Simple AD Cyber Security Lab (Part 4) - Active Directory

     In the last part we setup OPNSense to handle our plumbing and keep our lab segregated off on its own.  In Part 4 we will be installing Active Directory

Microsoft Active Directory is still used by a majority of fortune 500 companies and many non-cloud native enterprises.  This year AD is also 25 years old(as AD and a released product) meaning there are also lots of old deployments that may not be to current best practices.  Both its age and popularity mean AD is a common target and some thing blue teamers need to take some extra care to help ensure no easy holes are left open in it.

Warning:  This is NOT a best practice guide for installing Active Directory.  This procedure is meant just for a lab and leaves out many hardening steps.  

Create VM

Open up VirtualBox select Machine and New

Set our Name and Operating system

• Name: DC - DC1
• Folder: This should be the default location we set in part 2, only change this if you need to store your VM's in different locations
• ISO Image: select the installer we extracted
• Type: Microsoft Windows
• Version: Windows Server 2019 (64-bit)
• Skip Unattended Installation: Checked

Next, let's go to hardware, I know this is not what is on the plan from part 1.  The installer will take less time, especially the promotion to Domain controller will run a lot faster

• Base Memory: 4096 MB
• Processors: 3

Lastly, let's go to Hard Disk set our size and Finish

• Hard Disk File location and Size:  Size to 30.00 GB (even if you have extra space no need to go larger here)

Install Windows Server

With our DC VM selected click on the start arrow, you can also use the detached mode from the down arrow on the start button to get a larger separate window.

Give it a bit and you should see the Windows Setup screen, click next

Click Install now

Select Windows Server 2019 Standard Evaluation (Desktop Experience)  The default option is Server Core with no GUI.  I won't be covering that version in this guide.  Select Next

Accept the license and click Next

Select Custom Install Windows only (advanced)

We should only have the one drive we created in our VM, select it and click next

Wait while the installer does its thing.

Set your password

Now the Windows installation is complete once the reboot is finished you can log in with Administrator and the password you created

Configure Windows Server

    The VM will reboot when the installation is complete, after you log in the first time you may receive this Networks prompt and select yes.

Eventually, you should see this Server Manager Dashboard 

First thing let's set our IP address, we want a static IP address for our Domain Controller because DC's changing addresses can cause other issues and it will also be hosting our DNS and DHCP services.

 Go to Local Server on the side and click on the link next to Ethernet

We should have only the one network connection

Right-click and select Properties

Highlight Internet Protocol Version 4 and click Properties

Set the following static IP information, then click OK

• IP Address: 172.16.254.10
• Subnet mask: 255.255.255.0
• Default gateway: 172.16.254.1
• Preferred DNS server: 172.16.254.1

Go back to Server Manager and click on the link next to Computer name

Click on the Change button

Set our computer name DC1 then click OK

Follow the warning prompts and reboot

Now we are done with the basics of setting our IP address and computer name.  Login after the reboot to continue on to installing Active Directory

Install Active Directory

After we login we should again be greeted by the Server Manager Dashboard

Select Manage then Add Roles and Features

Before we begin warning, Next

Select Role-based or feature-based installation and Next

Select our server DC1 and Next

Now we have our shopping screen where we select all the goodies we want to install.

Start by checking Active Directory Domain Services (this is the core AD functionality)

You will get this required features windows select Add Features

Back to our shopping window next select DHCP Server

Again add the required features

Select DNS Server from our shopping list and you guessed it add the required features

Now we should have Active Directory Domain Services, DHCP Server and DNS Server selected, Next

We don't need to add any features beyond what was added with the roles, Next

Now time to next through the roles screens, Next 

Next

Next

Now we are ready to start installing, click Install 

This will take some time to install all of the roles and features selected.

Once the installs are done we will get some alerts in the Server Manager.  There are some post-install tasks for Active Directory and DHCP, let's start with Active Directory.  Click on Promote this server to a domain controller

More wizard time!

Select Add a new forest and set our domain name, Next

• Root domain name: mysclab.local

We have some options to set and our DSRM password.  For our lab, you can set this to the same password as the administrator account. Then click Next

• Forest functional level: Windows Server 2016
• Domain functional level: Windows Server 2016
• Domain Name System (DNS) server: Checked
• Global Catalog (GC): Checked

DNS Options, Next

Additional Options, this is for the NetBIOS domain name this is a legacy option that is still needed.  This screen can take a while to become active, it is testing the first part of your domain name on the network to make sure there are no conflicting domains or workgroups.  When it is done click Next

Yep, we are leaving the database and log files in the default location, Next

Review our choices and click Next

We will now get some warnings about how 2019 has non-optimal security settings to be backward compatible and how our DNS server is not properly set up.  The security defaults are what they are and this is our first DNS server so the DNS warring can also be ignored, select Install

After maybe a very long time our DC1 VM will want to restart, it will do so automatically if you ignore it.  The configuration after the reboot usually takes even longer so feel free to do something else for a while.

Once the reboot is done and you are back to the login screen Active directory is installed!

We still have a few more tasks to complete but this has already become overly long.  In the next installment we will get some data in AD so we have something to play with.

Simple AD Cyber Security Lab (Part 3) - OPNSense Gateway

In the pervious part we installed VirtualBox and prepared to start installing our VMs.  In this part we will finish the networking part of the lab setup.

