Background:
Metasploitable is a Linux-based vulnerable virtual machine. It is designed especially for people interested in learning system exploitation. Rapid7 maintains Metasploitable and this virtual machine is downloadable from their website. I’d played around with the 1st version of Metasploitable, but did not have much idea about the second version. I wanted to finish one task and wanted to check the same. Yet I didn’t have a vulnerable system handy, so I downloaded Metasploitable version 2. It is a zip file and needs to be extracted. When I extracted the same, it was a VMware image and I was using VirtualBox.
Problem Statement:
There were two major problems I ran into:
The objective of this article is to share my experience with all fellow penetration testers who want to use Metasploitable 2, but are facing the same issue that I did. This article can be used as a hands-on guide; I’ll explain step by step how to set up the virtual machine, the problem I faced, and how I resolved it. By end of the article, we’ll have a VirtualBox image up and running without any problem.
What won’t we cover?
A detailed description of VirtualBox, VM ware or Metasploitable is out of the scope of this article. We will not cover the installation aspects of VirtualBox, either. It is left as an exercise for the end user. This article will only focus on getting the vulnerable machine up and running in an already existing VirtualBox installation.
The following section will explain each of the steps in detail. We’ll also troubleshoot the problems as we face them. The first step for me was to convert the VMware image to the VirtualBox image. I normally use an ISO file and load it up in VirtualBox. This is the first time I came across a VMware image itself and I had to run it. As mentioned earlier due to one or the other reason, VMware image didn’t work for me directly.
As per VirtualBox Documentation, if the “Enable PAE/NX” setting is enabled on VirtualBox, and if it is supported by the operating system, then even a 32-bit x86 CPU can access more than 4 GB of RAM. Metasploitable – which again is based on Ubuntu, requires 4GB memory. Hence, when this feature is enabled, it solves the problem for us and we are able to run it, thus resolving our major problem.
The system is now up, All we need to do is change the network settings and make it host-only and we are good to go with a live penetration testing lab on which we can do all kinds of experiments without really worrying about anything. Even it crashes, all we need to do is reboot!
References:
http://sourceforge.net/projects/metasploitable/files/Metasploitable2/metasploitable-linux-2.0.0.zip/download
Metasploitable is a Linux-based vulnerable virtual machine. It is designed especially for people interested in learning system exploitation. Rapid7 maintains Metasploitable and this virtual machine is downloadable from their website. I’d played around with the 1st version of Metasploitable, but did not have much idea about the second version. I wanted to finish one task and wanted to check the same. Yet I didn’t have a vulnerable system handy, so I downloaded Metasploitable version 2. It is a zip file and needs to be extracted. When I extracted the same, it was a VMware image and I was using VirtualBox.
Problem Statement:
There were two major problems I ran into:
- I was unable to use the VMware image and use it as it is. For some reason, even after trying multiple times, it didn’t work for me. So I needed to convert the VMware image to a VirtualBox Image.
- The second problem was more complex. The first one was a bit easier compared to the second one and this is where I was stuck, as there was no documentation available on how to resolve this problem.
The objective of this article is to share my experience with all fellow penetration testers who want to use Metasploitable 2, but are facing the same issue that I did. This article can be used as a hands-on guide; I’ll explain step by step how to set up the virtual machine, the problem I faced, and how I resolved it. By end of the article, we’ll have a VirtualBox image up and running without any problem.
What won’t we cover?
A detailed description of VirtualBox, VM ware or Metasploitable is out of the scope of this article. We will not cover the installation aspects of VirtualBox, either. It is left as an exercise for the end user. This article will only focus on getting the vulnerable machine up and running in an already existing VirtualBox installation.
The following section will explain each of the steps in detail. We’ll also troubleshoot the problems as we face them. The first step for me was to convert the VMware image to the VirtualBox image. I normally use an ISO file and load it up in VirtualBox. This is the first time I came across a VMware image itself and I had to run it. As mentioned earlier due to one or the other reason, VMware image didn’t work for me directly.
