How to Use SecGen to Generate a Random Vulnerable Machine « Null Byte :: WonderHowTo

Recently, I ran acrossSecGen, a project which allows a user to create random vulnerable machines. I absolutely love vulnerable machines, since a vulnerable VM is a safe and legal way to practice hacking tactics, test out new tools, and exercise your puzzle-solving skills.What really got me interested in SecGen was the randomization feature. Most vulnerable machine downloads are static, meaning each version will always have the same vulnerabilities. Not very realistic. SecGen is different because it can generate unique vulnerable machines.Instead of digging throughVulnHub, or going through the Metasploitable checklist, you can have a vulnerable machine ready to go in minutes, with a different set of challenges each time. SecGen also allows for a good bit of user customization, which would make it useful in generating CTFs, or specifying a challenge for yourself.In this article, I will cover the installation of SecGen on Kali Linux and the generation of a vulnerable machine. If you need a good starter Kali computer for hacking, you can check out our guide linked below on setting one up on thelow-cost Raspberry Pi.Learn More:Build a Kali Linux Hacking Computer on the Raspberry PiStep 1: Installing SecGenAs always, we'll need to update before beginning to ensure everything works properly. You can do this by runningapt-get update. After updating, the first thing to do is clone a copy of this project from the git repository. To do so, type the following into terminal.git clonehttps://github.com/SecGen/SecGenOnce we have our source where we want it, it's time to make sure we have all the dependencies required. To do so, execute the following command in terminal.sudo apt install ruby-dev zlib1g-dev liblzma-dev build-essential patch virtualbox ruby-bundler vagrant imagemagick libmagickwand-devOnce all of the dependencies have completed installation, navigate to your SecGen directory withcd SecGenand run the command:bundle installI didn't prependsudoto this command because it's better practice to run bundle as a non-privileged user. It will prompt for your password, when necessary. Running bundle as root can cause issues and conflicts on your system.If you get a message like the one above, simply check your Ruby version number by typing the following.ruby --versionDepending on your Ruby version complete the steps required. In my case, none.Step 2: Setting Up Your First VMGenerating a random vulnerable VM is supposed to be as easy as typing the following into terminal.ruby secgen.rb runUnfortunately, at the time of writing, there is anissuewith the version of Vagrant from the Kali repository. I also had some issues with Ruby gems. If your machine refuses to come up and has fatal errors, I recommend downgrading your version of Vagrant. In order to do this, you can execute the following command in terminal.apt purge vagrantThen, download the Debian package fromthe Vagrant site.We'll usedpkgto install the vagrant.deb file by typing the following.dpkg -i vagrant1.9.7x86_64.debNow, go back to your SecGen folder and try the following command.ruby secgen.rb runIf this works without errors, you don't need to clean up your Ruby gems. If you encounter errors, you may have some gem issues to fix. You can fix these issues with the command below.sudo gem cleanupI had to do both of the above steps in order to get SecGen running on my system. You may not need to do any. I hope that this issue will be resolved fairly quickly in the future. Once I had completed both steps, I was able to start building my vulnerable machine with the following command.ruby secgen.rb runThe build process takes some time, but it's not too bad. Considering the time it takes to put together a vulnerable machine as an individual, this wait is painless.Looks good. We now have a randomized vulnerable machine. Below, we can see some of the details of our machine.Networking Your Vulnerable Guest OSAs it stands, VirtualBox defaults the machine networking mode to NAT. This isn't going to work for our purposes because while a NAT connected guest will be able to access the internet, it will not be accessible by our host operating system.Image viaVirtualBox ManualWe're going to want to change from NAT to a method that allows us to talk to the VM. Depending on what we want to do, our options are host-only or bridged. Bridged would expose our vulnerable machine to our internal network. This can