./tut/exp/slmail/prep :: Preparing the Lab
« prev :: next »
The first thing we’ll need to do is set up our secure lab environment. I’ll be using VirtualBox for this tutorial, but you’re welcome to use whichever hypervisor you prefer. By the time we’re finished, our lab will be configured as follows:
- Attacker VM:
- OS: Kali Linux (I’m using the 64-Bit VirtualBox OVA.)
- Software:
Python 3.7
(Preinstalled by default.)
- Networking:
- eth0: Bridged Adapter
- eth1: Host-Only Network (
vboxnet0
)
- Victim VM:
- OS: Windows 7 (I’m using the 32-Bit
IE11 on Win7 (x86)
version.)
- Software:
- Networking:
- eth0: Host-Only Network (
vboxnet0
)
For simplicity’s sake, I’ll also have a single shared folder visible to both VMs, which will allow me to download software to the victim machine without allowing it access to the internet.
Note: Running multiple VMs simultaneously can be taxing on your computer. I advise at least 8GB RAM and a fairly modern quad-core (or better) processor, otherwise the system’s performance will suffer.
Configuring the Attacker VM
After importing the Kali OVA file into VirtualBox, I open the Settings
menu and click to the Network
tab. I enable Adapter 1 in Bridged Adapter
mode and tell it to use my active wireless interface:

I also enable Adapter 2 in Host-only Adapter
mode, using the vboxnet0
network. This will enable Kali to target the Victim VM without the Victim VM having access to the internet:

Finally, I click the Shared Folders
tab and add a shared folder that both VMs will be able to access (for simplicity’s sake):

This allows me to develop the PoC scripts on the host machine in my preferred code editor, while actually running the scripts within the Attacker VM.
With all of this complete, I close the Settings
menu, turn to the Snapshots
menu and take a snapshot of the configured base system:

This will allow us to return to a pristine state, just in case we mess something up.
Configuring the Victim VM
After importing the Windows 7 OVA file into VirtualBox, I open the Settings
menu and click to the Network
tab. I enable adapter 1 in the Host-only Adapter
mode, using the vboxnet0
network:

By setting this as the only network adapter available to the VM, I effectively establish a quarantine. This is vital, as we’ll be making the Victim VM intentionally vulnerable, and we don’t want strangers finding and exploiting the vulnerability and gaining access to our network or systems. Practice good VM hygeine: keep your vulnerable VMs off the ‘net.
A few last things before the VM is ready to boot. First, I click to the Display
tab and select the Screen
submenu. I increase the Video Memory
slider to 33MB, then ensure the Enable 2D Video Acceleration
check-box is enabled:

Next, I click to the Shared Folders
tab and add the same shared folder as I specified in the Victim VM:

This allows me to download files from the internet from the Attacker VM or the host, then use those files on the Victim VM, without ever allowing the Victim VM to touch the internet. This is the method we’ll use to download and install the vulnerable software in the following tutorials.
Finally, I close the Settings
menu, click over to the Snapshots
menu, and create a new snapshot of the clean and configured system:

With that, the Victim VM is ready to boot! Which means it’s time to install Immunity Debugger and Mona.py. I download Immunity and Mona to the shared folder I established earlier, so they’ll be available within the VM.
Booting up the Victim VM, I browse to the shared folder, and find Immunity and Mona waiting for me:

I double-click the Immunity installer to begin the installation. When it asks if I want to install Python 2.7.1
on the system, I click “Yes.” I click through the rest of the installation steps, accepting the default values for everything. When the installation completes, I can see the Immunity Debugger
icon on the Windows desktop.
Next, I return to the shared folder and extract mona-master.zip
, then find the mona.py
file:

I copy and paste the file into the PyCommands
folder within the Immunity Debugger
installation:

With this complete, I spin-up Immunity and type !mona
in the command-bar:

The response shows that mona.py
was installed successfully:

I close Immunity Debugger
and shut down the Victim VM. Then, I make a second snapshot called Debugger Installed
, so I can return to this configuration quickly and easily:

