Build and Configure your White Hat Hacking Lab

0:00Someone once told me that a journey of 1,000 miles begins with a single step, and the challenge is if we don't take that single step we're not on the journey. So I would start off by recommending that you and I schedule time to go through these Nuggets. So regarding scheduling your time, take a look at what would be reasonable, perhaps 15 or 20 minutes a day at a certain time, and then block that off. And the great news is that most of the Nuggets in this course are less than that time-wise, so you could easily enjoy about one and maybe even two Nuggets a day just by carving out a little bit of time.

0:32And then during that time, let your friends and family know that you are studying. I've also noticed that when people publicly commit to studying, for example 10 or 15 minutes a day, there's a little bit added pressure because they've committed to that publicly. So if you would like to commit to me publicly, either on Twitter or on Facebook-- and just post, I commit to 10 minutes a day or 15 minutes a day-- I will be right there rooting for you along with your friends and family who also want to see you succeed. Another big aspect is practicing hands-on.

1:03Now, as part of that, the good news is I walk you through how to build your own virtual lab so you can practice many of the techniques that we'll be learning. And as you practice hands-on, I would encourage you to be aware that you would never want to do anything illegal or unethical against any systems that you're not authorized to perform that type of activity on. So when you're practicing hands-on, especially with hacking tools, do it in a safe and legal environment. And again, I walk through how to build the labs in this class, but if you also want to go out and purchase labs separately, that's also an option as well.

1:36ECCouncil.org, if you go up to their website and purchase their labs, they call them iLabs for certified ethical hacker. So for a person who doesn't want to build their own virtualized environment, the iLabs are one solution to the problem of getting hands-on practice in a safe environment where you're not going to damage production systems. And the third secret of getting the most out of our time together is to enjoy the journey. Have fun. In every single Nugget, I had fun creating it with the intent that you and I would be going through it together, enjoying the content, and having a boatload of fun learning it.

2:09So that's the basic three elements-- schedule time, practice what you learn, and enjoy your time. So I'm keeping this intro really, really short so we can get right to the content, which starts in the next Nugget. So I'll see you there. Meanwhile, I hope this has been informative for you, and I'd like to thank you for viewing.

0:00I remember a friend telling me many, many years ago saying, Keith, the best way to really learn something is to actually get your hands dirty and do it. And you know what? He was absolutely right. Well, a big part for you and I as we go through this course together is to make sure that you get the hands-on practice that you deserve to have to really learn the content. And a great way of doing that is building your own hands-on lab. So in this Nugget, you and I get to take a look at some options we have in building a lab to provide that environment for hands-on practice. And, my friend, also equally important, to keep us out of trouble.

0:35So let's begin our discussion of a lab idea with a user, Bob. So Bob is sitting here at this computer right here. And he wants to start practicing, which by the way, is a great idea. However, it could be really bad news for Bob if he loads the tools those computer and start using them on this network, especially if Bob is not in charge of that network and doesn't have written permission to use the tools. So instead of using a live network that Bob is not responsible for and doesn't have permission for, here's another idea. Bob could create his own network, and then as part of his lab he can have other computers, including Kali Linux.

1:11And Kali Linux as a Linux distribution with tons and tons of attack tools pre-built into the distribution. Also in his test network, we might want to have some various Windows servers and also some Windows hosts. That might include windows. 7, Windows 8, Windows 10, et cetera. So up here I'll put WIN S. for servers and WIN H. for hosts. There's also some really cool machines out there that we can put on our network to test our attack tools, like Metasploitable, which has some open vulnerabilities ready to go, as well as OWASP BWA, which is the Broken Web Applications Project.

1:46So maybe we add another machine for the Metasploitable and another one for the Broken Web Applications Project from OWASP. And the challenge that Bob might very quickly realize is that, holy schneikers, where am I going to get all these different machines? And the great news is that most of these can be virtualized, so we don't have to have physical systems for each of them. What Bob could do is, he could go ahead and have his computer right here, this is Bob's PC. And Bob could be using an application called a hypervisor. One of the most popular hypervisors out there is from VMware, and it's a product called VMware Workstation.

2:20They also have an equivalent version or similar version for the Mac called Fusion, and there are other vendors' products as well. And what these hypervisors like VMware Workstation allows us to do is to create virtual machines on the same computer. Let's say this is the 192.168.1.0 network. What Bob could do is, he could create a Kali Linux box as a virtual machine, so I'll put k there for Kali. He could create virtual machines for Windows servers, Windows hosts. He could create a virtual machine for Metasploitable, and the list goes on.

2:51Now, here's the trick. If this is Bob's PC, and this is a production environment, we really don't, especially without permission, want to allow these virtual machines to have access to this network. So what we could do in VMware Workstation, and in other virtualization tools-- it's very similar-- we could create additional networks. In VMware Workstation, we can create VMNet1. So just think of VMNet1 as a separate, virtualized network, meaning it's separate from the physical adapter on Bob's PC. And then if we logically place the Linux box, and the Windows servers and/or hosts, and the Metasploitable box, and we connect all their virtual network adapters on those virtual machines to this VM Net 1, they could all talk to and work with each other, and we could keep that traffic isolated and off of the production network.

3:39Now, on the other hand, if this is Bob's home network, and he's totally in charge of it, and he wants to use this network as well, another option would be to, instead of using a VM Net 1, we could bridge each of those adapters from Metasploitable, from Windows, and from the Kali Linux box, over to that physical network. And if we did the bridging option, as opposed to assigning those VMs a separate network, then it's as if each of those virtual machines is directly connected to the same VLAN, which corresponds to the subnet. In my case, it's 192.168.1.0.

4:11And as an additional option, if Bob had two physical network interface cards-- so let's say this is the 192.168.1 network in and up here he's connected to the 10.2.2.0 2.0 network. So lets call this adapter down here adapter number one, and this one connected to the 10.2.2 network physical adapter number two. Bob could then make decisions on where he wants to connect the virtual machines. Does he want them to connect to the VMNET1 or some other virtualized network? Or does he want to bridge them to the network interface one or, or does he want to bring them to network interface two, or do we want to have multiple network adapters in these virtual machines?

