Building Virtual Pentesting Labs for Advanced Penetration Testing（Second Edition）
上QQ阅读APP看书，第一时间看更新
上一章目录下一章

Open source and free environments

There are a number of free and open source virtual environments; we will look at some of the more popular ones here. In this section, we will discuss the following products:

  • VMware Workstation Player
  • VirtualBox
  • Xen
  • Hyper-V
  • vSphere Hypervisor
  • VMware Workstation Pro

VMware Workstation Player

The team at VMware has created a number of different products that are available for free. At the time of writing this book, VMware Workstation Player (formerly known as VMware Player) is available free of charge. One of the biggest limitations in the past was the fact that you could not use VMware Workstation Player to build and create virtual machines. Thankfully, the latest versions allow you to create machines. The limitations of the current version are in the networking department; this is because you cannot create additional switches with the VMware Workstation Player tool. For our purpose of building virtual pen testing labs, this is something that we really need, and if you do decide to use it, then you can only use VMware Workstation Player for a basic network architecture. It is free, and that is why we are going to cover it. The first thing you want to do is download it. You can download it from https://my.vmware.com/web/vmware/free#desktop_end_user_computing/vmware_workstation_player/12_0.

Once you have downloaded it, you will have to obtain a license key by registering with the site. Once you have the key, you can enter it during the installation or at a later time, and it will enable you to use the tool. For using the tool, the user guide is a good source of reference, and there are several tutorials on the Internet for it too. Again, it is limited in what it can provide us, but a viable solution is to use it to test machines you build on as well as other machines without having to purchase another license for the software.

VirtualBox

Oracle VirtualBox is a very powerful tool and is one of the most popular when it comes to selecting a virtualization solution. The fact that it is so powerful and free makes it a great choice. The tool performs well on a variety of platforms and offers desktop- as well as enterprise-level capabilities. The current version at the time of writing this book is 5.0; you can download it from https://www.virtualbox.org/wiki/Downloads. There are versions available for Windows, Mac, Linux, and Solaris. While this is a very popular tool, it has been known not to work as well with router emulation or machines that use a hypervisor, such as Dynamips.

Xen

It is no secret that the x86 market has been dominated for years by the solutions offered by VMware, but as time has passed, the market has had plenty of solutions that continue to increase their share. This is where Xen comes in. It has gained popularity and continues to do so as word gets around about it and as the product continues to improve. You will probably ask this question if you are new to Xen: what is it? This is a very good question, but to explain it in detail is beyond the scope of the book. There are entire books written on Xen, so we will only cover the basics here. Xen got its start at the University of Cambridge in the UK. Since then, there have been many players in the Xen game, and this has added features and capabilities to the tool, which in turn has increased its popularity.

Once the Xen project took off, as is typical in the IT world, the founders started their own company called XenSource, which was then taken over by Citrix. Citrix has expanded on the project and offers it as a solution along the lines of VMware ESXi. Additionally, other vendors have added Xen into their list of product vendors, such as Red Hat and Novell.

For the latest information about or to download Xen, go to https://www.citrix.com/.

For a very good tutorial, that is, a step-by-step guide to setting up Xen on a SUSE Linux machine, you can go to http://searchservervirtualization.techtarget.com/tip/Xen-and-virtualization-Preparing-SUSE-Linux-Enterprise-Server-10-for-virtualization.

Note

There is a free registration required, which consists of providing your e-mail address to read the document. It is worth it as they will send you links as new papers are published, so it becomes a nice, quick reference to stay updated. Another site to refer to for information and tutorials on Xen is http://wiki.xen.org/wiki/Category:Tutorial.

Hyper-V

Hyper-V is Microsoft's virtualization tool, and it is a continuation of their Virtual PC product. While still relatively new to the virtualization landscape, Microsoft is catching up fast. The one area I find lacking within their tool is networking and integration with desktop interfaces on Linux and Unix. Once they get that figured out, they will be worth serious consideration when selecting your virtual environment for your pen testing labs. Originally, Hyper-V was only offered as part of the server products for Microsoft, starting with Windows Server 2008 and continuing on to Windows Server 2012 and currently with the planned Windows Server 2016.

There are options to install Hyper-V with Windows 8 and Windows 10. This decision by Microsoft was based on the fact that the tool has been so popular on the server versions of their software that they wanted to expand it to give their customers more options when it comes to virtualization.

There are two main requirements for Hyper-V:

  • The operating system has to be 64 bit.
  • The second requirement, which is often overlooked, is the capabilities of the processor in the machine. The Hyper-V technology requires that the chip support Second Level Address Translation (SLAT), which is an extended feature of the CPU. To run Hyper-V on a Windows 10 platform other than a server, you will need to have one of the following Windows 10 editions:
    • Windows 10 Professional
    • Windows 10 Enterprise
    • Windows 10 Education

Within Windows 10, you can also check to see whether the machine is compatible with Hyper-V. You can do this using the Command Prompt shell in Windows. In a Command Prompt window, enter the following:

Systeminfo.exe

Review the information from the command output. If all listed Hyper-V Requirements have a value of Yes, your system can run the Hyper-V role. If any item returns No, check the requirements listed in this document and make adjustments where possible. An example of this is shown in the following screenshot:

Once you have your platform of choice, you can either add it as a feature if you are using one of the server versions or, if you have selected one of the Windows 8 platforms, download the software from http://www.microsoft.com/en-us/download/details.aspx?id=36188.

For the Windows 10 platform, you can install Hyper-V manually by following these steps:

  1. Right click on the Windows button and select Programs and Features.
  2. Select Turn Windows features on or off.
  3. Select Hyper-V and click on OK.

An example of the results of this is shown in the following screenshot:

When the installation is complete, you will be prompted to restart your computer, as shown in the following screenshot:

As with most things in Windows today, you can also install Hyper-V using PowerShell. To accomplish, this follow these steps:

  1. Open a Windows PowerShell console as administrator.
  2. Run the following command:
 Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All

As before, once the installation is complete, you will be required to reboot. We have another way we can install this on Windows 10, and that is using the Deployment Image Servicing and Management (DISM) tool. DISM is used to service Windows images and prepare Windows Preinstallation Environment (Windows PE). DISM also enables Windows features while the operating system is running. For more information, go to https://technet.microsoft.com/en-us/library/hh824821.aspx.

To enable the Hyper-V role using DISM, follow these steps:

  1. Open up a Windows PowerShell or Command Prompt session with administrator rights.
  2. Run the following command:
 DISM /Online /Enable-Feature /All /FeatureName:Microsoft-Hyper-V

An example of this is shown in the following screenshot:

Once the installation is completed, you have to create a virtual switch before you can create your virtual machines, so we will do that now!

We have three different types of switches with respect to creating a virtual machine in Hyper-V. These options are as follows:

  • External network: The virtual switch is connected to a physical network adapter, which provides connectivity between the physical network, the Hyper-V host, and the virtual machine. In this configuration, you can also enable or disable the host's ability to communicate over the physically connected network card. This can be useful to isolate only VM traffic to a particular physical network card.
  • Internal network: The virtual switch is not connected to a physical network adapter; however, network connectivity exists between virtual machines and the Hyper-V host.
  • Private network: The virtual switch is not connected to a physical network adapter, and connectivity does not exist between virtual machines and the Hyper-V host. This is something you might want to use so that you can perform a variety of man-in-the-middle (MiTM) attacks, and test tools such as SSLstrip.

We will now create an external virtual switch. To accomplish this manually, we will perform the following steps:

  1. Open up Hyper-V Manager.
  2. Right-click on the name of the Hyper-V host and select Virtual Switch Manager.
  3. Under Create virtual switch, select External.
  4. Click on the Create Virtual Switch button. An indication of this is in the following diagram:
  5. Under Virtual Switch Properties, give the new switch a name, such as External VM Switch.
  6. Under Connection type, ensure that External network has been selected.
  7. Select the physical network card that is to be paired with the new virtual switch. This is the network card that is physically connected to the network. An example of this is shown in the following screenshot:
  8. Select Apply to create the virtual switch. At this point, you will most likely see the following alert. Click on Yes to continue.

We can also create a virtual switch with Windows PowerShell. Once again, this shows us the flexibility and enhancements within the Windows family.

Tip

It is essential that, as a penetration tester, you gain more experience with PowerShell. We will cover this more in the section on post-exploitation activities. Packt Publishing has a number of products (books and videos) on this powerful tool, and you can find a sampling of them at https://www.packtpub.com/all/?search=powershell#.

To create a virtual switch using PowerShell, perform the following steps:

  1. Use Get-NetAdapter to return a list of network adapters connected to the Windows 10 system. An example of this is shown in the following screenshot:
  2. Select the network adapter to use with the Hyper-V switch, and place an instance in a variable named $net. To accomplish this, enter the following command in the PowerShell window: 
     $net = Get-NetAdapter -Name 'Ethernet'
  3. Once you have completed this, you are ready to create the switch, which can be accomplish by entering the following command: 
     New-VMSwitch -Name "External VM Switch" -AllowManagementOS $True-NetAdapterName $net.Name

Tip

With the VMware Workstation tool, you have the option of the interface being bridged automatically by default to all interfaces. This is not quite the same in Hyper-V on Windows 10; therefore, as per Microsoft, "[...]on a laptop, you may want to create a virtual switch for both the Ethernet and wireless network cards. With this configuration, you can change your virtual machines between these switches depending on how the laptop is connected to the network. Virtual machines will not automatically switch between wired and wireless."

We now are ready to build a virtual machine.

You will need an ISO image, and if you have one you want to use, then that is fine. We will use the popular pen testing framework from Offensive Security, Kali Linux. You can download the ISO image from http://www.kali.org/downloads/. On the download page, pick the version you'd like to use, and download it. Once you have downloaded it, launch Hyper-V, and follow these steps to create a virtual machine:

  1. In Hyper-V Manager, click on Action | New | Virtual Machine.
  2. Review the Before You Begin content, and click on Next.
  3. Give the virtual machine a name. Note that this will be the name of your virtual machine and not the computer name given to the system once the operating system has been deployed.
  4. Choose a location where the virtual machine files will be stored, such as C:\virtual machines. You can also accept the default location. Click on Next when done. An example of this is shown in the following screenshot:
  5. Select a generation for the machine, and click on Next. Generations were started with Windows Server 2012 R2:
    • Generation 1: This provides the same virtual hardware to the virtual machine as in previous versions of Hyper-V
    • Generation 2: This provides the following new functionality on a virtual machine:
    • PXE boot using a standard network adapter
    • Boot from a SCSI virtual hard disk
    • Boot from a SCSI virtual DVD
    • Secure boot (enabled by default)
    • UEFI firmware support

    Tip

    For additional information, refer to this article by Microsoft: https://technet.microsoft.com/en-us/library/dn282285.aspx.

  6. Select 1024 for the Startup Memory value and leave Use Dynamic Memory selected. Click on the Next button.

    Tip

    Memory is shared between a Hyper-V host and the virtual machine running on the host. The number of virtual machines that can run on a single host is in part dependent on available memory. A virtual machine can also be configured to use dynamic memory. When enabled, dynamic memory reclaims unused memory from the running virtual machine.

  7. On the Configure Networking screen, select a virtual switch for the virtual machine, and click on Next.
  8. Give the virtual hard drive a name, select a location or keep the default, and specify a size. Click on Next when ready.
  9. On the Installation Options screen, select Install an operating system from a bootable image file and then select an operating system ISO file. Click on Next once done.

Form here it is a matter of just following the normal operating system installation process.

As before, we can also create the virtual machine with PowerShell. But I'll leave the creation of that script for homework for those of you who want to attempt it.

vSphere Hypervisor

This is the free version of the commercial entity, which is something you should consider for your lab environment. There are some versions that will work on a laptop, and you can make it a part of your mobile lab environment too, but in my opinion, this is not the way to exploit the power of this type 1 virtualization solution.

As previously discussed, a type 1 solution has the hypervisor sitting on the actual hardware of the system itself. There are no emulation routines and no interaction with the OS is required; it is a pure bare-metal environment that, in most cases, equates to raw power.

While the setup is very easy to perform and most can do it without assistance, the VMware site has excellent resources for you to use to assist you with the installation. You can review these resources, including a video of how to perform the setup, at the following website:

http://www.vmware.com/products/vsphere-hypervisor/gettingstarted.html

As you will see when you visit the website, the team at VMware has provided plenty of references to assist you with the installation, configuration, and deployment of their virtualization solutions. One last thing to mention here is the hardware requirements that are listed on the site: most of these are considered to be recommendations, and it is best to test the hardware for the product before you make it your preferred solution. Again, this is another reason why I do not recommend this solution on your mobile or laptop platform: laptops, for the most part, do not have the power that we want at our disposal when it comes to a bare-metal virtual solution.

上一章目录下一章