Skip to content

AssessmentAttackPlan

Jump to bottom
echadbourne edited this page Oct 10, 2023 · 27 revisions

Phase One

P1 Useful Links

Lab01 Tech Journal

First Steps

Initial Snapshot

Cable all of the boxes properly

  • Firewall - Network Adapter 1 WAN, Network Adapter 2 LAN
  • Everything else LAN

Firewall Initial Setup

Username: admin

Password: pfsense

  1. IP Information
  • Steps 1 and 2 of Lab01
  • em0 = WAN, Upstream Gateway is 10.0.17.2, IP address is 10.0.17.102
  • em1 = LAN, IP address is 10.0.5.2

Hostname and admin password will be set after wks01 is set up

Windows Workstation Setup

Username: champuser

Password: Ch@mpl@1n!22

  1. Change champuser password
  • Settings > Accounts > Sign in Options
  • Password, Change
  1. Hostname
  • Properties of "This PC"
  • Change Settings
  • Rename to wks01-elizabeth
  1. New Admin Account
  • lusrmgr.msc
  • elizabeth.chadbourne-loc (New Local Admin Account)
  • Password never expires
  • WKS01-ELIZABETH\Administrators

Logout and login again

  1. IP Information
  • IP address 10.0.5.100
  • Default Gateway 10.0.5.2
  • DNS 10.0.5.2

Finish Firewall Setup

  1. Go to 10.0.5.2 in a browser
  • Login is admin and pfsense
  1. General Information
  • fw01-elizabeth
  • elizabeth.local
  • Primary DNS 8.8.8.8
  1. Configure WAN Interface
  • RFC1918 Networks: Uncheck "Block private networks from entering via WAN"
  1. Set Root Password

Check Connectivity for WKS01

Phase 1 Complete, snapshot and go take a break!

Phase 2 - AD and DNS

P2 Useful Links

Lab02 Tech Journal

AD & DNS Initial Setup

  • Do Product Key later
  • Set Administrator Password
  1. New Local Admin account and password (see above)
  2. IP Information
  • IP address 10.0.5.5
  • Gateway 10.0.5.2
  • DNS 10.0.5.2
  • Discoverable Option: Yes
  • UTC-5:00 Eastern Time (US and Canada)
  1. Computer name
  • ad01-elizabeth

Maybe Reboot?

I dont think the ADDS Role needs to be installed but if needed refer to lab doc

While stuff is installing, refer to Phase 3 - DHCP

Promotion

Double check that hostname is set

  1. Create a new forest called elizabeth.local
  • Enter a DSRM password
  • I think everything else is default

Computer will reboot

Adding a DNS Record

  1. Invoke DNS Manager
  • DNS Tab, right click AD01-ELIZABETH
  1. New Reverse Lookup Zone
  • 10.0.5
  1. New host for fw01
  • fw01-elizabeth
  • fw01-elizabeth.elizabeth.local
  • 10.0.5.2
  • Check make associated PTR record
  1. New host for ad01
  • ad01-elizabeth
  • ad01-elizabeth.elizabeth.local
  • 10.0.5.5
  1. New host for wks01
  • See above
  • 10.0.5.100
  1. New host for dhcp01
  • See above
  • 10.0.5.3

Create new users

  1. Active Directory Users and Computers tool
  2. New User (Domain Admin)
  • echadbourne-adm
  • Add to Domain Admins group
  1. New User (Normal)
  • echadbourne
  • Skip addition to group

Join WKS01 to Domain

  1. Change DNS to 10.0.5.5
  • Ping by hostname to check connectivity
  1. In system properties, double check the hostname and then connect to elizabeth.local
  2. Use Domain Admin username and password

Restart

Phase 2 Complete, snapshot and take a break

Phase 3 - DHCP

Useful Links

Lab03 Tech Journal

  • Most helpful

Lab04 Tech Journal

Basics

Username: root

Password: Ch@mpl@1n!22

  1. Set IP information - nmtui
  • IP address: 10.0.5.3/24
  • Gateway: 10.0.5.2
  • DNS: 10.0.5.5
  • Search Domain: elizabeth.local
  • Hostname: dhcp01-elizabeth
  • restart the network service with systemctl restart network
  • Check with ifconfig
  1. Change admin password
  • passwd root
  1. Add a privileged user
  • useradd elizabeth.chadbourne
  • passwd elizabeth.chadbourne - set the password
  • usermod -aG wheel elizabeth.chadbourne - Add the user to the admin group

Logout and log back in as elizabeth.chadbourne

  1. Check ssh
  • Go to wks01 and try to ssh dhcp01-elizabeth
  • ping to test connectivity

If there is time, install PuTTY

Installing DHCP Services

SSH/PuTTY into dhcp01

Start by checking the status of where you are with pwd, whoami, and hostname

  1. Install DHCP services
  • sudo yum install dhcp
  1. Configure DHCP services
  • elevate to root: sudo -i
  • nano /etc/dhcp/dhcpd.conf
  • Add in the following:
Screenshot 2023-09-27 at 7 12 18 PM
  • Also add in default-lease-time 3600; and max-least-time 14400

Starting DHCP Services

  1. Type the following as root:
  • systemctl start dhcpd
  1. Check it's status with systemctl status dhcpd
  2. Enable the service to start at boot
  • systemctl enable dhcpd

Configure the Firewall for DHCP

  1. firewall-cmd --list-all - List all the active services
  2. Add the ports associated with dhcp permanently
  • firewall-cmd --add-service=dhcp --permanent
  • firewall-cmd --reload
  • firewall-cmd --list-all

Final Windows Config

  1. Go into the IP information for WKS01 and change both options to "Obtain automatically"
  2. Check ipconfig and connectivity (ping champlain.edu)

Take a Snapshot and walk away for a bit, Phase 3 Complete!!

Securing SSH? Securing SSH Journal

Phase 4 Group Policy

I am unsure if this is needed so I'm just gonna leave these links here

Useful Links

Lab05 Tech Journal

Clone this wiki locally