All language subtitles for 010 Build a Virtual Lab

Instructor: As an aspiring penetration tester

it's important for you to understand

how to use virtual machines

to be able to practice your techniques

by being able to have your own pen testing environment.

Now in this course,

I'm gonna do a lot of demonstrations

to show you all the different tools and techniques

that you might wanna use,

and if you're in my course at diontraining.com

that also includes cloud based Hands-on Labs.

But if you wanna be able to build these things

for yourself and start playing around with them

that's what I'm gonna show you in this video.

Now, I will say

that this video is gonna be very generic in nature.

I'm showing you the basic steps.

I'm gonna show you how I do this on my machine

which is a Mac OSX machine.

But if you're using Windows or Linux

you're gonna be following similar steps

but the installation process will be a bit different.

What I want you to take away here is the concepts

and the basic steps.

As an aspiring penetration tester,

you should be able to go onto YouTube

or go online and google exactly how to do this

for your hardware and your operating system.

Now, the first thing you're gonna need

is some sort of a virtualization environment.

I recommend using VirtualBox

because it's an open source free tool

that works on all of the different operating systems.

To get VirtualBox, just go to virtualbox.org

and on the homepage click the big download button.

Now, when you go to the download screen

you're gonna see that it says there are platform packages.

These platform packages are based on the operating system

that your machine is gonna be using,

not the virtualization machines that you wanna be hosting.

So for example, I'm using a MacBook Pro,

so I need to click on OSX hosts.

If you're using Windows you'll click on Windows host,

and if you're using Linux

you'll click on Linux distributions

and pick your distribution.

Once you click on your distribution

or your operating system, it's gonna download that file.

At that point

you're gonna be installing this software

known as VirtualBox into your host operating system.

Now that it's been downloaded,

I can go into my downloads folder,

I can click on VirtualBox

and this is gonna mount the ISO

or the DMG in the case of a Mac,

which allows me to reach that installer file.

Now on a Windows machine,

you're gonna have an EXC or an MSI executable file

for you to run the installation,

but on a Mac, it's a pkg file.

You'll simply double click it

and it will open up the installer.

At this point, you're gonna say allow,

and you're gonna walk through the basic steps

of doing the installation.

If you're asked to a your admin password

you can simply put that in

and this will allow to fully install the software.

Once it's completed

it's gonna take about one to three minutes

depending on how fast your machine is,

you'll be ready to start using VirtualBox.

Now that VirtualBox has been installed

you can close the installer, you can move it to trash,

and you can close that mounted image.

At this point, we no longer need the VirtualBox website

so I'm gonna close that tab.

Now the next thing we need

is some sort of operating system

that we're gonna conduct our attacks from

because VirtualBox is just a virtualization system

that provides you emulated hardware for you to use.

Now, I personally like to use Kali

and Kali is what is mentioned

in your official textbook as well.

So we're gonna go ahead and download Kali

and use that in this course.

To download Kali,

just go to kali.org and then click on download.

Once you click download,

you'll be brought to this page

where there's a lot of different options

because Kali can be run on lots of different things.

Now, if you see the one on the left that says Bare Metal,

that would be if you want to format your entire hard drive

and install Kali as your default operating system.

As somebody who is learning penetration testing

I do not recommend using that option.

Instead, you're gonna wanna use a virtual machine

and that's what we're gonna use here up on the right.

Go ahead and just click on virtual machines

and then you're gonna select either 64 bit or 32 bit

depending on the operating system of your host OS,

and whether you're using VMware or VirtualBox.

In my case, I'm gonna be using VirtualBox,

and I'm gonna be using this 64 bit edition

and you'll download it by clicking on the download link

where it says 3.7 G which is 3.7 gigabytes.

Now to help speed up this process,

I've already downloaded that 3.7 gigabyte file

and I have it in my downloads.

We're gonna go to our applications folder.

We're gonna scroll down until we find VirtualBox

and then we're gonna open up VirtualBox.

