AWS Pen-Testing Laboratory - Pentesting Lab With A Kali Linux Instance Accessible Via Ssh And Wireguard VPN And With Vulnerable Instances In A Private Subnet
http://www.kitploit.com/2021/06/aws-pen-testing-laboratory-pentesting.html
http://www.kitploit.com/2021/06/aws-pen-testing-laboratory-pentesting.html
PenTesting laboratory deployed as IaC with Terraform (https://www.kitploit.com/search/label/Terraform) on AWS. It deploys a Kali Linux (https://www.kitploit.com/search/label/Kali%20Linux) instance accessible via ssh & wireguard VPN. Vulnerable instances in a private subnet. NOTE: Ids only defined for region "eu-west-1" For other regions, kali ami id must be specified and metasploitable3 (https://www.kitploit.com/search/label/Metasploitable3) id (after building it)
Changelog
[2021-06-02] AMI IDs changed to use Kali 2021.2 [2021-03-10] Use new Kali version 2021.1
Diagram
Changelog
[2021-06-02] AMI IDs changed to use Kali 2021.2 [2021-03-10] Use new Kali version 2021.1
Diagram
Components
Kali 2021.2 instance (private key is saved into kali.pem) Wireguard VPN service: client file client_vpn.wg Accessible via ssh/scp Public Subnet 10.0.0.5/24 Vulnerable machine "Metasploitable" (ami build is public) Private subnet 10.0.1.5/24 More vulnerable (https://www.kitploit.com/search/label/Vulnerable) labs/machines/docker (to-be-done)
Features added
User management Automatically create non privileged users in kali instance with rsa Wireguard VPN client file per user Command line audit logging in syslog auditd enabled with sudo_log and users_log keys for auditing user actions (see also ausearch command) ToDO: Forward terminal audit to CloudWatch or an S3 Bucket with write once policy
How-To
Requirements: Terraform CLI install guide (https://learn.hashicorp.com/terraform/getting-started/install.html) AWS CLI install guide (https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html) $PATH configured for AWS CLI & Terraform AWS account and configure credentials (https://www.kitploit.com/search/label/Credentials) via aws cli: aws configure Kali Linux Subscription in AWS Marketplace (version 2020.04) Metasploitable3 AMI image previously built (public AMI available for eu-west-1 region) see (https://github.com/juanjoSanz/aws-pentesting-lab/blob/main/metasploitable3)
Deploy
Enable/disable vulnerable instances to be deployed setting 0 or 1 in variables.tf: variable "deploment-control" {
type = map
default = {
#"instance" = 0 or 1, to disable or enable
"metasploitable3" = 1
"dvca" = 0
}
description = "Control which EC2 instances are deployed, 0 for none or 1"
}
Use terraform for deploy infraestructure terraform init
terraform plan
terraform apply -auto-approve
Outputs
Terraform outputs will show following entries: ssh connection command for kali user (root via sudo) wireguard client file for kali user will be automatically retrieved from kali server scp command to retrieve wireguard client file (just in case defined terraform local-exec command fails) For each of the normal users created in Kali instance Private key file for ssh connection Wireguard client file for VPN connectivity
Usage
Either connect to Kali via ssh or wireguard: SSH: (Only command line) Use autogenerated private key (see terraform output) # configure kali public ip ssh -i kali.pem -o StrictHostKeyChecking=no -o IdentitiesOnly=yes kali@${KALI_IP} ">KALI_IP= # configure kali public ip
ssh -i kali.pem -o StrictHostKeyChecking=no -o IdentitiesOnly=yes kali@${KALI_IP}
Wireguard: Connect your local kali instance via wireguard (see client_vpn.wg generated file) # configure kali public ip scp -i kali.pem -o StrictHostKeyChecking=no IdentitiesOnly=yes kali@${KALI_IP}:/home/kali/client_vpn.wg . #### (local_kali)$ sudo apt-get install –y wireguard (local_kali)$ sudo gedit /etc/wireguard/wg0.conf # copy contents of client_vpn.wg (local_kali)$ sudo chmod 700 /etc/wireguard/wg0.conf (local_kali)$ sudo wg-quick up wg0 (local_kali)$ ping 10.0.0.5 # test connectivity with kali instance in AWS ">KALI_IP= # configure kali public ip
scp -i kali.pem -o StrictHostKeyChecking=no IdentitiesOnly=yes kali@${KALI_IP}:/home/kali/client_vpn.wg .
