Inlined network connection type change (#60)

It seems like the separate script running from Autounattend.xml is not working which causes subsequent errors in winrm setup.
GoSecure · Jul 12, 2017 · 8023845 · 8023845
1 parent a8a9a07
commit 8023845
Show file tree

Hide file tree

Showing 7 changed files with 68 additions and 46 deletions.
diff --git a/malboxes/installconfig/windows7/Autounattend.xml b/malboxes/installconfig/windows7/Autounattend.xml
@@ -120,18 +120,12 @@
                 </SynchronousCommand>
                 <SynchronousCommand wcm:action="add">
                     <Order>3</Order>
-                    <Description>Mark all networks as private</Description>
-                    <CommandLine>cmd.exe /c powershell -File a:\fixnetworks.ps1</CommandLine>
-                    <RequiresUserInput>true</RequiresUserInput>
-                </SynchronousCommand>
-                <SynchronousCommand wcm:action="add">
-                    <Order>4</Order>
 		    <CommandLine>cmd.exe /c wmic useraccount where &quot;name=&apos;{{ username }}&apos;&quot; set PasswordExpires=FALSE</CommandLine>
 		    <Description>Disable password expiration for user {{ username }}</Description>
                     <RequiresUserInput>true</RequiresUserInput>
                 </SynchronousCommand>
                 <SynchronousCommand wcm:action="add">
-                    <Order>5</Order>
+                    <Order>4</Order>
                     <CommandLine>cmd.exe /c powershell -File &quot;A:\enablewinrm.ps1&quot;</CommandLine>
                     <Description>Enable WinRM for Packer/Vagrant communicator</Description>
                     <RequiresUserInput>true</RequiresUserInput>

diff --git a/malboxes/installconfig/windows7/enablewinrm.ps1 b/malboxes/installconfig/windows7/enablewinrm.ps1
@@ -1,3 +1,34 @@
+# --------------------------------------------------------------------------------------------------------------------
+# Enclosed section comes from the packer-windows project
+# https://github.com/joefitzgerald/packer-windows/blob/a2b9d6fdd91a857d605fb1d7ec822f3fdfa71db4/scripts/fixnetwork.ps1
+# Licensed under the MIT License
+# Copyright (c) 2014 Joe Fitzgerald
+
+# You cannot enable Windows PowerShell Remoting on network connections that are set to Public
+# Spin through all the network locations and if they are set to Public, set them to Private
+# using the INetwork interface:
+# http://msdn.microsoft.com/en-us/library/windows/desktop/aa370750(v=vs.85).aspx
+# For more info, see:
+# http://blogs.msdn.com/b/powershell/archive/2009/04/03/setting-network-location-to-private.aspx
+
+# Network location feature was only introduced in Windows Vista - no need to bother with this
+# if the operating system is older than Vista
+if([environment]::OSVersion.version.Major -lt 6) { return }
+
+# You cannot change the network location if you are joined to a domain, so abort
+if(1,3,4,5 -contains (Get-WmiObject win32_computersystem).DomainRole) { return }
+
+# Get network connections
+$networkListManager = [Activator]::CreateInstance([Type]::GetTypeFromCLSID([Guid]"{DCB00C01-570F-4A9B-8D69-199FDBA5723B}"))
+$connections = $networkListManager.GetNetworkConnections()
+
+$connections |foreach {
+	Write-Host $_.GetNetwork().GetName()"category was previously set to"$_.GetNetwork().GetCategory()
+	$_.GetNetwork().SetCategory(1)
+	Write-Host $_.GetNetwork().GetName()"changed to category"$_.GetNetwork().GetCategory()
+}
+# --------------------------------------------------------------------------------------------------------------------
+
 winrm quickconfig -q -transport:http
 winrm set winrm/config/client '@{AllowUnencrypted="true"}'
 winrm set winrm/config/service '@{AllowUnencrypted="true"}'
@@ -7,5 +38,6 @@ winrm set winrm/config/winrs '@{MaxMemoryPerShellMB="800"}'
 net stop winrm
 netsh advfirewall firewall set rule group="remote administration" new enable=yes
 netsh firewall add portopening TCP 5985 "Port 5985"
+# oddly enough the space is required below
 sc.exe config winrm start= auto
 net start winrm
diff --git a/malboxes/installconfig/windows7_64/Autounattend.xml b/malboxes/installconfig/windows7_64/Autounattend.xml
@@ -120,18 +120,12 @@
                 </SynchronousCommand>
                 <SynchronousCommand wcm:action="add">
                     <Order>3</Order>
-                    <Description>Mark all networks as private</Description>
-                    <CommandLine>cmd.exe /c powershell -File a:\fixnetworks.ps1</CommandLine>
-                    <RequiresUserInput>true</RequiresUserInput>
-                </SynchronousCommand>
-                <SynchronousCommand wcm:action="add">
-                    <Order>4</Order>
 		    <CommandLine>cmd.exe /c wmic useraccount where &quot;name=&apos;{{ username }}&apos;&quot; set PasswordExpires=FALSE</CommandLine>
 		    <Description>Disable password expiration for user {{ username }}</Description>
                     <RequiresUserInput>true</RequiresUserInput>
                 </SynchronousCommand>
                 <SynchronousCommand wcm:action="add">
-                    <Order>5</Order>
+                    <Order>4</Order>
                     <CommandLine>cmd.exe /c powershell -File &quot;A:\enablewinrm.ps1&quot;</CommandLine>
                     <Description>Enable WinRM for Packer/Vagrant communicator</Description>
                     <RequiresUserInput>true</RequiresUserInput>

