[Inori]

VirtualBox is a powerful tool for all aspects of computer engineering - hardware and software. That said, it's especially useful for pentesters and those who want to run local servers, given the right knowledge.

I'll be doing a tutorial on creating a Debian Linux (Ubuntu, Kali, Mint, Raspbian, etc...) VirtualBox VM and setting up a host-to-guest connection so you can access your test servers from your host OS.

The setup

---

I'm using Debian 8.6.0 as my distro of choice, but you can use anything that's based on it for the purposes of the networking structure.

First and foremost, download a bootable ISO for whatever distro you choose (Debian's is available here) to use and we can get started making the virtual machine.

Creating the VM

---

Once you've downloaded the iso, start VirtualBox and click the "new" button. Give your VM a name and choose the appropriate type (usually Linux -> Debian (64-bit), but Ubuntu has its own because it's cool like that).

After naming the VM, you'll be prompted for the memory size, which you can scale based on how much RAM you have in your computer (2 GB [2048 MB] usually does the trick).

Once you've specified the machine's memory size, you'll be asked about storage. Select "Create a virtual hard disk now" (probably the default option), then VDI for the type on the following page. On the third disk page it is VERY IMPORTANT that you select dynamically allocated storage unless you want a giant file with next to nothing in it sitting on your disk.
On the fourth and final disk page, leave the name as-is and set the size of the virtual disk (I usually use 32 GB, but it's more or less arbitrary and can be changed through the CLI later).

Now that we've created our VM, it's time to install the iso we downloaded earlier. Right-click your new VM, select settings, and go to the "storage" tab. Under "Controller: IDE" click the empty disk, then click the disk on the side to choose your image.


After all that, we can finally start the machine and install the OS. Most (if not all) Debian distros have an easy-to-follow graphical install, so I shouldn't need to explain much.

Configuring the adapter (host)

---

While your VM's operating system is installing, you can save some time by creating and configuring the network adapter.

On the main VirtualBox page, select file -> preferences and navigate to the "network" tab. Under the "host-only networks" heading, click the circuit board with a plus to create a new adapter.


After creating the adapter, select it and click the screwdriver to edit its properties. Change the IPv4 address to anything in the 192.168.x.x range (the last number is more or less arbitrary, I usually set it to 1) and set the mask to 255.255.255.0 if it isn't already.


After setting the IP, navigate to the DHCP Server tab and uncheck "enable server" if it's checked.

Configuring the adapter (vm)

---

Once you've rebooted your VM to make sure everything works as it should, shut it down, open its preferences in VirtualBox (right-click -> settings), and go to network.
Leave Adapter 1 as is (the default NAT adapter gives the VM a "wired" connection), and go to the Adapter 2 tab. Check "Enable Network Adapter" and select "Host-only Adapter" under "Attached to", then select the adapter we made in the last step under "Name".

Now start your VM and run the following command to open your network config file for editing:

Code:

sudo nano /etc/network/interfaces

This is where it gets tricky. The eth0 interface is the NAT one we left alone, and it should look like this in the interfaces file:

Code:

auto eth0 iface eth0 inet dhcp

The eth1 interface (the host-only one we configured) should look like this:

Code:

auto eth1 iface eth1 inet static address 192.168.42.68 netmask 255.255.255.0 network 192.168.42.0 broadcast 192.168.42.255

Extemely important note: The address up to the last dot (192.168.42) is the exact same as the host-only adapter we configured on the host OS. That noted, we need to make sure of a few things:

1. The last number in the "address" parameter must be different than that in the host-only adapter (in our case, it can't be 1)
   this is the address that the host can connect to
   
2. The last number in the "network" parameter must be zero
   
3. The last number in the "broadcast" parameter must be 255
   

After the interfaces are configured, restart the guest system's networking daemon like so:

Code:

sudo systemctl restart networking

Run your new pentest lab

---

Set up a quick app, configure what you need to, and point your browser to the IP you configured in interfaces.

Why should I do this?

---

Pentest labs and development instances are essential to developers that test web applications for vulnerabilities. Without one or both, two things could happen. You could:
a) accidentally destroy your production server due to a vulnerability (which leads to lots of unhappy people and a pissed off programmer)
or b) get busted and criminally charged for poking around on someone else's server without proper permission

[DarkMuse]

Nice tutorial! I usually use Kali specifically for this kind of box. Neat stuff man

[Inori]

I realize this tutorial is really old, but a few additional tricks that might help people out. The first is regarding interfaces: wired interfaces aren't always prefixed with "eth", but may follow the "enp0sX" scheme, where X varies for different interfaces. To find which scheme you should use, run the following command in your VM after creating and connecting the host-only adapter to list all your available adapters.

Code:

$ ip addr list 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 08:00:27:f4:0f:9a brd ff:ff:ff:ff:ff:ff inet 10.0.2.15/24 brd 10.0.2.255 scope global enp0s3 valid_lft forever preferred_lft forever inet6 fe80::a00:27ff:fef4:f9a/64 scope link valid_lft forever preferred_lft forever 3: enp0s8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 08:00:27:6a:4a:f1 brd ff:ff:ff:ff:ff:ff inet 192.168.42.68/24 brd 192.168.42.255 scope global enp0s8 valid_lft forever preferred_lft forever inet6 fe80::a00:27ff:fe6a:4af1/64 scope link valid_lft forever preferred_lft forever

In my case "enp0s3" replaces "eth0", and "enp0s8" replaces "eth1".

The second trick you can use is adding the configured address (the third line of the eth1/enp0s8 interface entry, in this case 192.168.42.68) to the host OS's (base system that's running VirtualBox) hosts file. This provides direct access to the VM's network using the supplied hostname.

Say I called my VM "lab" (original, I know); if I add the following line to my hosts file, I can access the VM "server" directly.

Code:

192.168.42.68   lab.localdomain         lab

To demonstrate, SSH works:

Code:

$ ssh inori@lab inori@lab's password: Linux lab 4.9.0-3-amd64 #1 SMP Debian 4.9.30-2+deb9u3 (2017-08-06) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Wed Sep 13 23:20:18 2017 from 192.168.42.1 inori@lab:~$

And so does visiting the address in browser:

[mothered]

I'm glad you've elaborated on the setup of the virtual network adapters. If not correctly configured, you can experience quite a few Issues along the way.

I deal with VMs everyday (In my network) and given I have my IDS/IPS constantly monitoring traffic, precision Is Imperative. On topic, a very well documented and Illustrated tutorial.

[ARI]

Thanks for this tutorial,
very informative, simple and straightforward

[Edog15]

thanks for the tutorial, much appreciated