14 Create a Vulnerable Desktop VM

Mathew J. Heath Van Horn, PhD

Metasploitable is an intentionally vulnerable virtual machine (VM) designed for security training, testing security tools, and practicing standard penetration testing techniques. There are different flavors of Metasploitable (original, 2, and 3), and each offers many features typically found in servers and websites, except that they are entirely vulnerable to attacks. Metasploitable 2 is easier to build and is based on Linux. However, it is outdated and has been replaced by Metasploitable 3, which supports both Linux and Windows Server.

Phase 0 – Professional Alignment

Cybersecurity professionals must understand how attackers exploit vulnerable systems in order to design effective defenses. In this chapter, you will deploy intentionally vulnerable virtual machines that serve as realistic targets for penetration testing, vulnerability assessment, and incident response exercises. These systems provide a safe environment for developing offensive and defensive cybersecurity skills without placing production networks at risk.

DCWF Work Roles

The knowledge and skills developed in this chapter align with the following Department of Defense Cyber Workforce Framework (DCWF) work roles:

  • 541 – Cyber Defense Analyst
  • 451 – System Security Analyst
  • 511 – Network Operations Specialist

NICE Work Roles

This chapter supports competencies associated with the following NICE Workforce Framework for Cybersecurity work roles:

  • Cyber Defense Analyst
  • Vulnerability Assessment Analyst
  • Network Operations Specialist

Professional Skills

By completing this chapter, you will begin developing the ability to:

  • Deploy intentionally vulnerable systems within an isolated enterprise environment.
  • Configure virtual machines to support cybersecurity training and testing.
  • Integrate vulnerable hosts into enterprise network topologies.
  • Validate the availability of target systems for security assessments.
  • Prepare controlled environments for penetration testing and vulnerability analysis.
  • Document laboratory configurations to support repeatable cybersecurity exercises.

What You’ll Be Able to Do

After completing this chapter, you should be able to:

  • Install and configure vulnerable Linux and Windows virtual machines.
  • Integrate vulnerable systems into your GNS3 enterprise laboratory.
  • Verify that the systems are accessible and functioning as intended.
  • Prepare realistic target systems for future penetration testing and defensive security exercises.
  • Document the configuration of vulnerable hosts for use in subsequent laboratory activities.
  • Maintain a safe, isolated environment for practicing offensive cybersecurity techniques.

 

Learning Objectives

  • Successfully download, install, and run Metasploitable 2 in VirtualBox and add it to the GNS3 environment.
  • Successfully download, build, and run Metasploitable 3 in VirtualBox and add it to the GNS3 environment.

Prerequisites

Deliverables

  • None – this is a preparatory lab that supports other labs in this book

Resources

Contributors and Testers

  • Kyle Wheaton, Cybersecurity student, ERAU – Prescott

Phase I – Installing Metasploitable 2 – Sourceforge

This is an easy way to download Metasploitable 2 as a VM. However, it is an older repository.

NEVER expose this VM to an untrusted network. Use NAT or Host-Only modes when using this VM.

Metasploitable 2 is VERY old. It still works as a vulnerable machine, but its usefulness may be limited.

  1. Visit SourceForge and download the Metasploitable 2 zip file
  2. Once downloaded, unzip the file and note the location where it is extracted.
  3. Open VirtualBox and create a new virtual machine
    1. On the VirtualBox menu, click on Machine, then New…
    2. Choose a name for the new Virtual Machine (VM).  In this case, we will call it Metasploitable 2
    3. Select the folder where you want the VM to reside
    4. Select Type: Linux
      Select Version: Oracle Linux (64-bit)
      Create a new machine
      Figure 1 – Create a new machine
    5. Click on “Specify virtual hardware” and make the following adjustments:
      1. Base memory: 2048 MB
      2. Processors: 2
        specify virtual hardware
        Figure 2 – specify virtual hardware
    6. Click on “specify virtual hard disk” and make the following adjustments:
      1. Click on Use an existing virtual hard disk file
        use an existing hard disk
        Figure 3 – use an existing hard disk
      2. Click on the folder next to the dropdown menu
      3. Click on the Add button
        screenshot of virtual box
        Figure 4 – Virtual Hard Disk Selector
      4.  Navigate to the location of the file you extracted and select it
        screenshot of where metasploitable 2 VM hard disk is located within Windows file system
        Figure 5 – Add the Metasploitable Virtual Hard Disk File
      5. Click on Open and notice it is now in the hard disk selector menu.  Keep it selected and click on Choose
        Screenshot of commands
        Figure 6 – Attach the file
      6. It is now selected as our hard disk file, so click Finish
      7. Click Finish, and you can see it added to the rest of your VMs
        it is now in VirtualBox
        Figure 7 – Metasploitable 2 is now in VirtualBox
  4. Now you can start it up like any other VM, and the login information is
    USER: msfadmin
    PASSWORD: msfadmin

