needed for the lab is ~115 GB (depend on the lab you use and it will take more space if you take snapshots), be sure you have enough disk space before install.
RAM
Depending on the lab you will need a lot of ram to run all the virtual machines. Be sure to have at least 20GB for GOAD-Light and 24GB for GOAD.
Nothing to prepare on windows host, install and prepare wsl and next follow linux install from your wsl console : see aws linux install
Nothing to prepare on windows host, install and prepare wsl and next linux install from your wsl console see azure linux install
Not supported, you will have to create a provisioning machine on your proxmox and run goad from then (see proxmox linux install)
Not supported, you will have to act from your ludus server (see ludus linux install)
"},{"location":"installation/windows/#prepare-wsl-environment","title":"Prepare WSL environment","text":"Now your host environment is ready for virtual machine creation. Now we will install WSL to run the goad installation script.
"},{"location":"installation/windows/#install-wsl","title":"Install WSL","text":"Open debian console then :
Verify you are using python version <= 11
python3 --version\nInstall python packages
sudo apt update\nsudo apt install python3 python3-pip python3-venv libpython3-dev\nNext you can clone and run goad
cd /mnt/c/whatever_folder_you_want\ngit clone https://github.com/Orange-Cyberdefense/GOAD.git\ncd GOAD\n./goad.sh\nPractice lab(s) :
Challenge lab :
POC lab :
This is a light version of goad without the essos domain. This lab was build for computer with less performance (min ~20GB).
Missing scenarios:
This lab is actually composed of five virtual machines:
domain : sevenkingdoms.local
domain : north.sevenkingdoms.local
NORTH.SEVENKINGDOMS.LOCAL
SEVENKINGDOMS.LOCAL
SEVENKINGDOMS
NORTH
DC02 : winterfell.north.sevenkingdoms.local (Windows Server 2019) (NORTH DC)
SRV02 : castelblack.essos.local (Windows Server 2019) (IIS, MSSQL, SMB share)
GOAD is the first and main lab of this project. It contains 3 domains and 2 forest.
"},{"location":"labs/GOAD/#servers","title":"Servers","text":"This lab is actually composed of five virtual machines:
domain sevenkingdoms.local
domain north.sevenkingdoms.local
domain essos.local
SEVENKINGDOMS / sevenkingdoms.local
NORTH / north.sevenkingdoms.local
DC02 : winterfell.north.sevenkingdoms.local (Windows Server 2019) (NORTH DC)
SRV02 : castelblack.essos.local (Windows Server 2019) (IIS, MSSQL, SMB share)
ESSOS / essos.local
DC03 : meereen.essos.local (Windows Server 2016) (ESSOS DC)
SRV03 : braavos.essos.local (Windows Server 2016) (MSSQL, SMB share)
NORTH.SEVENKINGDOMS.LOCAL
SEVENKINGDOMS.LOCAL
ESSOS.LOCAL
Starting point is on srv01 : 192.168.58.21
Flags are disposed on each machine, try to grab all. Be careful all the machines are up to date with defender enabled.
Obviously do not cheat by looking at the passwords and flags in the recipe files, the lab must start without user to full compromise.
Install :
./goad.sh -t install -l NHA -p virtualbox -m docker\n./goad.sh -t disablevagrant -l NHA -p virtualbox -m docker\n./goad.sh -t stop -l NHA -p virtualbox -m docker\n./goad.sh -t start -l NHA -p virtualbox -m docker\nAnd you are ready to play ! :)
./goad.sh -t enablevagrant -l NHA -p virtualbox -m docker\nTip
No bruteforce, if not in rockyou do not waste your time and your cpu/gpu cycle.
"},{"location":"labs/SCCM/","title":"SCCM lab","text":"Thanks!
Thanks a lot to my colleague Issam (@KenjiEndo15), who start the project and provide me a lot of ansible roles to start from !
