Simple AD Cyber Security Lab (Part 4) - Active Directory

     In the last part we setup OPNSense to handle our plumbing and keep our lab segregated off on its own.  In Part 4 we will be installing Active Directory

Microsoft Active Directory is still used by a majority of fortune 500 companies and many non-cloud native enterprises.  This year AD is also 25 years old(as AD and a released product) meaning there are also lots of old deployments that may not be to current best practices.  Both its age and popularity mean AD is a common target and some thing blue teamers need to take some extra care to help ensure no easy holes are left open in it.

Warning:  This is NOT a best practice guide for installing Active Directory.  This procedure is meant just for a lab and leaves out many hardening steps.  

Create VM

Open up VirtualBox select Machine and New

Set our Name and Operating system

• Name: DC - DC1
• Folder: This should be the default location we set in part 2, only change this if you need to store your VM's in different locations
• ISO Image: select the installer we extracted
• Type: Microsoft Windows
• Version: Windows Server 2019 (64-bit)
• Skip Unattended Installation: Checked

Next, let's go to hardware, I know this is not what is on the plan from part 1.  The installer will take less time, especially the promotion to Domain controller will run a lot faster

• Base Memory: 4096 MB
• Processors: 3

Lastly, let's go to Hard Disk set our size and Finish

• Hard Disk File location and Size:  Size to 30.00 GB (even if you have extra space no need to go larger here)

Install Windows Server

With our DC VM selected click on the start arrow, you can also use the detached mode from the down arrow on the start button to get a larger separate window.

Give it a bit and you should see the Windows Setup screen, click next

Click Install now

Select Windows Server 2019 Standard Evaluation (Desktop Experience)  The default option is Server Core with no GUI.  I won't be covering that version in this guide.  Select Next

Accept the license and click Next

Select Custom Install Windows only (advanced)

We should only have the one drive we created in our VM, select it and click next

Wait while the installer does its thing.

Set your password

Now the Windows installation is complete once the reboot is finished you can log in with Administrator and the password you created

Configure Windows Server

    The VM will reboot when the installation is complete, after you log in the first time you may receive this Networks prompt and select yes.

Eventually, you should see this Server Manager Dashboard 

First thing let's set our IP address, we want a static IP address for our Domain Controller because DC's changing addresses can cause other issues and it will also be hosting our DNS and DHCP services.

 Go to Local Server on the side and click on the link next to Ethernet

We should have only the one network connection

Right-click and select Properties

Highlight Internet Protocol Version 4 and click Properties

Set the following static IP information, then click OK

• IP Address: 172.16.254.10
• Subnet mask: 255.255.255.0
• Default gateway: 172.16.254.1
• Preferred DNS server: 172.16.254.1

Go back to Server Manager and click on the link next to Computer name

Click on the Change button

Set our computer name DC1 then click OK

Follow the warning prompts and reboot

Now we are done with the basics of setting our IP address and computer name.  Login after the reboot to continue on to installing Active Directory

Install Active Directory

After we login we should again be greeted by the Server Manager Dashboard

Select Manage then Add Roles and Features

Before we begin warning, Next

Select Role-based or feature-based installation and Next

Select our server DC1 and Next

Now we have our shopping screen where we select all the goodies we want to install.

Start by checking Active Directory Domain Services (this is the core AD functionality)

You will get this required features windows select Add Features

Back to our shopping window next select DHCP Server

Again add the required features

Select DNS Server from our shopping list and you guessed it add the required features

Now we should have Active Directory Domain Services, DHCP Server and DNS Server selected, Next

We don't need to add any features beyond what was added with the roles, Next

Now time to next through the roles screens, Next 

Next

Next

Now we are ready to start installing, click Install 

This will take some time to install all of the roles and features selected.

Once the installs are done we will get some alerts in the Server Manager.  There are some post-install tasks for Active Directory and DHCP, let's start with Active Directory.  Click on Promote this server to a domain controller

More wizard time!

