Published: | Updated: | Reading Time: 3 mins
I recently got a position as a Security Analyst where I'm the unofficial Red Teamer. Having a lab environment allows me to demo attacks or wacky ideas I have. I've also wanted a lab environment for a while but never had any motivation to make one.
At Shell on the Border I went to a workshop on Advanced AD Pentesting techniques and the person giving the workshop recommended Game of Active Directory as a lab environment. I have a local Proxmox cluster already which is running my network and media servers. I also had a minipc laying around not doing anything so I gave it a tb ssd, 32gb of ram and threw Proxmox on it. GOAD is pretty good as a lab environment because it has 2 forests, 3 domains, 3 domain controllers, and 2 servers. (5 total VMs)
The instructions for building GOAD on Proxmox aren't the greatest. They don't explain what they are doing until later so you run into some issues when you have to modify it for your environment. The firewall rules weren't explained. Packer and Terraform didn't work without some tweaks. It wanted to make a backup of the templates to 'local' instead of 'local-lvm' and I wasn't able to figure out where that was being set so I ended up allowing backups to be saved to 'local'. I had to change the adapter in the ansible inventory file. I think this was a windows issue not a GOAD issue but mssql randomly didn't work on one of the servers so I had to uninstall and reinstall it.
Reading this all back I just condensed like 15 hours worth of work and pain into a few sentences and that makes me feel bad. You can read my full notes here.
My coworker stood up a Wazuh instance. Wazuh is an opensource XDR/SIEM built on top of ELK (Elastic Search, Logstash, Kibana). One of the servers has Defender disabled so I threw a Wazuh agent on it so we can play with it in an environment where we know malicious things will happen.
I created another VM in the GOAD environment as my Caldera server. Caldera is an opensourse BAS (breach and attack simulation) software. I'm comparing this to other BAS software and one that I'm particularly interesting in comparing it to is Pentera. Pentera is agentless while Caldera is agent based. To get Caldera to work similarly I installed an agent on the Caldera server and created custom ability for the initial access plugin to remote into a machine and install an agent.
The adversaries Caldera comes with are super basic and can't do much. The adversaries that come with the emu plugin don't really work. They require very specific parameters to be met to work. Such as a specific c2 ip, files in specific locations, specific users to exist.
This means Caldera requires quite a bit of elbow grease but once you get it setup it works really well. The ttps come from atomic red team so you can string a lot together to make a custom adversary.