####
(local_kali)$ sudo apt-get install –y wireguard
(local_kali)$ sudo gedit /etc/wireguard/wg0.conf # copy contents of client_vpn.wg
(local_kali)$ sudo chmod 700 /etc/wireguard/wg0.conf
(local_kali)$ sudo wg-quick up wg0
(local_kali)$ ping 10.0.0.5 # test connectivity with kali instance in AWS
Destroy
terraform destroy -auto-approve
References
rapid7 / metasploitable3 (https://github.com/rapid7/metasploitable3) - license (https://github.com/rapid7/metasploitable3/blob/master/LICENSE) Kali 2021.2 AWS Marketplace (https://aws.amazon.com/marketplace/pp/B08LL91KKB) terraform-aws-ec2-kali-linux
Kali 2021.2 instance (private key is saved into kali.pem) Wireguard VPN service: client file client_vpn.wg Accessible via ssh/scp Public Subnet 10.0.0.5/24 Vulnerable machine "Metasploitable" (ami build is public) Private subnet 10.0.1.5/24 More vulnerable (https://www.kitploit.com/search/label/Vulnerable) labs/machines/docker (to-be-done)
Features added
User management Automatically create non privileged users in kali instance with rsa Wireguard VPN client file per user Command line audit logging in syslog auditd enabled with sudo_log and users_log keys for auditing user actions (see also ausearch command) ToDO: Forward terminal audit to CloudWatch or an S3 Bucket with write once policy
How-To
Requirements: Terraform CLI install guide (https://learn.hashicorp.com/terraform/getting-started/install.html) AWS CLI install guide (https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-install.html) $PATH configured for AWS CLI & Terraform AWS account and configure credentials (https://www.kitploit.com/search/label/Credentials) via aws cli: aws configure Kali Linux Subscription in AWS Marketplace (version 2020.04) Metasploitable3 AMI image previously built (public AMI available for eu-west-1 region) see (https://github.com/juanjoSanz/aws-pentesting-lab/blob/main/metasploitable3)
Deploy
Enable/disable vulnerable instances to be deployed setting 0 or 1 in variables.tf: variable "deploment-control" {
type = map
default = {
#"instance" = 0 or 1, to disable or enable
"metasploitable3" = 1
"dvca" = 0
}
description = "Control which EC2 instances are deployed, 0 for none or 1"
}
Use terraform for deploy infraestructure terraform init
terraform plan
terraform apply -auto-approve
Outputs
Terraform outputs will show following entries: ssh connection command for kali user (root via sudo) wireguard client file for kali user will be automatically retrieved from kali server scp command to retrieve wireguard client file (just in case defined terraform local-exec command fails) For each of the normal users created in Kali instance Private key file for ssh connection Wireguard client file for VPN connectivity
Usage
Either connect to Kali via ssh or wireguard: SSH: (Only command line) Use autogenerated private key (see terraform output) # configure kali public ip ssh -i kali.pem -o StrictHostKeyChecking=no -o IdentitiesOnly=yes kali@${KALI_IP} ">KALI_IP= # configure kali public ip
ssh -i kali.pem -o StrictHostKeyChecking=no -o IdentitiesOnly=yes kali@${KALI_IP}
Wireguard: Connect your local kali instance via wireguard (see client_vpn.wg generated file) # configure kali public ip scp -i kali.pem -o StrictHostKeyChecking=no IdentitiesOnly=yes kali@${KALI_IP}:/home/kali/client_vpn.wg . #### (local_kali)$ sudo apt-get install –y wireguard (local_kali)$ sudo gedit /etc/wireguard/wg0.conf # copy contents of client_vpn.wg (local_kali)$ sudo chmod 700 /etc/wireguard/wg0.conf (local_kali)$ sudo wg-quick up wg0 (local_kali)$ ping 10.0.0.5 # test connectivity with kali instance in AWS ">KALI_IP= # configure kali public ip
scp -i kali.pem -o StrictHostKeyChecking=no IdentitiesOnly=yes kali@${KALI_IP}:/home/kali/client_vpn.wg .
####
(local_kali)$ sudo apt-get install –y wireguard
(local_kali)$ sudo gedit /etc/wireguard/wg0.conf # copy contents of client_vpn.wg
(local_kali)$ sudo chmod 700 /etc/wireguard/wg0.conf
(local_kali)$ sudo wg-quick up wg0
(local_kali)$ ping 10.0.0.5 # test connectivity with kali instance in AWS
Destroy
terraform destroy -auto-approve
References
rapid7 / metasploitable3 (https://github.com/rapid7/metasploitable3) - license (https://github.com/rapid7/metasploitable3/blob/master/LICENSE) Kali 2021.2 AWS Marketplace (https://aws.amazon.com/marketplace/pp/B08LL91KKB) terraform-aws-ec2-kali-linux
(https://github.com/offensive-terraform/terraform-aws-ec2-kali-linux)
Download Aws-Pentesting-Lab (https://github.com/juanjoSanz/aws-pentesting-lab)
Download Aws-Pentesting-Lab (https://github.com/juanjoSanz/aws-pentesting-lab)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
Microsoft Tracks Attack Campaign Against Customer Support Agents
The company attributes the attack to Nobelium, the same group it linked to the SolarWinds campaign earlier this year.
Microsoft Tracks Attack Campaign Against Customer Support Agents
The company attributes the attack to Nobelium, the same group it linked to the SolarWinds campaign earlier this year.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
Microsoft Refining Third-Party Driver Vetting Processes After Signing Malicious Rootkit
Rogue driver was distributed within gaming community in China, company says.
Microsoft Refining Third-Party Driver Vetting Processes After Signing Malicious Rootkit
Rogue driver was distributed within gaming community in China, company says.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
New House Bill Aims to Drive Americans' Security Awareness
The legislation requires the National Telecommunications and Information Administration to establish a cybersecurity literacy campaign.
New House Bill Aims to Drive Americans' Security Awareness
The legislation requires the National Telecommunications and Information Administration to establish a cybersecurity literacy campaign.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
Attacks Erase Western Digital Network-Attached Storage Drives
The company suspects a remote code execution vulnerability affecting My Book Live and My Book Live Duo devices and recommends that business and individual users turn off the drives to protect their data.
Attacks Erase Western Digital Network-Attached Storage Drives
The company suspects a remote code execution vulnerability affecting My Book Live and My Book Live Duo devices and recommends that business and individual users turn off the drives to protect their data.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Distribute Your Data, Secure Your Future
https://cdn-images-1.medium.com/max/799/1*sfj60bzDFnDiH6SJ1qqv1A.jpeg
If data is the new oil and oil is the new gold, then let’s talk about data and cybersecurity in terms of gold and the famous Fort Knox…
Continue reading on Medium »
Distribute Your Data, Secure Your Future
https://cdn-images-1.medium.com/max/799/1*sfj60bzDFnDiH6SJ1qqv1A.jpeg
If data is the new oil and oil is the new gold, then let’s talk about data and cybersecurity in terms of gold and the famous Fort Knox…
Continue reading on Medium »