offensive security
Active Directory Lab with Hyper-V and PowerShell
Below are some notes with a couple of simple Powershell scripts that I use to:
- Promote a computer to Domain Controller
- Create an Active Directory (AD) domain
offense.local - Join computer to
offense.localdomain - Create users in
offense.localdomain
The scripts are not intended to fully automate building of the Active Directory lab, rather they serve as cheatsheets that suit most of my needs most of the time.
I use Hyper-V to run my virtual machines (VM) which I installed manually:
- WS01 - Windows 10
- DC01 - Windows Server 2019
Promote Computer to Domain Controller
Below script establishes a Powershell Remoting session to the
DC01 VM using credentials administrator:123456 (I set that password on DC01 manually before running this script) and does the following:- Congifures the IP/DNS addresses - Domain Controller
DC01will have a static IP10.0.0.6; - Installs AD services and management tools;
- Creates a domain
offense.local.
You may need to change the passwords depending on your password policies.
Promote-DC.ps1
1
$plainPassword = "123456"
2
$password = $plainPassword | ConvertTo-SecureString -asPlainText -Force
3
$credential = New-Object System.Management.Automation.PSCredential("administrator", $password)
4
​
5
$session = New-PSSession -Vmname dc01 -Credential $credential -Verbose
6
​
7
$code = {
8
$plainPassword = "123456"
9
$password = $plainPassword | ConvertTo-SecureString -asPlainText -Force
10
$credential = New-Object System.Management.Automation.PSCredential("administrator", $password)
11
​
12
netsh int ip set address "ethernet" static 10.0.0.6 255.255.255.0 10.0.0.6 1
13
netsh int ip set dns "ethernet" static 10.0.0.6 primary
14
​
15
$domainName = "offense"
16
$domain = "$domainName.local"
17
​
18
Write-Host "Installing management tools"
19
Import-Module ServerManager
20
Add-WindowsFeature RSAT-AD-PowerShell,RSAT-AD-AdminCenter
21
​
22
Write-Host "Deploying Active Directory Domain..."
23
Install-WindowsFeature AD-domain-services, DNS -IncludeAllSubFeature -IncludeManagementTools -Restart
24
Import-Module ADDSDeployment
25
Install-ADDSForest `
26
-SafeModeAdministratorPassword $password `
27
-CreateDnsDelegation:$false `
28
-DatabasePath "C:\Windows\NTDS" `
29
-DomainMode "7" `
30
-DomainName $domain `
31
-DomainNetbiosName $domainName `
32
-ForestMode "7" `
33
-InstallDns:$true `
34
-LogPath "C:\Windows\NTDS" `
35
-NoRebootOnCompletion:$true `
36
-SysvolPath "C:\Windows\SYSVOL" `
37
-Force:$true
38
​
39
Restart-Computer -Force -Verbose
40
}
41
​
42
Invoke-Command -Session $session -ScriptBlock $code
Copied!
Output of Promote-DC.ps1
Join Computer to Domain
Below script establishes a Powershell Remoting session to the
WS01 VM using credentials mantvydas:123456 (I set that password on WS01 manually before running this script) and does the following:- Configures IP/DNS settings - the workstation
WS01will have a static IP10.0.0.7and a DNS pointing to10.0.0.6, which is ourDC01; - Adds computer to the domain.
Join-Member.ps1
1
$plainPassword = "123456"
2
$password = $plainPassword | ConvertTo-SecureString -asPlainText -Force
3
$credential = New-Object System.Management.Automation.PSCredential("mantvydas", $password)
4
​
5
$session = New-PSSession -Vmname ws01 -Credential $credential -Verbose
6
​
7
$code = {
8
netsh int ip set address "ethernet" static 10.0.0.7 255.255.255.0 10.0.0.6 1
9
netsh int ip set dns "ethernet" static 10.0.0.6 primary
10
​
11
$plainPassword = "123456"
12
$password = $plainPassword | ConvertTo-SecureString -asPlainText -Force
13
$credential = New-Object System.Management.Automation.PSCredential("administrator", $password)
14
Add-computer -computername ws01 -domain offense.local -domaincredential $credential -Verbose -Restart
15
}
16
​
17
Invoke-Command -Session $session -ScriptBlock $code
Copied!
Create Domain Users
Below script establishes a Powershell Remoting session to the
DC01 VM and does the following:- Creates some domain users
- Sets their passwords to
123456
Create-Users.ps1
1
$plainPassword = "123456"
2
$password = $plainPassword | ConvertTo-SecureString -asPlainText -Force
3
$credential = New-Object System.Management.Automation.PSCredential("offense\administrator", $password)
4
​
5
$session = New-PSSession -Vmname dc01 -Credential $credential -Verbose
6
​
7
$code = {
8
$plainPassword = "123456"
9
$password = $plainPassword | ConvertTo-SecureString -asPlainText -Force
10
$credential = New-Object System.Management.Automation.PSCredential("offense\administrator", $password)
11
12
# Create users
13
"spotless", "sandy", "bob" | % { New-ADUser $_ }
14
15
# Reset users' passwords
16
Get-ADUser -Filter * -Properties samaccountname | select -exp samaccountname | ? {$_ -notmatch "krb|guest"} | ForEach-Object { Write-host Changing password for $_ to $plainPassword; net user $_ $plainPassword | out-null }
17
}
18
​
19
Invoke-Command -Session $session -ScriptBlock $code
Copied!
Before running this script, the password policy needs to be manually updated on
DC01:- Minimum password length:
0 - Password must meet complexity requirements:
disabled
Don't forget to run
gpupdate.exe on the DC01 for the new password policy to take affect. This step is mandatory before running Create-Users.ps1 script, otherwise the user passwords will not be changed.Setting up Kali in Enhanced Session Mode
Execute the below in kali:
1
sudo git clone https://github.com/mimura1133/linux-vm-tools /opt/linux-vm-tools
2
sudo chmod 0755 /opt/linux-vm-tools/kali/2020.x/install.sh
3
sudo /opt/linux-vm-tools/kali/2020.x/install.sh
4
sudo reboot -f
Copied!
Execute the below on the host OS with Hyper V, that is hosting your kali VM:
1
Set-VM "KALI02" -EnhancedSessionTransportType HVSocket
Copied!