    As we get started with building our lab we have some plumbing we should take care of.  With the gateway, we will be able to allow our lab access to the Internet but prevent it from accessing our home network.  This is important as it will allow us to do updates and install applications while protecting our home network from unintended targeting by any tools we run in our lab.

Warning:  This is in no way a best practices guide and should not be used for the installation of a production or even home firewall.

Create VM

First, let's Download and extract the installer for OPNSense

Download from https://opnsense.org/download/ we want the "amd64" and "dvd" options

Once downloaded right click select 7-Zip and Extract here

Open up VirtualBox select Machine and New

Set our Name and Operating system

• Name: GW - OPNSense
• Folder: This should be the default location we set in part 2, only change this if you need to store your VM's in different locations
• ISO Image: select the installer we extracted
• Type: BSD
• Subtype: FreeBSD(this is what OPNSense runs  under the hood)

Next let's go to hardware, I know this is not what is on the plan from part 1.  The installer can fail with less then 3GB of ram and the extra CPU just makes the install much faster.  We will turn these back down after the install is complete.

• Base Memory: 3096 MB
• Processors: 2

Lastly, let's go to Hard Disk set our size and Finish

• Hard Disk File location and Size:  Size to 16.00 GB (even if you have extra space no need to go larger here)

Now we have our VM but we still need to tweak our network interfaces.  By default, we only get one and it is not set the way we want it

Select our VM and click on the settings gear

Go down to Network and change Adapter 1 to bridged, the Name should be the host's active network adaptor, in my case that is the built in WiFi.  This will be our WAN/Internet interface.  

Take note of the MAC Address listed we will want that in a later step

On the Adaptor 2 tab we will set up our LAN/lab interface, then click OK.

• Enable Network Adaptor: check
• Attached to: Host-only Adaptor
• Name: VirtualBox Host-Only Ethernet Adaptor #2 ( the one we created in part 2)

We are now done with the initial setup of the VM and ready to install OPNSense

Install OPNSense

With our GW VM selected click on the start arrow, you can also use the detached mode from the down arrow on the start button to get a larger separate window.

This will boot up the live disk it may take a while

Once we get to the login prompt we will log in with the user "installer" and password "opnsense" to begin the install

• User: installer
• Password: opnsense

Select your keyboard layout using the arrow keys and the spacebar then Select

Take the default Install (ZFS) and OK

You should only see this if you selected less than 3 GB of ram, from my experience the installer will fail if you continue.  Power off the VM and adjust the ram under the settings menu

We have one drive and don't need redundancy for this lab so select stripe

Select your drive with the spacebar then OK

Yes, we really want to destroy our virtual drive, as long as you have the VirtualBox menu and icons here you are safe to proceed, the disk listed is a file on your host's storage so this will not hurt your host ssytem

Now we wait while the installer runs, if you added that second CPU just imagine how slow this would be with out it.  If you didn't add it, you might want to find something to do for a while...

And the install is finally done, let's set a root password

Type in then confirm your password

Complete Install

Select Halt now, this will power off our VM so we can go in an update the hardware

Back in the settings under System then Motherboard set our ran to 512 MB

• Base Memory: 512 MB

On the Processor tab we can go back to 1,  If you have extra CPU you can leave this but this VM really won't need more than 1

• Processors: 1

Under Storage let's remove our install media, select the DVD ISO and Remove Attachment

Yes, we want to remove the optical drive, it is unneeded past the installer

Now we have OPNSense fully installed we can move on to configuring it.

Configure OPNSense

Let's start our VM back up and login with root and the password we created

First, we need to assign our interfaces, OPNSense will take a guess at it but is not always correct.

Enter 1 to assign interfaces

No LAGGs or VLANs needed for our lab setup

Okay for our WAN interface, this will be Adaptor 1 in our VM, if you noted the MAC address from before you can use it to select the correct interface.  You can also go into the VM settings and look if needed.   Type in the name em0/em1 of the matching interface and hit enter

We will then enter the other interface for our LAN then just hit enter for Optional Interface 1 as we only have 2 interfaces.  If your WAN and LAN interface selection looks correct Y to proceed

Back at the main menu, type in 2 to set our IP addresses

We only need to configure our LAN interface it should be option 1

• LAN IPv4 address: 172.16.254.1
• Subnet Mask: 24

Select No(n) the rest of the way through the interface config

Now OPNSense is installed and configured.  One last set to go.

Create Rule

    Now for the reason, we are using a firewall and not just a router.  Let's create a rule that will prevent our lab from talking to any private networks our host computer happens to be connected to.

From your host computer, you should be able to browse to https://172.16.254.1, here we should find the web gui for OPNSense login with root and the password you created.

Now go to the Firewall menu and Aliases, click on the Add button

Let's create the following Alias and save

• Name: RFC1918_Addresses
• Type: Network(s)
• Content: 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
• Description: Private address blocks

After saving we need to Apply our changes

On to the Rules then WAN menu still under Firewall and select Add

Here we will create the rule using our Alias then save at the bottom

• Action: Block
• Direction: out
• Destination: RFC1918_Addresses

After saving we need to Apply changes

This rule will take a few seconds to apply but will prevent our lab from being able to communicate with the private IPv4 networks that are used for both home and business networks.  

Now that our plumbing is finished we will move on to getting Active Directory setup in the next part.