jsecurity101-JonMon/deployment/Azure

Deploy JonMon in Azure

Deploy an Azure VM with Hyper-V Server Installed

Click on the button below to deploy an environment, provide a username and password, and select the Azure Bastion option to connect to the environment. Deployment takes around 20 minutes.

Create Windows 10 Installation Media

• Connect to the Windows server via Azure Bastion Host
• Open PowerShell as an Administrator and run the following PowerShell commands to download the MediaCreationTool

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 
$url = 'https://go.microsoft.com/fwlink/?LinkId=691209' 
$request = [System.Net.WebRequest]::Create($url) 
$response = $request.GetResponse() 
 
$realUrl = $response.ResponseUri.OriginalString 
$OutputFile = [System.IO.Path]::GetFileName($realUrl) 
$response.Close() 
 
$File = "C:\ProgramData\$OutputFile" 
$wc = new-object System.Net.WebClient 
$wc.DownloadFile($realUrl, $File)

• Double-click on the MediaCreationTool.exe executable located in C:\ProgramData and Accept the license terms

• Select Create Installation media (USB flash drive, DVD, or ISO file) for another PC

• Select language, architecture, and edition

• Choose media type ISO file

• Choose where to save the file

• Download file

Create Hyper-V Environment

Set Up Network

I use the official script from Azure Lab Services to create a create a basic Hyper-V network.

Set-Location C:\ProgramData

Invoke-WebRequest 'https://aka.ms/azlabs/scripts/hyperV-powershell' -Outfile SetupForNestedVirtualization.ps1 

.\SetupForNestedVirtualization.ps1 

Create Hyper-V Virtual Machine

On the same privileged PowerShell session, run the following commands:

$VM = "Win10-JonMon" 
$Switch = "LabServicesSwitch" 
$ISOFile = "C:\ProgramData\Windows.iso" 
$VMPath = "C:\Programdata\$VM" 
$VHD = "$VMPath\$VM.vhdx" 

New-VM -Name $VM -MemoryStartupBytes 4GB -Path $VMPath -NewVHDPath $VHD -NewVHDSizeBytes 60GB -Generation 2 -SwitchName $Switch 

Mount ISO File

On the same privileged PowerShell session run the following command:

Add-VMDvdDrive -VMName $VM -Path $ISOFile

Configure VM Boot Order and Disable Secure Boot

Set-VMFirmware -VMName $VM -BootOrder $(Get-VMDvdDrive -VMName $VM), $(Get-VMHardDiskDrive -VMName $VM), $(Get-VMNetworkAdapter -VMName $VM) -EnableSecureBoot Off

Start Hyper-V and Start Windows 10 Virtual Machine

If for some reason, the boot screen does not let you press any keys for the ISO to load, you can click on Action > Reset and it should work:

Install Windows

Select the I don't have a product key for now

Select Windows 10 Pro > Next

Accept License

Select Install Windows Only (advanced)

Select the drive where to install Windows

Wait for the installation to complete

Finish the installation of Windows 10 according to your needs

Turn TESTSIGNING On

Open cmd.exe as Administrator and restart Hyper-V Win10 VM

bcdedit /set TESTSIGNING on

Enable Internet Connection on VM

By default, our Hyper-V VM will not be connected to the Internet and since WinNAT by itself does not allocate and assign IP addresses to an endpoint (e.g. VM), we need to do this manually from within the VM itself - i.e. set IP address within range of NAT internal prefix, set default gateway IP address, set DNS server information.

After that you will be able to browse the Internet :)

Install JonMon Service

Open PowerShell as Administrator and run the following commands to run a Blacksmith script created by the community to install JonMon directly from its latest release.

(New-Object System.Net.WebClient).DownloadString("https://raw.githubusercontent.com/OTRF/Blacksmith/master/resources/scripts/powershell/endpoint-software/Install-JonMon.ps1") | IEX

Basic Test

I highly recommend to go over Jonny's presentation "Unleashing JonMon" for a few examples.

In my basic test, I wanted to see what Sliver - GetSystem looked like in JonMon events.

References:

• https://github.com/Azure/azure-quickstart-templates/tree/master/demos/nested-vms-in-virtual-network
• https://github.com/jsecurity101/Presentations/blob/main/JonMon.pdf