Breach Attack Simulation - Starting With OpenBAS

Caldera has been in market for years, I have never tried it. I saw OpenBAS on my recommended lists in Github so I thought I might give it a try

Installation

Since I have my docker server running I used that. There are ways to install it directly as well, I didn't go through it.

I followed steps as per the docs

mkdir -p ~/openBAS && cd ~/openBAS
git clone https://github.com/OpenBAS-Platform/docker.git .

Changing Environment Variables

I did nothing in this regard. This was a local test for me. I just followed the installation guide and ran the following commands

mv .env.sample .env
export $(cat .env | grep -v "#" | xargs)

Starting the docker

When I tried

docker-compose up -d

It gave me an error that the file rabbitmq.conf should have the full path.

It seems like a simple fix in the docker-compose.yml file. Find the section about RabbitMQ and change the source to include a full path or a ./

rabbitmq:
    image: rabbitmq:4.0-management
    environment:
      - RABBITMQ_DEFAULT_USER=${RABBITMQ_DEFAULT_USER}
      - RABBITMQ_DEFAULT_PASS=${RABBITMQ_DEFAULT_PASS}
      - RABBITMQ_NODENAME=rabbit01@localhost
    volumes:
      - type: bind
        source: ./rabbitmq.conf #Fix This Line 
        target: /etc/rabbitmq/rabbitmq.conf
      - amqpdata:/var/lib/rabbitmq
    restart: always

After fixing the docker-compose.yml file. The docker-compose up -d command was successful. After a few minutes, the system was ready and I could reach the platform web UI at http://localhost:8080

The credentials were supplied in the .env file. I used that to log in.

Platform

The platform was nice and very intuitive to me. There is a 3 min short video of OpenBAS as well.

Installing the agent

The agent installation is a breeze. Click the top right button and follow the instructions

The next step is to run the agent as an admin and non-admin user. I leave that as an exercise to the reader. I am sure the reader of this blog post knows how to run a bunch of Powershell commands as an admin and non-admin user.

Creating a Scenario

Use the Scenarios button to list or create a scenario

For creating a scenario, use the bottom right bottom and provide details as follows

I was only interested in running some tactics through my agent first. My larger goal would be to import tactics and run them for a specific threat group. I'll try that in a later post. For now, just running some tactics would be fine.

After creating the scenario, click on injects and import the tactics you want to run. For sampling, I imported a few injects related to process injection