4:42And I wanted to point out these options conceptually, because I want to make sure that you are not accidentally placing virtual machines, especially with attack tools that you plan on testing and working with, you do not want to have those actively working on networks where you're not authorized to use those tools. So as you and I go through these Nuggets together, I'm going to use the 192.168.1 network. That's my physical/wireless network that's all bridged together in my home office. And I'm going to bridge all of my virtual machines to that network. So as you build your lab environment, just be aware of whether or not you want to actually put those virtual machines on the real network that you're physically connected to or wirelessly connected to, versus connecting all your virtual machines to some virtualized network that's created instead of VMware Workstation.

5:27In this Nugget, we've taken a look at the concept of using virtualization to create our virtual machines that we can use as a test bed for our lab environment, as well the concepts of how we can make sure we're keeping that traffic and those virtual machines separate from any type of production or other networks that we're not authorized to use the tools on. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00In our Nugget regarding the building a lab concepts, we talked about connecting virtual machines to specific virtual networks. The question might be, how easy is that to configure inside of VMware workstation? And the answer is it's a piece of cake. So let's imagine that this is the host computer that's going to be running VMware workstation, which is acting as our hypervisor. And maybe this is Bob's PC. And it's connected to a physical network, which it could also be connected to a wireless network. It's going to be the same concept here. As part of VMware workstation, there's going to be multiple VMNETs.

0:34Now, whenever we see the concept or the word "VMNET", we can think to ourselves, that's a logical network. So VMNET1, VMNET2, VMNET3, et cetera, each of those represent a different logical network space, very similar to the concept of a VLAN, a separate network. And these VMNETs only exist logically as part of VMware workstation. Now, here's the cool part, how we can leverage those. When we deploy a virtual machine, as part of the configuration for that virtual machine, we can associate that virtual machine with a VMNET.

1:07So if we have one network adapter in the virtual machine, we could associate it, for example, with VMNET1. And then as part of being in VMNET1, we could associate VMNET1 with, for example, the 10.1.1.0 network, or any other IP addressing scheme that we want to choose to associate with VMNET1. And maybe VMNET2 is the 10.2.2.0 network. Again, it's up to us with what IP addresses we use on the machines that are connected to the respective VMNETs. Now for the physical network down here, it's 192.168.1.0.

1:41And maybe this is also VLAN 10. From the physical network's perspective, we would have the option of bridging the network adapter on the VM over to that physical network. Or if we had a VMNET-- let's take VMNET0-- and we had configured VMNET0 to be bridged to this physical network interface card, then if we associate the VM with VMNET0, its like algebra in high school. If a equals b and b equals c then a equals c. And how that applies here is that if this VM is associated with VMNET0 and VMNET0 is associated to be bridged with this physical network interface card, effectively this VM is on that same network, the 192.168.1, in our case.

2:21And one other item I'd like to share with you before we demo this is, what if we wanted Bob's PC to also take part in and play a role on the 10.1.1 network? One of the options we have when we work with the networking portion of VMware Workstation is to configure the host computer to have a logical virtual network interface card on one of these VMNETs. So we could configure VMNET1 to represent the 10.1.1 network. And if we check the box that says we want Bob's PC to also be present and participate on that network, we could check that box and Bob's PC would be given an IP address on that 10.1.1 network as part of VMNET1.

2:59We also have an option of being a DHCP server on a VMNET if we choose to. And those are in the controls of the VMware Workstation, which we're going to look at right now. So here on Bob's machine, I've launched VMware Workstation just to verify what version we're running. And I click on Help and go to About VMware Workstation from the dropdown. And what this reveals is that we're running VMware Workstation 12 pro, version 12.1. And if you're running version 11 or version 10 of VMware workstation, it's going to be very similar in its configuration.

3:30Now, to configure the networking, the VMNETs inside of VMware workstation, we're going to go up here to Edit. We're going to click on Edit. And then from the dropdown we're going to select the Virtual Network Editor. And here we can view the settings for the virtual networking. And if we want to change the settings, we need to click on this little button right here, which will allow us to change the settings. So we'll click on the Change Settings button right here. I have Windows User Account Control saying, are you sure you want to allow this to happen? I'm going to click on Yes. And now with VMNET0 highlighted, it's showing me that it's currently bridged to my network interface card.

4:06So down here, because the radio button for bridged is selected, also from this dropdown, if I have multiple network interface cards, I can control which network interface card on the host computer, Bob's PC, that VMNET0 is currently being bridged to. So I've got a pluggable network interface adapter that goes in a USB port. And I've also got the one that was built into the motherboard on the host computer that I'm using. So next let's click on VMNET1. And in my current configuration is configured as a host-only network. It's a logical network that's being created on this host that's running VMware workstation.

4:39And if we had three virtual machines and each of the virtual machines were connected logically to VMNET1, they could all talk to each other on that network. I've also identified what the subnet address range is going to be for that network. And the reason that's important is if we're going to also add a network interface card from Bob's PC, the host computer, by clicking this check box right here-- connect a host virtual adapter to this network-- and that would give this computer the IP address of 10.1.1.1 on the 10.1.1 network. And if we wanted VMware workstation to be a DHCP server to hand out IP addresses, we could click this check box and say use local DHCP service to hand out IP addresses to virtual machines.

5:19And another option is if we wanted to set up network address translation, we could click this radio button. And that would allow VMware workstation to act as a router to route the packets from the 10.1.1 subnetwork out to the physical network that it's connected to on its other interface. And then here's VMNET2, which is also just another logical network. And if we wanted to add a new network, we could click on Add Network. It's going to recommend VMNET3 as our next logical number. We can click on OK. It came up with some wacky address space it wants to use. If we want that to be 10.3.3.0, we could.

5:51And then we could decide whether or not we want to be a DHCP server for that logical network and whether or not we want to connect a network interface card from the host computer, Bob's PC, also to that network, which would be important if we want direct communication from this host computer to that VMNET. Or rather, I should say, to the devices in that VMNET. So if you need that interface, you check that box. If you don't, you can de-select it. And I'm going to click on Apply. Now the lab that we're going to build together as part of these Nuggets, I'm going to connect all my virtual machines directly to my physical/wireless network here in my home office.