Now you can see here that there's nothing showing

in VirtualBox because we haven't created any hardware

to emulate yet and there's no virtual machines,

but we did just download a Kali Linux Virtual Machine.

And so if we wanna use that,

we're simply gonna go to our downloads folder,

and in my case, it's right there

with this ova file, which is a VirtualBox system.

So if I click on that, it's gonna open up

and it's gonna ask to import this appliance into VirtualBox.

I can go ahead and select the normal default settings

that it gives me.

In this case, you can see it's using Kali Linux.

It's from Offensive Security.

It is a rolling X64 version in 2021.4a

which is the current version of Kali

at the time of this recording.

You can see the guest type of the operating system

is a Debbie and Linux machine which is 64 bit.

It's gonna give it two processor core

from my computer and two gigabytes of ram.

And if we go down a little bit further

we do have an emulated DVD, USB controller,

sound card, and network adapter,

as well as some storage controllers for IDE and SATA,

and a virtual disc image

which is already being mounted for us,

the base folder and the primary group.

From here, we're gonna go ahead and hit import.

From here, we'll then say agree,

and now we're just gonna wait as it imports.

Usually this'll take just a couple of minutes

depending on the speed of your system and your hard drive.

All right, once it's done, you can now see it listed

in the left panel showing that I have one machine here

which is Kali Linux 2021.4a as a virtual machine.

And this means we'll be able to use this machine

and be able to add settings to it, changes to it,

or just load it up and use it as if was a real computer.

Now this is great except for one thing,

this is my attack machine.

I have no targets right now

and so if I wanna practice my penetration testing skills

I need someone to hack against.

Now, as we talked about, you need to have permission

from the system owner before you hack them.

So the best way to do this is to create your own systems

and this is the great thing about virtual machines.

You can create your own virtual machines

and you can then hack against them

and you have your own permission to do so.

Now, to do this, one of the great websites

that I find out there is called VulnHub,

and if you go over here and go to vulnhub.com,

you're gonna find hundreds and hundreds

of virtual machines here.

These are all free to download and free to use.

And these have all been created by the community

to create different levels of challenges

for people who are practicing their pen-testing skills.

Now, the bad thing about these

is none of these are directly tied

to the pen-test plus exam.

For instance, you're not gonna find one here

called pen-test plus objective 3.7 that you can download

and practice those particular skill sets.

Again, this is one of the good things

about using something like CompTIA Certmaster Labs,

or the labs at diontraining.com because we tie them directly

to the objectives of the pen-test plus exam.

But as you're building your skills

and going beyond the exam, VulnHub is a great place to go.

Now, what I'm gonna do here

is point out the fact

that there is different difficulties here

and as you're starting out

you definitely wanna stick to the easy ones.

So what I'm gonna do is I'm just gonna download

the one on the right here, which is an easy difficulty,

and it says the secret to this box is enumeration.

So that's their hint they're giving us

and I'm gonna go ahead and choose that one

because enumeration is really the next phase

of penetration testing as you go into information gathering

and vulnerability scanning.

So we're gonna go ahead and use that one

as one of our targets just so we can play around with it

and have a target to play with.

Now, to download it, you simply go over here

and click on it.

When you do that,

you're gonna learn a little bit about the release,

when it came out, who the author was,

and then the links to download it.

Now notice we have that ova file again,

that is an appliance image for VirtualBox.

So if I click that and download it,

you can see this one is 827 megabytes

and it'll take me less than a minute.

Now below that, you can go down

and you can see the description of this box.

Some of these have better descriptions than others.

This one doesn't have a very big description.

It just says it's an easy difficulty box,

the secret to the box is enumeration.

If you have questions you can email the author

at their Gmail address.

And this works better with VirtualBox than VMware

which is good because we're using VirtualBox.

And down here they actually have some file information

so if you wanted to check the hash

and make sure it wasn't corrupted during the download

you could do that,

and then you could see what type of system it is.

