Your Virtual Machines
First steps
There is no better way to learn new stuff than hands-on, right? For a good start, let's analyze your credentials and test the connections. In the e-mail where I sent you VPN creds, you should find also a purplelabs_vadminX_creds.txt file that includes a list of credentials for your OWN dedicated VMs. For simplicity of console listings, we are going to use the above $X = 11 credentials set by default in every lab. Saying that you can assume that whenever you see vadmin11-related logs, then probably it's me :) Anyway, use your own $X credentials set for all the lab instructions.
Let's see what the credential set looks like for sample identifier X = 11:
-
VADMIN_X:
vadmin11
-
PASSWORD_X:
vadmin11
-
BECOME ROOT:
sudo su -
-
KALI_X:
KALI_X_IP = 192.168.38.X
KALI_X_HOSTNAME = kali11
-
PRD_X [CentOS 7]:
PRD_X_IP = 192.168.38.X
PRD_X_HOSTNAME = prd11
-
DEV_X [CentOS 8]:
DEV_X_IP = 10.7.0.10 [192.168.39.X]
DEV_X_SSH_PORT = XXX
DEV_X_HOSTNAME = dev11
-
FUBU_X [Ubuntu 21.04]:
FUBU_X_IP = 10.7.0.10 [192.168.39.X]
FUBU_X_SSH_PORT = XXX
FUBU_X_HOSTNAME = fubu11
-
VPS_X [Ubuntu 20.04 + Katoolin]:
VPS_IP = XXX
VPS_SSH_PORT = 22
VPS_X_USERNAME = root
VPS_X_PASSWORD = passw0rd123
VPS_X_HOSTNAME = vps
RECOMMENDED SSH/CLI TERMINALS
-
Linux:
Terminator
-
Mac OSX:
Tabby
-
Windows:
MobaXterm
My general advice is to have a group of open tabs per PRD_X / DEV_X, etc as we will really need a huge number of active SSH connections per every single box. For a good start, get initial access to all your boxes:
KALI_X INITIAL ACCESS
A group of KALI_X VMs is running on a physical server #h1 where the default internal network subnet is 192.168.38.0/24:
1. Log in to your KALI_X VM via ssh and look around:
# uname -a
Linux kali12 5.18.0-kali5-amd64 #1 SMP PREEMPT_DYNAMIC Debian 5.18.5-1kali6 (2022-07-07) x86_64 GNU/Linux# lsb_release -a
No LSB modules are available.
Distributor ID: Kali
Description: Kali GNU/Linux Rolling
Release: 2021.3
Codename: kali-rolling# cat /etc/resolv.conf
nameserver 8.8.8.8# ifconfig -a
eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.38.132 netmask 255.255.255.0 broadcast 192.168.38.255
inet6 fe80::a00:27ff:fee3:fd35 prefixlen 64 scopeid 0x20<link>
ether 08:00:27:e3:fd:35 txqueuelen 1000 (Ethernet)
RX packets 219093 bytes 237814489 (226.7 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 122664 bytes 66388962 (63.3 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0# ip r s
default via 192.168.38.1 dev eth1 onlink
10.0.2.0/24 dev eth0 proto kernel scope link src 10.0.2.15
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown
192.168.38.0/24 dev eth1 proto kernel scope link src 192.168.38.132 # ps uax
# netstat -antpPRD_X INITIAL ACCESS
A group of PRD_X VMs is running on a physical server #h1 where the default internal network subnet is 192.168.38.0/24:
1. Log in to your PRD_X VM via ssh and look around:
# uname -a
Linux prd11 3.10.0-1160.25.1.el7.x86_64 #1 SMP Wed Apr 28 21:49:45 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux# lsb_release -a
LSB Version: :core-4.1-amd64:core-4.1-noarch
Distributor ID: CentOS
Description: CentOS Linux release 7.9.2009 (Core)
Release: 7.9.2009
Codename: Core# cat /etc/resolv.conf
nameserver 8.8.8.8# ifconfig -a
enp0s8: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.38.232 netmask 255.255.255.0 broadcast 192.168.38.255
inet6 fe80::a00:27ff:fea2:9a1d prefixlen 64 scopeid 0x20<link>
ether 08:00:27:a2:9a:1d txqueuelen 1000 (Ethernet)
RX packets 5040990 bytes 1387587154 (1.2 GiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 8892009 bytes 4640629425 (4.3 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0# ip r s
default via 192.168.38.1 dev enp0s8
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
172.18.0.0/16 dev br-139635b83a45 proto kernel scope link src 172.18.0.1
172.19.0.0/16 dev br-d3fd91bb0118 proto kernel scope link src 172.19.0.1
172.20.0.0/16 dev br-d30704f23e34 proto kernel scope link src 172.20.0.1
172.21.0.0/16 dev br-9a473b9f791c proto kernel scope link src 172.21.0.1
192.168.38.0/24 dev enp0s8 proto kernel scope link src 192.168.38.232 metric 100 # ps uax
# netstat -antpDEV_X INITIAL ACCESS
A group of DEV_X VMs are running on a physical server #H2 where the default internal network subnet is 192.168.39.0/24. #H2 is connected to #H1 by VPN, however, there is no direct routing to 192.168.39.0/24 from 192.168.38.0/24 (It works in the opposite). That's the reason why the IP address of DEV_X and FUBU_X is the same IP 10.7.0.10 for everybody but the difference is in ports definition (NAT port-forwarding). Iptables-based port forwarding for SSH service has been configured to get easier access to the private subnet of #H2.