- Convert VMware Image to VirtualBox Image
This step was not very difficult and just by doing a little bit of Googling, I was able to find out how to convert the VMware image to VirtualBox. One can use the following command for image conversion:VBoxManage clonehd Metasploitable.vmdk Metasploitable2-Linux.vdi -format VDI*.vmdk files are VMware extensions and VDI is the extension for VirtualBox. The above command will do the conversion – which can be seen in following screenshot:
Once the above command completes, we have a VirtualBox compatible hard disk ready no. All we need to do is create a new virtual machine and fire it up. - Creating a Virtual MachineNow that we have the VirtualBox image ready, let’s create a new virtual machine and see if this works. Open VirtualBox and Click on Add to create a new Virtual Machine and follow the screenshots in the following order:a. Enter a name of your choice – I’ve keyed in “exploitable.”
b. Next we can choose the memory. By default, it is 256 MB. You can modify this if you want; I went with the default settings.
- c. Choose the hard disk by locating the same from local machine. Here – we’ll point the VirtualBox image to our converted hard disk.
- d. Once hard disk is selected, our screen should look as follows. Click on create button and If all goes well, we should be able to see the following screen
e. Next, Click on “Exploitable” Virtual Machine and click the “Start” button to start the Virtual Machine as shown in following screenshot
f. However, upon starting, the following error is displayed:
Now this is disappointing. After reaching here, if we are unable to boot, then it waters down all our efforts. This is where I was stuck and it took me some time, as I was unable to find any ready reference. I guess not many people were interested in running Metasploitable in VirtualBox! After some research, I finally figured how to fix this problem. - Getting the VirtualBox Image Running
There is one small setting that can resolve our problem. I was able to locate this after referring VirtualBox manuals (and some background knowledge about the Metasploitable distro). Metasploitable is based on Ubuntu Linux and for the latest version of the Ubuntu based distro to work on VirtualBox, we need to Enable PAE/NX option for it to work. Go to Settings > System > Processor and enable the checkbox “Enable PAE/NX.”
Let’s try to boot out Virtual Machine again now.Bingo – it worked! One small tweak and now we have Metasploitable running perfectly on VirtualBox. Following screen shows that system is ready to login for us:
Default credentials are msfadmin/msfadmin.
As per VirtualBox Documentation, if the “Enable PAE/NX” setting is enabled on VirtualBox, and if it is supported by the operating system, then even a 32-bit x86 CPU can access more than 4 GB of RAM. Metasploitable – which again is based on Ubuntu, requires 4GB memory. Hence, when this feature is enabled, it solves the problem for us and we are able to run it, thus resolving our major problem.
The system is now up, All we need to do is change the network settings and make it host-only and we are good to go with a live penetration testing lab on which we can do all kinds of experiments without really worrying about anything. Even it crashes, all we need to do is reboot!
References:
http://sourceforge.net/projects/metasploitable/files/Metasploitable2/metasploitable-linux-2.0.0.zip/download
Want to learn more?? The InfoSec Institute Ethical Hacking course goes in-depth into the techniques used by malicious, black hat hackers with attention getting lectures and hands-on lab exercises. While these hacking skills can be used for malicious purposes, this class teaches you how to use the same hacking techniques to perform a white-hat, ethical hack, on your organization. You leave with the ability to quantitatively assess and measure threats to information assets; and discover where your organization is most vulnerable to black hat hackers. Some features of this course include:
http://www.virtualbox.org/manual/ch03.html- Dual Certification - CEH and CPT
- 5 days of Intensive Hands-On Labs
- Expert Instruction
- CTF exercises in the evening
- Most up-to-date proprietary courseware available
About the Author: arD3n7
arD3n7 works for a leading IT company and is deeply passionate about information security. As a researcher - arD3n7 loves anything and everything related to penetration testing.
These are the steps I did so far:
1. downloaded the Metasploitable2-Linux VM
2. Unzip it somewhere (i.e. C:\VMs\Metasploitable2-Linux
3. opened VMware machine configuration file (Metasploitable.vmx, an easy to understand text file) to see what the main configuration details are for the VM
4. Started VirtualBox (4.2.6)
5. Created a new VM (Metasploitable2) of type Linux/other Linux
6. Set the RAM to 512MB (as original VMware machine)
7. Choose and existing hard drive and point it to file C:\VMs\Metasploitable2-Linux\Metasploitable.vmdk
8. Set network card to NAT (as original VMware machine)
9. Start the VirtualBox machine
10. Enjoy exploiting the vulnerable Linux installation!
I can provide you with more details/screenshots so to avoid the complex conversion process you mentioned in your post. Thanks.