A note on hardware

Metasploitable 2 startup error
Figure 8 – Metasploitable 2 startup error

Metasploitable2 is outdated, and hardware and software have evolved. If you get an error when you try to start the machine, take the following steps:

  1.  Close the virtual machine
  2. Open settings, go to the motherboard settings, and disable all the extended features
    disable all the extended features
    Figure 9 – disable all the extended features
  3. Press ok

Phase II – Installing Metasploitable3

Metasploitable3 comes in two flavors: Windows and Linux.  Because of licensing issues, sharing Metasploitable 3 as a Windows VM is prohibitive, but you may build the image without violating any laws.

  1. Visit Rapid7’s GitHub page for metasploitable3 and read the README file. You will see lots of steps.  We are going to follow the steps for building the VM using Windows
  2. Install some supporting software
    1. Install Packer
      1. Download the precompiled binary (AMD64) for Windows 11
      2. Once downloaded, extract it from the zip file.  We are extracting all the supporting software files to the Downloads folder
        Pciture of commands
        Figure 10 – Extract the downloaded file
      3. In the Windows Start menu type “environment variables” and click on the menu item when it appears
        Search environment variables
        Figure 11 – Search environment variables
      4. Click on the Environment Variables button
        System Properties Window
        Figure 12 – System Properties Window
      5. Scroll down to Path and click on edit
        screenshot of commands
        Figure 13 – Editing path environment variable
      6. Click New, then browse to the downloads folder, then scroll until you find the extracted packer folder. Then click ok.”
        Screenshot of commands
        Figure 14 – Adding a folder to the path variable

         

         

      7. Click ok until the system properties menu closes
      8. Open a new PowerShell window for the changes to take effect
      9. Type packer (highlighted in yellow) and you should get a list of available commands.  This means Packer is working
        packer is working
        Figure 15 – Image of packer working
    2. Install Vagrant
      1. Visit the Vagrant downloads page and download the appropriate package
      2. Once downloaded, you can click on the file and install it like any other Windows program
      3. Restart the Computer
      4. Open Windows PowerShell
      5. Type vagrant to see a menu of commands
      6. Create a new vagrant environment by typing

        vagrant init

      7. Install the vagrant reload plugin that allows the reloading of VMs as they are being created by typing

        vagrant plugin install vagrant-reload

      8. Create a new vagrant box by typing

        vagrant box add hashicorp/bionic64

      9. When asked, choose option 2 for VirtualBox
        Select option 2 for VirtualBox
        Figure 16 – Select option 2 for VirtualBox
    3. Install both versions of metsasploitable (Windows and Linux) by doing the following:
      1. Create a new directory by typing

        mkdir metasploitable3-workspace

      2. Navigate to the directory by typing

        cd metasploitable3-workspace

      3. Extract both versions of metasploitable3 by typing  the following (all on one line)

        Invoke-WebRequest -Uri “https://raw.githubusercontent.com/rapid7/metasploitable3/master/Vagrantfile” -OutFile “Vagrantfile”

      4.   Start the building of the VMs by typing

        vagrant up

        Sleeping 0
        Figure 17 – This could take awhile
    4. This will take some time, but once it’s finished, you’ll have two new VMs in VirtualBox. The credentials for both machines is:
      USER: vagrant
      PASSWORD: vagrant
  3. Now add them to the GNS3 environment for future use

 

Career Connection

Cybersecurity teams routinely build isolated laboratory environments that replicate real-world systems for security testing, vulnerability research, malware analysis, and incident response training. Rather than testing against production systems, organizations use dedicated lab environments to safely identify weaknesses, validate security controls, and train personnel. The vulnerable systems you create in this chapter become the foundation for many of the offensive and defensive cybersecurity exercises that follow, providing practical experience with the same methodologies used by penetration testers, cyber defense analysts, and security researchers.

End of Lab

Feedback email
Figure 00 – Contact us via prmaster@erau.edu

License

Icon for the Creative Commons Attribution-NonCommercial 4.0 International License

Mastering Enterprise Networks 3e Copyright © 2024 by Mathew J. Heath Van Horn is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License, except where otherwise noted.

Share This Book