.

Setting up my own hack lab

<<

Preestar

Newbie
Newbie

Posts: 14

Joined: Sat Sep 24, 2011 3:59 pm

Post Sun Sep 25, 2011 8:37 pm

Setting up my own hack lab

After watching some amazing hacking videos on security tube id like to set up my own lab and practice on.

My main system runs windows vista 32bit and I have virtual box installed but my question is do I just need to install windows onto the virutal box and then im good too go?

Which programs should I be downloadings? Ive seen alot of metaspolit and meterpreter being used although the "ls" doesnt seem to work like in the tutorial....
<<

impelse

Hero Member
Hero Member

Posts: 585

Joined: Mon Feb 16, 2009 3:40 pm

Post Sun Sep 25, 2011 10:16 pm

Re: Setting up my own hack lab

I suggest you to begin to install backtrack 5 in your virtualbox and 1 windows machine.

Here is a good site:

http://www.metasploit.com/learn-more/ho ... st-lab.jsp
CCNA, Security+, 70-290, 70-291
CCNA Security
Taking Hackingdojo training

Website: http://blog.thehost1.com/
<<

Triban

User avatar

Hero Member
Hero Member

Posts: 620

Joined: Fri Feb 19, 2010 4:17 pm

Post Mon Sep 26, 2011 11:14 am

Re: Setting up my own hack lab

Toss vista ;-)  For a future upgrade go with a Windows 7 x64 and toss in more RAM.  That way you can run multiple VMs without worrying about skimping on the resources.  Some password bruteforcing is happy if it can get more RAM to run.  Backtrack 5 will have all the tools you may need to start.  Remember, you may not use all the tools or need all the tools and tools don't make the hacker.  They just tend to make the job a bit easier. 

If you can, absolutely, toss in a Windows victim machine.  The majority of your networks are running mostly Windows so that is why you see more Windows exploits than any other.  Pick up the De-ice builds, they are linux builds with a vulnerabilities and challenges associated with them.  They are designed to start out easy and then get more difficult as you work through them.  Another nifty testing app is Web Goat, it turns your Windows XP system into a really vulnerable web site.  Metasploitable is another, it is a linux build created with exploits in mind from metasploit attackers. 

That should keep you busy for a bit :D
Certs: GCWN
(@)Dewser
<<

Preestar

Newbie
Newbie

Posts: 14

Joined: Sat Sep 24, 2011 3:59 pm

Post Mon Sep 26, 2011 3:19 pm

Re: Setting up my own hack lab

Thanks 3xban. I already have backtrack 5 on 1 virtual box and windows xp professional with SP3 on another with windows vista 32 on my main computer.

Now everything im doing is legal because it is on my own computer so please try to help me as much as you can I really do want to get into this.

I am following this tutorial http://www.securitytube.net/video/1175 and he is extremely good at explaining stuff. I got to part 3 and then decided that I want to give this a try.

So I get to the part where he downloads the exploit from a site I wont mention here. Although my exploit is different because the exploit he uses wont work on my XP professional with SP3

Here is the one I want to use, why? I have absolutely no idea but what the hell try and learn right? http://technet.microsoft.com/en-us/secu ... n/ms11-071

So I open up metaspolit console just like he does, but I think he already has the code saved on his computer because he types in something like "search dcom.1" and it finds it.

When I type in "search ms11-071" it doesnt find it and I cant find the code for this exploit anywhere on the internet....

It's quite difficult to follow along to his video to the T because metasploit has been updated sinse his video and some things have changed but I dont expect it to be simple although any help would be greatly appreciated.
<<

eccodom

Newbie
Newbie

Posts: 5

Joined: Thu Jan 17, 2008 7:00 pm

Post Mon Sep 26, 2011 4:45 pm

Re: Setting up my own hack lab

If you need to update your framework..

cd /pentest/exploits/framwork3/
svn update

msf > search ms11-071

no results

That exploit is has not been ported over to Metasploit yet. So a search turns up no results.  http://www.metasploit.com/modules/ it appears the latest is ms11-050.
-Harms
<<

Preestar

Newbie
Newbie

Posts: 14

Joined: Sat Sep 24, 2011 3:59 pm

Post Mon Sep 26, 2011 5:51 pm

Re: Setting up my own hack lab

I'm making progress! im so close lol. I updated my msf just a little while ago and I thought let me just try and see if his exploit works on xp pro sp3 which ofcourse it never but it feels good to know im so close if I just had the correct exploit.


http://i51.tinypic.com/wclu86.jpg%5B/IMG


for the doubters who think im not using my own computer to test

p.s thnx eccodom ill try that one


**EDIT** sorry going abit of topic now I know but eccodom that exploit is quite different I have to set the server host IP and address and it exploits something to do with internet explorer. I need something very basic. Thanks anyway
Last edited by Preestar on Mon Sep 26, 2011 6:16 pm, edited 1 time in total.
<<

TheXero

User avatar

Full Member
Full Member

Posts: 112

Joined: Tue Dec 07, 2010 12:24 pm

Post Tue Sep 27, 2011 3:52 am

Re: Setting up my own hack lab

Preestar, if you can set up an XP unpatched machine and try attacking it.  Only way to properly learn in this is practice.