6:25So to do that, I could associate the network interface cards of the virtual machines either with VMNET0, and that would do it, because it's bridged to my ethernet card. Or there's another option that says, please bridge the network interface card directly to the physical interface. And that would also have the same logical function. So I'm going to go ahead and click on OK here. And to demonstrate the connectivity, let's go to one of my virtual machines that I already have in place. Here's a Windows 8 machine, a virtual machine. So by clicking on this virtual machine here, it has the settings. And what we're focused on here is networking.

6:57So this shows that this virtual machine, its network adapter is connected to VMNET2. If we wanted to change that, we could go ahead and simply right click on this virtual machine. From the dropdown we'll go ahead and select Settings, down here near the bottom. And then for the network adapter, we would highlight that. And here's where you and I would specify where we want the virtual network interface card on that virtual machine, where we want that to connect. If we want it to connect to VMNET1, we would select VMNET1 from the dropdown. If we wanted to connect it to VMNET0, we'd click on or select VMNET0 from the dropdown.

7:30And in our case, in my current topology, VMNET0 is bridged to my ethernet adapter. And if the goal for you and I is to bridge this virtual machine's network card to our physical machine's network interface card, another way of doing that exact same logic is by clicking on the bridged option here, which says connect directly to the physical network. And then I usually replicate the physical network connection state to the virtual machine. And little interesting thing, see how we made that change here, but over here it still shows VMNET2? If we clicked on something else-- for example, let's click on processors-- that refreshes the screen.

8:03And now it shows that it's bridged. And if you have multiple network interface cards and you want to make sure you're bridging it to the right network interface card, it might be a good idea to go ahead and specify a VMNET0 which is bridged over to a specific network interface card. And that way you don't have to guess about which network it's connected to. So we'll say Custom VMNET0. And then we'll click over here somewhere else once more so it refreshes. And now once we click on OK and then we start that virtual machine, that virtual machine is now logically connected to the same network that the host computer-- in our example, Bob's computer-- is connected.

8:39So I'm going to leave that change and click on OK. In this Nugget, we've discussed and demonstrated how to work with VMware Workstation to control the networking and to associate which network a virtual machine is connected to. This will become really important as we start building virtual machines, which we'll do in our very next Nugget. So thanks for joining me. I hope this has been informative for you. And I'd like to thank you for viewing.

0:00It has been proven that it's really tough to use the features in Kali Linux if we don't have Kali Linux deployed. In this Nugget, you and I are going to walk through how simple it can be to download, deploy, and then snapshot a Kali Linux virtual machine. There's three basic steps in getting a virtual machine up and running in VMware Workstation. First of all, we need the software. So we can download the software. We can either download the virtual machine itself and just run it, or we can download an ISO and then install it into VMware Workstation as a virtual machine.

0:32Personally, I think the downloading of the VM is a lot faster, because we don't have to wait for the full install. And as a security note, we want to make sure that we are getting the actual Kali Linux distribution from a reliable source. And that would start by using one of these two sites and the links that are part of these two sites. Then, once we've downloaded it and deployed it as part of a VMware Workstation, we're going to configure networking for that virtual machine. In our lab environment, or specifically I should say in the lab environment that I'm going to demonstrate, I'm going to bridge the virtual network interface card of the Kali Linux box to my physical slash wireless network, which in my case is being represented by VM Net 0 in VMware Workstation's networking.

1:14I'm also going to go ahead and apply updates once I have internet connectivity to that Kali Linux box. I also want to point out that in my network environment, when I connect a virtual machine to my 192.169.1 subnet, there is a DACP server running on that network. So, if we want to, we can go ahead and either statically configure an IP address on this virtual machine, the Kali Linux box, or we can have it pick up an IP address via DACP. And my default gateway on this 192.168.1 network is a little router at .1.

1:47And then, once this virtual machine has been updated and it's current, we're then going to go into the VMware Workstation tools and we're going to create a snapshot. And the benefit, and the reason that I'm demonstrating it, is because we're going to want to make sure we have some snapshots that we can go back to if we need to at any given point in time. And this applies not only to our attack machine, in this case this can be our Kali Linux box, this is going to be delivering many of our attacks, but also to victims. So that way, if we want to hammer a machine, and then roll it back to its pre-hammered or pre-compromised state, if it's a virtual machine and we have a snapshot, we can roll back to that state in VMware Workstation.

2:24So here on the host that's going to be running VMware Workstation, let's go ahead and open up a browser. And let's to http://www.kali.org. And from here we can scroll down and simply click on download Kali Linux. It's then going to give us options for which image do we want to download. Here we have a bunch of ISO options, but if we want the VMware version, we just scroll down even further. And here are the links for Kali virtual images. So I'm going to click on Kali virtual images. In it, you'll notice up in the URL, it's now taking us to offensive-security.com.

2:57And so from here, we can follow the links for downloading the VMware version of Kali Linux. Or if we'd gone here originally to offensive-security.com, we'd go to the main page. From here, we could go to projects, so I'll click on projects, and then there's a link for Kali Linux. So go ahead and click on Kali Linux over here. And you'll notice we're once again brought to the downloads area. And their website over time may change a little bit, but the key is we want to make sure we download the Kali Linux image from the reliable source. And that reliable source is offensive-security.com.

3:29So if we scroll down just a little bit, currently we have the prebuilt Kali Linux VMware images selected. And then we can download the 64-bit or the 32-bit flavor. So let's go ahead and click on the 64-bit VM. That's the one I want to install as part of our lab. So I'll go ahead and click on that. And also as that's downloading, it also has, right here, a SHA-1 checksum. And we can use that SHA-1 checksum to validate that the image that we downloaded is the actual, literal image. It's not a tampered or modified version. And the documentation on Offensive Security's site has the details, depending on what platform you're downloading it to, on how to use that checksum to verify that.

4:05But there's a great chance that if you are using HTTPS and you're at the right site, you're getting an untampered with download. So in the bottom here, it says it's about 2 gigs. It says it's almost downloaded completely. That's great. And then what we do is we go to that file. We'd unzip it, because this is going to be a compressed file that we downloaded. So if we go to our downloads folder on this computer, there's the Kali Linux image and it is compressed. So it needs something that can decompress that. On this computer, I also have a decompress tool called Win7 Zip that I downloaded from SourceForge for free that's able to go ahead and decompress that.

