This Home Lab project aimed to create a controlled environment with virtual machines, for simulating and defending against cyber attacks. The focus was on using Kali Linux to launch attacks on an Ubuntu VM, while using UFW for defense and analyzing network traffic with Wireshark. This hands-on experience was designed to enhance my understanding of cybersecurity TTP's, attack methods, and effective defense strategies.
- Learnt how to set up, configure and manage virtual environments.
- Experience in penetration testing with Metasploit.
- Developed skills in network configuration and traffic analysis using Wireshark.
- Ability to implement and configure firewall defenses with UFW.
- Enhanced understanding of attack patterns and security vulnerabilities.
- Development of critical thinking and problem-solving skills in cybersecurity.
- VMware to create and configure the virtual machines.
- Kali Linux, a penetration testing platform to launch an attack.
- Metasploit, a penetration testing framework used to exploit vulnerabilities and simulate attacks
- Wireshark, for capturing and examining network traffic.
- UFW, a firewall management tool on Ubuntu for configuring and enforcing security rules.
I started by downloading the disc images for Ubuntu and Kali, then uploaded them into VMware.
Then I set up both systems and configured network, disc and other settings.
Once both were up and running, I updated and upgraded both systems to make sure they up to date.
I then installed wireshark, nmap and Metasploit on Kali.
Then Wireshark and UFW on Ubuntu, with sudo apt install wireshark UFW, and turned on UFW.
I got the hostname of my Ubuntu machine, so I could target it from Kali, and the hostname of my Kali machine and allowed that host on my Ubuntu UFW.
I then started Wireshark on the Ubuntu machine with sudo wireshark, and ran an nmap scan from Kali to the target Ubuntu machine.
However the nmap scan showed no open ports on my Ubuntu VM, so I checked for open ports on Ubuntu.
After some troubleshooting some of these seemed to be open but the nmap scan couldnt see them and I checked that my Kali could reach Ubuntu with ping .... I then decided to start a service on my Ubuntu VM, so I installed apache2 web server and started that. I could now see this service listening on port 80, HTTP.
I then ran a nmap -sV scan, to get the version of services, which returned an open port, the apache web server.
With Metasploit I was able to search for known vulnerabilities for the apache web server but nothing for the version I was using.
In conclusion, this project introduced my to many essential tools and skills, some of which I had never even heard of before, and massively helped me troublshoot issues. Also it sparked my curiousity and I want to continue playing around with tools like Metasploitable.
As I couldn't break into an up to date Ubuntu machine, I tried a intentionally vulnerable VM, Metasploitable. However, as ait is made for x86 architecture and I am using a mac, I had to emulate it using UTM. This included coverting the .vmdk file to a .qcow2 (QEMU disk file), and then configuring it in UTM.
I got the IP address of the target metasploitable machine using ifconfig.
Then I ran a nmap scan from my Kali machine, using -sV to get the versions of each of the services.
I chose the vsftpd 2.3.4 service to attempt to exploit so within the msfconsole I searched for exploits.
I selected a exploit with use exploit/unix/ftp/vsftpd_234_backdoor. I then started to configure the options.
I then set the RHOST, the IP address of the target machine, and selected the payload, only one available.
Then I ran exploit to execute the exploit and I was in. Using uname -a confirmed that I was into my Metasploitable target machine and I had root access.
