Changes

SEC520/labs/Lab 1

67 bytes removed, 14:35, 31 January 2018

no edit summary

<h2> Task #1: Install Kali Linux as Host Server on Your Hard Disk Pack (notebook or netbook) and Install VirtualBox</h2>

There are many toolkits that are avaible for individuals to help "harden" their computer systems...

Examples include: Live Hacking CD, Samurai Web Testing Framework,

Organizational Systems Wireless Assistant., Ardius, Operator", etc. There are even distributions for the Raspberry Pi (although we need to have a pen testing solution support virtual machines for this course).

TE: Make certain NOT to accept the default computer name. Use a smaller name (like three letters), otherwise, the telnet server package will NOT be installed by defaultOne tookit that contained many of the penetration-testing tools taught in this course was BackTrack. BackTrack is a specialized distribution based on Ubuntu. A newer distribution called Kali Linux is a newer and more complete build of Linux Backtrack using Debian (i.e. Kali is "BackTrack 6"). There is a noticeable improvement which includes fixes to "broken packages" (less hassle to the student to setup and use), as well as better wireless support, and better flexibility for customization. We will be using Kali Linux for this semester...

{{Admon/important|Our Labs Assume Using a Removable Hard Disk|Although there are several ways to setup your pentration testing system, this lab will assume that you are using a removable hard disk.

Whichever configuration you decide to use, your system MUST allow both the Kali Linux system to be running at the same time as your other vulnerable Windows and Linux operating systems (to conduct penetration testing).

NOTE: It is recommended NOT to use all disk space for the host machine, since a future assignment may require the installation of other host and VM

operating system....

}}

<li>Make certain that you can connect to the Internet (confirm by using a web-broswer)</li>

</ol>

{{Admon/caution|Caution When Running XWindows as Root|It is usually a "bad idea" to run XWindows as root. Running a graphical environment that has the privileges as root can cause damamge when users become accustomed to working in an everyday environment. It is suggested to create a regular user (same one that you added to group admin).

|}}

<ol>

<{{Admon/tip|Other Vulnerable Linux Distributions|Although we will be

using an outdate version of Fedora Linux, there are other Linux

distributions of Linux that are designed with security flaws for

<li>Double-click on the VM called Vulnerable Linux in order to install that version of Linux from the CD drive.</li>

</ol>

{{Admon/important|Auto Capture Keyboard Shortcut Keys|There are a number of methods to focus the keyboard and mouse on the Virtual Machine (VM) as opposed to the host machine. The user can accept the default key <right ctrl> to act as a capture toggle-switch.

}}

<ol>

{{Admon/important|DO NOT Install Service Packs (Beyond Service Pack 1) On Windows 2003 Server|Since this course will be exploring security issues with the Windows operating systems, do not update your Window 2003 Server's OS. We will be exploiting this less-secure OS, then later "harden" this OS from attacks.}}

{{Admon/important|

Do Not Accept Default Computer Name (Use smaller name)| Make certain NOT to accept the default computer name. Use a smaller name (like three letters), otherwise, the telnet server package will NOT be installed by default (needs to be less than 15 characters).}}

INSTRUCTIONS:

<ol>

<li>At the Windows Server Post-Setup Updates screen, do NOT perform any updates, and proceed with exiting the screen.</li>

<li>You will proceed to a Windows Server Post-Setup Wizard to help manage your server (like installing services or roles). Make certain that the following wizard settings (or roles) have been added to your Windows server Virtual Machine (for later exploitation):

<ul> <li>NO Updates / NO Automatic Updates</li> <li>In the Manage Your Server section, make the following selections (add roles): <ul> <li>IIS<ul><li>NOTE: Select Administration, Add Software, view existing services, select IIS, click Details, and then select FTP server.</li></ul></li> <li>SMTP SERVER</li> <li>TELNET SERVER<ul> <li>NOTE: Select Administration, Services, scroll down the list to Telnet, right-click a select View Properties, enable telent server, Apply settings, and then Start the telent server.</li></ul></li> <li>SSH SERVER <ul> <li>NOTE:You can download and install FreeSSH from the following URL: [http://www.freesshd.com/freeSSHd.exe http://www.freesshd.com/freeSSHd.exe]. </li> </ul> </li> </olul> </li> </ul></li>

~~~~{{Admon/important|Verification of Running Services|

To verify that services are running, you can select Start, Administration, Services. Note: To view that SSH service is running, select the On Demand services tab.

|}}

~~<ol>~~

<li value="9">Verify that all the above-mentioned services are running.</li>

~~</ol>~~

{{Admon/important|Register (Activate) Windows Server / Connectivity Issues|

You have 30 days to register your Windows 2003 Server. If you are experiencing connectivity issues to register your Windows 2003 Server, you can power-off Windows 2003 Server, go to Virtual Box main window (for your Vulnerable Windows server), select in the menu Settings, choose the Networktab, and change to Bridged Connection for the appropriate network card. When you start your Windows 2003 Server and login as Administrator, then you should be able to register your copy of Windows 2003 Server...

|}}

~~<ol>~~ <li value="10">Make certain that Firewall is DISABLED.~~</li>~~ ~~</ul></li>~~ ~~</ul>~~ </li>

<li>Proceed to "Completing the Lab".</li>

</ol>

Answer Task #3 observations / questions in your lab log book.

Nathan.misener

53

edits

CDOT Wiki β

Changes

SEC520/labs/Lab 1

CDOT Wiki ^β