4:41If we open up a new browser and we did a Google search for Win7 Zip and we typed in site:sourceforge.not, it's going to show us the Win7 Zip Zip results, but only for SourceForge.net. So here's one right here. We'll click on that. We also want to verify that we have HTTPS, we're going to the right location, and then we click right here, and that would download the 7 Zip utility for us so that we could then use, as one of many archive utilities, to decompress our Kali File we downloaded a moment earlier.

5:12So, I've already got 7-Zip installed on this computer. So because it's installed, it's already associated with .7z extension. I'll click on extract, and then it's going to ask me, where do I want to extract these files to? So, I'm going to select a location I have already set up on my X drive, which is a solid state drive. I'll navigate to that location, and I'll go ahead and click on OK to extract, and that will extract the contents of that download we did over to this folder. And that's going to be our virtual machine for Kali Linux. And now, through the magic of editing, that happened really, really fast.

5:44So the next thing we're going to do is we're going to go ahead and double click on the configuration file for that virtual machine from the file system. So we'll go to the file system on the X drive, go to the Kali Linux folder, and here is the VMX file. And because I have VMware Workstation installed on this computer, that .vmx is associated with VMware Workstation. So what we're going to do is just double click on that virtual machine, and that adds it into VMware Workstation. Now, before we launch this, we need to make sure we get the networking set up correctly. So, for this virtual machine, it's got two gigs of memory.

6:16It's got two processors. It's got a 30 gig hard disk. And for the network adapter, it's currently set up to use network address translation, and what we want to do, at least in my lab environment, I'm going to go ahead and bridge that directly to the same network that the host computer, the Windows 8 machine, that it's connected to. And we could do that either by bridging it or linking it to VM NET Zero, which is bridged to my physical interface on the host computer. So I'll go ahead and click on the network adapter. That brings up the settings for this virtual machine, and let's specify that we want to go ahead and associate the network adapter with VM NET Zero, which is bridged to my ethernet interface on the physical host machine.

6:54Also, because I'm not going to need a sound card at all, I'm going to go ahead and remove that while I'm here. And because I've got a few cores on the host machine, I'm also going to modify the processors and I'm going give it two cores on two processors. And while I'm at it, because I do have a little bit more memory, I'm going to go ahead and give this guy four gigs of RAM, too. So a little more memory, a little more CPU, but if you're in a limited environment, you don't have a lot of CPU and memory to spare, you don't have to raise them up. But I do want to show you everything that I'm doing, in the event that you want to replicate it. So we'll go ahead and click on OK.

7:26So our next step would be to start the machines. We could right click it and go to power and then click on startup guest, or we can click on this green arrow, or that green arrow, it all does the same thing, starts up the virtual machine. So let's start with the guest. It's saying, hey, this machine may have been moved or copied, and I'm simply going to say say, moved. That way it's not going to mess with the layer two ethernet address or anything else like that. And then it's just going to go ahead and boot up this virtual machine, including bringing us to a graphical user interface. So we'll go ahead and click here to put the cursor control in this field, and we'll type in root as the username, and the default password is the word root backwards.

8:02So it's toor. So the user is root and the default password is toor. And then we'll go ahead and press enter to sign in. In VMware Workstation, I can also click on this icon right here, and that will enter fullscreen mode, which gives the full real estate of the screen to that virtual machine. To get that control back, we can take the mouse, hover near the top of it, that brings down the menu again. We can click on the full screen option. That would undo that feature. So, for now, I'm going to leave it full screen. Now, to verify the IP address that this machine has, there's a few ways we can do it.

8:35Number one, we can use the graphical user interface. Number two, we could go to a command line, or three, we could bring up a browser and just see if it actually works. So, let's start off with the command line interface first. We'll bring up a terminal. We'll click over here on the icon for terminal. And we'll type in F and press enter. And this reveals that we have the IP address of 192.168.1.26, which implies we got that from a DHCP server. In fact, let me make this window a little bit bigger so we don't have a wrapping issue. So I'll scroll that over there and just bring that over a little bit.

9:06There we go. Or, if we want to look at the IP information from a graphical user interface here in Kali Linux, we can click on this little networking icon right here. From the dropdown, we can select wired connection, click on that. And then go to wired settings. Here we have the wired connection highlighted. We can click on the little gear icon in the bottom right hand corner, and here it's showing us the details. So we've got a gigabit interface. There is its IP address. It also has an IP v-6 address. There's the layer 2 address. And the default gateway is set up as 191.168.1.1.

9:39And it's also using 192.168.1.1 as a DNS server. So I've got this router on my 192.168.1 network, it's at .1. And that router is acting both as a default gateway, it's also providing DNS services, or at least relaying those DNS requests, for clients who make DNS requests to the router. So those all look great, so we'll go ahead and click on cancel because we're not going to change anything there. And we could also do a quick ping just to verify that we can reach, for example, something on the internet. We'll have pinged 8.8.8.8.

10:11That's one of Google's servers. We'll click on control-c to stop that. We can also do a trace route out to 8.8.8.8, and that will verify the path that we're taking, or attempting to take, out to the internet. So those parts look great. So now that we have connectivity out the internet, the other thing we want to do is update this distribution of Kali Linux. And to do that, we're going to type in apt-get update and press enter. And that's going to chew on that for a little while. Fantastic. And when that's done, we're going to do in apt-get dist-upgrade.

10:50Now, this is going to prompt us to continue. It's going to use the additional space. I'll go ahead and put in a y for yes. Press enter. It's also going to prompt for additional confirmations about stopping and restarting services. So effectively, we're just going to want to say yes to everything until the entire process finishes. And this could take up to a half hour or more depending on your CPU, and your processor, and your internet connection involved. And due to the magic of editing, what you and I get to do is I'm going to fast forward until all of this is done so we can continue on with the final step, and that is to take a snapshot of the freshly updated Kali Linux box.

11:26So, back at Kali Linux, I'll go head press enter to enter my password for root, which I haven't changed yet, so it's still toor. We'll press Enter. And that confirms for us that the update is done. So, next, what I'm going to do is we're going to go ahead and close that window. And I'm also going to shut down Kali Linux. I'm going to go to the power button up here. And from the drop down, go to the power icon and select power off. Whenever we do a snapshot, it's best for timelines if we have the virtual machine powered off and take a snapshot of that machine in a powered off state.

