Penetration Testing Lab Setup

# Update system
sudo apt update && sudo apt upgrade -y

# Install additional tools
sudo apt install -y \
    gobuster feroxbuster \
    bloodhound neo4j \
    netexec evil-winrm \
    seclists \
    docker.io docker-compose-v2

# Enable services
sudo systemctl enable ssh
sudo systemctl start ssh
sudo systemctl enable postgresql
sudo systemctl start postgresql

# Initialize Metasploit database
sudo msfdb init

# Create directory structure
mkdir -p ~/engagements/client_name/{recon,scans,exploits,loot,notes}

# Clone useful repos
git clone https://github.com/danielmiessler/SecLists ~/tools/SecLists
git clone https://github.com/carlospolop/PEASS-ng ~/tools/PEASS-ng
git clone https://github.com/samratashok/nishang ~/tools/nishang

# Install Python tools via pipx (isolated environments)
pipx install impacket
pipx install netexec

# Start BloodHound CE
sudo neo4j console &
bloodhound

# Or use BloodHound Community Edition (Docker):
# curl -L https://ghst.ly/getbhce | docker compose -f - up

# Quick Vulnerable Web App Setup with Docker

# DVWA
docker run -d -p 80:80 vulnerables/web-dvwa
# Access at http://localhost
# Login: admin/password

# bWAPP
docker run -d -p 8080:80 raesene/bwapp
# Access at http://localhost:8080/install.php

# OWASP Juice Shop
docker run -d -p 3000:3000 bkimminich/juice-shop
# Access at http://localhost:3000

# WebGoat (OWASP)
docker run -d -p 8081:8080 -p 9090:9090 webgoat/webgoat
# Access at http://localhost:8081/WebGoat

# SQLi-labs
docker run -d -p 8082:80 acgpiano/sqli-labs
# Access at http://localhost:8082

# NodeGoat
docker run -d -p 4000:4000 owasp/nodegoat
# Access at http://localhost:4000

# Run multiple with docker compose
cat > docker-compose.yml << 'EOF'
services:
  dvwa:
    image: vulnerables/web-dvwa
    ports:
      - "80:80"
  juiceshop:
    image: bkimminich/juice-shop
    ports:
      - "3000:3000"
  webgoat:
    image: webgoat/webgoat
    ports:
      - "8080:8080"
      - "9090:9090"
EOF
docker compose up -d

# ==========================================
# Step 1: Domain Controller Setup
# ==========================================

# Open PowerShell as Admin

# Set computer name
Rename-Computer -NewName DC01 -Restart

# Install AD DS role
Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools

# Promote to Domain Controller
Install-ADDSForest -DomainName "lab.local" -DomainNetbiosName "LAB" -InstallDns

# After restart, create users and groups
Import-Module ActiveDirectory

# Create OUs
New-ADOrganizationalUnit -Name "Lab Users" -Path "DC=lab,DC=local"
New-ADOrganizationalUnit -Name "Lab Computers" -Path "DC=lab,DC=local"
New-ADOrganizationalUnit -Name "Lab Groups" -Path "DC=lab,DC=local"

# Create users with weak passwords (for testing)
$users = @(
    @{Name="John Smith"; SamAccountName="jsmith"; Password="Password123!"},
    @{Name="Jane Doe"; SamAccountName="jdoe"; Password="Summer2026!"},
    @{Name="Admin User"; SamAccountName="admin.user"; Password="Admin@123"},
    @{Name="Service Account"; SamAccountName="svc_sql"; Password="SQLService1!"}
)

foreach ($user in $users) {
    New-ADUser -Name $user.Name -SamAccountName $user.SamAccountName -UserPrincipalName "$($user.SamAccountName)@lab.local" -AccountPassword (ConvertTo-SecureString $user.Password -AsPlainText -Force) -Enabled $true -PasswordNeverExpires $true -Path "OU=Lab Users,DC=lab,DC=local"
}

# Create groups
New-ADGroup -Name "IT Admins" -GroupScope Global -Path "OU=Lab Groups,DC=lab,DC=local"
New-ADGroup -Name "HR" -GroupScope Global -Path "OU=Lab Groups,DC=lab,DC=local"

# Add users to groups
Add-ADGroupMember -Identity "IT Admins" -Members "admin.user"
Add-ADGroupMember -Identity "Domain Admins" -Members "admin.user"

# ==========================================
# Step 2: Configure Vulnerabilities
# ==========================================

# Kerberoastable user (SPN)
setspn -a MSSQLSvc/dc01.lab.local:1433 svc_sql

# AS-REP Roastable user
Set-ADAccountControl -Identity jdoe -DoesNotRequirePreAuth $true

# SMB Signing disabled (via Registry for lab simplicity)
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Services\LanmanServer\Parameters" -Name "requiresecuritysignature" -Value 0

# ==========================================
# Step 3: Join Workstations (Run on Workstation)
# ==========================================

# Set DNS to DC IP
Set-DnsClientServerAddress -InterfaceAlias "Ethernet0" -ServerAddresses "10.0.0.1"

# Join Domain
Add-Computer -DomainName "lab.local" -Restart

# Clone GOAD repository
git clone https://github.com/Orange-Cyberdefense/GOAD.git
cd GOAD

# Install python dependencies
pip install ansible pywinrm

# Deploy with Vagrant (VirtualBox provider)
cd ad/GOAD/providers/virtualbox
vagrant up

# Ludus requires a dedicated Proxmox server
# Install via the official installer:
curl -s https://ludus.cloud/install | bash

# Configure your first range
ludus range config get > config.yml
# Edit config.yml to define your lab VMs
ludus range config set -f config.yml

# Deploy the range
ludus range deploy

# Check status
ludus range status

# VMware - Export from GUI:
# File > Export to OVF > Choose OVA format

# VirtualBox - Export from CLI:
VBoxManage export "Kali-Lab" -o kali-lab.ova
VBoxManage export "DC01" -o dc01-lab.ova
VBoxManage export "WS01" -o ws01-lab.ova

# Import on another machine:
VBoxManage import kali-lab.ova

# Compress for sharing (OVAs can be large):
# Windows
Compress-Archive -Path *.ova -DestinationPath lab-export.zip

# Linux
tar czf lab-export.tar.gz *.ova