search

clong / DetectionLab

Automate the creation of a lab environment complete with security tooling and logging best practices
MIT License
4.6k stars 980 forks source link

VMWare tools or path incorrect: breaks future functions which are relying on tools to be present #738

Open seanb81 opened 2 years ago

seanb81 commented 2 years ago

==> vmware-iso: Retrieving ISO ==> vmware-iso: Trying https://software-download.microsoft.com/download/pr/18362.30.190401-1528.19h1_release_svc_refresh_CLIENTENTERPRISEEVAL_OEMRET_x64FRE_en-us.iso ==> vmware-iso: Trying https://software-download.microsoft.com/download/pr/18362.30.190401-1528.19h1_release_svc_refresh_CLIENTENTERPRISEEVAL_OEMRET_x64FRE_en-us.iso?checksum=sha256%3Aab4862ba7d1644c27f27516d24cb21e6b39234eb3301e5f1fb365a78b22f79b3 ==> vmware-iso: https://software-download.microsoft.com/download/pr/18362.30.190401-1528.19h1_release_svc_refresh_CLIENTENTERPRISEEVAL_OEMRET_x64FRE_en-us.iso?checksum=sha256%3Aab4862ba7d1644c27f27516d24cb21e6b39234eb3301e5f1fb365a78b22f79b3 => /home/corelight/detectionlab/DetectionLab/Packer/packer_cache/d48c36ef1e2c29895cbf01e82d405f0d93f875a4.iso ==> vmware-iso: Configuring output and export directories... ==> vmware-iso: Creating floppy disk... vmware-iso: Copying files flatly from floppy_files vmware-iso: Copying file: ../../Packer/answer_files/10/Autounattend.xml vmware-iso: Copying file: ../../Packer/floppy/WindowsPowershell.lnk vmware-iso: Copying file: ../../Packer/floppy/PinTo10.exe vmware-iso: Copying file: ../../Packer/scripts/fixnetwork.ps1 vmware-iso: Copying file: ../../Packer/scripts/rearm-windows.ps1 vmware-iso: Copying file: ../../Packer/scripts/disable-screensaver.ps1 vmware-iso: Copying file: ../../Packer/scripts/disable-winrm.ps1 vmware-iso: Copying file: ../../Packer/scripts/enable-winrm.ps1 vmware-iso: Copying file: ../../Packer/scripts/microsoft-updates.bat vmware-iso: Copying file: ../../Packer/scripts/win-updates.ps1 vmware-iso: Copying file: ../../Packer/scripts/unattend.xml vmware-iso: Copying file: ../../Packer/scripts/sysprep.bat vmware-iso: Done copying files from floppy_files vmware-iso: Collecting paths from floppy_dirs vmware-iso: Resulting paths from floppy_dirs : [] vmware-iso: Done copying paths from floppy_dirs vmware-iso: Copying files from floppy_content vmware-iso: Done copying files from floppy_content ==> vmware-iso: Uploading Floppy to remote machine... vmware-iso: packer4144920236 1.41 MiB / 1.41 MiB [===================================================================================================================] 100.00% 0s ==> vmware-iso: Remote cache was verified skipping remote upload... ==> vmware-iso: Creating required virtual machine disks ==> vmware-iso: Building and writing VMX file ==> vmware-iso: Registering remote VM... ==> vmware-iso: Starting virtual machine... ==> vmware-iso: Connecting to VNC... ==> vmware-iso: Waiting 6m0s for boot... ==> vmware-iso: Typing the boot command over VNC... ==> vmware-iso: Waiting for WinRM to become available... vmware-iso: WinRM connected. ==> vmware-iso: Connected to WinRM! ==> vmware-iso: Provisioning with windows-shell... ==> vmware-iso: Provisioning with shell script: ../../Packer/scripts/vm-guest-tools.bat vmware-iso: vmware-iso: C:\Users\vagrant>if not exist "C:\Windows\Temp\7z2102-x64.msi" (powershell -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object