F.1: Pentesting Lab - morgan-hanrahan/Tech-Journal GitHub Wiki
VMWare
Firstly, I had to make sure that my PC was capable of running VMWare Workstation and that the system has 16GB and at least 100GB of spare space. Next, I had to set up my Virtual Network Editor within VMWare Workstation. I add a new network VMnet8 and set it up as NAT with my subnet address as 192.168.229.0. Then I add a second new network vment5 and changed the settings so both Host Connection and DHCP were off and set the subnet address as 10.0.5.0.
Setting up the VMs
Kali
From my web application and security class I already had a kali vm OVA file, which I decided to reuse for this lab. All I had to do was add a new user and make sure I had my network adapter set to NAT. To make sure the network is working properly I did a simply ping to google.com. Now that I had my functioning kali-base set up properly, I simply cloned the box and named it kali-lab.
Vyos
For VyOS, my professor gave me a OVA file that used for the box. This VM was configured with 1 GB of RAM, 1 processor, and 8GB of disk space. For this VM, I connected the first network adapter to NAT and then the second network adapter to vment5. Once I logged into the box I deleted the MAC address from the configuration file and then ran the following commands.
configure
show interfaces
delete interfaces ethernet eth0 hw-id
delete interfaces ethernet eth1 hw-id
show interfaces
commit
save
Now the VM vyos-base is all complete so I cloned it and named my new box vyos-lab. On vyos-lab I ran the following commands to configure the network settings. Double check that the second network adapter was still vmnet5. To test the connectivity I ran another simple ping to google.com.
configure
set interfaces ethernet eth0 address '192.168.229.10/24'
set interfaces ethernet eth0 description 'Nat on VMware Host'
set interfaces ethernet eth1 address '10.0.5.2/24'
set interfaces ethernet eth1 description 'VMNET5-RANGE'
set protocols static route 0.0.0.0/0 next-hop 192.168.229.2
set service ssh listen-address '192.168.229.10'
set system name-server '192.168.229.2'
set service ssh listen-address 192.168.229.10
commit
save
Centos Target
I created a base image for centos titled centos-base. This VM isn't connected to NAT and is soley on vmnet5, which I set up a static IP for. To install CentOS I selected web server. Then under development I selected Development tools and Server Platform Development. For the rest of the setup I ran the following commands.
useradd deployer
passwd deployer
usermod -aG wheel deployer
vi /etc/sudoers
# Uncomment out the %wheel ALL=(ALL) ALL
vi /etc/sysconfig/network-scripts/ifcfg-eth0
# Remove hw id
# Remove UUID
# Add ONBOOT=yes
cd /etc/udev/rules.d
rm 70-persistent-net.rules
Once this is done I installed VMWare Tools. First I needed to mount the media and then I could run the following commands.
mount /dev/cdrom /mnt
cd /mnt
# Let it autofill with the VMware tools name (tab)
cp VMwareTools /tmp
# Let it autofill with the VMware tools name (tab)
tar xf VMwareTools
cd vmware-tools-distrib
chmod +x vmware-install.pl
./vmware-install.pl
# Use all defaults
Finally, I just cleaned up the temp directory and shut down the virtual machine. Since the centos-base was finished I just cloned it and named my new box cupcake.
DHCP Configuration
Now that cupcake is set up, I went back to VyOS and configured DHCP using the following commands.
configure
set service dhcp-server global-parameters 'local-address 10.0.5.2;'
set service dhcp-server shared-network-name DHCPPOOL authoritative
set service dhcp-server shared-network-name DHCPPOOL subnet 10.0.5.0/24 default-router '10.0.5.2'
set service dhcp-server shared-network-name DHCPPOOL subnet 10.0.5.0/24 domain-name 'range.local'
set service dhcp-server shared-network-name DHCPPOOL subnet 10.0.5.0/24 lease '86400'
set service dhcp-server shared-network-name DHCPPOOL subnet 10.0.5.0/24 range POOL1 start '10.0.5.50'
set service dhcp-server shared-network-name DHCPPOOL subnet 10.0.5.0/24 range POOL1 stop '10.0.5.100'
commit
save
Connectivity to Target Network
First install wireguard on kali and create a keypair using.
sudo apt install wireguard
cd /etc/wireguard
umask 077
wg genkey | tee privatekey | wg pubkey > publickey
Next, create the default keypair on vyos.
generate pki wireguard key-pair
# Make note of what the public key is, because you will need it for kali
configure
set interfaces wireguard wg0 private-key 'keygoeshere'
set interfaces wireguard wg0 address '10.0.99.1/24'
set interfaces wireguard wg0 peer namegoeshere allowed-ips '10.0.99.100/32'
set interfaces wireguard wg0 peer namegoeshere public-key keygoeshere
set interfaces wireguard wg0 port '51820'
commit
save
exit
In kali I then ran the following commands to configure the VPN connection.
cd /etc/wireguard/
vi wg0.conf
# Page contents
[Interface]
PrivateKey = kali-private-key
Address = 10.0.99.100/24
[Peer]
PublicKey = vyos-public-key
EndPoint = 192.168.229.131:15820
AllowedIPs = 10.0.99.1/32, 10.0.5.0/24
# Save File
sudo wg-quick up wg0
Now that everything is set up sshing into cupcake from kali should be easy.
Reflection
This lab was challenging for me, but it was ultimately beneficial. I first ran into some issues with the configuration of some of the VMs, but quickly determined it was just the version of the ISO/OVA I was using, so it was a simple adjustment. I then struggled with configuring the wireguard keys. Because I couldn't get copy and paste to function on the VMS, I had to type the keys out by hand, and the vyos commands I was given were out of date. I was able to address these issues and get my ssh operating after some troubleshooting and assistance from my professor. Aside from that, I found this lab to be very simple, having already worked with putting up VMs from scratch.