BUILD A HOMELAB TO PREP FOR OSCP / SECURITY RESEARCH
Table of Contents
- 1. Introduction
- 1.1. Host Prep
- 1.2. My Lab Specs
- 1.3. VMs to build
- 1.4. Research Material
- 1.5. Programs to write
- 1.5.1. TODO Make a program in ruby that will convert other image files to raw files. we will need to run this in bulk after dl of ova images
- 1.5.2. TODO Make a program in ruby that will download the .ova files from https://download.vulnhub.com/checksum.txt
- 1.5.3. TODO Make a program in ruby that will generate ssh keypairs for our vms
- 1.5.4. TODO Make a program that configures a static ip address for a host system in ruby (most of the vulnhub vms come configured with dhcp, but this will still be a nice tool to have for vm reconfiguring if ever needed)
- 1.5.5. TODO RESEARCH: Make a program that will allow you to export an org-mode document in emacs to a pentest report.
1 Introduction
When I started my search on the internet on creating a lab environment for security research and learning the skills of penetration test, I was often frustrated. Many of the articles and how-to guides that I found were using Windows as the host operating system and/or VMware as the hypervisor. I like linux very much and I have grown to really enjoy using qemu/kvm. libvirt has a great community behind it that offers bindings in many different programming languages (https://libvirt.org/bindings.html). We can use automation to build efficient methods for spawning purposelly vulnerable systems to hack away at til our heads fall off.
In my efforts to build a lab that will withstand the test of time, I purchased a very expensive CPU for my home system. I stacked it with RAM and lots of spinning space, and some SSD space as well. You do not need to go crazy like I did and buy a bunch of hardware. This will work on a laptop with a decent amount of RAM to allocate to the VMs and a modern CPU. It also needs to support VT-D.
I am going to be primarily using ruby and bash scripting to glue everything together. I am sure it will not be the prettiest code, but it will solve the problem.
1.1 Host Prep
First you are going to want to ensure that your system is capable of running virtualization software. Most modern Intel and AMD based processors will support this. However, they may have the option disabled within the Bios. You will need to check with your motherboard manufacturer to see if your system supports VT-D support.
1.1.1 TODO RESEARCH: - add in the methods to check to make sure the system is ready to deploy kvm/qemu (cpu flags for vt-d/grub options/bios options….etc, attach or link images if neccessary)
def get_cpu_flags cpu_flags = `grep flags /proc/cpuinfo | cut -f 2 -d : | uniq`.strip end cpu_flags = get_cpu_flags
1.3 VMs to build
- TODO RESEARCH: can we figure out a way to start a base template VM, and based on a set of vulns that we give the VM at deploy time, spin up the VM with those vulns?
- TODO OpenVas VM
- TODO Kanban board (investigate opensource JIRA alternatives)
- Atlassian offers confluence, bitbucket, and jira all for $10 per year per 10 users. I like these tools, so I am more than happy to pay them for them.
- TODO Issue tracking (bugzilla maybe?)
- TODO Wiki - (as close to confluence as we can find)
- DONE Pentest System (Kali linux and/or pentoo)
- TODO Vulnerable system with multiple web apps (multidae, dvwa)
- OWASP Broken Web Application Project - https://www.owasp.org/index.php/OWASP_Broken_Web_Applications_Project#tab=Main
1.4 Research Material
1.4.1 Filesystem specific(I used ZFS as my main FS)
1.4.2 Web Application Testing:
1.4.3 Pentest Specific:
1.5 Programs to write
1.5.1 TODO Make a program in ruby that will convert other image files to raw files. we will need to run this in bulk after dl of ova images
def file_exists(filename) File.file?(filename) # return true if filename exists end def convert_file(format, filename) # needs qemu-img binary installed on the system, returns a new raw image file `qemu-img convert -f #{format} -O raw "#{filename}" "#{filename}.img"` end # I am using a 56MB vmdk file to test the conversion process def test_convert(format, filename) file_exists(filename) convert_file(format, filename) end test_convert('vmdk', '/storage/virtual_machines/DSL-4.4.10-disk1.vmdk')
1.5.2 TODO Make a program in ruby that will download the .ova files from https://download.vulnhub.com/checksum.txt
class DownloadVulnHubTorrents require 'csv' def initialize @base_url = 'https://download.vulnhub.com' end # get the checksum file which has checksums + urls. we can automate the check of the files and compare with the checksums to make sure everything downloaded matches def download_checksum checksum_url = "#{@base_url}/checksum.txt" `wget #{checksum_url}` # download the checksum file end def gather_urls(filename) urls = `awk ' { print $2 } ' #{filename} | sed 's/^\./''/g' | grep -E 'ova|torrent|zip|tar|txt|gz|gzip|iso|7z|exe|text|img|png|jpg|jpeg|md|LICENSE|README'` CSV.parse(urls).flatten end end vulnhubber = DownloadVulnHubTorrents.new vulnhubber.download_checksums vulnhubber.gather_urls('/home/booboy/bin/mygit/homelab_scripts/checksum.txt')
1.5.3 TODO Make a program in ruby that will generate ssh keypairs for our vms
found a nice ruby gem sshkey gem
require 'sshkey' def gen_ssh_keypair k = SSHKey.generate( type: "DSA", bits: 1024, comment: "foo@bar.com", passphrase: "foobar" ) end keypair = gen_ssh_keypair