11:58It will save you a boatload of time and disk space. I'm going to go ahead and go up here and take it non full screen. Actually, it's in the process of powering off still. And as soon as the little green arrow is no longer here, that virtual machine will be powered off. So now that that virtual machine is powered off, let's right click on it. And to make a snapshot, we can go down here to snapshot. Click on take a snapshot. So we can take a snapshot by clicking here from the side mini, menu, or there's also a shortcut, same icon, right here that we could create a snapshot with.

12:30Or, if we wanted to the Snapshot Manager, which we'll do in a moment, we could either use this option, or there's also a little shortcut up here as well. Let's go ahead and take a snapshot, and then call this Kalie right after initial update, and you can put a description there if you want to, and click on take snapshot. And because it's powered off, it doesn't have to take a snapshot of the entire memory state. Which, if we had a virtual machine that was running, we'd have to back up all that memory state as well, and that would take a lot more disk space and a lot more time. So now, in the future, if we ever want to go back to this exact state, we could right click on that virtual machine, from the dropdown, select snapshot.

13:05I like to get a Snapshot Manager so I can see exactly what my snapshots are. We can click on that snapshot, and then click on go to. And that would rollback any changes past that snapshot back to that exact moment in time. And then, as we progress through the course, and as you progress through your lab, you can delete the snapshots that are older, because you'll no longer need them. But I always like to have at least one snapshot of the previous state so I can roll back to that spot if I need to. In this Nugget, we've downloaded, deployed, and updated a Kali Linux box as one of our tools in our arsenal and our virtual lab environment.

13:41As homework, I would strongly encourage you to build your own practice lab and practice virtually everything that you see us do together in class. Practice it on your own as well to help reinforce those skills. Hey, I'm glad you joined me for this Nugget. I hope this has been informative for you, and I'd like to thank you for viewing.

0:00In a love environment, we are going to want several machines that we can work with, both as attack machines and also victims, the machines we're going to attempt to discover and potentially compromise. So in addition to machines that may be fully patched and ready to go, we also want to stack the deck and make sure we have some machines that are fairly easy to exploit as well so we can see some measurable results with our tools. One of those tools that we can use is a virtual machine called Metasploitable. Now, Metasploit is a fascinating attack tool, a suite of tools, actually, that we're going to cover in more detail in this course.

0:33And now, in preparation for that, we're going to download a virtual machine for Metasploitable 2 and make it part of our lab. So there's two basic steps. Number one, we want to download it from Sourceforge.net, we want to configure it to put it on the right network, and then make sure it's up and running, and we'll also snapshot it so we can restore it back to its original state if we need to. Let's download Metasploitable 2. And one easy way of doing that is to type in Metasploitable 2, and I'm also going to narrow it down to the site where we want to download it from.

1:04And I'm going to type in site:sourceforge.net sourceforge.net and press Enter. As we do this narrowing down to a certain site, if you think that's a pretty cool tool inside of Google, oh, my gosh, there are so many cool quote unquote, hacks that we can do as part of Google searches, and we'll have separate Nuggets just on that. And here, my friend, is the download that we want to get right now. It's Metasploitable 2 at sourceforge.net, so we'll go ahead and click on this link. We can also see up here that we have https in use.

1:35We're at SourceForge.net. Those are all good indicators. There's a read-me dot txt file along with the actual downloaded zip file, and I'm just going to click on this link right here for the latest version. So we'll click on Download, and it is on its way right here. So Metasploitable is a flavor of Ubuntu Linux that intentionally contains many vulnerabilities, and so is great for testing and verifying that our tools are working. And once again, it's just nice to have a little bit of low-hanging fruit in our lab environment so we can readily verify our tools.

2:07Also, we might want to throw in some older windows machines. For example, if you throw in Windows XP, that has tons and tons of vulnerabilities built in if you don't apply the updates and patches. Windows 8, without the updates and patches, has lots of vulnerabilities as well. Windows Server 2003, Windows Server 2012, without the updates and patches, has many, many vulnerabilities as well. And so here's the downloaded .zip file for Metasploitable Version 2.0, and I have it sitting in a folder on my file system, and I'm going to go ahead and unzip this file, and then we'll deploy that virtual machine.

2:42So after I do that, I'm going to right click. I'm going to select Extract All, this using the Windows native unzip tool. And then I'm going to browse to the location where I want to put this VM. I'm going to select that, and then we'll click on Make New Folder. And we'll call this Metasploitable 2 as the destination folder for the unzipping, and we'll click on OK. And then we'll go ahead and click on Extract to start the extraction process. So now that that's done, let's go into that folder. Here's the VMX file, the descriptor file, for that virtual machine.

3:13We'll go ahead and double click on it. And on my host computer, because I have VMware Workstation installed, that virtual machine now shows up here. Now, before we fire up this bad boy, let's also configure the networking portion of it. So with the Metasploitable VM selected, we'll go over here to the network adapter. Click on it. That brings up the VM settings, and let's go out and also put the network adapter on VM net zero, which is bridged over to my physical slash wireless network, which is the 192.168.1 subnet.

3:45And we'll click on OK. And also, just to make sure it's working, let's go ahead and selected it, and we'll power on that virtual machine by clicking one of the green arrows that shows up here with that machine selected. So we'll power it on. I just want to verify that it comes up. It's asking me, did I copy it, or did I move it? I'm going to say I moved it, and that way it won't attempt to change layer 2 information for the ethernet adapter and so forth. So it's now booting up, and an indicate tray here if we want to log on. And we log on with the username of msfadmin, and the password of msfadmin to get started.

4:19So let's log in to make sure we're good to go. So we'll log in as msfadmin with the password of msfadmin. And here it's giving us a heads up in Ubuntu of how we're going to run an application as an administrator using the sudo command. And we'll include additional tips and tricks and basic functionality regarding Linux commands as we continue through this course. So just to verify our IP information, if we do an ifconfig here and press Enter, look at that. That looks pretty good. We have an IPv4 address of .61 that we picked up from my DHCP server on the 192.168.1 subnet, and we have an IPv6 address as well, which I'm not using in my network.

4:55And it's also pretty helpful, from an attack perspective. If a customer or host has a protocol stack running, like IPv6, they don't even know it's running or aren't aware that it's running. That's just another attack vector that we can use to go ahead and discover and potentially compromise that virtual machine or that host. And just for grins, let's do a ping of www.Google.com, and that's going to verify several things for us. Oh, that's great. I'll do a control-C to stop that. That verifies that name resolution is working, DNS, because it translated Google.com over to this IP address.