"},{"location":"labs/SCCM/#servers","title":"Servers","text":"4 virtual machines with Windows Server 2019
All vms got defender activated
"},{"location":"labs/SCCM/#prerequisites","title":"Prerequisites","text":"1) create a template with the windows_server2019_proxmox_cloudinit_uptodate.pkvars.hcl packer file (guide here: https://mayfly277.github.io/posts/GOAD-on-proxmox-part2-packer/) (note the id after the creation)
2) create the variable file (ad/SCCM/providers/proxmox/terraform/variables.tf) by coping the template (ad/SCCM/providers/proxmox/terraform/variables.tf.template) and change the value according to your proxmox environnement
3) on the provisioning computer :
./goad.sh -t check -l SCCM -p proxmox -m local\n./goad.sh -t install -l SCCM -p proxmox -m local\n4) if something goes wrong (restart of the vms during install, etc...), you can rerun only ansible with -a
./goad.sh -t install -l SCCM -p proxmox -m local -a\nProviders are used to create and deploy the lab virtual machine.
Goad actually support the following providers:
On your own computer :
Cloud :
Hypervisor :
The architecture is slightly different depending on the provider. Please consult the provider you use to understand the behavior.
"},{"location":"providers/aws/","title":"Aws","text":"Thanks!
Thx to @ArnC_CarN for the initial work on the aws provider
The architecture is quite the same than the Azure deployment.
Warning
LLMNR, NBTNS and other poisoning network attacks will not work in aws environment. Only network coerce attacks will work.
"},{"location":"providers/aws/#prerequisites","title":"Prerequisites","text":"You need to configre AWS cli. Use a key with enough privileges on the tenant.
aws configure\nCreate an aws access key and secret for goad usage
[goad]\naws_access_key_id = changeme\naws_secret_access_key = changeme\ncredentials in plain text
Storing credentials in plain text is always a bad idea, but aws cli work like that be sure to restrain the right access to this file
# ~/.goad/goad.ini\n...\n[aws]\naws_region = eu-west-3\naws_zone = eu-west-3c\n# check prerequisites\n./goad.sh -t check -l GOAD -p aws\n# Install\n./goad.sh -t install -l GOAD -p aws\nor from the interactive console :
GOAD/aws/remote/192.168.56.X > install\nstatusstart and stopad/<lab>/providers/aws/windows.tf\"dc01\" = {\n name = \"dc01\"\n domain = \"sevenkingdoms.local\"\n windows_sku = \"2019-Datacenter\"\n ami = \"ami-018ebfbd6b0a4c605\"\n instance_type = \"t2.medium\"\n private_ip_address = \"{{ip_range}}.10\"\n password = \"8dCT-DJjgScp\"\n}\ngoad/workspaces/<instance_folder>ssh and rsyncgoad/workspaces/<instance_folder>/ssh_keysGOAD/aws/remote/192.168.56.X > create_empty # create empty instance\nGOAD/aws/remote/192.168.56.X > load <instance_id>\nGOAD/aws/remote/192.168.56.X (<instance_id>) > provide # play terraform\nGOAD/aws/remote/192.168.56.X (<instance_id>) > sync_source_jumpbox # sync jumpbox source\nGOAD/aws/remote/192.168.56.X (<instance_id>) > prepare_jumpbox # install dependencies on jumpbox\nGOAD/aws/remote/192.168.56.X (<instance_id>) > provision_lab # run ansible\nssh_jumpbox in the goad interactive consolessh_jumpbox_proxy <proxy_port> in the goad interactive console<lab_name>-<lab_instance_id>Thanks!
Thx to Julien Arault for the initial work on the azure provider
Warning
LLMNR, NBTNS and other poisoning network attacks will not work in azure environment. Only network coerce attacks will work.
