diff --git a/docs/content/reference/exploiters/PowerShell.md b/docs/content/reference/exploiters/PowerShell.md
new file mode 100644
index 000000000..5e901e93c
--- /dev/null
+++ b/docs/content/reference/exploiters/PowerShell.md
@@ -0,0 +1,55 @@
+---
+title: "PowerShell"
+date: 2021-08-24T12:19:21+03:00
+draft: false
+tags: ["exploit", "windows"]
+---
+
+### Description
+
+This exploiter uses brute-force to propagate to a victim through PowerShell
+Remoting using Windows Remote Management (WinRM).
+
+See Microsoft's documentation for more on [PowerShell Remoting
+Protocol](https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/winrmsecurity?view=powershell-7.1)
+and [Windows Remote
+Management](https://docs.microsoft.com/en-us/windows/win32/winrm/portal).
+
+
+##### Credentials used
+
+The PowerShell exploiter can be run from both Linux and Windows attackers. On
+Windows attackers, the exploiter has the ability to use the cached username
+and/or password from the current user. On both Linux and Windows attackers, the
+exploiter uses all combinations of the [user-configured usernames and
+passwords]({{< ref "/usage/configuration/basic-credentials" >}}). Different
+combinations of credentials are attempted in the following order:
+
+1. **Cached username and password (Windows attacker only)** - The exploiter will
+ use the stored credentials of the current user to attempt to log into the
+ victim machine.
+
+1. **Brute force usernames with blank passwords** - Windows allows you to
+ configure a user with a blank/empty password. The exploiter will attempt to
+ log into the victim machine using each username set in the
+ [configuration]({{< ref "/usage/configuration/basic-credentials" >}}) with a
+ blank password.
+
+ In order for the attacker to connect with a blank password, the victim must
+ have enabled basic authentication, http and no encryption.
+
+1. **Brute force usernames with cached password (Windows attacker only)** - The
+ exploiter will attempt to log into the victim machine using each username
+ set in the [configuration]({{< ref "/usage/configuration/basic-credentials"
+ >}}) and the current user's cached password.
+
+1. **Brute force usernames and passwords** - The exploiter will attempt to use
+ all combinations of usernames and passwords that were set in the
+ [configuration.]({{< ref "/usage/configuration/basic-credentials" >}})
+
+
+#### Securing PowerShell Remoting
+
+Information about how to remediate security concerns related to PowerShell
+Remoting can be found
+[here](https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/winrmsecurity?view=powershell-7.1).
diff --git a/envs/monkey_zoo/docs/fullDocs.md b/envs/monkey_zoo/docs/fullDocs.md
index 3cdc79f74..80ecf5f55 100644
--- a/envs/monkey_zoo/docs/fullDocs.md
+++ b/envs/monkey_zoo/docs/fullDocs.md
@@ -30,8 +30,11 @@ This document describes Infection Monkey’s test network, how to deploy and use
[Nr. 22 Scan](#_Toc526517197)
[Nr. 23 Struts2](#_Toc536021476)
[Nr. 24 Struts2](#_Toc536021477)
-[Nr. 250 MonkeyIsland](#_Toc536021478)
-[Nr. 251 MonkeyIsland](#_Toc536021479)
+[Nr. 25 Zerologon](#_Toc536021478)
+[Nr. 3-45 Powershell](#_Toc536021479)
+[Nr. 3-46 Powershell](#_Toc536021480)
+[Nr. 250 MonkeyIsland](#_Toc536021481)
+[Nr. 251 MonkeyIsland](#_Toc536021482)
[Network topography](#network-topography)
# Warning\!
@@ -59,9 +62,9 @@ To deploy:
1. Configure service account for your project:
a. Create a service account (GCP website -> IAM & Admin -> Service Accounts -> + CREATE SERVICE ACCOUNT) and name it “your\_name-monkeyZoo-user”
-
+
b. Give these permissions to your service account:
-
+
**Compute Engine -> Compute Network Admin**
and
**Compute Engine -> Compute Instance Admin (v1)**
@@ -69,11 +72,11 @@ To deploy:
**Compute Engine -> Compute Security Admin**
and
**Service Account User**
-
+
or
-
+
**Project -> Owner**
-
+
c. Create and download its **Service account key** in JSON and place it in **monkey_zoo/gcp_keys** as **gcp_key.json**.
2. Get these permissions in the monkeyZoo project (guardicore-22050661) for your service account (ask monkey developers to add them):
@@ -85,29 +88,29 @@ To deploy:
link to your service account key file):
provider "google" {
-
+
project = "test-000000" // Change to your project id
-
+
region = "europe-west3" // Change to your desired region or leave default
-
+
zone = "europe-west3-b" // Change to your desired zone or leave default
-
- credentials = "${file("../gcp_keys/gcp_key.json")}" // Change to the location and name of the service key.