With that, our VMs are set up and ready to roll!
« prev :: next »
Read other posts
« prev :: next »
The first thing we’ll need to do is set up our secure lab environment. I’ll be using VirtualBox for this tutorial, but you’re welcome to use whichever hypervisor you prefer. By the time we’re finished, our lab will be configured as follows:
- Attacker VM:
- OS: Kali Linux (I’m using the 64-Bit VirtualBox OVA.)
- Software:
Python 3.7
(Preinstalled by default.) - Networking:
- eth0: Bridged Adapter
- eth1: Host-Only Network (
vboxnet0
)
- Victim VM:
- OS: Windows 7 (I’m using the 32-Bit
IE11 on Win7 (x86)
version.) - Software:
- Networking:
- eth0: Host-Only Network (
vboxnet0
)
- eth0: Host-Only Network (
- OS: Windows 7 (I’m using the 32-Bit
For simplicity’s sake, I’ll also have a single shared folder visible to both VMs, which will allow me to download software to the victim machine without allowing it access to the internet.
Note: Running multiple VMs simultaneously can be taxing on your computer. I advise at least 8GB RAM and a fairly modern quad-core (or better) processor, otherwise the system’s performance will suffer.
Configuring the Attacker VM
After importing the Kali OVA file into VirtualBox, I open the Settings
menu and click to the Network
tab. I enable Adapter 1 in Bridged Adapter
mode and tell it to use my active wireless interface:
I also enable Adapter 2 in Host-only Adapter
mode, using the vboxnet0
network. This will enable Kali to target the Victim VM without the Victim VM having access to the internet:
Finally, I click the Shared Folders
tab and add a shared folder that both VMs will be able to access (for simplicity’s sake):
This allows me to develop the PoC scripts on the host machine in my preferred code editor, while actually running the scripts within the Attacker VM.
With all of this complete, I close the Settings
menu, turn to the Snapshots
menu and take a snapshot of the configured base system:
This will allow us to return to a pristine state, just in case we mess something up.
Configuring the Victim VM
After importing the Windows 7 OVA file into VirtualBox, I open the Settings
menu and click to the Network
tab. I enable adapter 1 in the Host-only Adapter
mode, using the vboxnet0
network:
By setting this as the only network adapter available to the VM, I effectively establish a quarantine. This is vital, as we’ll be making the Victim VM intentionally vulnerable, and we don’t want strangers finding and exploiting the vulnerability and gaining access to our network or systems. Practice good VM hygeine: keep your vulnerable VMs off the ‘net.
A few last things before the VM is ready to boot. First, I click to the Display
tab and select the Screen
submenu. I increase the Video Memory
slider to 33MB, then ensure the Enable 2D Video Acceleration
check-box is enabled:
Next, I click to the Shared Folders
tab and add the same shared folder as I specified in the Victim VM:
This allows me to download files from the internet from the Attacker VM or the host, then use those files on the Victim VM, without ever allowing the Victim VM to touch the internet. This is the method we’ll use to download and install the vulnerable software in the following tutorials.
Finally, I close the Settings
menu, click over to the Snapshots
menu, and create a new snapshot of the clean and configured system:
With that, the Victim VM is ready to boot! Which means it’s time to install Immunity Debugger and Mona.py. I download Immunity and Mona to the shared folder I established earlier, so they’ll be available within the VM.
Booting up the Victim VM, I browse to the shared folder, and find Immunity and Mona waiting for me:
I double-click the Immunity installer to begin the installation. When it asks if I want to install Python 2.7.1
on the system, I click “Yes.” I click through the rest of the installation steps, accepting the default values for everything. When the installation completes, I can see the Immunity Debugger
icon on the Windows desktop.
Next, I return to the shared folder and extract mona-master.zip
, then find the mona.py
file:
I copy and paste the file into the PyCommands
folder within the Immunity Debugger
installation:
With this complete, I spin-up Immunity and type !mona
in the command-bar:
The response shows that mona.py
was installed successfully:
I close Immunity Debugger
and shut down the Victim VM. Then, I make a second snapshot called Debugger Installed
, so I can return to this configuration quickly and easily:
With that, our VMs are set up and ready to roll!