"},{"location":"providers/azure/#prerequisites","title":"Prerequisites","text":"You need to login to Azure with the CLI.
az login\n# ~/.goad/goad.ini\n...\n[azure]\naz_location = westeurope\n# check prerequisites\n./goad.sh -t check -l GOAD -p azure\n# Install\n./goad.sh -t install -l GOAD -p azure\nor from the interactive console :
GOAD/azure/remote/192.168.56.X > install\nstatusstart and stopInfo
The command stop use deallocate, it take a long time to run but it is not only stopping the vms, it will deallocate them. By doing that, you will stop paying from them (but you still paying storage) and can save some money.
ad/<lab>/providers/azure/windows.tf\"dc01\" = {\n name = \"dc01\"\n publisher = \"MicrosoftWindowsServer\"\n offer = \"WindowsServer\"\n windows_sku = \"2019-Datacenter\"\n windows_version = \"17763.4377.230505\"\n private_ip_address = \"{{ip_range}}.10\"\n password = \"8dCT-DJjgScp\"\n size = \"Standard_B2s\"\n}\ngoad/workspaces/<instance_folder>ssh and rsyncgoad/workspaces/<instance_folder>/ssh_keysGOAD/azure/remote/192.168.56.X > create_empty # create empty instance\nGOAD/azure/remote/192.168.56.X > load <instance_id>\nGOAD/azure/remote/192.168.56.X (<instance_id>) > provide # play terraform\nGOAD/azure/remote/192.168.56.X (<instance_id>) > sync_source_jumpbox # sync jumpbox source\nGOAD/azure/remote/192.168.56.X (<instance_id>) > prepare_jumpbox # install dependencies on jumpbox\nGOAD/azure/remote/192.168.56.X (<instance_id>) > provision_lab # run ansible\nssh_jumpbox in the goad interactive consoleTo setup a socks proxy you can use ssh_jumpbox_proxy <proxy_port> in the goad interactive console
If the command destroy or delete fails, you can delete the resource group using the CLI
az group delete --name GOAD\nThanks!
Huge shootout to @badsectorlabs for Ludus and Erik for his support and tests during the ludus provider creation
Install on ludus server only
To add GOAD on Ludus please use goad directly on the server. By now goad can work only directly on the server and not from a workstation client.
Install Ludus : https://docs.ludus.cloud/docs/quick-start/install-ludus/
Be sure to create an admin user and keep his api key
git clone https://github.com/Orange-Cyberdefense/GOAD.git\ncd GOAD\nsudo apt install python3.11-venv\n./goad.sh\nexit\n# ~/.goad/goad.ini\n...\n[ludus]\nludus_api_key = changeme\nuse_impersonation = yes\n./goad.sh -p ludus\nGOAD/ludus/local > set_lab XXX # GOAD/GOAD-Light/NHA/SCCM\nGOAD/ludus/local > install\nlab_name<6alphanumeric_digit>Info
On ludus the config ip_range is not used and is ignored. The ips will be setup automatically during the lab installation
"},{"location":"providers/proxmox/","title":"Proxmox","text":"And once your prerequisites are ready see https://mayfly277.github.io/posts/GOAD-on-proxmox-part2-packer/ to prepare the template for proxmox
You can run the automatic installation
# check prerequisites\n./goad.sh -t check -l GOAD -p proxmox\n# Install\n./goad.sh -t install -l GOAD -p proxmox\nProviding
Provisioning
./goad.sh -p virtualbox\nGOAD/virtualbox/local/192.168.56.X > check\nInfo
If there is some missing dependencies goes to the installation chapter and follow the guide according to your os.
Note
check give mandatory dependencies in red and non mandatory in yellow (but you should be compliant with them too depending one your operating system)
"},{"location":"providers/virtualbox/#install","title":"Install","text":"./goad.sh -p virtualbox\nGOAD/virtualbox/local/192.168.56.X > set_lab <lab> # here choose the lab you want (GOAD/GOAD-Light/NHA/SCCM)\nGOAD/virtualbox/local/192.168.56.X > set_ip_range <ip_range> # here choose the ip range you want to use ex: 192.168.56\nGOAD/virtualbox/local/192.168.56.X > install\n./goad.sh -t install -p virtualbox -l <lab> -ip <ip_range_to_use>\nQuote
\"Virtualbox c'est no way\" @mpgn
"},{"location":"providers/vmware/#prerequisites","title":"Prerequisites","text":"Providing
Provisioning
./goad.sh -p vmware\nGOAD/vmware/local/192.168.56.X > check\nInfo
If there is some missing dependencies goes to the installation chapter and follow the guide according to your os.