5:27And because the pings are successful, it's also indicating that we have internet connectivity through the router that's sitting at 192.168.1.1. That's fantastic. One other thing I'd love to do is go ahead and power off this virtual machine and then take a snapshot in VMware Workstation if we need to return to this state. Now, currently my mouse and cursor are kind of stuck inside of this virtual machine. To get it out over here to the console and to the controls in the Windows host computer, we can do a Control Alt on the keyboard, and that should release our mouse.

5:58Also, the fact that it doesn't release the mouse automatically is a good indicator that VMware Tools is not installed as part of this virtual machine. So if you're working with some virtual machines, and you take your mouse, and you move it from here, for example, and you move it over here, and it just goes and goes between console and the host computer no problem, that's because the virtual machine has a thing called VMware Tools installed as part of that virtual machine. Also, if we have VMware Tools as part of a virtual machine, if we right click on that virtual machine, and go to power, and select Shut Down Guest, that will perform a graceful shutdown of that virtual machine courtesy of the VMware tools that's facilitating that shut down.

6:35However, in an environment where the virtue machine does not have VMware tools, the Shut Down Guest is pretty much the equivalent of a Power Off, where you're just cutting the power to the virtual machine. And it's really not a good idea to just pull the power from a system, including a virtual machine, because it could leave files and configurations in an unknown state. So in the event, like on this Metasploitable 2 virtual machine, where it doesn't have VMware Tools installed, the proper thing to do before we snapshot this virtual machine would be to gracefully shut it down.

7:06And to do that, here in this Ubuntu flavor of Linux, we can type in sudo-- that allows us to run commands as an administrator-- and the command Power Off, and press Enter. It's going to ask us for the password for msfadmin, so we'll supply it. It is msfadmin. We'll press Enter, and that's going to go ahead and stop all the services and shut down the power, or at least that's what I hope it's going to do. On some flavors of Linux, you can use the command shutdown dash H for halt, or shut down dash P for Power Off, capital P, and also schedule a time when you want it to happen.

7:39So for example, if you wanted to shut down now, you can use the command shut down dash H space now, and that would give us similar results as we have right here. Now, the concerning part, just a little bit, I see that everything's been shut down and stopped, 0 and the system's been halted, which is great. But if you notice up here, from a VMware Workstation perspective, VMware Workstation still thinks that VM is running. So because the virtual machine itself thinks it's all halted and powered off, we could now safely go over here to VMware Workstation, go to the Power menu, and simply say Shut Down Guest.

8:10And we're not at risk of having open files and half-baked configurations on that virtual machine because it logically shut itself down. I would feel better if VMware Workstation also felt that that VM was off by itself, but sometimes we have to take what we can get. So now, with this virtual machine powered off, I'm going to go ahead and go up to the Snapshot Manager, which is this icon right here, or we could right click, and from the snapshot menu, we could go to Snapshot Manager. And I'm going to go ahead and take a snapshot. So to take a snapshot, we'll click on Take Snapshot.

8:42And let's title this before hacks and attacks. And we could also put in the description other details regarding what this snapshot represents, and that way we can go back to it if we want to. So we'll go ahead and click on Take Snapshot, and now we have that snapshot right here, and we'll close that dialog window. In this Nugget, we've downloaded and deployed Metasploitable as a virtual machine that we can leverage and use as part of our lab environment. We specified in the networking details where we wanted that virtual machine to connect to.

9:12In our case, I connected it to my 192.168.1 network through the logical VMnet0 network connection in VMware Workstation, and we also powered off that virtual machine, and we made a snapshot of it in VM Workstation. And, my friend, my intention is for you to also include this virtual machine as part of your lab. So that way, when we're working through the labs together, and we're doing attacks, and discovery, and reconnaissance, you can have the benefit of not only seeing it happen but also doing the hands-on practice right alongside me.

9:43I'm glad you joined me for this Nugget, I hope this has been informative for you, and I'd like to thank you for viewing.

0:00Is it possible that we might want to have some Windows devices as part of our lab? And the answer is a resounding yes. And those can be physical machines that are in Windows, or virtual machines, or both. In this Nugget, we'll take a look at integrating and documenting what VMs and real Windows machines we have and making sure we have good snapshots of any windows based VMs. The idea I'd like to chat with you about regarding this Nugget and adding Windows to your live environment is one word, and that is options.

0:31For example, if we have an existing computer network, and it could be wireless or wired, and we have a computer on that network that's running Windows, that computer can be part of your lab environment for the purposes of testing as a potential victim, or if you want to use it to launch attacks. You could do that as well from the Windows operating system itself by using some native tools that are part of Windows or by downloading and installing tools in the Windows OS. Now, if this is our Windows computer in our example that's Windows 8 and it's a physical machine, let's put some documentation in place for getting what IP addresses we're going to use.

1:05So for the Windows 8 computers that's on the 192.168.1 network, let's say its IP address is .200. Now, one word of caution, if we're going to run attack tools from a virtual machine against this Windows computer that's hosting our virtualized environment, we definitely want to be careful about not taking down this computer because if the machine crashes and it happens to be running VMR Workstation, we have other VMs running inside of it, that's going to cause a bigger problem as part of our lab. So we might want to reserve the machine that's running VMR Workstation as a machine we are not going to try to compromise, but instead only launch attacks from this machine and the physical interface using the IP address of .200 on the 192.168.1 network.

1:49I've also got another physical computer that's running Windows, and it's actually running Windows 10. And what I'd like use for the IP address on it is .201. Also, each of those computers are using the default gateway of .1. That's my router. Now, as far as other additional Windows machines we might want to bring in, I also have a virtual machine running Windows 8 that's running in VMR Workstation that's running as Windows host. So I've got another copy of Windows 8 as a VM on this machine. And let's say we want that virtual machine to have the IP address of .199.

2:23We would just configure the network interface card of this virtual machine to be either bridged to the physical interface or we could link it to a VM Net 0 if VM Net 0 is bridged to the physical interface. Both of those concepts we've talked about in previous Nuggets in this course. On the other hand, if we were trying to keep these VMs completely separate from our physical network we could associate them with VM Net 1 or VM Net 2 and not perform NAT services instead of VMR Workstation. And that would keep those virtual machines off of our production or the network that you don't want them to be on.

