52 Build the Baseline Environment (Eagle Net)

Dante Rocca and Kyle Wheaton

This section is for building a baseline environment. e.g., Your target. We’ll call it Eagle Network, The Eagle, or just Eagle for reference. It will include many of the devices of a real network, but will be abbreviated to conserve host machine resources. You will need to create this enterprise network first before starting any of the attack labs. This is NOT recommended for new learners.

Folks ask, “Why this setup?” This environment provides the most hands-on, real-world-ish experience that accommodates many different types of attacks. DHCP servers are popular targets of hackers. Having an actual server helps us keep that in mind. So where is the firewall? We want you to see the attacks on a quiet network and keep the Wireshark captures clean, so to speak, so you can focus on the attack and see its effects. This is also the reason we use 10-year-old vulnerable machines. They are well-documented, reliable, and still relevant to the attacks we show you in the section. If you ever feel like exploring your skills, you can download more vulnerable machines at Vulnhub.

Phase 0 – Professional Alignment

Effective cybersecurity requires a realistic environment where security tools and techniques can be practiced safely without impacting production systems. In this chapter, you will assemble the Eagle Net enterprise laboratory by integrating routers, servers, workstations, and intentionally vulnerable systems into a complete network that will serve as the target environment for the offensive security exercises that follow. This lab demonstrates how enterprise cyber ranges are built to support security testing, validation, and hands-on training.

DCWF Work Roles

The knowledge and skills developed in this chapter align with the following Department of Defense Cyber Workforce Framework (DCWF) work roles:

  • 541 – Cyber Defense Analyst
  • 511 – Network Operations Specialist
  • 531 – Systems Administrator

NICE Work Roles

This chapter supports competencies associated with the following NICE Workforce Framework for Cybersecurity work roles:

  • Cyber Defense Analyst
  • Network Operations Specialist
  • Systems Administrator

Professional Skills

By completing this chapter, you will begin developing the ability to:

  • Integrate enterprise network components into a functional cyber range.
  • Configure a baseline environment for offensive and defensive security testing.
  • Validate network services and host connectivity across multiple systems.
  • Verify DHCP operation and endpoint configuration throughout the environment.
  • Document enterprise network topology and system roles.
  • Prepare a repeatable laboratory environment for cybersecurity assessments.

What You’ll Be Able to Do

After completing this chapter, you should be able to:

  • Assemble the Eagle Net enterprise environment using the previously configured virtual machines and network infrastructure.
  • Verify that enterprise services and vulnerable systems are functioning correctly.
  • Confirm that client systems receive appropriate network configuration information through DHCP.
  • Validate end-to-end connectivity between network segments and critical systems.
  • Document the baseline network topology to support future offensive security exercises.
  • Prepare a reusable enterprise cyber range for penetration testing, vulnerability assessments, and attack simulations.

 

Learning Objectives

  • Create a network to serve as a target for offensive cyber operations

Prerequisites

Deliverables

  • Four (4) Screenshots are required:
    • GNS3 lab environment
    • Kali box receiving an IP address
    • Metasploitable3-Win box receiving an IP address
    • Metasploitable3-Linux box receiving an IP address

Resources

  • N/A

Contributors and Testers

  • Mathew J. Heath Van Horn, PhD
  • Jacob M. Christensen, Cybersecurity Student, ERAU-Prescott

Phase I – Setting up the network

This lab provides students with a guide to creating a network containing vulnerabilities that can be exploited during a cyber attack. Much of this lab is directly from the DHCP Relay chapter. We highly recommend that once the GNS3 environment is complete, you save a master copy for reuse in future activities.
  1.  The goal is to create a network like this:
    Jigsaw picture of final result
    Figure 1 – Expected final result
  2. Create the following virtual machines and add them to the GNS3 environment:

    NOTE: Not every virtual machine (VM) is used in every lab. To conserve resources, consider replacing any unused machine with a Tiny Core Linux box. This device swap will still display live targets on scans, but it utilizes only 50 MB of memory instead of 2 GB.

    1. TinyCore Linux in Installing Tiny Core Linux
    2. Ubuntu Server VM with all add-ons in Create a Linux Server
    3. Ubuntu Desktop in Create a Ubuntu Desktop
    4. Kali VM in Create a Kali Linux VM
    5. Both Metasploitable 3 (Windows and Linux) VMs in Create a Vulnerable Desktop VM
  3. Configure the Ubuntu Server to handle DHCP requests
    1. Modify the /etc/netplan/*.yaml on the DHCP server
      Screenshot of the network configuration file (.yaml)
      Figure 2 – Ubuntu Server netplan configuration
    2. Modify the /etc/kea/kea-dhcp4.conf file on the DHCP machine
      Screenshot of the DHCP config using KEA
      ” Figure 3 – Ubuntu Server DHCP configuration
    3. Ensure the daemon is active and running

      NOTE: As a reminder to:

      1. Start the service:

      > sudo systemctl start kea-dhcp4-server.service

      2. Restart the service:

      > sudo systemctl restart kea-dhcp4-server.service

      3. Start the service on system boot:

      > sudo systemctl enable kea-dhcp4-server.service

      4. Check service status:

      > systemctl status kea-dhcp4-server.service

      5. Check the configuration for errors

      > kea-dhcp4 -t /etc/kea/kea-dhcp4.conf

      6. Check the system log for additional error messages

      > journalctl -xeu kea-dhcp4-server.service

  4. Configure the router
    1. Assign each interface on the router an IP address according to the following
      1. ether 1 – 150.150.150.1/24
      2. ether 2 – 100.100.100.1/24
      3. ether3 – 200.200.200.1/24
    2. Disable the ether1 DHCP service
    3. Configure the router as a DHCP relay for the Red and Blue networks
  5. Check to make sure that everything is working properly
    1. The attacker’s machine should receive an address from the 100.100.100.0/24 pool
    2. The blue machines should receive addresses from the 200.200.200.0/24 pool
    3. Restart the kea-dhcp4-server.service if needed

Career Connection

Organizations routinely build isolated cyber ranges to evaluate security controls, validate system configurations, conduct penetration testing, and train cybersecurity personnel without exposing production systems to unnecessary risk. Security engineers, cyber defense analysts, penetration testers, and systems administrators rely on baseline environments like Eagle Net to reproduce enterprise scenarios, safely test offensive techniques, and measure the effectiveness of defensive controls. The skills developed in this chapter mirror the planning, integration, and validation processes used to establish realistic training and testing environments that support enterprise cybersecurity operations.

End of Lab

Deliverables

3 Screenshots are needed to earn credit for this exercise:

  • Screenshot of Lab Environment
  • Screenshot of Kali VM receiving an IP address
  • Screenshot of Metasploitable3 VM receiving an IP address
Feedback email
Figure 00 – Contact us via prmaster@erau.edu

License

Icon for the Creative Commons Attribution-NonCommercial 4.0 International License

Mastering Enterprise Networks 3e Copyright © 2024 by Mathew J. Heath Van Horn is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License, except where otherwise noted.

Share This Book