Once you have access you can all kinds of things.

Btw, where did you get that awesome logon screen for Win7 :)
<<

Preestar

Newbie
Newbie

Posts: 14

Joined: Sat Sep 24, 2011 3:59 pm

Post Tue Sep 27, 2011 10:45 am

Re: Setting up my own hack lab

Sorry me again..... I am looking through the microsoft website for vulnerabilities that suit my windows xp pro sp3 machine and there are loads and loads but none! not 1 single exploit is listed in the metasploit framework...

So I widen my search my typing in "search ms11, ms10, ms09" ect so it refines the search by the year and it lists lots of exploits but there for things like windows media player, .net framework, microsoft office and such.

I wish there was a way to search specifically for vulnerabilities with windows xp pro sp3  in metasploit...
<<

Triban

User avatar

Hero Member
Hero Member

Posts: 620

Joined: Fri Feb 19, 2010 4:17 pm

Post Tue Sep 27, 2011 11:01 am

Re: Setting up my own hack lab

Install old version of Adober reader and you will have something to exploit :D

Edit:
Also you can check out http://www.exploit-db.com/ to search there for exploits, MS won't always have the most updated list of security vulnerabilities.  The publish what they found or have proven to be a vulnerable and have a fix for it (sometimes).

And http://seclists.org/bugtraq/ can also help you.
Last edited by Negrita on Tue Sep 27, 2011 11:05 am, edited 1 time in total.
Certs: GCWN
(@)Dewser
<<

Preestar

Newbie
Newbie

Posts: 14

Joined: Sat Sep 24, 2011 3:59 pm

Post Tue Sep 27, 2011 11:17 am

Re: Setting up my own hack lab

Thanks x3ban but I have checked those sites before. Basically to put it simply I am trying to find an exploit that will work for Windows XP professional sp3 as thats what my virtual box system is running its annoying because in metasploit you cant actually search for a list of exploits that work for xxx system you can only search for that specific exploit by name like MS11-xxx


Thanks anyway ill keep having a look around
<<

Triban

User avatar

Hero Member
Hero Member

Posts: 620

Joined: Fri Feb 19, 2010 4:17 pm

Post Tue Sep 27, 2011 1:30 pm

Re: Setting up my own hack lab

Understandable, though if you think about it, there are very few times where you will find a plain jane install of XP w/ SP3 and have no other applications installed in a production environment.  Like I had mentioned, start tossing on unpatched office, SQL Express or Adobe Reader and work at exploiting those rather than attacking the workstation directly.
Certs: GCWN
(@)Dewser
<<

Preestar

Newbie
Newbie

Posts: 14

Joined: Sat Sep 24, 2011 3:59 pm

Post Tue Sep 27, 2011 3:16 pm

Re: Setting up my own hack lab

So do you mean downloading these programs to my main computer and running exploits on them? I cant get into the xp on my virtual box without running an O/S exploit first?

I'll have a look around see if I can get an unpatched software like you said but it may prove difficult
<<

Triban

User avatar

Hero Member
Hero Member

Posts: 620

Joined: Fri Feb 19, 2010 4:17 pm

Post Tue Sep 27, 2011 7:09 pm

Re: Setting up my own hack lab

Nah install them on your virtual XP box, should be able to do that without a problem.  Why can't you get into your XP box on your VM?  You installed it right?  Why don't you have access to it?
Certs: GCWN
(@)Dewser
<<

Preestar

Newbie
Newbie

Posts: 14

Joined: Sat Sep 24, 2011 3:59 pm

Post Tue Sep 27, 2011 8:05 pm

Re: Setting up my own hack lab

Yes ofcourse I have access to it, but dont I have to hack it from my other virtual box running linux or can I just log into the virtual box running xp and start exploiting stuff
<<

cd1zz

User avatar

Recruiters
Recruiters

Posts: 566

Joined: Sun Oct 03, 2010 9:01 pm

Post Tue Sep 27, 2011 8:41 pm

Re: Setting up my own hack lab

Depends what you're trying to test. If its a remote exploit, you'd do it remotely. If you're testing a local privilege escalation exploit for example, you'd be local. There is a slew of options here depending on the case. If you just want to get your feet wet, look at the ms08-067 bug but make sure you don't have a patch XP box since it was patched long ago. The metasploit module is pretty reliable and you can begin to familiarize yourself with the framework.

You should probably also pick up the latest metasploit book that just came out, its a great reference guide for beginners.

http://www.amazon.com/Metasploit-Penetr ... 072&sr=8-1
Next

Return to Network Pen Testing

Who is online

Users browsing this forum: No registered users and 2 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software