Packer Vmware Fusion

Purpose

This lab has been designed with defenders in mind. Its primary purpose is to allow the user to quickly build a Windows domain that comes pre-loaded with security tooling and some best practices when it comes to system logging configurations. It can easily be modified to fit most needs or expanded to include additional hosts.

Read more about Detection Lab on Medium here: https://medium.com/@clong/introducing-detection-lab-61db34bed6ae

1. Just follow packer's guide. To be able to use the VMware integration, you should also download another tool depending on your system. For me, I need to get VMware Fusion. Do not worry, this tool.
2. VMware Fusion is designed for every kind of Mac user. IT pros, developers and businesses choose VMware Fusion Pro for its broad OS support, rock-solid stability and advanced features simply not available in a non-virtualized environment. Solutions for IT Pros Design, test and demo software solutions for nearly any device, platform or cloud.

NOTE: This lab has not been hardened in any way and runs with default vagrant credentials. Please do not connect or bridge it to any networks you care about. This lab is deliberately designed to be insecure; the primary purpose of it is to provide visibility and introspection into each host.

Packer is a free tool that can help you automate vSphere template creation and management. It features multiple builders optimized for VMware Fusion, Workstation Pro or Workstation Player.

Primary Lab Features:

• Splunk forwarders are pre-installed and all indexes are pre-created. Technology add-ons for Windows are also preconfigured.
• A custom Windows auditing configuration is set via GPO to include command line process auditing and additional OS-level logging
• Palantir's Windows Event Forwarding subscriptions and custom channels are implemented
• Powershell transcript logging is enabled. All logs are saved to wefpslogs
• osquery comes installed on each host and is pre-configured to connect to a Fleet server via TLS. Fleet is preconfigured with the configuration from Palantir's osquery Configuration
• Sysmon is installed and configured using SwiftOnSecurity's open-sourced configuration
• All autostart items are logged to Windows Event Logs via AutorunsToWinEventLog
• SMBv1 Auditing is enabled

Requirements

• 55GB+ of free disk space
• 16GB+ of RAM
• Packer 1.0.0 or newer
• Vagrant 1.9.2 or newer
• Virtualbox or VMWare Fusion/Workstation

This lab has been successfully tested on:

Known Bad Versions:

• Packer 1.1.2 will fail to build VMWare-ISOs correctly due to this issue.

Quickstart

1. Determine which Vagrant provider you want to use.
   • Note: Virtualbox is free, the VMWare vagrant plugin is $80.
2. cd to the Packer directory and build the Windows 10 and Windows Server 2016 boxes using the commands below. Each build will take about 1 hour. As far as I know, you can only build one box at a time.

1. Once both boxes have built successfully, move the resulting boxes (.box files) in the Packer folder to the Boxes folder:

   mv *.box ../Boxes

2. cd into the Vagrant directory: cd ../Vagrant

3. Install the Vagrant-Reload plugin: vagrant plugin install vagrant-reload

4. Ensure you are in the Vagrant folrder and run vagrant up. This command will do the following:
   • Provision the logger host. This host will run the Fleet osquery manager and a fully featured pre-configured Splunk instance.
   • Provision the DC host and configure it as a Domain Controller
   • Provision the WEF host and configure it as a Windows Event Collector in the Servers OU
   • Provision the Win10 host and configure it as a computer in the Workstations OU
5. Navigate to https://192.168.38.5:8000 in a browser to access the Splunk instance on logger. Default credentials are admin:changeme (you will have the option to change them on the next screen)
6. Navigate to https://192.168.38.5:8412 in a browser to access the Fleet server on logger. Default credentials are admin:admin123#. Query packs are pre-configured with queries from palantir/osquery-configuration.

Basic Vagrant Usage

Vagrant commands must be run from the 'Vagrant' folder.

