Skip to main content

Introductory Ranges - Chapter 1

Example Corp

Overview

The Example Corp network consists of four separate subnets in a tiered topology.

Tier 1 contains the most important assets from a security standpoint: the Domain Controller and Certificate Authority. This is followed by Tier 2, which contains a file server. Next, you have the lowest priority machines contained within Tier 3. This subnet contains three workstations, two of which are identical Windows hosts, and the third is built using an Ubuntu Desktop template which is also domain-joined.

The final Security subnet contains a Windows Event Forwarding (WEF) host, used to aggregate the logs generated throughout the network. These logs are ingested by the Elastic host also found in this subnet.

simple_network.jpg

---

Networking

When creating the Example Corp network, the entire Range has a `/16` network available for subnetting into individual networks to better represent an Enterprise network environment. During the build, you'll create five subnets, as shown in the table below.

Machines are assigned IP addresses specific to their location and are hardcoded in the included [Ansible inventory file](../blob/main/range/inventory.yml). When starting the range in the Immersive Labs Ranges environment, an admin machine will use DHCP to ensure that each machine always receives its specified IP address when the range starts. The machines are to be configured as such:

| Hostname | IP address | OS | Network | Description |
| :--- | :---: | :---: | :---: | :--- |
| DC01 | 10.10.0.10 | Windows Server 2022 | Tier 1 (10.10.0.0/24) | Primary Domain Controller (DC) for the Example Corp domain |
| CA01 | 10.10.0.20 | Windows Server 2022 | Tier 1 (10.10.0.0/24) | Enterprise Certificate Server (ADCS) for the Example Corp domain |
| FS01 | 10.10.10.10 | Windows Server 2022 | Tier 2 (10.10.10.0/24) | File server with domain-wide share created |
| OFF-WKS01 | 10.10.20.10 | Windows Server 2022<sup>1</sup> | Tier 3 (10.10.20.0/24) | Representative Windows user workstation |
| OFF-WKS02 | 10.10.20.20 | Windows Server 2022<sup>1</sup> | Tier 3 (10.10.20.0/24) | Representative Windows user workstation |
| OFF-WKS03 | 10.10.20.30 | Ubuntu Desktop 20.04 | Tier 3 (10.10.20.0/24) | Representative Ubuntu Linux user workstation |
| WEF01 | 10.10.30.10 | Windows Server 2022 | Security (10.10.30.0/24) | Windows Server with Windows Event Forwarding (WEF) configured via event subscriptions |
| ELK01 | 10.10.30.20 | Ubuntu Server 22.04 | Security (10.10.30.0/24) | Elastic Community server for SIEM solution |
| Ansible-Temp | 10.10.40.10 | Ubuntu Server 22.04 | Ansible (10.10.40.0/24) | Temporary server for running Ansible against the range – to be removed once the build is finished |

Organizational units, groups, and users

Users and their respective groups, as well as the organizational unit (OU) structure of the domain, are defined in their relevant Ansible file. [Users](../../blob/main/range/playbooks/windows/supporting-files/domain_users.yml) and their passwords are hardcoded and will be created after [OUs and groups](../../blob/main/range/playbooks/windows/domain_controller/ou_and_groups.yml) are created. There is one exception, which is a single domain/enterprise admin is created before OUs and groups are created to facilitate that creation.

[!TIP]
If you're creating a range environment for offensive security professionals, it's recommended to change usernames and passwords early rather than using the public hardcoded ones!

Once the range is created, the following users will be created in the domain:

| Username | Password | Built-in group membership | Created group membership | 
| :--- | :---: | :---: | :--- |
| m.magdelena | 10Ek!d0S[1qX*d[=o^k& | Enterprise Admin, Domain Admin, Schema Admin | - |
| a.blake | 7=ABO{j17$=D | - | HR Staff |
| s.daugherty | d<Gw(OZW943K | - | HR Staff |
| a.chang | I,!:p9Q7;4od | - | HR Staff |
| a.allison | rg_vBH0:44m* | - | HR Staff |
| k.mccormick | 7q^q~p2/8o\E | - | HR Staff |
| e.castaneda | x61492D&m0]~ | - | IT Staff |
| a.vaughan | u+2{77{A"*v6 | - | IT Staff |
| l.velasquez | =W9r@h497Cq( | - | IT Staff |
| a.quinn | FwS.o85}Z9!8 | - | IT Staff |
| j.mcdowell | (e9h,27&GS7{ | - | IT Staff |
| m.fleming | ._>70D9`cs4I | - | Finance Staff |
| k.mccall | 76yY$Wu2MC8b | - | Finance Staff |
| k.lloyd | 38'*o#OJ/T/2 | - | Finance Staff |
| t.pacheco | a/g1-9'68IXM | - | Finance Staff |
| t.leach | 4Ab[a2:6fC`+ | - | Finance Staff |
| m.mccarty | 4]5UDu_2ns:F | - | Operations Staff |
| b.mason | n5cfl193R1A1 | - | Operations Staff |
| l.brady | 160ZgK5nsr87 | - | Operations Staff |
| r.velazquez | oEY3YhP8dph5 | - | Operations Staff |
| m.fleming | DMHtZ8h8h1xw | - | Operations Staff |
| m.rivera | hjSKVj0793w2 | - | Mgmnt Staff |
| i.holland | j0YY728sTw8A | - | Mgmnt Staff |
| m.sosa | UxzS7Ir60mJO | - | Mgmnt Staff |
| k.johnson | 6lzz0TCC3CgH | - | Mgmnt Staff |
| l.potter | t61w42Gf5snK | - | Mgmnt Staff |

---

GPO configuration

Several Group Policy Objects (GPOs) are created or applied during the build process, some of which are to set up services such as:

  • The WEF log aggregator
  • Certificate auto-enrollment from the ADCS server

Others are used to disable:

  • Windows Defender
  • Windows Firewall
  • Machine Account password reroll every 30 days

Disabling or weakening security features may not be required for every scenario but can be helpful to facilitate offensive activities in a beginner range environment. These GPOs can easily be removed if required.

Next steps

First, you need to create the barebones range in the Immersive Labs Ranges platform, instructions for which are detailed in Chapter 2.

Footnotes

1Windows 7/10/11 images are not generally available from the AWS marketplace. Because AWS doesn't license any of these AMIs](https://docs.aws.amazon.com/workspaces/latest/adminguide/byol-windows-images.html), we haven't used them in this guide. Users will need to use their own standalone licenses, license servers, or licenses from MSDN if using Windows clients long term.