Metasploitable 2 Lab - The IT governance and compliance needs of businesses vary widely. For small PDF

Preview

Summary

The IT governance and compliance needs of businesses vary widely. For small businesses, IT governance is often an informal process for the management of services that support the business. For larger companies, IT governance is a framework – a significant set of policies, procedures, and controls – ...

Description

CYB 205 Software Foundations for Cybersecurity Kali Linux and Metasploitable2 Lab for VirtualBox

For this lab, three major components are required: • • •

VirtualBox virtualization software A Kali Linux virtual machine (which should have been installed previously) Metasploitable2 virtual machine

The Metasploitable2 virtual machine (VM) is a Linux virtual machine purposely designed with security flaws to demonstrate vulnerabilities and tools used to exploit them. This lab will cover installation of Metaspolitable2 with VMware and VirtualBox applications. Metasploitable2 Installation 1. Navigate to https://sourceforge.net/projects/metasploitable/files/Metasploitable2/download the preconfigured Metasploitable2 VM and note your download location.

2. The downloaded folder contains the zipped files and need to be extracted for use. Extract or unzip the folder using your preferred method to the same location as the zipped folder for simplicity.

1

unzipped

zipped 3. Open the VirtualBox application. 4. Click the “New” icon to create a new VM. When the dialog box appears, fill out the information as seen below and click “Next.”

5. Adjust your memory size if desired. This application does not need a lot of memory to run and the default is fine. For this screenshot, the user chose 2GB (2048MB). Click “Next” to continue the installation.

2

6. Select the “Use an existing virtual hard disk file.” Click the folder on the right side and navigate to the “VMDK” file extracted in Step 2, select it and click “open”. Click the “Create” button to continue the installation.

3

1

2

4

5 7. The Metasploitable2 VM should now show up in the list of VM’s within VirtualBox.

8. Before powering on the Metasploitable2 VM, network settings must be configured. Since this VM is plagued with vulnerabilities, it is NOT advisable to allow this VM access to the internet. Select the VM and then select the “Settings” button to configure network settings. 3

9. When the “Settings” dialog box appears, select the “Network” icon on the left. Under “Adapter 1” ensure the “Enable Network Adapter” is selected. Set the “Attached to” dropdown to “Internal Network.”

10. After “Internal Network” has been selected, the default network name of “intnet” can be used or a custom internal network name can be created by typing a name in the “Name” field. The user in the screenshot named their “Internal Network” USA. Once completed select “OK.”

4

11. Now select the Metasploitable2 machine and power on the virtual machine.

5

12. Wait for the VM to fully boot. Once booted, the Metasploitable Logo appears. You may have to click inside the VM a couple of times to see the “Metasploitable login” after a successful boot. To login to the VM, enter the default login “msfadmin” all lowercase and press “enter.” The default password is “msfadmin” all lower case, type the password and press “enter.”

13. After a successful login, the user is presented with a command prompt.

******************************IMPORTANT************************************ When working inside the VM, you may lose the cursor, DO NOT PANIC! To regain access to the cursor simply press the “Ctrl” and the “Alt” keys at the same time. Move the mouse around to find its location. Also, if your Metasploitable2 VM screen goes blank, click inside the VM and press the spacebar. This should wake-up the VM. Do not worry about the small screen size. Not much time will be spent in this VM after it has been configured. 14. It is now time to configure the Metasploitable2 VM to be accessed by Kali Linux (and vice versa) by imputing our network address. Clear the terminal by typing “clear.” This will get rid of all the default syntax on the screen. To see the current network configurations, type “ifconfig -a” (this command is “ifconfig” (space) “-a”) and note all the Ethernet settings. The network interface “eth0” needs to be configured with a valid IP address to talk to other machines on the network. 6

15. To assign an IP address to “eth0” an individual must have “root” privileges. To elevate to “root” type “sudo su” in the terminal and press enter. Again enter, “msfadmin” for the “root” password and the prompt “root@metaploitable:/home/msfadmin#” appears.

16. Assign an IP address to “eth0” by following these sub steps: a. In the terminal type “ifconfig eth0 down” and press “enter”. b. Next, type “ifconfig eth0 10.0.0.100/24” and press “enter” to assign an IP address of 10.0.0.100 and a subnet mask of 255.255.255.0 (this is what the /24 is responsible for, Google “CIDR notation” for more information). c. Type “ifconfig eth0 up” and press “enter” to bring the interface up with the newly assigned IP address. d. Type “ifconfig -a” and press “enter” to verify the new IP was successfully assigned to “eth0.”

17. The Metasploitable2 VM is now fully configured. Leave this VM powered on for the rest of the lab.

7

Configure Kali Linux to talk to Metasploitable2 VM 1. From the VirtualBox application, highlight the Kali Linux VM and select the “Settings” button. Assign the Kali Linux VM to the same internal network as the Metasploitable2 VM as in steps 8, 9, and 10 from above. 2. Once the Kali VM is powered on, access a terminal and repeat steps 14 and 16 from above. There is no need to elevate to “root” (step 15); in Kali Linux as the default user is “root.” Give the Kali Linux VM an IP address of 10.0.0.200/24 for “eth0.” 3. Once the “eth0” interface is configured and brought back up, ping the Metasloitable2 VM to check for connectivity. Type “ping 10.0.0.100” and note responses. Press the “Ctrl” and “c” simultaneously to stop the pings. Successful pings to Metasploitable2 VM

4. Go back to Metasploitable 2 VM and ping the Kali VM to ensure connection.

Successful pings to Kali Linux VM

5. Next, open the Firefox browser in Kali Linux and type the IP address of the Metasploitable2 VM in the address bar. If configured correctly, the “metasploitable2” webpage appears.

6. Once these configurations are achieved, the installation is complete, and it is time to move to use Burp Suite. 8...