Skip to content

Commit a52d2af

Browse files
author
Patrick Bareiss
committed
Add GCP support
1 parent 10d5b37 commit a52d2af

File tree

11 files changed

+164
-22
lines changed

11 files changed

+164
-22
lines changed

‎docs/source/Attack_Range_GCP.md

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
# Attack Range GCP
2+
3+
## Docker
4+
We built a docker image which you can use to build and run the attack range. The image includes all needed binaries.
5+
````bash
6+
docker pull splunk/attack_range
7+
docker run -it splunk/attack_range
8+
gcloud auth application-default login
9+
python attack_range.py configure
10+
````
11+
12+
## MacOS
13+
Clone attack_range git repo to local machine:
14+
````bash
15+
git clone https://github.com/splunk/attack_range.git
16+
cd attack_range
17+
````
18+
19+
Install and configure Terraform:
20+
````bash
21+
brew update
22+
brew install terraform
23+
cd terraform/gcp && terraform init && cd ../..
24+
````
25+
26+
Install the GCP CLI by follwoing this [guide](https://cloud.google.com/sdk/docs/install-sdk).
27+
28+
Install and run Poetry:
29+
````bash
30+
curl -sSL https://install.python-poetry.org/ | python -
31+
poetry shell
32+
poetry install
33+
````
34+
35+
Configure Attack Range:
36+
````bash
37+
python attack_range.py configure
38+
````
39+
40+
Once the configuration is complete, you can proceed to build and control your range [here](Control_Attack_Range.md)
41+
42+
## Linux
43+
Install the required packages:
44+
````bash
45+
apt-get update
46+
apt-get install -y python3.10 git unzip python3-pip curl
47+
````
48+
49+
Install and configure Terraform:
50+
````bash
51+
curl -s https://releases.hashicorp.com/terraform/1.9.8/terraform_1.9.8_linux_amd64.zip -o terraform.zip && \
52+
unzip terraform.zip && \
53+
mv terraform /usr/local/bin/
54+
````
55+
56+
Clone attack_range git repo to local machine:
57+
````bash
58+
git clone https://github.com/splunk/attack_range.git
59+
cd attack_range
60+
````
61+
62+
Install the GCP CLI by follwoing this [guide](https://cloud.google.com/sdk/docs/install-sdk).
63+
64+
Install and run Poetry:
65+
````bash
66+
curl -sSL https://install.python-poetry.org/ | python -
67+
poetry shell
68+
poetry install
69+
````
70+
71+
````bash
72+
python attack_range.py configure
73+
````
74+
75+
Once the configuration is complete, you can proceed to build and control your range [here](Control_Attack_Range.md)
76+
77+
## Windows
78+
79+
We recommend using the Windows Subsystem for Linux (WSL). You can find a tutorial [here](https://docs.microsoft.com/en-us/windows/wsl/install). After installing WSL, you can follow the steps described in the [Linux section](#linux).

‎docs/source/index.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ The Attack Range is a detection development platform, which solves three main ch
1313
1414
Attack Range AWS <Attack_Range_AWS>
1515
Attack Range Azure <Attack_Range_Azure>
16+
Attack Range GCP <Attack_Range_GCP>
1617
Attack Range Local <Attack_Range_Local>
1718
Attack Range Cloud <Attack_Range_Cloud>
1819
Control Attack Range <Control_Attack_Range>

‎modules/configuration.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -466,6 +466,8 @@ def _configure_linux_servers(self) -> None:
466466
"message": "Shall we include Splunk SOAR",
467467
"name": "phantom",
468468
"default": False,
469+
"when": lambda answers: self.configuration["general"]["cloud_provider"]
470+
!= "gcp",
469471
},
470472
{
471473
"type": "text",

‎terraform/ansible/roles/set_hostname_win/tasks/main.yml

Lines changed: 22 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3,31 +3,42 @@
33
- name: Verify WinRM connection
44
win_ping:
55
register: winrm_result
6-
retries: 3
7-
delay: 10
6+
retries: 5
7+
delay: 15
88
until: winrm_result.ping == "pong"
9+
ignore_errors: true
910

1011
- name: Change the hostname
1112
win_hostname:
1213
name: "{{ windows_servers.hostname }}"
1314
register: hostname_result
14-
retries: 3
15-
delay: 10
15+
retries: 5
16+
delay: 15
1617
until: hostname_result is success
18+
ignore_errors: true
1719

