/marsform

terraform deployment for red team

Primary LanguageHCL

Marsform (Terraform for RedTeamers)

Introduction

Marsform is a RedTeam infrastructure deployment tool based on Terraform.

The goal is to deploy a secure infrastructure as fast as possible.

A simplified tutorial is available in infra-examples

Setup

Digital Ocean and Azure (mostly) are used in this setup, but any provider could be used.

  • The only exposed ssh port is the jumpbox, every other machine uses an "ssh jump" through this jumpbox.
  • The firewalls are managed with ferm
    • teamservers are accessible through ssh port forward
  • The global.tf in the root folder contains all the global variables that might be needed in any module.

1) Define your API Keys/Tokens.

Add this to your .bashrc

export DIGITALOCEAN_TOKEN="CHANGEME"
export ARM_SUBSCRIPTION_ID="CHANGEME"
export FASTLY_API_KEY="CHANGEME"

2) Install providers dependencies (if you plan to deploy in Azure)

Install azure-cli. Make sure you run az login before deploying in Azure.

3) Adjust the Global Varibales file global.tf

  • Set the jumpbox_ip variable (a jumpbox where you can ssh with a private key)
  • Set the do_ssh_keys variable (a comma separated list of ssh key fingerprints) : curl -s -X GET -H "Content-Type: application/json" -H "Authorization: Bearer ${DIGITALOCEAN_TOKEN}" "https://api.digitalocean.com/v2/account/keys" | grep -o '"id":[0-9]*'

4) Create missing files

Initial jumpbox config; the generated ssh_config will use 'jumpbox' as ProxyJump.

Make sure you have a 'jumpbox' entry in your ~/.ssh/config:

Host jumpbox
  User root
  Hostname 159.263.323.317

Cobalt Strike archive IS NOT provided; if you plan to deploy a Cobalt Strike teamserver, download it with your license and copy it there:

  • ./files/cobaltstrike-dist.tgz

5) Define your infrastructure and deploy

In the root directory of this project, adjust the content of infra.tf to reflect the infrastructure you wish to deploy.

You will then be able to init then apply:

terraform init
terraform apply

Caveats

  • Users will require port forward knowledge
  • Most stuff runs as root :(
  • When deploying a FiercePhish server, you must copy/paste the value from the FiercePhish installation output (saved in /tmp/fiercephish-install.out), then re-run terraform apply. (since the mail._domainkey key is generated during the installation)

Typical Infrastructure Example

                                                       |
                       Private                         |            Internet
                      ---------                        |           ----------
                                                       |
                                                       |
                                                       |     +-----------------+
                                                       |     |                 |
     ssh port forward to access teamserver, ssh, etc.  |     |     Jumpbox     |   ssh    +----------+
  +----+-----+-----------------------+-----------------+-----| (port 22 open)  |<---------| Attacker |
  |          |                       |                 |     |(permanent infra)|          +----------+
  |          |                       |                 |     |                 |
  |          |                       |                 |     +-----------------+
  |          |                       |                 |
  |          |                       |                 |
  |          |                       |                 |
  |          v                       v                 |
  |  +--------------+        +---------------+         |    +-------------+
  |  |              |        |               |         |    |             |
  |  |  TeamServer  |<-------+  HTTPS Redir  |<--------+----|  Azure CDN  |<--------+
  |  |              |        |               |         |    |             |         |
  |  +--------------+        +---------------+         |    +-------------+         |
  |                                                    |                            |
  |                                                    |                            |
  |                     +----------------------+       |                            |
  |                     |                      |       |                            |
  |                     |   +--------------+   |     +-+------------------+         |
  |                     |   |              |   +---->|                    |         |
  |---------------------+-->|  TeamServer  |<--------|     DNS Redir      |<--------+
  |                         |              |         |                    |         |
  |                         +--------------+         +-+------------------+         |     +----------+
  |                                                    |                            |-----|  Victim  |
  |                                                    |                            |     +----------+
  |                   +-----------------------+        |    +-------------+         |
  |                   |                       |        |    |             |         |
  +------------------>|  Web Delivery Server  |<-------+----|  Azure CDN  |<--------+
  |                   |                       |        |    |             |         |
  |                   +-----------------------+        |    +-------------+         |
  |                                                    |                            |
  |                                                    |                            |
  |                                                  +-+------------------+         |
  |                                              ssh |                    |         |
  +------------------------------------------------->|  Phishing Server   |<--------+
                                                     |                    |
                                                     +-+------------------+
                                                       |
                                                       |
                                                       |
                                                       v

Credits

Author: S2V2

Inspired from: