/offensive-windows-ansible

Primary LanguagePowerShell

Offensive Windows Ansible

Table of Contents

Description

An ansible playbook to setup and configure Windows 10 Machines for Offensive Engagements.

Getting Started

For Ansible to communicate to a Windows host and use Windows modules, the Windows host must meet these requirements:

  • PowerShell 3.0 or newer and at least .NET 4.0 to be installed on the Windows host.
  • A WinRM listener that should be created and activated. More details for this can be found below.

Upgrading PowerShell and .NET Framework

The base image of windows does not meet the requirements to run ansible, therefore, PowerShell and .NET must be upgraded. This can be done by running the following script. Upgrade-PoweerShell.ps1 that is located in the scripts folder.

Example of how to run this script

# Make sure you're able to run the script in powershell
Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Force

# Upgrade to powershell 5.1 with automatic login and reboots using powershell
.\Upgrade-Powershell.ps1 -version 5.1 -username "Username" -password "Password"


# Using Command Prompt
powershell.exe -ExecutionPolicy Bypass -File Upgrade-Powershell.ps1 -version 5.1 -username "Username" -password "Password"

Once completed, you will need to remove auto login and set the execution policy back to the default Restricted `` for Windows clients, or ``RemoteSigned for Windows servers). You can do this with the following PowerShell commands:

# This isn't needed but is a good security practice to complete
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force

$reg_winlogon_path = "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"
Set-ItemProperty -Path $reg_winlogon_path -Name AutoAdminLogon -Value 0
Remove-ItemProperty -Path $reg_winlogon_path -Name DefaultUserName -ErrorAction SilentlyContinue
Remove-ItemProperty -Path $reg_winlogon_path -Name DefaultPassword -ErrorAction SilentlyContinue

The script works by checking to see what programs need to be installed (such as .NET Framework 4.5.2) and what PowerShell version is required. If a reboot is required and the username and password parameters are set, the script will automatically reboot and logon when it comes back up from the reboot. The script will continue until no more actions are required and the PowerShell version matches the target version. If the username and password parameters are not set, the script will prompt the user to manually reboot and logon when required. When the user is next logged in, the script will continue where it left off and the process continues until no more actions are required.

Setup WinRM

Once Powershell has been upgraded to at least version 3.0, the final step is for the WinRM service to be configured so that Ansible can connect to it. There are two main components of the WinRM service that governs how Ansible can interface with the Windows host: the listener and the service configuration settings.

This script sets up both HTTP and HTTPs listeners with a self-signed cert and enables Basic authentication option on the service.

# From local PowerShell
.\ConfigureRemote.ps1

# From download
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$url = "https://github.com/hackedbyagirl/offensive-windows-ansible/blob/main/scripts/ConfigureRemote.ps1"
$file = "$env:temp\ConfigureRemote.ps1"

(New-Object -TypeName System.Net.WebClient).DownloadFile($url, $file)

powershell.exe -ExecutionPolicy ByPass -File $file

To view the current listeners that are running on the WinRM service, run the following command:

winrm enumerate winrm/config/Listener

After done running ansible, it is important to disable WinRM. To do so, run the following script.

.\DisableWinRM.ps1

Features to Add

  • MSOLSpray
  • Rubeus
  • Microburst
  • RedTeamPowerShellScripts