2:57I also got another Windows device as a virtual machine and it is a Windows 2012 server. And it's at the IP address of .111. And that Windows 2012 server has lots of services running, including DNS, web services, directory services, and others. So what we could do if we wanted to, we could have all these Windows machines as part of our lab environment, physical and virtual, we could have them point to .111 for DNS services. And then if DNS is configured and working on that 2012 server, and the server's running and available, it can perform DNS services.

3:32We could also configure a backup for DNS as 8.8.8.8, which is a Google DNS server out on the internet, so that way if, for whatever reason, DNS isn't configured, or that virtual machine-- the Windows 2012 server-- is not up and running, the host will have a fallback to go to an alternate DNS server of 8.8.8.8. So as a summary, it's going to look like this. Also what we'd want to do on our virtual machines, this guy and this guy, is once they're configured, we'd want to power them down and then make a snapshot so that we can return to that state in the future, if we ever need to.

4:09So here on my Windows host computer that's running VMware workstation, let me just check out my two VMs, one for Windows 8 as a VM, and also the one for Windows Server. So let's verify the network connections. For Windows 8, it shows us that the network adapter is connected to VMnet0, which in my case is bridging to my wired/wireless wireless 192.168.1 network, which is great. And the active directory virtual machine, if we click on that, has lots of network adapters.

4:41But at least one of those is connected to VMnet0. Also when I mentioned that VMnet0 is bridged over, as a reminder of how that works, if we go to Edit and select from the dropdown Virtual Network Editor, and click on Change Settings, and click on Yes for User Account Control, here it shows us that VMnet0 is bridged over to my ethernet adapter. Now just so you know, the ethernet adapter, which is a wired connection from this host, connects to the 192.168.1 network. Also, what you should be aware of is that that same network is also connected to a wireless network here at my home office.

5:18So effectively, anybody connect to the 192.168.1 network, whether they're connected via wireless here in my home office, or whether they're directly connected with a wired connection, are all on that same layer two broadcast domain. And we'll bring up the Windows 8 machine by clicking on Start. And we'll click on the active directory Windows 2012 server, and click on Start. And I just want to verify the IP addresses, the default gateway, as well as the DNS configuration on each of those. So let's go to Windows 8. I'll go ahead and log in.

5:48So I'll log in as a user called user. And let's go to full screen by clicking on this little icon right here for full screen mode. And we'll click on the networking icon, and click on Open Network and Sharing, and Change Adapter settings. And here's our network adapter. We'll right click, go to Properties, we're going to go down to IP version 4, double click on it, and we want this virtual machine to have the IP address of .199. So let's go ahead and change that to 199.

6:21Default gateway is 1.1. The preferred DNS server is .111, which is our VM for the Windows 2012 server, and the alternate DNS is 8.8.8.8. That looks great. We'll click on OK, click on OK, close the dialog boxes for Control Panel. And let's just do a quick ping out to the internet, just to verify we have connectivity. So we'll ping www.google.com And if that works, that means DNS is working. It also implies that we have internet connectivity, which is great. So let's go ahead and shut down this VM, this Windows 8 computer, using the Windows 8 methodology for doing that.

6:56And that'll gracefully shut down. Then we'll go back, we'll take off full screen mode, and we'll go to our Active Directory virtual machine. We'll go to full screen mode, and we'll log in here to verify its IP address as well. So to log in here, it says Control Alt Delete. That would be if it wasn't a virtual machine. Because this Windows computer is a virtual machine inside a VMware workstation, we're going to press Control Alt Insert, and that will go ahead and allow us to log on. So we'll log on as administrator with my lab password. And there's several ways of verifying the IP address here.

7:27We could go to the properties of the network adapters. That would work. Or we could go to local server. And here it shows me that I've got my first network interface card labelled as management with the IP address of 192.168.1.111. We could also right click on the network adapter, go to Open Network and Sharing Center, Change Adapter Settings, and then look at the details of that interface as well by going to properties, double clicking on IP version four, and verifying the details here. So here's our IP address.

7:58There's the default gateway. The preferred DNS server is a loop-back address, which is the Windows 2012 server saying, hey, I am my own DNS server, and if I can't reach my own DNS service, I'm going to try a Google DNS server at 8.8.8.8. So that all looks great. So we'll click on Cancel, close the dialog boxes. So let's go to Command Prompt and just verify we have basic connectivity. So I'm going to type in CMD, and let's do a ping out to www.google.com. And that is working as well. So that is great. And we'll shut down this puppy as well.

8:29So to do that, I'm going to click on the Windows icon, and the Power icon, and Shut Down, and Continue, and that will gracefully close that down. Now, because VMware Tools is installed on this Windows 2012 server, I could have also just gone in VMware workstation, right clicked on that active directory server and clicked on Power, selected Shutdown Guest, and that also would have gracefully shut it down because I have VMware Tools installed. So then now what I want to do is make snapshots of each one of those. So to take a snapshot, we can go to Windows 8. First of all, right click.

9:00And if we want to remove full screen mode, we can do that, too. I'll go up here, take off full screen mode if we want to have the toolbar up here as well. However, the right click also works. So we'll go to Windows 8, right click. We'll go to Snapshot and Snapshot Manager. And I'm going to go ahead and remove-- I'm going to delete my old snapshot by clicking on Delete. And then click on Take Snapshot. I'm going to call this Basecamp, just to represent a time and space before we started compromising or messing with this virtual machine from an attack perspective.

9:34So we'll take that snapshot, we'll click on close, and we'll do the same thing with active directory, that Windows 2012 server. Right-click, Snapshot, Snapshot Manager, we'll delete the old snapshot, click on Delete. Then we'll click on take snapshot, and we'll call this Basecamp as well. And click on Take Snapshot. I would also encourage you not to keep multiple snapshots of the same virtual machine. It's going to eat up a lot of space. And if you don't have a lot of disk space, that's a problem. So usually, as I'm building the labs, I'll keep the single previous snapshot.