1820
- name: Wait for hostname change to take effect
1921
win_wait_for:
20-
timeout: 60
21-
delay: 10
22+
timeout: 120
23+
delay: 15
24+
ignore_errors: true
2225

2326
- name: reboot | Rebooting Server
2427
win_reboot:
2528
msg: "Reboot initiated by Ansible"
26-
connect_timeout: 60
29+
connect_timeout: 120
2730
pre_reboot_delay: 30
28-
post_reboot_delay: 30
29-
reboot_timeout: 600
31+
post_reboot_delay: 60
32+
reboot_timeout: 900
3033
register: reboot_result
31-
retries: 3
34+
retries: 5
3235
delay: 30
33-
until: reboot_result is success
36+
until: reboot_result is success
37+
ignore_errors: true
38+
39+
- name: Wait for WinRM to be available after reboot
40+
win_wait_for:
41+
port: 5985
42+
timeout: 300
43+
delay: 15
44+
ignore_errors: true

‎terraform/ansible/windows.yml

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,15 @@
44
ansible_connection: winrm
55
ansible_winrm_server_cert_validation: ignore
66
ansible_port: 5985
7-
ansible_winrm_operation_timeout_sec: 300
8-
ansible_winrm_read_timeout_sec: 900
7+
ansible_winrm_operation_timeout_sec: 600
8+
ansible_winrm_read_timeout_sec: 1200
9+
ansible_winrm_connection_timeout: 600
10+
ansible_winrm_transport: basic
11+
ansible_winrm_scheme: http
12+
ansible_winrm_kerberos_delegation: false
13+
ansible_winrm_message_encryption: auto
14+
ansible_winrm_retry_timeout: 600
15+
ansible_winrm_retry_interval: 10
916
roles:
1017
- windows_common
1118
- windows_universal_forwarder

‎terraform/azure/modules/windows/files/winrm.ps1

Lines changed: 26 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,37 @@
11
Enable-PSRemoting -Force -SkipNetworkProfileCheck
22
winrm quickconfig -q
33
winrm quickconfig -transport:http
4-
powershell.exe -c "winrm set winrm/config '@{MaxTimeoutms=\`"1800000\`"}'"
5-
powershell.exe -c "winrm set winrm/config/winrs '@{MaxMemoryPerShellMB=\`"800\`"}'"
6-
powershell.exe -c "winrm set winrm/config/service '@{AllowUnencrypted=\`"true\`"}'"
4+
5+
# Configure WinRM with optimized settings
6+
powershell.exe -c "winrm set winrm/config '@{MaxTimeoutms=\`"3600000\`"}'"
7+
powershell.exe -c "winrm set winrm/config/winrs '@{MaxMemoryPerShellMB=\`"2048\`"; MaxShellsPerUser=\`"50\`"; MaxProcessesPerShell=\`"25\`"; IdleTimeout=\`"3600000\`"}'"
8+
powershell.exe -c "winrm set winrm/config/service '@{AllowUnencrypted=\`"true\`"; MaxConcurrentOperations=\`"4294967295\`"; MaxConcurrentOperationsPerUser=\`"4294967295\`"; MaxConnections=\`"4294967295\`"}'"
79
powershell.exe -c "winrm set winrm/config/service/auth '@{Basic=\`"true\`"}'"
810
powershell.exe -c "winrm set winrm/config/client/auth '@{Basic=\`"true\`"}'"
911
powershell.exe -c "winrm set winrm/config/listener?Address=*+Transport=HTTP '@{Port=\`"5985\`"}'"
1012
powershell.exe -c "winrm set winrm/config/client '@{TrustedHosts=\`"*\`"}'"
13+
14+
# Configure firewall rules
1115
netsh advfirewall firewall set rule group="Windows Remote Administration" new enable=yes
1216
netsh advfirewall firewall set rule name="Windows Remote Management (HTTP-In)" new enable=yes action=allow remoteip=any
17+
netsh advfirewall firewall add rule name="Port 5985" dir=in action=allow protocol=TCP localport=5985
18+
19+
# Configure WinRM service for auto-start and recovery
1320
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v StartWinRM /t REG_SZ /f /d "cmd.exe /c 'sc config winrm start= auto & sc start winrm'"
21+
sc.exe config winrm start= auto
22+
sc.exe failure winrm reset= 0 actions= restart/5000/restart/5000/restart/5000
23+
24+
# Restart WinRM service
1425
Restart-Service winrm
15-
netsh advfirewall firewall add rule name="Port 5985" dir=in action=allow protocol=TCP localport=5985
26+
27+
# Set LocalAccountTokenFilterPolicy to 1 for better authentication
28+
$token_path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"
29+
$token_prop_name = "LocalAccountTokenFilterPolicy"
30+
$token_key = Get-Item -Path $token_path
31+
$token_value = $token_key.GetValue($token_prop_name, $null)
32+
if ($token_value -ne 1) {
33+
if ($null -ne $token_value) {
34+
Remove-ItemProperty -Path $token_path -Name $token_prop_name
35+
}
36+
New-ItemProperty -Path $token_path -Name $token_prop_name -Value 1 -PropertyType DWORD > $null
37+
}