It's a virtual machine running Linux.

It has DHCP enabled, and it has an automatic assignment

of the IP address for that particular box.

And there's two basic screenshots.

Now that's all the information they're giving you.

From here, you're gonna be able to try to hack

into this box and figure it out on your own.

If you get stuck though,

I will tell you most of the boxes on VulnHub

do have walkthroughs available and this one is no exception.

There's actually a great video on YouTube

that's about eight to nine minutes long

of a pen tester walking through exactly

how they crack this box,

going through the enumeration, finding the passwords,

using that creating reverse shells,

and all the other exploits he does

to win at this particular box.

But for our purposes right now,

I just wanted to have some machine that I can use

inside a VirtualBox and be able to talk to it

from the Kali Linux machine.

So what I'm gonna do is just go down here to my downloads,

and again, we have that file jengow.ova.

Click on that.

It'll do the same import process, click on import.

This one's a little bit smaller

so it should take less than a minute to import.

And once I have both of those

we're now gonna be able to start up our Kali Linux machine

and this vulnerable machine.

Now the great thing with VulnHub is

these tend to be smaller images that are based on Linux.

This one, for example, is only one gigabyte.

So you saw I had two gigabytes assigned to Kali,

I have one gigabyte assigned to this box,

that's three gigabytes.

My system has 16 gigabytes,

so I can actually load up two, three, four,

maybe five of these virtual machines

and have a whole network of vulnerable machines

for me to scan and attack from my Kali Linux machine.

All right, now that I'm done with VulnHub,

I'm just gonna go ahead and close that out

and clear it outta the way.

And now we wanna go ahead and start VirtualBox.

Now on Mac, there is gonna be an error

if I try to start this up right now,

and I'm gonna show you that exactly.

When you click on the machine,

you wanna start and you click start.

By default, you're gonna get this kernel driver

not installed error.

Now, what do you do if you get this error?

Well, the first thing I would do

is actually take that error message,

put it into Google and it will tell me what the problem is

and how to solve it.

If you get an error on Windows or Linux,

google the error and you'll be able to figure out

what's wrong.

Now, in this particular case, I know what the error is

and it's the fact that the support driver is not installed

and it hasn't been signed.

So what I'm gonna do is actually go down here and hit okay,

and I'm gonna ignore that error,

and I'm gonna go to my system preferences.

And underneath my security and privacy,

this is a security setting on Macs that does this.

I have to go in here and you'll see right here it says,

system software developer Oracle America

has been updated and nobody has allowed it yet.

So I have to unlock my machine,

and then I can allow that to happen.

And then it's gonna require me to restart my computer.

I'm gonna go ahead and restart my computer

and I'll be right back.

Okay, my machine has restarted

and it brought me right back to here

and it already loaded up VirtualBox for me.

To verify that driver has now been signed

and approved in security and privacy

just click on that box and you'll see

it's no longer listed here as something that's a problem.

So I can close that window.

And now we should be able to go ahead

and click on Kali and then click on start.

Once you do this,

it should open up Kali in a window just like it did there.

I'm gonna go ahead and move this over to my left side here

and you'll see it's pretty small

and I'm gonna go ahead and just hit enter.

It's gonna go into the GUI environment

and it will expand into a larger size

as it starts booting up

and getting the right things into it.

In this case, VirtualBox wants access to my microphone.

You can allow that or not.

In my case, I have no need for my Kali machine

to use my microphone so I'm gonna say don't allow.

Then I'm gonna go ahead

and get rid of these little boxes here

and we are gonna make this a little bit bigger

so we can see it by going here,

and then we're gonna go here and go to scaled mode.

This will stretch it out

and make it so it'll be easier for us to see.

Okay, to log into your Kali Linux machine

you're gonna use the username Kali and the password Kali.

This is the default on the 2021 version.

