Splunk Attack Range Setup V2

[@TheSumit395]

Hi Thanks for this video. Its pretty useful

[@weakiztlink]

What's the overall cost for running the environment for a month?

[@rolfe727]

Hi There I am facing a issue when I'm trying to finalize the set up of attack range. When I attempt to run python attack_range.py -m terraform -a build
I get the following error messages...
Traceback (most recent call last):
File "attack_range.py", line 7, in
from modules.TerraformController import TerraformController
File "/opt/attack_range/modules/TerraformController.py", line 2, in
from modules.IEnvironmentController import IEnvironmentController
File "/opt/attack_range/modules/IEnvironmentController.py", line 2, in
from abc import ABC, abstractmethod
ImportError: cannot import name ABC
Any Ideas?
Thank you in advance for your assistance!

[@TheGrumpsalot]

This error is due to a/some of the modules missing. Inside of the attack range folder there should be a requirments.txt file. Make sure you run the command
pip install -r requirments.txt after you setup the virtualenv.

[@rolfe727]

@@TheGrumpsalot Awesome thanks for your quick reply! This fixed it :)

[@rolfe727]

@@TheGrumpsalot Hi again, I am facing another issue when running python attack_range.py -m terraform -a simulate -st T1117,T1003 -t 3.124.85.116 ............. I have confirmed both the Splunk server and DC have been assigned Elastic IP's
# python attack_range.py -m terraform -a simulate -st T1117 -t 3.124.85.116
The Vagrant executable cannot be found. Please check if it is in the system path.
starting program loaded for B1 battle droid
||/__'`.
|//()'-.:
|-.||
|o(o)
|||\\ .==._
|||(o)==::'
`|T ""
()
|\
||\
()()
||//
|//
.'=`=.
attack_range is using config at path attack_range.conf
2020-04-30 07:52:16,015 - INFO - attack_range - INIT - attack_range v1
Traceback (most recent call last):
File "attack_range.py", line 158, in
controller.simulate(target, simulation_techniques)
File "/opt/attack_range/modules/TerraformController.py", line 62, in simulate
target_public_ip = aws_service.get_single_instance_public_ip(target, self.config)
File "/opt/attack_range/modules/aws_service.py", line 16, in get_single_instance_public_ip
return instance['NetworkInterfaces'][0]['Association']['PublicIp']
TypeError: 'NoneType' object is not subscriptable
(venv) [root@ip-172-31-35-217 attack_range]#
Thanks again!!!!

[@TheGrumpsalot]

@@rolfe727 When you run the attack you want to do it on the Name value instead of IP Address so run command
python attack_range.py -m terraform -lm that will list the names and then run -t against name like
python attack_range.py -m terraform -a simulate -st T1134 -t attack-range-windows-domain-controller

[@rolfe727]

@@TheGrumpsalot Thanks again! This fixed the issue