HOWTO : Setting up a Penetration environment with VirtualBox

*** CAUTION : This tutorial is written for Penetration Test only. Otherwise, you may be arrested if you attack/intrude any other network/computer without authorization. ***



Software :

Back|Track 4 R1

Ubuntu 10.10 Desktop

VirtualBox 3.2.10 r66523



Hardware :

Lenovo ThinkPad X200 with 4GB RAM and 80GB SSD



Lenovo ThinkPad X200 is installed Ubuntu 10.10 Desktop edition. On which, installs VirtualBox.



Go to the Oracle VM VirtualBox site to download the VirtualBox :

http://dlc.sun.com/virtualbox/vboxdownload.html#linux



(A) Create Back|Track virtual machine :



Select at least 8GB virtual hard drive place and 512MB RAM for the Back|Track. The first network adapter is set to "NAT" while the second is set to "Host-Only".



Boot up Back|Track from the VirtualBox and click on "install.sh" to install Back|Track.



Login for further setting. The username is "root" and the password is "toor".



Step 1 :



After the installation, you may execute the following command to fix the screen size to 800x600.



fix-splash800



Then, change the password of the root when necessary. Otherwise, the username is "root" while the password is "toor".



Execute the following command to make Back|Track to start network interface and X.org when bootup each time.



kate /root/.bash_profile



Append the following lines :



start-network

startx



Step 2 :



To install VirtualBox Additions when necessary via "Konqueror" -- "Storage Media" -- "media:/hdc".



bash VBoxLinuxAdditions-x86.run



Step 3 :



apt-get -y update

apt-get -y upgrade



Step 4 :



Go to "Menu" -- "BackTrack" -- "Penetration" -- "Fast Track". Select "Fast-Track Interactive" and choose "1".



Step 4a :



Go to "Menu" -- "BackTrack" -- "Penetration" -- "ExploitDB". Select "Update Exploitdb".



Step 4b :



Go to "Menu" -- "BackTrack" -- "Penetration" -- "Social Engineering Toolkit". Select "S.E.T-Update".



Step 5 :



At the terminal, execute the following command :



airodump-ng-oui-update



Step 6 :



Go to "Menu" -- "BackTrack" -- "Vulnerability Identification" -- "OpenVAS" -- "OpenVAS NVT Sync".



Step 7 :



Update the Add-ons of Firefox.



Step 8 :



apt-get -y install crark

apt-get -y install wbox

apt-get -y install vlc



Step 9 :



Update the Framework. However, it will take several hours.



cd /pentest/exploits/framework3/

svn up



Step 10 :



Reboot the system.



(B) Create Metasploitable virtual machine (Optional)



Go to the following link to download the "Metasploitable" which is an Ubuntu 8.04 server with some flaws.



http://blog.metasploit.com/2010/05/introducing-metasploitable.html



Set the downloaded Metasploitable as virtual hard drive at VirtualBox. The network adapter is set to "Host-Only". The virtual hard disk space is at least 8GB and 512MB RAM for the Metasploitable.



(C) The final



Now, the IP address of eth0 of Metasploitable is similar to 192.168.56.101. The IP address of eth0 and eth1 of Back|Track are similar to 10.0.2.15 and 192.168.56.102 respectively.



You may require to execute the following command at Back|Track in order to see the two network interfaces and their IPs.



/etc/init.d/networking restart



Back|Track can access (or ping) Metasploitable via IP address. Back|Track can surf the internet but Metasploitable cannot.



At last, your penetration environment is set up.



(D) Free Tutorials



(1) Metaploit Unleashed

(2) Fast-Track

(3) Social-Engineer Tootkit

(4) Got Milk?

(5) How to Metasploit Beginner to Advanced (Video)



(E) Non-free Training



Offensive Security



(F) Resources



(1) Exploits Database

(2) Metaploit Blog

(3) Offensive security Blog

(4) Yet another Back|Track in Gnome

(5) Metasploit



That's all! See you.