• Bring up all Detection Lab hosts: vagrant up (optional --provider=[virtualbox|vmware_fusion|vmware_workstation])
• Bring up a specific host: vagrant up
• Restart a specific host: vagrant reload
• Restart a specific host and re-run the provision process: vagrant reload --provision
• Destroy a specific host vagrant destroy
• Destroy the entire Detection Lab environment: vagrant destroy (Adding -f forces it without a prompt)
• SSH into a host (only works with Logger): vagrant ssh logger
• Check the status of each host: vagrant status
• Suspend the lab environment: vagrant suspend
• Resume the lab environment: vagrant resume

Lab Information

• Domain Name: windomain.local
• Admininstrator login: vagrant:vagrant
• Fleet login: admin:admin123#
• Splunk login: admin:changeme

Lab Hosts

• DC - Windows 2016 Domain Controller
  • WEF Server Configuration GPO
  • Powershell logging GPO
  • Enhanced Windows Auditing policy GPO
  • Sysmon
  • osquery
  • Splunk Universal Forwarder (Forwards Sysmon & osquery)
  • Sysinternals Tools
• WEF - Windows 2016 Server
  • Windows Event Collector
  • Windows Event Subscription Creation
  • Powershell transcription logging share
  • Sysmon
  • osquery
  • Splunk Universal Forwarder (Forwards WinEventLog & Powershell & Sysmon & osquery)
  • Sysinternals tools
• Win10 - Windows 10 Workstation
  • Simulates employee workstation
  • Sysmon
  • osquery
  • Splunk Universal Forwarder (Forwards Sysmon & osquery)
  • Sysinternals Tools
• Logger - Ubuntu 16.04
  • Splunk Enterprise
  • Fleet osquery Manager

Splunk Indexes

Index Name | Description———–|————osquery | osquery/Fleet result logsosquery-status | osquery/fleet INFO/WARN/ERROR logspowershell | Powershell transcription logssysmon | Logs from the Sysmon servicewineventlog | Windows Event Logs

Installed Tools on Windows

• Sysmon
• osquery
• AutorunsToWinEventLog
• Process Monitor
• Process Explorer
• PsExec
• TCPView
• Google Chrome
• Atom editor
• WinRar
• Mimikatz

Applied GPOs

Known Issues and Workarounds

Vagrant has been particularly flaky with VMWare and I encountered many issues while testing. However, most of the issues are easily resolved.

Issue: Vagrant reports: Message: HTTPClient::KeepAliveDisconnected: while provisioning.
Workaround: Run $ vagrant reload --provision

Issue:Vagrant timed out while attempting to connect via WinRM after Win10 host joins the domain.
Workaround Documented in #21. Just run $ vagrant reload win10 --provision

Issue: Vagrant is unable to forward a port for you
Workaround: Documented in #11. There are a few possibilities:

1. Try a vagrant reload --provision. For whatever reason vagrant up doesn't fix conflicts but reload does.
2. Check if something is legitimately occupying the port via sudo lsof -n -iTCP:
3. Follow the instructions from this comment: https://github.com/hashicorp/vagrant/issues/8130#issuecomment-272963103

Issue: Fleet server becomes unreachable after VM is suspended and resumed

Workaround: Documented in #22. The following commands should make it reachable without deleting data:

Contributing

Please do all of your development in a feature branch on your own fork of detectionlab.Requests for tools and features will be reviewed on a case by case basis, but I will always accept fixes and improvements.

Credits/Resources

A sizable percentage of this code was borrowed and adapted from Stefan Scherer's packer-windows and adfs2 Github repos. A huge thanks to him for building the foundation that allowed me to design this lab environment.

About the author

Martin Buchleitner is a Senior IT-Consultant for Infralovers and for Commandemy. TwittergithubLinkedIn

Automated VMWare Templates with HashiCorp Packer

Within all the cloud providers you get automated built template based virtual machines - what about doing this on your own to build your custom Templates for VMWare vSphere?In this case HashiCorp Packer is the tool you want to go for. This posting will go through the main concepts of creating a packer based virtual machine template

What is Packer?

Packer Vmware Fusion Download

Packer images allow you to launch completely provisioned and configured machines in seconds, rather than several minutes or hours. This benefits not only production, but development as well, since development virtual machines can also be launched in seconds, without waiting for a typically much longer provisioning time.