‎terraform/gcp/modules/linux-server/resources.tf

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,11 @@ resource "google_compute_instance" "linux_server" {
3636

3737
# Use local-exec provisioner to clean known_hosts
3838
provisioner "local-exec" {
39-
command = "ssh-keygen -f ~/.ssh/known_hosts -R ${self.network_interface.0.access_config.0.nat_ip}"
39+
command = <<-EOT
40+
mkdir -p ~/.ssh
41+
touch ~/.ssh/known_hosts
42+
ssh-keygen -f ~/.ssh/known_hosts -R ${self.network_interface.0.access_config.0.nat_ip}
43+
EOT
4044
}
4145

4246
# Assign the Linux Service Account to this instance

‎terraform/gcp/modules/nginx-server/resources.tf

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,11 @@ resource "google_compute_instance" "nginx_server" {
3737

3838
# Use local-exec provisioner to clean known_hosts
3939
provisioner "local-exec" {
40-
command = "ssh-keygen -f ~/.ssh/known_hosts -R ${self.network_interface.0.access_config.0.nat_ip}"
40+
command = <<-EOT
41+
mkdir -p ~/.ssh
42+
touch ~/.ssh/known_hosts
43+
ssh-keygen -f ~/.ssh/known_hosts -R ${self.network_interface.0.access_config.0.nat_ip}
44+
EOT
4145
}
4246

4347
# Metadata for SSH and Custom Commands

‎terraform/gcp/modules/phantom-server/resources.tf

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,11 @@ resource "google_compute_instance" "phantom_server" {
4141

4242
# Use local-exec provisioner to clean known_hosts
4343
provisioner "local-exec" {
44-
command = "ssh-keygen -f ~/.ssh/known_hosts -R ${self.network_interface.0.access_config.0.nat_ip}"
44+
command = <<-EOT
45+
mkdir -p ~/.ssh
46+
touch ~/.ssh/known_hosts
47+
ssh-keygen -f ~/.ssh/known_hosts -R ${self.network_interface.0.access_config.0.nat_ip}
48+
EOT
4549
}
4650

4751
# Assign the Phantom Service Account to this instance

‎terraform/gcp/modules/snort-server/resources.tf

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,11 @@ resource "google_compute_instance" "snort_sensor" {
3636

3737
# Use local-exec provisioner to clean known_hosts
3838
provisioner "local-exec" {
39-
command = "ssh-keygen -f ~/.ssh/known_hosts -R ${self.network_interface.0.access_config.0.nat_ip}"
39+
command = <<-EOT
40+
mkdir -p ~/.ssh
41+
touch ~/.ssh/known_hosts
42+
ssh-keygen -f ~/.ssh/known_hosts -R ${self.network_interface.0.access_config.0.nat_ip}
43+
EOT
4044
}
4145

4246
# SSH key metadata for user access

‎terraform/gcp/modules/zeek-server/resources.tf

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,11 @@ resource "google_compute_instance" "zeek_sensor" {
3535

3636
# Use local-exec provisioner to clean known_hosts
3737
provisioner "local-exec" {
38-
command = "ssh-keygen -f ~/.ssh/known_hosts -R ${self.network_interface.0.access_config.0.nat_ip}"
38+
command = <<-EOT
39+
mkdir -p ~/.ssh
40+
touch ~/.ssh/known_hosts
41+
ssh-keygen -f ~/.ssh/known_hosts -R ${self.network_interface.0.access_config.0.nat_ip}
42+
EOT
3943
}
4044

4145
# Assign the Zeek Service Account to this instance

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy