Wednesday, February 26, 2014

Basic Setup for a Penetration testing lab

Ok so I am part of the college Ethical hacker society and becoming more active I have decided to run a weekly get together to practice pen testing & all things related. Below is the activity I described as a basic setup for someone with no knowledge of VM's or Kali/BackTrack.

###################################################################################

This is just a brief outline of the setup you will need for the Hacker Soc meetings.


Software:


OR
OR

OR
Or both




Guide:

HashMyFiles

HashMyFiles is a hash checker. This is used to check the integrity of the files you have just downloaded.

Usually before downloading you should see a MD5 or SHA number, take note of this. This is your hash, hashes are a random string of numbers and letters that are specific to the file you are about to download.

Once the file has been downloaded, load it into HashMyFiles and wait for it to compute the hash. If the hashes match then you’re downloads integrity hasn’t been compromised.


I recommend doing this for every file that you are given a hash for just as standard practice so you know nothing has been compromised. To read more on hashing check out: http://www.techopedia.com/definition/19744/hash-function

VMPlayer/VMWorkstation/Virtual Box

These tools are virtualisation software used to host your machines such as Kali/BackTrack which we will get to later.

Personally I use VMWorkstation, I find it really easy to load VM’s, create new VM’s & generally work with & I used VMPlayer for a couple of years before hand so it was natural progression.

If you like VMPlayer I recommend using VMWorkstation to see what more you can do. I can provide support for most things with these programs; the alternate option is to use Virtual Box (VBox). There is no issue in using this and from experience it is used a lot more in industry than VMWare but I will only be able to help out so much before I run into issues.

If you have any issues with these there are loads of guides and tutorial on googles.





Install: Kali

Kali (not the Indian goddess) is a Debian Linux Distribution designed for Digital Forensic & Penetration Testing. It is a continuation of Backtrack; it includes most of the tool you will need for testing/hacking.

For the purpose of the guide I will be using VMWorkstation to install Kali but I will release a VMPlayer & VBox guide in the future.

I recommend using virtualisation to host your Operating Systems when Hacking as you may have tools on Windows that are not available on Kali & vice versa also you could have 2 Kali’s open doing different things. This again is my personal opinion but I find a lot of security people would agree with this setup also.

So firstly you need to create the Kali VM in VMWorkstation. To do this go to File > New Virtual Machine.


Select:
>Typical (recommended)
>Installer disk image file (ISO):
>Browse
>Navigate to where you have downloaded Kali
>Open
>Next

>Enter name for your VM
>Select a location for your VM(leave untouched if you want it to be saved in the standard place)
>Next

>Enter in the size you want to give to your installation (recommended: 20GB //can be changed in the future if needed)
>Store virtual disk as a single file
>Next

>Now click the Customize hardware button
>Click Memory and increase that. I recommend half of what your laptop currently has (recommended minimum 2GB). **Do not give the VM to much RAM as you will slow down your host machine and your laptop could potentially, to put it in technical terms, crap out**


>Click processors and give it the same amount of processors that your laptop has (It will give you a error if it is too much)

>Click cores per processors and give it the same amount of processors that your laptop has (It will give you a error if it is too much)



>You can configure your Network Adaptors here also; Leave it as NAT for now.
>Close
>Finish

Your Kali system will now boot up...

>Click into the VM
>Go to Graphical Install
>Press Enter


Kali’s installation wizard will now load.

>Select “English - English” (or appropriate)
>Select “Ireland” (or appropriate)
>Select “Irish” (or appropriate)

This will start the initial installation of Kali, may take a while depending how much RAM you have given to the machine.

>Enter the hostname for you VM
>You will probably have no domain name so just press Continue

>Enter your password(for standard we use “ toor “ as the password)
>Continue

More auto setup

>Partition disks select Guided – use entire disk
>Continue
>Continue
>Continue
>Yes
>Continue (talk about a goto fail eh?)

Installation will continue.

>You will be asked to configure the packet manager
>If you are using a proxy you need to configure it here, if not click YES and continue

Installation will continue.

>You will be asked to install the GRUB boot loader (googles for more info)
>Select Yes
>Continue

Installation will continue.

>Installation will complete and click Continue

Instillation has now completed, to access the system you will need the username and password.

Username: root
Password: toor



Install: Backtrack (BT)

Backtrack is a Debian Linux Distribution designed for Digital Forensic & Penetration Testing. It is the old version of Kali; it includes most of the tool you will need for testing/hacking.

For the purpose of the guide I will be using VMWorkstation to install BT but I will release a VMPlayer & VBox guide in the future.

I recommend using virtualisation to host your Operating Systems when Hacking as you may have tools on Windows that are not available on BT & vice versa also you could have 2 BT’s open doing different things or have BT & Kali open simultaneously. This again is my personal opinion but I find a lot of security people would agree with this setup also.

So firstly you need to create the BT VM in VMWorkstation. To do this go to File > New Virtual Machine.


Select:
>Typical (recommended)
>Installer disk image file (ISO):
>Browse
>Navigate to where you have downloaded BT
>Open
>Next

>Enter name for your VM
>Select a location for your VM (leave untouched if you want it to be saved in the standard place)
>Next

>Enter in the size you want to give to your installation (recommended: 20GB //can be changed in the future if needed)
>Store virtual disk as a single file
>Next

>Now click the Customize hardware button
>Click Memory and increase that. I recommend half of what your laptop currently has (recommended minimum 2GB). **Do not give the VM to much RAM as you will slow down your host machine and your laptop could potentially, to put it in technical terms, crap out**

>Click processors and give it the same amount of processors that your laptop has (It will give you a error if it is too much)

>Click cores per processors and give it the same amount of processors that your laptop has (It will give you a error if it is too much)


>You can configure your Network Adaptors here also; Leave it as NAT for now.
>Close
>Finish

Your BT system will now boot up...

>Click into the VM
>Go to BackTrack Text – Default Boot Text Mode

It will take a little bit and you will be presented with:
root@bt:

>Enter “ startx ”
>Press enter

>There will be an icon on the desktop called ”Install BackTrack”, double click this.

Select:
>English (or appropriate)
>Forward

>The time zone should configure itself, if not select Ireland on the map (or appropriate)
>Again the keyboard layout should auto config if not select Ireland – Ireland (or appropriate)
>Forward

>Make sure erase and use the entire disk is selected
>Forward

>Check your settings are correct & select Install

Installation will commence

The next message you will get is to restart. Click the restart button.

Instillation has now completed, to access the system you will need the username and password.

Username: root
Password: toor
TO start: startx



Install: Metasploitable

Metasploitable is an intentionally vulnerable Linux distribution.

This is a great starting point for anyone looking to try out there skills. There are plenty of guides on the googles of how to exploit it but I recommend taking a look at it fist and trying out different thing before you go reading a walkthrough. Its one thing reading but actually learning how to do it is 10x better!

To load Metasploitable in VMWorkstation you need to go to:

>File
>Open
>Metasploitable.vmx
>Power on this VM
>Select I copied it

Your Metasploitable system will now boot up...

Leave it alone and go to your Kali/BT machine and start testing against it.

Install: VMTools

VMWare give you the option of install VMWare Tools which is used to drag things from your host machine to your Kali/BT box. I recommend doing this so you won’t be constantly plugging in & out a USB drive.

To do this you should select VM > Install VMTools

The VMTools folder will popup.

Now for the mad Linux skillz KFed style...

Drag the VMTools folder to the desktop.

Enter the following commands:

**HINT: if you type VM and then press tab it should auto fill the rest of it.

Now the fun bit:
Press:
>Enter
>Enter
>Enter
>Enter
>Enter
>y
>Enter
>Enter
>y
>Enter
>y
>Enter
>n
>Enter
>n
>Enter
>y
>Enter
>y
>Enter
>n
>Enter
AHHH It all went black!!!
Phew...
Now reboot your system and test... It may take a second so be patient!

This will work for both Kali & BT so rinse and repeat.

Install: TrueCrypt

Download,
Install,
Read the guides on the googles...

The only reason I threw this in here is because it is good practice encrypting your stuff. I have my USB encrypted via TrueCrypt so if any of you want anything from me you will need it too.

Kali & BT come with it pre installed so just get it for your windows if you haven’t already.

That is my basic setup guide, a few things to do in Kali & BackTrack once started would be to open a terminal & enter:

apt-get update;apt-get dist-upgrade

That command will update the OS.

Also:
apt-get install armitage