Because Packer creates identical images for multiple platforms, you can run production in AWS, staging/QA in a private cloud like OpenStack, and development in desktop virtualization solutions such as VMware or VirtualBox. Each environment is running an identical machine image, giving ultimate portability.

Packer installs and configures all the software for a machine at the time the image is built. If there are bugs in these scripts, they'll be caught early, rather than several minutes after a machine is launched.

After a machine image is built, that machine image can be quickly launched and smoke tested to verify that things appear to be working. If they are, you can be confident that any other machines launched from that image will function properly.

Packer makes it extremely easy to take advantage of all these benefits.

Ubuntu based example

Install Packer

To start with Packer download the prebuilt binary. After installing Packer, verify the installation worked by opening a new command prompt or console, and checking that packer is available:

Packer Vmware Iso

ESXi Configuration

To use the upper template with VMWare ESXi 6 and later you must perform some modifications on the ESXi host.The ESXi host needs a little bit of configuration to allow Packer to work. Packer communicates over SSH, so first we need to open that. Secondly, we'll enable an option to discover Guest IPs from the Host and then finally allow VNC connections remotely.

Enable SSH

Inside the web UI, navigate to 'Manage', then the 'Services' tab. Find the entry called: 'TSM-SSH', and enable it.You may wish to enable it to start up with the host by default. You can do this inside the 'Actions' dropdown (it's nested inside 'Policy').

Enable 'Guest IP Hack'

Run the following command on the ESXi host:

This allows Packer to infer the guest IP from ESXi, without the VM needing to report it itself.

Open VNC Ports on the Firewall

Packer connects to the VM using VNC, so we'll open a range of ports to allow it to connect to it.

First, ensure we can edit the firewall configuration:

Then append the range we want to open to the end of the file:

Finally, restore the permissions and reload the firewall:

Template Definition

The configuration file used to define what image we want built and how is called a template in Packer terminology. The format of a template is simple JSON. JSON struck the best balance between human-editable and machine-editable, allowing both hand-made templates as well as machine generated templates to easily be made.

We'll start by creating the entire template, then we'll go over each section briefly. Create a file example.json and fill it with the following contents:

You can also start building images with VMWare Fusion when you remove the remote_* keys in the json. When doing the initial workthis can be quite useful to keep the loop tight, because debugging debconf or kickstart files is easier going the local devloop In the Ubuntu based example the bootswitch DEBCONF_DEBUG is used to output on the installation log when a settings is found that is not set or set to an invalid value.

Quickstart

1. Determine which Vagrant provider you want to use.
   • Note: Virtualbox is free, the VMWare vagrant plugin is $80.
2. cd to the Packer directory and build the Windows 10 and Windows Server 2016 boxes using the commands below. Each build will take about 1 hour. As far as I know, you can only build one box at a time.

1. Once both boxes have built successfully, move the resulting boxes (.box files) in the Packer folder to the Boxes folder:

   mv *.box ../Boxes

2. cd into the Vagrant directory: cd ../Vagrant

3. Install the Vagrant-Reload plugin: vagrant plugin install vagrant-reload

4. Ensure you are in the Vagrant folrder and run vagrant up. This command will do the following:
   • Provision the logger host. This host will run the Fleet osquery manager and a fully featured pre-configured Splunk instance.
   • Provision the DC host and configure it as a Domain Controller
   • Provision the WEF host and configure it as a Windows Event Collector in the Servers OU
   • Provision the Win10 host and configure it as a computer in the Workstations OU
5. Navigate to https://192.168.38.5:8000 in a browser to access the Splunk instance on logger. Default credentials are admin:changeme (you will have the option to change them on the next screen)
6. Navigate to https://192.168.38.5:8412 in a browser to access the Fleet server on logger. Default credentials are admin:admin123#. Query packs are pre-configured with queries from palantir/osquery-configuration.

Basic Vagrant Usage

Vagrant commands must be run from the 'Vagrant' folder.

