List of Supported System Features
January 12, 2024 · View on GitHub
Systems defined in the configuration files can be customised using system features (also referred to as just features).
System features are a core concept in Dynamic Labs and allow for the definition of specific configuration states for the host, e.g. whether a machine is joined to a domain, definition of system users, deployment of vulnerable configurations.
The following tables list the available features and the systems they can be used with.
Windows Features
| Feature name | Description | Definition and Usage Documentation |
|---|---|---|
| AD_Forest | Creates a new forest | ../Ansible/tasks/AD/create.yml |
| AD_Domain | Adds a domain to an existing forest | ../Ansible/tasks/AD/domain/create.yml |
| AD_Join | Joins a machine to a domain | ../Ansible/tasks/AD/join.yml |
| AD_User | Creates a new domain User | ../Ansible/tasks/AD/user/create.yml |
| AD_User_Password | Changes the password of an existing domain user | ../Ansible/tasks/AD/user/password.yml |
| AD_User_Right | Adds rights to an existing user object | ../Ansible/tasks/AD/user/right.yml |
| AD_Group | Creates a new domain group | ../Ansible/tasks/AD/group/create.yml |
| AD_Group_Membership | Adds members to a domain group | ../Ansible/tasks/AD/group/membership.yml |
| AD_SecEdit_Access | Sets domain security policy | ../Ansible/tasks/AD/secedit_access.yml |
| AD_MSA | Creates a Managed Service Account | ../Ansible/tasks/AD/msa/create.yml |
| AD_MSA_AllowRetrieve | Sets permissions to retrieve the password for a Managed Service Account | ../Ansible/tasks/AD/msa/PrincipalsAllowedToRetrieveManagedPassword.yml |
| AD_SetSPN | Adds an SPN to an domain account | ../Ansible/tasks/AD/setspn.yml |
| AD_GPO | Creates an empty GPO and attaches it to an OU | ../Ansible/tasks/AD/gpo/create.yml |
| AD_GPO_ACL | Sets permissions on a GPO object | ../Ansible/tasks/AD/acl/gpo.yml |
| AD_Object_ACL | Sets permissions on a domain object (users, groups, computers, OUs, etc..). Can be used to configure resource based constrained delegation. | ../Ansible/tasks/AD/acl/object.yml ../Ansible/tasks/AD/delegation/resourcebased.yml |
| AD_Organizational_Unit | Creates a new Organisational Unit (OU) | ../Ansible/tasks/AD/ou/create.yml |
| AD_Object_Organizational_Unit | Moves a domain object into an existing OU | ../Ansible/tasks/AD/ou/move_object.yml |
| AD_Unconstrained_Delegation | Configure unconstrained delegation for a domain account | ../Ansible/tasks/AD/delegation/unconstrained.yml |
| AD_Constrained_Delegation | Configures constrained delegation for a domain account | ../Ansible/tasks/AD/delegation/constrained.yml |
| AD_DNS_Forwarder_Zone | Creates a DNS forwarded zone. Useful when creating AD_Trusts between forests | ../Ansible/tasks/AD/dns/forwarder_zone.yml |
| AD_DNS_Record | Creates a custom DNS record in a domain | ../Ansible/tasks/AD/dns/record.yml |
| AD_Trust | Configures trust between domains and forests (depends on AD_DNS_Forwarder_Zone) | ../Ansible/tasks/AD/domain/trust.yml |
| AD_CleanUp | Disables Ansible domain account used for deployment, so that they cannot be used in attack paths. This will prevent further Ansible executions. | ../Ansible/plays/cleanup.yml |
| Win_User | Creates a local user | ../Ansible/tasks/system/windows/user/create.yml |
| Win_User_Password | Sets the password of an existing local user | ../Ansible/tasks/system/windows/user/password.yml |
| Win_Group | Creates a local group (currently not implemented) | ../Ansible/tasks/system/windows/group/create.yml |
| Win_Group_Membership | Adds members to a local group | ../Ansible/tasks/system/windows/group/membership.yml |
| Win_Directory | Creates an empty directory | ../Ansible/tasks/system/windows/filesystem/directory.yml |
| Win_Simple_File | Creates a file with optional text content and sets the owner | ../Ansible/tasks/system/windows/filesystem/simplefile.yml |
| Win_Dirtree_Copy | Copies a directory tree from the template’s assets to the target system and sets the owner | ../Ansible/tasks/system/windows/filesystem/dirtree.yml |
| Win_Filesystem_ACL | Sets permissions on files and folders | ../Ansible/tasks/system/windows/filesystem/acl.yml |
| Win_File_Share | Creates a Windows file share | ../Ansible/tasks/system/windows/smb/fileshare.yml |
| Win_Defender_Disable | Disables Windows Defender antivirus (note: Windows 10/11 are currently not supported) | ../Ansible/tasks/system/windows/antivirus/disable_defender.yml |