Note
check give mandatory dependencies in red and non mandatory in yellow (but you should be compliant with them too depending one your operating system)
"},{"location":"providers/vmware/#install","title":"Install","text":"./goad.sh -p vmware\nGOAD/vmware/local/192.168.56.X > set_lab <lab> # here choose the lab you want (GOAD/GOAD-Light/NHA/SCCM)\nGOAD/vmware/local/192.168.56.X > set_ip_range <ip_range> # here choose the ip range you want to use ex: 192.168.56 (only the first three digits)\nGOAD/vmware/local/192.168.56.X > install\n./goad.sh -t install -p vmware -l <lab> -ip <ip_range_to_use>\nGoad script can be run in two ways.
The easy way to use goad is just launch ./goad.sh and use ? in the interactive console to get some help.
usage: goad.py [-h] [-t TASK] [-l LAB] [-p PROVIDER] [-ip IP_RANGE] [-m METHOD] [-i INSTANCE] [-e EXTENSIONS] [-a ANSIBLE_ONLY] [-r RUN_PLAYBOOK]\n\nDescription : goad lab management console.\n\noptional arguments:\n -h, --help show this help message and exit\n -t TASK, --task TASK tasks available : (install/start/stop/restart/destroy/status/show)\n -l LAB, --lab LAB lab to use (default: GOAD)\n -p PROVIDER, --provider PROVIDER\n provider to use (default: vmware)\n -ip IP_RANGE, --ip_range IP_RANGE\n ip range to use (default: 192.168.56)\n -m METHOD, --method METHOD\n deploy method to use (default: local)\n -i INSTANCE, --instance INSTANCE\n use a specific instance (use default if not selected)\n -e EXTENSIONS, --extensions EXTENSIONS\n extensions to use\n -a ANSIBLE_ONLY, --ansible_only ANSIBLE_ONLY\n run only provisioning (ansible) on instance (-i) (for task install only)\n -r RUN_PLAYBOOK, --run_playbook RUN_PLAYBOOK\n run only one ansible playbook on instance (-i) (for task install only)\n\nExample :\n - Install GOAD on virtualbox : python3 goad.py -t install -l GOAD -p virtualbox\n - Launch GOAD interactive console : python3 goad.py\nLaunch goad interactive mode
"},{"location":"usage/goad_console/#enter-interactive-mode","title":"Enter interactive mode","text":"To enter interactive mode just launch goad without the -t parameter
./goad.sh\n*** Lab Instances ***\ncheck ................................... check dependencies before creation\ninstall / create ........................ install the selected lab and create a lab instance\ncreate_empty ............................ prepare a lab instance folder without providing and provisioning\nlist .................................... list lab instances\nload <instance_id> ...................... load a lab instance\n\n*** Configuration ***\nconfig .................................. show current configuration\nlabs .................................... show all labs and available providers\nset_lab <lab> ........................... set the lab to use\nset_provider <provider> ................. set the provider to use\nset_provisioning_method <method> ........ set the provisioning method\nset_ip_range <range> .................... set the 3 first digit of the ip to use (ex: 192.168.56)\nWill check the lab dependencies
check\nInstall the lab with the current select config
install\nCreate an empty instance folder (into the workspaces/ folder)
create_empty\nList instances
alias : ls
list\nSelect an instance by his name
alias : use, cd
load <instance name>\nshow current configuration
config\nshow available labs
labs\nChoose the lab to use (GOAD/GOAD-Light/NHA/SCCM/MINILAB)
set_lab <lab_name>\nChoose the provider to use (virtualbox/vmware/aws/azure/ludus/proxmox)
set_provider <lab_name>\nChoose the provisioning method (local/runner/docker/remote) (most of the time you don't have to change it)
set_provisioning <provisioning_method>\nsudo docker build -t goadansible .)Set the ip range you want to use (Three first digit, example : 192.168.10)