• Bring up all Detection Lab hosts: vagrant up (optional --provider=[virtualbox|vmware_fusion|vmware_workstation])
• Bring up a specific host: vagrant up
• Restart a specific host: vagrant reload
• Restart a specific host and re-run the provision process: vagrant reload --provision
• Destroy a specific host vagrant destroy
• Destroy the entire Detection Lab environment: vagrant destroy (Adding -f forces it without a prompt)
• SSH into a host (only works with Logger): vagrant ssh logger
• Check the status of each host: vagrant status
• Suspend the lab environment: vagrant suspend
• Resume the lab environment: vagrant resume

Lab Information

• Domain Name: windomain.local
• Admininstrator login: vagrant:vagrant
• Fleet login: admin:admin123#
• Splunk login: admin:changeme

Lab Hosts

• DC - Windows 2016 Domain Controller
  • WEF Server Configuration GPO
  • Powershell logging GPO
  • Enhanced Windows Auditing policy GPO
  • Sysmon
  • osquery
  • Splunk Universal Forwarder (Forwards Sysmon & osquery)
  • Sysinternals Tools
• WEF - Windows 2016 Server
  • Windows Event Collector
  • Windows Event Subscription Creation
  • Powershell transcription logging share
  • Sysmon
  • osquery
  • Splunk Universal Forwarder (Forwards WinEventLog & Powershell & Sysmon & osquery)
  • Sysinternals tools
• Win10 - Windows 10 Workstation
  • Simulates employee workstation
  • Sysmon
  • osquery
  • Splunk Universal Forwarder (Forwards Sysmon & osquery)
  • Sysinternals Tools
• Logger - Ubuntu 16.04
  • Splunk Enterprise
  • Fleet osquery Manager

Splunk Indexes

Index Name | Description———–|————osquery | osquery/Fleet result logsosquery-status | osquery/fleet INFO/WARN/ERROR logspowershell | Powershell transcription logssysmon | Logs from the Sysmon servicewineventlog | Windows Event Logs

Installed Tools on Windows

• Sysmon
• osquery
• AutorunsToWinEventLog
• Process Monitor
• Process Explorer
• PsExec
• TCPView
• Google Chrome
• Atom editor
• WinRar
• Mimikatz

Applied GPOs

Known Issues and Workarounds

Vagrant has been particularly flaky with VMWare and I encountered many issues while testing. However, most of the issues are easily resolved.

Issue: Vagrant reports: Message: HTTPClient::KeepAliveDisconnected: while provisioning.
Workaround: Run $ vagrant reload --provision

Issue:Vagrant timed out while attempting to connect via WinRM after Win10 host joins the domain.
Workaround Documented in #21. Just run $ vagrant reload win10 --provision

Issue: Vagrant is unable to forward a port for you
Workaround: Documented in #11. There are a few possibilities:

1. Try a vagrant reload --provision. For whatever reason vagrant up doesn't fix conflicts but reload does.
2. Check if something is legitimately occupying the port via sudo lsof -n -iTCP:
3. Follow the instructions from this comment: https://github.com/hashicorp/vagrant/issues/8130#issuecomment-272963103

Issue: Fleet server becomes unreachable after VM is suspended and resumed

Workaround: Documented in #22. The following commands should make it reachable without deleting data:

Contributing

Please do all of your development in a feature branch on your own fork of detectionlab.Requests for tools and features will be reviewed on a case by case basis, but I will always accept fixes and improvements.

Credits/Resources

A sizable percentage of this code was borrowed and adapted from Stefan Scherer's packer-windows and adfs2 Github repos. A huge thanks to him for building the foundation that allowed me to design this lab environment.

About the author

Martin Buchleitner is a Senior IT-Consultant for Infralovers and for Commandemy. TwittergithubLinkedIn

Automated VMWare Templates with HashiCorp Packer

Within all the cloud providers you get automated built template based virtual machines - what about doing this on your own to build your custom Templates for VMWare vSphere?In this case HashiCorp Packer is the tool you want to go for. This posting will go through the main concepts of creating a packer based virtual machine template

What is Packer?