Select Add a new forest and set our domain name, Next

• Root domain name: mysclab.local

We have some options to set and our DSRM password.  For our lab, you can set this to the same password as the administrator account. Then click Next

• Forest functional level: Windows Server 2016
• Domain functional level: Windows Server 2016
• Domain Name System (DNS) server: Checked
• Global Catalog (GC): Checked

DNS Options, Next

Additional Options, this is for the NetBIOS domain name this is a legacy option that is still needed.  This screen can take a while to become active, it is testing the first part of your domain name on the network to make sure there are no conflicting domains or workgroups.  When it is done click Next

Yep, we are leaving the database and log files in the default location, Next

Review our choices and click Next

We will now get some warnings about how 2019 has non-optimal security settings to be backward compatible and how our DNS server is not properly set up.  The security defaults are what they are and this is our first DNS server so the DNS warring can also be ignored, select Install

After maybe a very long time our DC1 VM will want to restart, it will do so automatically if you ignore it.  The configuration after the reboot usually takes even longer so feel free to do something else for a while.

Once the reboot is done and you are back to the login screen Active directory is installed!

We still have a few more tasks to complete but this has already become overly long.  In the next installment we will get some data in AD so we have something to play with.

Simple AD Cyber Security Lab (Part 1)

    There are many good Cyber Security learning systems out there such as Hack the Box, Try Hack Me, and Blue Team Labs to name a few, but I still believe hands-on in a live(live lab anyway) environment is the best way to learn.  

    Why Active Directory?  First, according to a quick search, multiple sources are reporting that 90-95% of Fortune 500 companies are still using Active Directory to some extent. Second, Identity systems are a prime target for attackers due to the access and ability to pivot they offer.

    So let's look at what it takes to set up a Cyber Lab where we can use real red and blue team tools in an Active Directory environment.  We don't need a whole lot just a basic network(to keep this safely isolated), a Domain Controller, a workstation, and our tools(Attacker/Defender) system.  On the Network, I strongly recommend this be isolated from any other network be it a production or even your home network.

The Software

    This is where the magic really is.  Virtualization allows us to build an entire network with servers and clients all in software on just one computer.  We will need a bit more hardware than the absolute minimum for basic computing.  For software, I will be using Oracles Virtual Box software.  This is a freely available type 2 hypervisor(meaning it runs on top of an existing operating system).  Not only is it free for our use it is also available for Windows, MacOS, and Linux.

The Hardware

    Just about any  Intel or AMD based computer from the last 10 years should work as long as it has an SSD and 12 or more Gigabytes of RAM.  There are some Intel CPU's that don't support virtualization they are pretty uncommon but if you buy a used system you may want to do a bit of research first.

Where is how you can check to see if an Intel CPU supports VT-x

https://www.intel.com/content/www/us/en/support/articles/000005486/processors.html

The host I will be using is a cheap Intel N100 based system I've had for a bit.  It is a 4 core 4 thread system with 12GB of RAM.  This could just as easily be an existing or cheap used system.  You will want at least 4 threads, 12GB of RAM, and an SSD.  This could be done with 8GB of RAM but you will probably have to be selective about what VMs are enabled, you may not need both the client and tools VM active at the same time.

Again you don't need expensive hardware, brand-new systems with the same CPU and even more RAM can be had for under $150 US.  Used systems off Ebay or your local thrift store could be even less.

Host

• Windows 10 Home Standard
• 4 core 4 thread Intel N100
• 12GB of Ram
• 512GB NVME SSD
• Single 1Gbps NIC
• WiFi 5

Network Diagram

    As you can see this will be a very simple and yes flat network.  I will be using the network 172.16.254.0/24.  You can use something else but it needs to be from the private ranges described in RFC 1918 and shouldn't overlap with any networks your host will connect to.

IEEE RFC 1918 for reference https://datatracker.ietf.org/doc/html/rfc1918

Let's look at what we will need for the resources on each VM.  All in we are looking at 6GB of RAM and up to 116GB of storage, this will be dynamic so the disk files will only grow as needed.

CPU, we are going to be oversubscribed(more assigned than we actually have) this is not as big of a deal on the CPU we won't be pushing multiple VM's very often but it will be slow when we do.

RAM, 

Disk,6

Gateway

• 1 CPU
• 512MB of Ram
• 16GB Disk

Domain Controller

• 2 CPU
• 1,536MB of Ram
• 30GB Disk

Workstation

• 2 CPU
• 2.048MB of Ram
• 30GB Disk

Kali

• 2 CPU
• 2.048MB of Ram
• 30GB Disk