set_ip_range <ip_range>\n*** Manage Lab instance commands ***\nstatus .................................. show current status\nstart ................................... start lab\nstop .................................... stop lab\ndestroy ................................. destroy lab\n\n*** Manage one vm commands ***\nstart_vm <vm_name> ...................... start selected virtual machine\nstop_vm <vm_name> ....................... stop selected virtual machine\nrestart_vm <vm_name> .................... restart selected virtual machine\ndestroy_vm <vm_name> .................... destroy selected virtual machine\n\n*** Extensions ***\nlist_extensions ......................... list extensions\ninstall_extension <extension> ........... install extension (providing + provisioning)\nprovision_extension <extension> ......... provision extension (provisioning only)\n\n*** JumpBox ***\nprepare_jumpbox ......................... install package on the jumpbox for provisioning\nsync_source_jumpbox ..................... sync source of the jumpbox\nssh_jumpbox ............................. connect to jump box with ssh\nssh_jumpbox_proxy <proxy_port> .......... connect to jump box with ssh and start a socks proxy\n\n*** Providing (Vagrant/Terrafom) ***\nprovide ................................. run only the providing (vagrant/terraform)\n\n*** Provisioning (Ansible) ***\nprovision <playbook> .................... run specific ansible playbook\nprovision_lab ........................... run all the current lab ansible playbooks\nprovision_lab_from <playbook> ........... run all the current lab ansible playbooks from specific playbook to the end\n\n*** Lab Instances ***\ncheck ................................... check dependencies before creation\ninstall ................................. install the current instance (provide + prepare_jumpbox + provision_lab\nset_as_default .......................... set instance as default\nupdate_instance_files ................... update lab instance files\nlist .................................... list lab instances\nload <instance_id> ...................... load a lab instance\n\n*** Configuration ***\nconfig .................................. show current configuration\nunload .................................. unload current instance\ndelete .................................. delete the currently selected lab instance\nGive the current lab status
status\nStart the current lab instance
start\nStop the current lab instance
stop\nDanger
Destroy the current lab instance vms
destroy\nStart a vm
start_vm <vm_name>\nStop a vm
stop_vm <vm_name>\nRestart a vm (start and stop)
restart_vm <vm_name>\nDanger
Destroy a vm
destroy_vm <vm_name>\nList available extensions
list_extensions\nAdd an extension to the lab (providing + provisioning)
Warning
An installed extension can't be deleted
install_extension <extension_name>\nLaunch provisioning (ansible) for the extension
provision_extension <extension_name>\nPrepare jumpbox : run the preparation script on the jumpbox (install dependencies)
prepare_jumpbox\nRsync goad source with the jumpbox
sync_source_jumpbox\nSSH into the jumpbox
ssh_jumpbox\nSSH into the jumpbox with a socks proxy option (-D)
ssh_jumpbox_proxy <socks_proxy_port>\nLaunch providing (machine creation)
provide\nLaunch specific playbook (use playbook in ansible/ folder)
provision <playbook.yml>\nLaunch all the lab provisioning (install labs on machines with ansible)
provision_lab\nLaunch the lab provisioning from a specific playbook (use playbook in ansible/ folder)
Tip
useful if the install crash to not redo all the provisioning
provision_lab_from <playbook.yml>\nLaunch the check (same as without instance)
check\nLaunch the install (useful if you created an empty instance)
install\nSet the current instance as default (automatically loaded on goad start)
set_as_defualt\nRecreate the files inside the workspace folder
update_instance_files\nList instances
alias : ls
list\nSelect an instance by his name (here change the current instance)
alias : use, cd
load <instance name>\nShow current configuration
config\nUnload the instance (alias cd ..)
unload\nDanger
delete the current instance lab and vms
delete\n