System.Net.WebClient).DownloadFile('https://www.7-zip.org/a/7z2102-x64.msi', 'C:\Windows\Temp\7z2102-x64.msi')" 0<NUL ) vmware-iso: vmware-iso: C:\Users\vagrant>if not exist "C:\Windows\Temp\7z2102-x64.msi" (powershell -Command "Start-Sleep 5; [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object System.Net.WebClient).DownloadFile('https://www.7-zip.org/a/7z2102-x64.msi', 'C:\Windows\Temp\7z2102-x64.msi')" 0<NUL ) vmware-iso: vmware-iso: C:\Users\vagrant>msiexec /qb /i C:\Windows\Temp\7z2102-x64.msi vmware-iso: vmware-iso: C:\Users\vagrant>if "vmware-iso" EQU "vmware-iso" goto :vmware vmware-iso: vmware-iso: C:\Users\vagrant>if exist "C:\Users\vagrant\windows.iso" (move /Y C:\Users\vagrant\windows.iso C:\Windows\Temp ) vmware-iso: vmware-iso: C:\Users\vagrant>if not exist "C:\Windows\Temp\windows.iso" ( vmware-iso: powershell -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object System.Net.WebClient).DownloadFile('https://softwareupdate.vmware.com/cds/vmw-desktop/ws/15.5.5/16285975/windows/packages/tools-windows.tar', 'C:\Windows\Temp\vmware-tools.tar')" 0<NUL vmware-iso: cmd /c ""C:\Program Files\7-Zip\7z.exe" x C:\Windows\Temp\vmware-tools.tar -oC:\Windows\Temp" vmware-iso: FOR /R "C:\Windows\Temp" %a in (VMware-tools-windows-*.iso) DO REN "%~a" "windows.iso" vmware-iso: rd /S /Q "C:\Program Files (x86)\VMWare" vmware-iso: ) vmware-iso: vmware-iso: 7-Zip 21.02 alpha (x64) : Copyright (c) 1999-2021 Igor Pavlov : 2021-05-06 vmware-iso: vmware-iso: Scanning the drive for archives: vmware-iso: 1 file, 143431680 bytes (137 MiB) vmware-iso: vmware-iso: Extracting archive: C:\Windows\Temp\vmware-tools.tar ==> vmware-iso: The system cannot find the file specified. vmware-iso: -- vmware-iso: Path = C:\Windows\Temp\vmware-tools.tar vmware-iso: Type = tar vmware-iso: Physical Size = 143431680 vmware-iso: Headers Size = 8704 vmware-iso: Code Page = UTF-8 vmware-iso: Characteristics = ASCII vmware-iso: vmware-iso: Everything is Ok vmware-iso: vmware-iso: Files: 2 vmware-iso: Size: 143422729 vmware-iso: Compressed: 143431680 vmware-iso: vmware-iso: C:\Users\vagrant>REN "C:\Windows\Temp\VMware-tools-windows-11.0.6-15940789.iso" "windows.iso" vmware-iso: vmware-iso: C:\Users\vagrant>cmd /c ""C:\Program Files\7-Zip\7z.exe" x "C:\Windows\Temp\windows.iso" -oC:\Windows\Temp\VMWare" vmware-iso: vmware-iso: 7-Zip 21.02 alpha (x64) : Copyright (c) 1999-2021 Igor Pavlov : 2021-05-06 vmware-iso: vmware-iso: Scanning the drive for archives: vmware-iso: 1 file, 143421440 bytes (137 MiB) vmware-iso: vmware-iso: Extracting archive: C:\Windows\Temp\windows.iso vmware-iso: -- vmware-iso: Path = C:\Windows\Temp\windows.iso vmware-iso: Type = Iso vmware-iso: Physical Size = 143421440 vmware-iso: Created = 2020-03-30 14:59:23 vmware-iso: Modified = 2020-03-30 14:59:23 vmware-iso: vmware-iso: Everything is Ok vmware-iso: vmware-iso: Folders: 12 vmware-iso: Files: 24 vmware-iso: Size: 142967402 vmware-iso: Compressed: 143421440 vmware-iso: vmware-iso: C:\Users\vagrant>cmd /c C:\Windows\Temp\VMWare\setup.exe /S /v"/qn REBOOT=R\" ==> vmware-iso: Provisioning with shell script: ../../Packer/scripts/enable-rdp.bat vmware-iso: vmware-iso: C:\Users\vagrant>netsh advfirewall firewall add rule name="Open Port 3389" dir=in action=allow protocol=TCP localport=3389 vmware-iso: Ok. vmware-iso: vmware-iso: vmware-iso: C:\Users\vagrant>reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f vmware-iso: The operation completed successfully. ==> vmware-iso: Provisioning with Powershell... ==> vmware-iso: Provisioning with powershell script: ../../Packer/scripts/debloat-windows.ps1 vmware-iso: Downloading debloat zip vmware-iso: Disable Windows Defender vmware-iso: Optimize Windows Update vmware-iso: Disable automatic download and installation of Windows updates vmware-iso: vmware-iso: vmware-iso: Hive: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Policies\Microsoft\Windows\WindowsUpdate vmware-iso: vmware-iso: vmware-iso: Name Property vmware-iso: ---- -------- vmware-iso: AU vmware-iso: Disable seeding of updates to other computers via Group Policies vmware-iso: vmware-iso: vmware-iso: Hive: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows vmware-iso: vmware-iso: vmware-iso: Name Property vmware-iso: ---- -------- vmware-iso: DeliveryOptimization vmware-iso: Disable 'Updates are available' message vmware-iso: vmware-iso: SUCCESS: The file (or folder): "C:\Windows\System32\MusNotification.exe" now owned by user "VAGRANT-10\vagrant". vmware-iso: processed file: C:\Windows\System32\MusNotification.exe vmware-iso: Successfully processed 1 files; Failed processing 0 files vmware-iso: vmware-iso: SUCCESS: The file (or folder): "C:\Windows\System32\MusNotificationUx.exe" now owned by user "VAGRANT-10\vagrant". vmware-iso: processed file: C:\Windows\System32\MusNotificationUx.exe vmware-iso: Successfully processed 1 files; Failed processing 0 files vmware-iso: Disable Windows Update vmware-iso: vmware-iso: vmware-iso: Hive: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT vmware-iso: vmware-iso: vmware-iso: Name Property vmware-iso: ---- -------- vmware-iso: Reliability ==> vmware-iso: Restarting Machine ==> vmware-iso: Waiting for machine to restart... ==> vmware-iso: A system shutdown is in progress.(1115) vmware-iso: vagrant-10 restarted. ==> vmware-iso: Machine successfully restarted, moving on ==> vmware-iso: Provisioning with Powershell... ==> vmware-iso: Provisioning with powershell script: ../../Packer/scripts/set-powerplan.ps1 vmware-iso: Set power plan to high performance ==> vmware-iso: Provisioning with powershell script: ../../Packer/scripts/docker/disable-windows-defender.ps1 ==> vmware-iso: Provisioning with windows-shell... ==> vmware-iso: Provisioning with shell script: ../../Packer/scripts/pin-powershell.bat vmware-iso: vmware-iso: C:\Users\vagrant>rem https://connect.microsoft.com/PowerShell/feedback/details/1609288/pin-to-taskbar-no-longer-working-in-windows-10 vmware-iso: vmware-iso: C:\Users\vagrant>copy "A:\WindowsPowerShell.lnk" "C:\Users\vagrant\AppData\Local\Temp\Windows PowerShell.lnk" vmware-iso: 1 file(s) copied. vmware-iso: vmware-iso: C:\Users\vagrant>A:\PinTo10.exe /PTFOL01:'C:\Users\vagrant\AppData\Local\Temp' /PTFILE01:'Windows PowerShell.lnk' vmware-iso: vmware-iso: C:\Users\vagrant>exit /b 0 ==> vmware-iso: Provisioning with shell script: ../../Packer/scripts/compile-dotnet-assemblies.bat vmware-iso: vmware-iso: C:\Users\vagrant>if "AMD64" == "AMD64" goto 64BIT vmware-iso: vmware-iso: C:\Users\vagrant>C:\Windows\microsoft.net\framework\v4.0.30319\ngen.exe update /force /queue 1>NUL vmware-iso: vmware-iso: C:\Users\vagrant>C:\Windows\microsoft.net\framework64\v4.0.30319\ngen.exe update /force /queue 1>NUL vmware-iso: vmware-iso: C:\Users\vagrant>C:\Windows\microsoft.net\framework\v4.0.30319\ngen.exe executequeueditems 1>NUL vmware-iso: vmware-iso: C:\Users\vagrant>C:\Windows\microsoft.net\framework64\v4.0.30319\ngen.exe executequeueditems 1>NUL vmware-iso: vmware-iso: C:\Users\vagrant>exit 0 ==> vmware-iso: Provisioning with shell script: ../../Packer/scripts/set-winrm-automatic.bat vmware-iso: vmware-iso: C:\Users\vagrant>echo Set WinRM start type to auto vmware-iso: Set WinRM start type to auto vmware-iso: vmware-iso: C:\Users\vagrant>sc config winrm start= auto vmware-iso: [SC] ChangeServiceConfig SUCCESS ==> vmware-iso: Provisioning with shell script: ../../Packer/scripts/dis-updates.bat vmware-iso: vmware-iso: C:\Users\vagrant>rem http://www.windows-commandline.com/disable-automatic-updates-command-line/ vmware-iso: vmware-iso: C:\Users\vagrant>reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" /v AUOptions /t REG_DWORD /d 1 /f vmware-iso: The operation completed successfully. vmware-iso: vmware-iso: C:\Users\vagrant>rem remove optional WSUS server settings vmware-iso: vmware-iso: C:\Users\vagrant>reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /f vmware-iso: The operation completed successfully. vmware-iso: vmware-iso: C:\Users\vagrant>rem even harder, disable windows update service vmware-iso: vmware-iso: C:\Users\vagrant>rem sc config wuauserv start= disabled vmware-iso: vmware-iso: C:\Users\vagrant>rem net stop wuauserv vmware-iso: vmware-iso: C:\Users\vagrant>if exist C:\Windows\Temp\win-updates.log ( vmware-iso: echo Show Windows Updates log file C:\Windows\Temp\win-updates.log vmware-iso: dir C:\Windows\Temp\win-updates.log vmware-iso: type C:\Windows\Temp\win-updates.log vmware-iso: rem output of type command is not fully shown in packer/ssh session, so try PowerShell vmware-iso: rem but it will hang if log file is about 22 KByte vmware-iso: rem powershell -command "Get-Content C:\Windows\Temp\win-updates.log" vmware-iso: echo End of Windows Updates log file C:\Windows\Temp\win-updates.log vmware-iso: ) ==> vmware-iso: Gracefully halting virtual machine... vmware-iso: Waiting for VMware to clean up after itself... ==> vmware-iso: Deleting unnecessary VMware files... vmware-iso: Deleting: /vmfs/volumes/datastore0_ESXi-1_RAID/Windows10/vmware.log ==> vmware-iso: Cleaning VMX prior to finishing up... vmware-iso: Unmounting floppy0 from VMX... vmware-iso: Disabling VNC server... ==> vmware-iso: Skipping export of virtual machine... ==> vmware-iso: Keeping virtual machine registered with ESX host (keep_registered = true) Build 'vmware-iso' finished after 28 minutes 138 milliseconds.

==> Wait completed after 28 minutes 138 milliseconds

==> Builds finished. The artifacts of successful builds are: --> vmware-iso: VM files in directory: /vmfs/volumes/datastore0_ESXi-1_RAID/Windows10

========= After it fails on the Tools install, it has no sanity built in that would avoid future vmware tools calls/functions, and all subsequent reboots and whatnot are failing. If I manually babysit the console, and reboot when it fails a vmware tools reboot, the script does continue just fine. Host is configured just fine. Reboots/shutdowns however, if left until their timer expires, will cause the script to fail.

clong commented 2 years ago

Thanks for the issue - will look into it this weekend!