Packer Vmware Fusion Download

Packer images allow you to launch completely provisioned and configured machines in seconds, rather than several minutes or hours. This benefits not only production, but development as well, since development virtual machines can also be launched in seconds, without waiting for a typically much longer provisioning time.

Because Packer creates identical images for multiple platforms, you can run production in AWS, staging/QA in a private cloud like OpenStack, and development in desktop virtualization solutions such as VMware or VirtualBox. Each environment is running an identical machine image, giving ultimate portability.

Packer installs and configures all the software for a machine at the time the image is built. If there are bugs in these scripts, they'll be caught early, rather than several minutes after a machine is launched.

After a machine image is built, that machine image can be quickly launched and smoke tested to verify that things appear to be working. If they are, you can be confident that any other machines launched from that image will function properly.

Packer makes it extremely easy to take advantage of all these benefits.

Ubuntu based example

Install Packer

To start with Packer download the prebuilt binary. After installing Packer, verify the installation worked by opening a new command prompt or console, and checking that packer is available:

Packer Vmware Iso

ESXi Configuration

To use the upper template with VMWare ESXi 6 and later you must perform some modifications on the ESXi host.The ESXi host needs a little bit of configuration to allow Packer to work. Packer communicates over SSH, so first we need to open that. Secondly, we'll enable an option to discover Guest IPs from the Host and then finally allow VNC connections remotely.

Enable SSH

Inside the web UI, navigate to 'Manage', then the 'Services' tab. Find the entry called: 'TSM-SSH', and enable it.You may wish to enable it to start up with the host by default. You can do this inside the 'Actions' dropdown (it's nested inside 'Policy').

Enable 'Guest IP Hack'

Run the following command on the ESXi host:

This allows Packer to infer the guest IP from ESXi, without the VM needing to report it itself.

Open VNC Ports on the Firewall

Packer connects to the VM using VNC, so we'll open a range of ports to allow it to connect to it.

First, ensure we can edit the firewall configuration:

Then append the range we want to open to the end of the file:

Finally, restore the permissions and reload the firewall:

Template Definition

The configuration file used to define what image we want built and how is called a template in Packer terminology. The format of a template is simple JSON. JSON struck the best balance between human-editable and machine-editable, allowing both hand-made templates as well as machine generated templates to easily be made.

We'll start by creating the entire template, then we'll go over each section briefly. Create a file example.json and fill it with the following contents:

You can also start building images with VMWare Fusion when you remove the remote_* keys in the json. When doing the initial workthis can be quite useful to keep the loop tight, because debugging debconf or kickstart files is easier going the local devloop In the Ubuntu based example the bootswitch DEBCONF_DEBUG is used to output on the installation log when a settings is found that is not set or set to an invalid value.

Building the image

With a properly validated template, it is time to build your first image. This is done by calling packer build with the template file. The output should look similar to below. Note that this process typically takes a few minutes.Because the template uses variables for the esxi specific data, these must be set on build time with the -var argument.

Provisioning Packer Templates

The upper command would just generate a default installed Ubuntu 19.04 image using a preseed file which just generates a user who is able to use sudo.

So the next step in this setup is to do some custom provisioning. For this packer is able to launch provisioners.Using these methods you are able to:

• Setup the provisioning ( e.g. install ansible and dependencies )
• Do custom provisioning ( e.g. with ansible playbook )
• Remove provisioning tools ( e.g. remove ansible )

The full template will like this:

The layout of the local is like

Within ansible/main.yml you can define your playbook to install default tools and libraries ( e.g. cloud-init ) and set custom configuration items.

Packer Post Processing

When running the upper build process the result is a customized VMWare machine, which is ready to run - but we wanted to get a VMWare template to produce virtual machines with this build. For this Packer has Post Processors in place. In our use case we gonna use the vsphere post processor and also the vsphere-template processor which finally generates our template.The vsphere post processor halts the previous generated virtual machine and tranfers it to the specified directory. Afterwards the vsphere template post processesor transforms the virtual machine into a machine template for later usage.