10:06So I'll delete the old one, I'll create a new one, and then I'll move forward. Then, at any time we want to, we can roll back to that snapshot that we have saved in VMware workstation. So that looks great. And now, let's go ahead and check the IP addresses for our two physical hosts, as well. The first physical host is the Windows 8 computer that's running VMware workstation. So if we want to verify its IP address and information, we can right-click on the network icon, open Network and Sharing Center, click on Change Adapter Settings. Here's our physical network interface card. We'll right click, go to Properties, we'll scroll down, we'll double click on IPv4.

10:41There's its IP address of .200. The default gateway looks good. The primary DNS server looks good. And these secondary or alternate DNS servers, we're going to change to 8.8.8.8. And click on OK, and OK again. So that looks good. And the last physical computer I need to check is my Windows 10 computer. So my Windows 10 computer, let's go to Network and Sharing Center, Change Adapter settings-- so this computer has a wireless adapter that's currently disabled. It's got some VMware adapters, as well, because it also has VMware workstation installed on it.

11:17And it also has a pluggable gigabit ethernet adapter that's in a USB port on this computer that happens to be the only one that's currently connected to the physical network. So we'll right click on the pluggable, go to Properties, scroll down to IPv4, we'll double-click on that. And it has the IP address .201, that looks good. The default gateway is .1. The primary DNS server is our Active Directory Windows 2012 server, .111. And the alternate DNS server is 8.8.8.8, which looks perfect. So I'm going to click on Cancel, because I'm not changing anything there.

11:48I just want to verify all the IP addresses that are in place on our four Windows computers, two of which are virtualized, and two of which are physical computers. The other thing I wanted to point out-- and I almost forgot-- was that if we want our physical Windows computer, which is running VMware workstation, to participate in VMnet1, or VMnet2, or some other virtualized network it's created, we'd simply go the Properties of Networking. In fact, let's do that real quick. So here's the Windows physical computer. We'll go to VMware workstation.

12:18And in VMware workstation, we'll go to Edit. And select from the dropdown Virtual Network Editor, click on Change Settings, click on Yes for User Account Control. And if we wanted this host, for example, to have a logical interface on the VMnet1 network, with VMnet1 selected, we'd come down here and check the check box that says connect a host virtual network adapter to this network. And then we would have a new virtual interface on the host computer that could then communicate with other devices that are also connected to the virtual 10.1.1 virtual network inside of VMware workstation.

12:50Now in my lab environment, I'm not going to actually connect a host to VMnet1, because we're actually bridging everything over to my 192.168.1 network. But I wanted to remind you that if you are using, for example, VMnet1 or VMnet2 and you want direct connectivity to those logical networks, this is how you do it-- by adding a logical adapter, a virtual adapter, to the host computer that's running VMware workstation. So in this Nugget, we've taken a look at four Windows computers. We documented what their IP addresses are going to be. We verified those IP addresses along with the default gateway and DNS information that each of them can use.

13:24And, for the virtual machines, we powered them down gracefully. We also took snapshots of those so that you and I can return to those snapshots of those VMs if we need to. And that can be very handy in the event we try an attack and it maybe works too well and we cause a virtual machine to go toes up. We're like, oh [BLEEP],, did that really happen? If we have a snapshot, we can restore back to the previous state before the attack. And that can help a virtual machine be ready, once again, for the next attack without being crippled before it starts. Hey I'm glad you joined me for this Nugget.

13:55I hope this has been informative for you. And I'd like to thank you for viewing.

0:01We may decide for a couple of different reasons to set a static IP address on our Kali Linux box as opposed to using DHCP. Number one, it's handy in a learning environment to know exactly what the IP address is that you're using. And secondly, if we're doing a penetration test, we probably don't want the first thing that comes out of our Kali Linux box is a DHCP request to the network it's trying to investigate trying to find an IP address. In either case, the basic steps in getting an IP address set up are to number one, identify what IP address we want to use.

0:32And in our case, we're going to use the IP address of 192.168.1.109, and we'll specify a default gateway of .1, and a DNS server of .111, and also backup DNS server of 8.8.8.8. And then once we have it configured, we'll test it. And we'll also take a moment to create a VMware snapshot of that virtual machine. So let's power up our Kali Linux virtual machine inside of VMware workstation by clicking on the Go icon, and then we'll click on the expand to full screen option right here.

1:03And we'll log in as root with the default password of T-O-O-R, and press Enter. Now there are a couple of different ways that we could use to change the IP information statically on this Kali box. We could go to the command line and get a text editor and find the files. The files involved would be if we go the file system and do a PWD, which stands for Present Working Directory, and we change directory over to /etc/network, and press Enter.

1:33And then use command ls to list the contents of this directory, this file right here, interfaces, we could go ahead and edit that with a text editor of our choice. And that's one way of configuring the IP address information for this Linux box. Or we could go ahead, since we have a graphical user interface right here, we could click on the Network icon up here in the upper right hand corner. From the drop down, we could select Wired Connection. And then further, we could go down to Wired Settings. And with the Wired Connection highlighted, we could click on the Configure symbol in the bottom right hand corner to configure those settings.

2:06If we wanted to have a static IP address, we could go ahead and specify that we don't want to use DHCP, we want to have a manually configured IP address. Then we can put in the IP address that we want to use. And in our case, what we want to use is we're going to use .109 for this Kali Linux box. It's got a 24-bit mask. So we'll put that in as well. And the default gateway is going to be my router at 192.168.1.1. For the DNS information, we're going have you use the server at 192.168.1.111, and we're going to add a backup of 8.8.8.8 which is a Google server on the internet.

2:40Then we click on Apply. And then we go ahead and close this. I'm going to use the ifconfig command, and we'll specify eth0, and we'll simply say down. We'll give it a second to bring itself down. And when it comes back up, it should be using the new information that we just configured for it. So hit the up arrow key and back off the down, and we'll type in up, and press Enter. Now we type in ifconfig and press Enter. Here's our IP address that we just statically configured. And if you do a ping out to www.google.com, this should verify whether or not DNS is working as well.

3:15It's internet connectivity. And the rest-- the reason that it's very likely taking a little bit longer is that the primary DNS server at .111, the Windows 2012 server in my virtualized environment, is not up. It's powered off at the moment. So it timed out. It went to the Google DNS server to do the name resolution. So we're going to do a Control-C to stop that. And now we have statically configured the IP address on our Kali Linux box as 192.168.1.109. I hope this has been informative for you, and I'd like to thank you for viewing.