+
+ credentials = "${file("../gcp_keys/gcp_key.json")}" // Change to the location and name of the service key.
// If you followed instruction above leave it as is
-
+
}
-
+
locals {
-
+
resource_prefix = "" // All of the resources will have this prefix.
// Only change if you want to have multiple zoo's in the same project
-
+
service_account_email="tester-monkeyZoo-user@testproject-000000.iam.gserviceaccount.com" // Service account email
-
+
monkeyzoo_project="guardicore-22050661" // Project where monkeyzoo images are kept. Leave as is.
-
+
}
-
+
4. Run terraform init
To deploy the network run:
@@ -117,7 +120,7 @@ To deploy the network run:
# Using islands:
-###How to get into the islands:
+### How to get into the islands:
**island-linux-250:** SSH from GCP
@@ -125,9 +128,9 @@ To deploy the network run:
island-windows-251. Set password for your account and then RDP into
the island.
-###These are most common steps on monkey islands:
+### These are most common steps on monkey islands:
-####island-linux-250:
+#### island-linux-250:
To run monkey island:
`sudo /usr/run\_island.sh`
@@ -142,7 +145,7 @@ Update all requirements using deployment script:
1\. `cd /usr/infection_monkey/deployment_scripts`
2\. `./deploy_linux.sh "/usr/infection_monkey" "develop"`
-####island-windows-251:
+#### island-windows-251:
To run monkey island:
Execute C:\\run\_monkey\_island.bat as administrator
@@ -156,8 +159,8 @@ To update repository:
3\. `git pull` (updates develop branch)
Update all requirements using deployment script:
-1. `cd C:\infection_monkey\deployment_scripts`
-2. `./run_script.bat "C:\infection_monkey" "develop"`
+1\. `cd C:\infection_monkey\deployment_scripts`
+2\. `./run_script.bat "C:\infection_monkey" "develop"`
# Running tests:
@@ -276,10 +279,6 @@ fullTest.conf is a good config to start, because it covers all machines.
Notes: |
Quick tutorial on how to add entries (was useful when setting up). |
-
- |
- |
-
@@ -357,10 +356,6 @@ fullTest.conf is a good config to start, because it covers all machines.
Notes: |
|
-
- |
- |
-
@@ -433,10 +428,6 @@ fullTest.conf is a good config to start, because it covers all machines.
Notes: |
Vulnerable app is under /cgi-bin/test.cgi |
-
- |
- |
-
@@ -613,10 +604,6 @@ fullTest.conf is a good config to start, because it covers all machines.
Notes: |
|
-
- |
- |
-
@@ -653,10 +640,6 @@ fullTest.conf is a good config to start, because it covers all machines.
Notes: |
Don’t add this machine’s credentials to exploit configuration. |
-
- |
- |
-
@@ -695,10 +678,6 @@ fullTest.conf is a good config to start, because it covers all machines.
Notes: |
|
-
- |
- |
-
@@ -765,10 +744,6 @@ fullTest.conf is a good config to start, because it covers all machines.
Notes: |
If you change this machine’s IP it won’t get exploited. |
-
- |
- |
-
@@ -839,10 +814,6 @@ fullTest.conf is a good config to start, because it covers all machines.
Notes: |
|
-
- |
- |
-
@@ -985,10 +956,6 @@ fullTest.conf is a good config to start, because it covers all machines.
Notes: |
Used to scan a machine that has no vulnerabilities (to evaluate scanning speed for e.g.) |
-
- |
- |
-
@@ -1093,17 +1060,13 @@ fullTest.conf is a good config to start, because it covers all machines.
Notes: |
|
-
- |
- |
-
@@ -1123,7 +1086,63 @@ fullTest.conf is a good config to start, because it covers all machines.
+
+
+
+| OS: |
+Windows Server 2016 x64 |
+
+
+| Software: |
+WinRM service |
+
+
+| Default server’s port: |
+- |
+
+
+| Notes: |
+User: m0nk3y, Password: Passw0rd!
User: m0nk3y-user, No Password. |
+
+
+
+
+
+
+
+
+
+
+| OS: |
+Windows Server 2016 x64 |
+
+
+| Software: |
+WinRM service |
+
+
+| Default server’s port: |
+- |
+
+
+| Notes: |
+User: m0nk3y, Password: Passw0rd! |
+
+
+
+
+
+
+
@@ -1149,20 +1168,18 @@ fullTest.conf is a good config to start, because it covers all machines.
| Notes: |
Only accessible trough GCP |
-
- |
- |
-
+
+
| OS: |
Windows Server 2016 x64 |
@@ -1183,13 +1200,9 @@ fullTest.conf is a good config to start, because it covers all machines.
Notes: |
Only accessible trough GCP |
-
- |
- |
-
# Network topography:
-
+