| Win_PowerShell_Script | Executes a custom PowerShell script. Useful as a complement to existing features, when the desired state is not implemented by an existing feature. | ../Ansible/tasks/system/windows/scripts/powershell_script.yml |
| Win_EARLY_PowerShell_Script | Executes early on a custom PowerShell script (only use when other features depend on the command, where possible use Win_PowerShell_Script instead) | ../Ansible/tasks/system/windows/scripts/powershell_script.yml |
| Win_CleanUp | Disables Ansible local account used for deployment, so that it cannot be used in attack paths. This will prevent further Ansible executions. | ../Ansible/plays/cleanup.yml |
| IIS_Web_Application | Deploys an IIS web server and application | ../Ansible/tasks/system/windows/IIS/iis_web_application.yml |
| MSSQL_Server | Deploys a MSSQL server and database | ../Ansible/tasks/system/windows/MSSQL/MSSQL_server.yml |
| flag | Deploys a flag on the filesystem for CTF style templates. DEPRECATED – instead use Win_Simple_File or Linux_Simple_File | ../Ansible/tasks/system/windows/filesystem/add_flag.yml |
| ATTCK_T1003_1 | T1003.001 - OS Credential Dumping: LSASS Memory | ../Ansible/tasks/attacks/T1003_1/logonpasswords.yml |
| ATTCK_T1187_1 | T1187.001 - Forced Authentication : NTLMv2 Response Give-away via SMB | ../Ansible/tasks/attacks/T1187_1/T1187_SCF_1.yml |
| ATTCK_T1552_2_1 | T1552.002 - Unsecured Credentials: Credentials in Registry | ../Ansible/tasks/attacks/T1552_2/1.yml |
| ATTCK_T1574_9_1 | T1574.009 – Hijack Execution Flow: Path Interception by Unquoted Path | ../Ansible/tasks/attacks/T574_9/1.yml |
Linux Features
| Feature name | Description | Definition and Usage Documentation |
|---|---|---|
| Linux_User | Creates a local user | ../Ansible/tasks/system/linux/user/create.yml |
| Linux_Authorized_Keys | Adds authorised SSH keys to a local user | ../Ansible/tasks/system/linux/ssh/authorized_keys.yml |
| Linux_Directory | Creates a directory and sets the permissions | ../Ansible/tasks/system/linux/filesystem/directory.yml |
| Linux_Simple_File | Creates a file with optional text content and sets the permissions | ../Ansible/tasks/system/linux/filesystem/simplefile.yml |
| Linux_Dirtree_Copy | Copies a directory tree from the template’s assets to the target system and sets permissions | ../Ansible/tasks/system/linux/filesystem/dirtree.yml |
| Linux_Apt_Package_Install | Installs an apt package | ../Ansible/tasks/system/linux/packages/apt_package_install.yml |
| Linux_Apt_Package_Upgrade | Upgrades the system via apt upgrade | ../Ansible/tasks/system/linux/packages/apt_package_upgrade.yml |
| Linux_Nginx_Website | Deploys Nginx web server and a hosted web site | ../Ansible/tasks/system/linux/nginx/nginx_website.yml |
| Linux_Shell_Script | Executes a custom script on Linux. Useful as a complement to existing features, when the desired state is not implemented by an existing feature. | ../Ansible/tasks/system/linux/scripts/shell_script.yml |
| Linux_EARLY_Shell_Script | Executes early on a custom script on Linux (only use when other features depend on the command, where possible use Linux_Shell_Script instead) | ../Ansible/tasks/system/linux/scripts/shell_script.yml |
MacOS Features
| Feature name | Description | Definition and Usage Documentation |
|---|---|---|
| MacOS_User | Creates a local user | ../Ansible/tasks/system/macos/user/create.yml |
| MacOS_Authorized_Keys | Adds authorised SSH keys to a local user | ../Ansible/tasks/system/linux/ssh/authorized_keys.yml |
| MacOS_Remote_Desktop | Enables Remote Desktop System Wide (VNC on port 5900) | ../Ansible/tasks/system/macos/remote_desktop/enable.yml |
| AD_Join_MacOS | Joins a machine to a Windows Active Directory domain | ../Ansible/tasks/AD/join_macos.yml |
| MacOS_Directory | Creates a directory and sets the permissions | ../Ansible/tasks/system/linux/filesystem/directory.yml |
| MacOS_Simple_File | Creates a file with optional text content and sets the permissions | ../Ansible/tasks/system/linux/filesystem/simplefile.yml |
| MacOS_Dirtree_Copy | Copies a directory tree from the template’s assets to the target system and sets permissions | ../Ansible/tasks/system/linux/filesystem/dirtree.yml |
| MacOS_Shell_Script | Executes a custom script on MacOS. Useful as a complement to existing features, when the desired state is not implemented by an existing feature. | ../Ansible/tasks/system/linux/scripts/shell_script.yml |
| MacOS_EARLY_Shell_Script | Executes early on a custom script on MacOS (only use when other features depend on the command, where possible use MacOS_Shell_Script instead) | ../Ansible/tasks/system/linux/scripts/shell_script.yml |