1. Log in to your DEV_X VM via ssh and look around:
# uname -a
Linux dev12 4.18.0-305.3.1.el8.x86_64 #1 SMP Tue Jun 1 16:14:33 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux# cat /etc/redhat-release
CentOS Linux release 8.4.2105# cat /etc/resolv.conf
nameserver 8.8.8.8# ifconfig -a
enp0s8: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.39.32 netmask 255.255.255.0 broadcast 192.168.39.255
inet6 fe80::a00:27ff:fe0b:a516 prefixlen 64 scopeid 0x20<link>
ether 08:00:27:0b:a5:16 txqueuelen 1000 (Ethernet)
RX packets 6193 bytes 512401 (500.3 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 24949 bytes 9485538 (9.0 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0# ip r s
default via 192.168.39.1 dev enp0s8 proto static metric 101
10.0.2.0/24 dev enp0s3 proto kernel scope link src 10.0.2.36 metric 100
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown
192.168.38.0/24 via 10.0.2.2 dev enp0s3 proto static metric 100
192.168.39.0/24 dev enp0s8 proto kernel scope link src 192.168.39.32 metric 101 # ps uax
# netstat -antpFUBU_X INITIAL ACCESS
A group of FUBU_X VMs is running on a physical server #H2 where the default internal network subnet is 192.168.39.0/24. #H2 is connected to #H1 by VPN, however, there is no direct routing to 192.168.39.0/24 from 192.168.38.0/24 (It works in the opposite). That's the reason why SSH connections point to the same IP 10.7.0.10 for everybody but to different ports. Iptables-based port forwarding for SSH service has been configured for easier access to the private subnet of #H2.
1. Log in to your FUBU_X VM via ssh and look around:
# uname -a
Linux fubu12 5.11.0-49-generic #55-Ubuntu SMP Wed Jan 12 17:36:34 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 21.04
Release: 21.04
Codename: hirsute# cat /etc/resolv.conf
nameserver 8.8.8.8# ifconfig -a
eth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.39.52 netmask 255.255.255.0 broadcast 192.168.39.255
inet6 fe80::a00:27ff:fe6d:f4b6 prefixlen 64 scopeid 0x20<link>
ether 08:00:27:6d:f4:b6 txqueuelen 1000 (Ethernet)
RX packets 1858722 bytes 488301094 (488.3 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 2850459 bytes 1664015163 (1.6 GB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
# ip r s
default via 192.168.39.1 dev eth1 onlink
default via 10.0.2.2 dev eth0 proto dhcp src 10.0.2.15 metric 100
10.0.2.0/24 dev eth0 proto kernel scope link src 10.0.2.15
10.0.2.2 dev eth0 proto dhcp scope link src 10.0.2.15 metric 100
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
192.168.38.0/24 via 10.0.2.2 dev eth0
192.168.39.0/24 dev eth1 proto kernel scope link src 192.168.39.52
# ps uax
# netstat -antpVPS_X INITIAL ACCESS
1. Log in to your VPS_X via ssh, and look around. You can use this machine as a C2 server whenever you want to egress connection to an external public IP.
# uname -a
Linux vps 5.4.0-100-generic #113-Ubuntu SMP Thu Feb 3 18:43:29 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux# ip a s
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether c2:55:80:97:21:5e brd ff:ff:ff:ff:ff:ff
inet XX.XX.XX.XX/24 brd 185.203.117.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 2a07:5741:0:336::1/64 scope global
valid_lft forever preferred_lft forever
inet6 fe80::c055:80ff:fe97:215e/64 scope link
valid_lft forever preferred_lft forever
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:39:da:c2:ec brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
2. Find out what python versions are available by pyenv.
# pyenv versions
* system (set by /root/.pyenv/version)
2.7.183. Find current connections/port listings:
# ss -antp