diff --git a/malboxes/installconfig/windows7_64/enablewinrm.ps1 b/malboxes/installconfig/windows7_64/enablewinrm.ps1
@@ -1,3 +1,34 @@
+# --------------------------------------------------------------------------------------------------------------------
+# Enclosed section comes from the packer-windows project
+# https://github.com/joefitzgerald/packer-windows/blob/a2b9d6fdd91a857d605fb1d7ec822f3fdfa71db4/scripts/fixnetwork.ps1
+# Licensed under the MIT License
+# Copyright (c) 2014 Joe Fitzgerald
+
+# You cannot enable Windows PowerShell Remoting on network connections that are set to Public
+# Spin through all the network locations and if they are set to Public, set them to Private
+# using the INetwork interface:
+# http://msdn.microsoft.com/en-us/library/windows/desktop/aa370750(v=vs.85).aspx
+# For more info, see:
+# http://blogs.msdn.com/b/powershell/archive/2009/04/03/setting-network-location-to-private.aspx
+
+# Network location feature was only introduced in Windows Vista - no need to bother with this
+# if the operating system is older than Vista
+if([environment]::OSVersion.version.Major -lt 6) { return }
+
+# You cannot change the network location if you are joined to a domain, so abort
+if(1,3,4,5 -contains (Get-WmiObject win32_computersystem).DomainRole) { return }
+
+# Get network connections
+$networkListManager = [Activator]::CreateInstance([Type]::GetTypeFromCLSID([Guid]"{DCB00C01-570F-4A9B-8D69-199FDBA5723B}"))
+$connections = $networkListManager.GetNetworkConnections()
+
+$connections |foreach {
+	Write-Host $_.GetNetwork().GetName()"category was previously set to"$_.GetNetwork().GetCategory()
+	$_.GetNetwork().SetCategory(1)
+	Write-Host $_.GetNetwork().GetName()"changed to category"$_.GetNetwork().GetCategory()
+}
+# --------------------------------------------------------------------------------------------------------------------
+
 winrm quickconfig -q -transport:http
 winrm set winrm/config/client '@{AllowUnencrypted="true"}'
 winrm set winrm/config/service '@{AllowUnencrypted="true"}'
@@ -7,5 +38,6 @@ winrm set winrm/config/winrs '@{MaxMemoryPerShellMB="800"}'
 net stop winrm
 netsh advfirewall firewall set rule group="remote administration" new enable=yes
 netsh firewall add portopening TCP 5985 "Port 5985"
+# oddly enough the space is required below
 sc.exe config winrm start= auto
 net start winrm
diff --git a/malboxes/profiles/win7_32_analyst.json b/malboxes/profiles/win7_32_analyst.json
@@ -18,8 +18,7 @@
 
 		"floppy_files": [
 			"{{ cache_dir }}/Autounattend.xml",
-			"{{ dir }}/installconfig/windows7/enablewinrm.ps1",
-			"{{ dir }}/scripts/windows/fixnetworks.ps1"
+			"{{ dir }}/installconfig/windows7/enablewinrm.ps1"
 		]
 	}],
 

diff --git a/malboxes/profiles/win7_64_analyst.json b/malboxes/profiles/win7_64_analyst.json
@@ -18,8 +18,7 @@
 
 		"floppy_files": [
 			"{{ cache_dir }}/Autounattend.xml",
-			"{{ dir }}/installconfig/windows7_64/enablewinrm.ps1",
-			"{{ dir }}/scripts/windows/fixnetworks.ps1"
+			"{{ dir }}/installconfig/windows7_64/enablewinrm.ps1"
 		]
 	}],
 

diff --git a/malboxes/scripts/windows/fixnetworks.ps1 b/malboxes/scripts/windows/fixnetworks.ps1