> For the complete documentation index, see [llms.txt](https://www.redteam.cafe/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.redteam.cafe/red-team/breach-attack-simulation-starting-with-openbas.md).

# Breach Attack Simulation - Starting With OpenBAS

## Installation

Since I have my docker server running I used that. There are ways to install it directly as well, I didn't go through it. 

I followed steps as per the docs 

```
mkdir -p ~/openBAS && cd ~/openBAS
git clone https://github.com/OpenBAS-Platform/docker.git .
```

### Changing Environment Variables

I did nothing in this regard. This was a local test for me. I just followed the installation guide and ran the following commands 

```
mv .env.sample .env
export $(cat .env | grep -v "#" | xargs)
```

### Starting the docker 

When I tried 

```
docker-compose up -d 
```

It gave me an error that the file *rabbitmq.conf* should have the full path. 

It seems like a simple fix in the *docker-compose.yml file.* Find the section about RabbitMQ and change the source to include a full path or a ./

```
rabbitmq:
    image: rabbitmq:4.0-management
    environment:
      - RABBITMQ_DEFAULT_USER=${RABBITMQ_DEFAULT_USER}
      - RABBITMQ_DEFAULT_PASS=${RABBITMQ_DEFAULT_PASS}
      - RABBITMQ_NODENAME=rabbit01@localhost
    volumes:
      - type: bind
        source: ./rabbitmq.conf #Fix This Line 
        target: /etc/rabbitmq/rabbitmq.conf
      - amqpdata:/var/lib/rabbitmq
    restart: always
```

After fixing the docker-compose.yml file. The `docker-compose up -d` command was successful. After a few minutes, the system was ready and I could reach the platform web UI at `http://localhost:8080`

### Login

The credentials were supplied in the `.env` file. I used that to log in. 

### Platform

The platform was nice and very intuitive to me. There is a 3 min short video of OpenBAS as well.

{% embed url="<https://www.youtube.com/watch?v=FJgceyZoY1g>" %}

### Installing the agent

The agent installation is a breeze. Click the top right button and follow the instructions&#x20;

<figure><img src="/files/HhuhWRT3jI6SbwY5ZZnB" alt=""><figcaption></figcaption></figure>

The next step is to run the agent as an admin and non-admin user. I leave that as an exercise to the reader. I am sure the reader of this blog post knows how to run a bunch of Powershell commands as an admin and non-admin user.&#x20;

### Creating a Scenario

Use the Scenarios button to list or create a scenario

<figure><img src="/files/1m6Y5qeF4B5tAZojyfFz" alt=""><figcaption></figcaption></figure>

For creating a scenario, use the bottom right bottom and provide details as follows&#x20;

<figure><img src="/files/7SIJr1WEqAuYhrWzR3yv" alt=""><figcaption></figcaption></figure>

I was only interested in running some tactics through my agent first. My larger goal would be to import tactics and run them for a specific threat group. I'll try that in a later post. For now, just running some tactics would be fine.

After creating the scenario, click on injects and import the tactics you want to run. For sampling, I imported a few injects related to process injection&#x20;

<figure><img src="/files/DuOUHVDwyhn2RvMxhcAH" alt=""><figcaption></figcaption></figure>

To add an inject, click on inject and click create&#x20;

<figure><img src="/files/pVfKibUKClCVRIXdzZNA" alt=""><figcaption></figcaption></figure>

Once you have the injects that you want, you will see something like this in your injects tab of the scenario you created.

<figure><img src="/files/CYys25UeTKvyIdWsmz4I" alt=""><figcaption></figcaption></figure>

Now lets change the missing content status to enabled. click update&#x20;

<figure><img src="/files/YW9WCW2VqYblMD6ha42G" alt=""><figcaption></figcaption></figure>

Now Add the missing content.&#x20;

<figure><img src="/files/GbsEftHJVaWgGHgUFcHv" alt=""><figcaption></figcaption></figure>

Once done, your TTP should be enabled. Now let's click Launch&#x20;

<figure><img src="/files/HDEtXd4U54tlbYMqhguU" alt=""><figcaption></figcaption></figure>

In a few moments, you will see the results&#x20;

<figure><img src="/files/WsbhVZ5b0HVc1acDuCHa" alt=""><figcaption></figcaption></figure>

### Final Thoughts

Looks pretty awesome at first glance. Will explore how to integrate with OpenCTI to include scenarios.&#x20;

### References

{% embed url="<https://github.com/OpenBAS-Platform/openbas>" %}

{% embed url="<https://docs.openbas.io/latest/>" %}