Installation

Installed on VMWare Workstation Pro without using WSL. Just Python and GIT.

Some errors encountered during installation:

  1. Permission error on private key:

    image.png

    OpenSSH strictly requires that private keys have restrictive permissions and be accessible only to the current user (or SYSTEM/Administrators). On Windows, permission inheritance grants read access to groups such as Authenticated Users or Users, which blocks the SSH client.

    image.png

  2. The link embedded inside Ansible configuration from GitHub was no more valid. So I download manually the exe, renamed and copied manually inside the SRV02 and SRV03 machine c:\setup\mssql\sql_installer.exe:

    image.png

    Thanks to Gemini: https://go.microsoft.com/fwlink/?linkid=866658

    image.png

  3. SSMS install hangs → SSMS is OPTIONAL: the MSSQL service and ALL vulnerabilities are installed before it, and an attacker uses impacket-mssqlclient from Kali, not SSMS.

    image.png

    From PROVISIONING VM you must comment these 4 lines inside the file /home/vagrant/GOAD/ansible/server.yml:

    image.png

    image.png

    Retype install in Vagrant console after doing this modification.

Run

cd V:\GOAD\
python.exe goad.py -m vm
provision_lab

image.png

GOAD Credentials

Below is a table that summarizes all GOAD credentials to be used as reference:

User Domain Password Purpose Administrator on
tywin.lannister sevenkingdoms.local powerkingftw135 Lannister leader, with specific permissions (forcechangepassword). -
jaime.lannister sevenkingdoms.local cersei Lannister member, with elevated permissions (GenericWrite). -
cersei.lannister sevenkingdoms.local il0vejaime Administrative leader, member of Domain Admins, Lannister and Small Council. dc01 (kingslanding)
tyron.lannister sevenkingdoms.local Alc00L&S3x Lannister member, with specific permissions (Self-Membership). -
robert.baratheon sevenkingdoms.local iamthekingoftheworld Administrative leader, member of Domain Admins, Baratheon and Small Council. dc01 (kingslanding)
joffrey.baratheon sevenkingdoms.local 1killerlion Member of Baratheon and Lannister, with elevated permissions (WriteDacl). -
renly.baratheon sevenkingdoms.local lorastyrell Member of Baratheon and Small Council, with sensitive permissions (WriteDacl). -
stannis.baratheon sevenkingdoms.local Drag0nst0ne Member of Baratheon and Small Council, with elevated permissions (GenericAll). -
petyer.baelish sevenkingdoms.local @littlefinger@ Small Council member, standard role. -
lord.varys sevenkingdoms.local W1sper$ Small Council member, with critical permissions (GenericAll Domain Admins). -
maester.pycelle sevenkingdoms.local MaesterOfMaesters Small Council member, standard role. -
arya.stark north.sevenkingdoms.local Needle Stark member, with elevated SQL permissions (impersonate dbo). -
eddard.stark north.sevenkingdoms.local FightP3aceAndHonor! Administrative leader, member of Domain Admins and Stark. dc02 (winterfell)
catelyn.stark north.sevenkingdoms.local robbsansabradonaryarickon Stark member, with administrative role. dc02 (winterfell)
robb.stark north.sevenkingdoms.local sexywolfy Stark member, with exposed credentials (autologon). dc02 (winterfell)
sansa.stark north.sevenkingdoms.local 345ertdfg Stark member, with SPN (HTTP/eyrie). -
brandon.stark north.sevenkingdoms.local iseedeadpeople Stark member, with SQL permissions (impersonate jon.snow). -
rickon.stark north.sevenkingdoms.local Winter2022 Stark member, standard role. -
hodor north.sevenkingdoms.local hodor Stark member, standard role (likely test account). -
jon.snow north.sevenkingdoms.local iknownothing Member of Stark and Night Watch, with SPN (HTTP/thewall) and SQL permissions (sa). -
samwell.tarly north.sevenkingdoms.local Heartsbane Night Watch member, with SQL permissions (impersonate sa). -
jeor.mormont north.sevenkingdoms.local L0ngCl@w Night Watch and Mormont leader, with administrative role. srv02 (castelblack)
sql_svc (north) north.sevenkingdoms.local YouWillNotKerboroast1ngMeeeeee SQL service account for MSSQL on castelblack. -
daenerys.targaryen essos.local BurnThemAll! Administrative leader, member of Domain Admins and Targaryen. dc03 (meereen)
viserys.targaryen essos.local GoldCrown Targaryen member, with specific permissions (e.g. CA manager). dc03 (meereen)
khal.drogo essos.local horse Dothraki leader, with elevated permissions (GenericAll). srv03 (braavos)
jorah.mormont essos.local H0nnor! Targaryen member, with specific permissions (GenericAll by Spys). -
missandei essos.local fr3edom User with specific permissions (GenericWrite/GenericAll). -
drogon essos.local Dracarys Dragons member, related to gMSA. -
sql_svc (essos) essos.local YouWillNotKerboroast1ngMeeeeee SQL service account for MSSQL on braavos. -

References