Over at https://www.vulnhub.com/, there are a load of virtual machines ready to be broken, hacked or used as a learning tool. I like a challenge, so I thought I would have a go. All that is required is a suitable VM player, such as virtualbox. For my first challenge, I chose the Frisileaks VM . The Challenge is aimed at a beginner, and is pitched to take around 4 hours.
Once the OVA is downloaded, it is simple to import into virtualbox. I chose to use Kali linux for my host machine, which I would also be launching attacks from. I modified the setttings of the VM, to use a host-only adapter, as I like to have control over what my VMs are doing. Especially when I have just downloaded a random VM from the internet. One that is made for Hackers no-less. Finding out that it did something nasty wouldn't be great, especially as part of the challenge is to have minimal information about the vm before you start.
I also start my VMs headless, so as I later realised, the DHCP IP assigned IP address was sitting on the console for me. The main reason for starting headless is to lower my impatence and not cheat by rooting the vm straight out the box. So my first task was to identify what IP address the VM had been assigned. Fortunately, this vm responds to ICMP pings, so discovery was as simple as running:
nmap -sP 192.168.56.0/24
Continue reading "Vulnhub - Fristileaks walkthrough."