In older versions, it was root as the username,

toor which is root spelled backwards as the password.

Now, once you're into the system

we're gonna wanna make this larger

so it'll be easier to work with.

And as you can see here,

because I'm using a MacBook with a retina display

it is really gonna be a very small portion of my screen.

Now, if you wanna make Kali Linux larger

and take up more of your real desktop

you need to make the virtual display a little bit larger.

By default, it's only set to 800 by 600 pixels

which is really small on a MacBook

which has a retina display.

So what I'm gonna do is just right click on the desktop,

go to applications,

go up to settings and then go over to display.

When you do this, it will allow you to go here

and create your virtual resolution for this display.

Now here you can see my resolution is 800 by 600.

I wanna go ahead and set that

to something like 1920 by 1080, which is full hd,

and then I'll just hit apply.

Once I do that, it's now gonna say yes.

Do I wanna keep this or do I wanna restore?

I'm gonna say yes, keep the configuration.

And now I can actually maximize my window

and take up a lot more space

and it now looks like a full machine that I can use.

I'm gonna go ahead and close my display settings here

and in the meantime, I'm gonna go ahead

and take Kali and move it on the left side of my screen

to get it out of the way.

Now, on my Mac, I actually have a program called Better Snap

which allows me to move things left and right

just like you can on Windows.

By default on your Mac, that setting does not exist

so you'll have to resize the windows by yourself.

Now, let's go back to VirtualBox.

And over here on VirtualBox,

we wanna start up the other machine which is our target.

Just go in here, click start,

and it's gonna go ahead and boot up.

Now it is gonna say there's a problem here.

It's saying the physical network interface was not found

for VirtualBox host only ethernet adapter adapter one.

Now, this happens sometimes

when you download somebody else's virtual machines

like we did from VulnHub.

Sometimes their adapters are not the same

as what's on your system.

So to fix this,

you'll just click on change network settings.

Now from here, we can just select whichever adapter we want.

Now, in this case, we have a host only adapter,

so we're just gonna take that

and we're gonna change that to a NAT adapter.

And from there we are gonna hit the advanced tab

and just make sure everything looks fine,

it looks like it is, and we'll go ahead and hit OK,

and now we should be able to start up this machine.

Now, because I set it as a NAT adapter,

that means that this machine

can actually talk to the internet

because it's using my internet connection

to talk to the internet and the rest of my home network.

Now here, we're having the same problem.

You can see that it is a very small amount of my screen

because it is using that 800 by 600 pixels by default.

We'll give it a second here and let it load all the way up.

There we go.

Now we're at the login screen.

Now we can't really do anything

to fix this particular machine

because we don't know the login credentials.

That's part of what we want to hack

and part of what we wanna have a challenge with.

So what we wanna do first is we wanna figure out

where that device is on the network.

Now, as I said, right now, I use NAT for both of these,

so these are both able to talk to the internet.

And so if I go over here on my Kali machine,

I'm gonna make it full screen real quick,

I can go ahead and click on Firefox

and I can go online and access any website I want.

For instance, I can go to google.com

because I'm tied to the internet, okay?

If you don't wanna be able to do that

and you want them to talk on their own isolated network

as you're doing your hacking and practicing

we can do that as well.

Now that we have both the Kali machine and jengow set up

we have an attacker and a target.

We're gonna play a lot more with this environment

as we go through the course,

and I do some demonstrations

to show you how we can find out what the IP address is

of that target and how we can exploit and attack that target

based on the vulnerabilities we find,

and we'll go through and do this

as we go through the course together.

But for now, I just wanna make sure you could set up

a basic environment consisting of VirtualBox, Kali Linux,

and some form of vulnerable machine

that you can attack against.

It doesn't have to be jengow,

that's just the one I'm using for this course.

You can use any of the ones you want

that you find on VulnHub,

and as you go through, you'll play with multiple of those

to increase your skills and get more comfortable

with the tools as we go through the course.