be a bad thing, so I selected host-only. In VirtualBox, with the machine selected, select "Settings," then select "Network" and change from "NAT" to "Host-only Adapter."This is a safe option for a vulnerable machine. Lastly, we need to find the machine on the network. Usually, you would just log in and check the address, but since this is a boot-to-root, we need to figure out where it is. To do so, we will execute the following command.sudo ifconfigIf you have an issue with ifconfig, you can runapt-get install net-tools.Ifconfig gives us the status of our vboxnet0 adapter, and tells us where to look for our vulnerable machine, in this case the 172.28.128.0/24 address space. Next, let's execute the following command.nmap 172.28.128.0/24 -snNmap should return two results, your host machine, and your guest machine. From here, you should be able to launch your attack on the machine.Don't Miss:How to Conduct Active Reconnaissance & DOS Attacks with NmapDigging a Little DeeperIf you find yourself stuck on a machine, you can have a look at the scenario that was generated for the machine. From within the SecGen repository folder, issue the following command.cd projectsThis directory contains previously generated machines. I only have one machine, so I change directories into that machines directory. Within that directory, there is a scenario.XML file. You can view it with the following command.cat scenario.xml | lessOr, you can alternatively with your favorite text editor, likeVim, by typing the following.vim scenario.xmlI prefer Vim because it offers syntax highlighting.Don't Miss:An Intro to Vim, the Unix Text Editor Every Hacker Should Be Familiar WithIf you're looking for hints, you can also type the following into terminal.cat marker.xml | lessThis will give you hints to help you figure out your randomly generated machine.Step 3: Generating Other ScenariosWriting your own scenarios is out of the scope of this article, but is well-documented atthe SecGen GitHub page. Beyond just generating a random VM with the default scenario, some other scenarios can be passed. An example is below.ruby secgen.rb --scenario scenarios/examples/remotely_exploitable_user_vulnerability.xml runThis will create a VM that has a random remotely exploitable vulnerability. which results in a low privilege compromise.ruby secgen.rb --scenario scenarios/security_audit/team_project_scenario.xml runThis creates a vulnerable set of machines, simulating a mini enterprise structure. SecGen creates an intranet server, a desktop machine, and a web server. These systems can then be configured in such a way as to simulate a breach into an internal network. This is excellent for practicing network pivots.You can find more examples in your ./SecGen/scenarios/examples directory.Stick Around for More on Vulnerable VMsSecGen is an excellent tool to generate vulnerable VMs. The speed and variety make it perfect for students. I'm hoping that as the tool matures, a community will grow around creating scenarios and distributing them. The educational value is definitely there, and my hope is that the project continues on strong!Stay tuned for my following article, in which I will attack my newly generated random VM.Follow Null Byte onTwitterandGoogle+Follow WonderHowTo onFacebook,Twitter,Pinterest, andGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by Barrow/Null ByteRelatedHow To:Attack a Vulnerable Practice Computer: A Guide from Scan to ShellHow To:Create a random pulse machine using stone and redstone in MinecraftHow To:Generate random numbers (integers) in ExcelHow To:Generate random numbers (with decimals) in ExcelHow To:Hack Hackademic.RTB1 Machine Part 1How To:Generate random letters without RANDBETWEEN in ExcelHow To:Create a random frame using Flash and Actionscript 3How To:Use UFONetHow To:Generate random numbers not divisible by 3 in ExcelHow To:Build a working slot machine in MinecraftHow To:Discover XSS Security Flaws by Fuzzing with Burp Suite, Wfuzz & XSStrikeHow To:Diceware Gives You Truly Random Yet Easy-to-Memorize PasswordsHow To:Build a random number generator in Java programmingHow To:Generate Word-Lists with Python for Dictionary AttacksHow To:Hack Coin-Operated Laudromat Machines for Free Wash & Dry CyclesNews:Public Bathroom Fiasco7/6- Tues Pick:Fol Chen / Baths / Random Patterns / PNews:Minecraft World's Weekly Workshop: Reverse Engineering Minecraft Cake DefenseHow To:Make a Programmable Piano in MinecraftNews:old man and the bloody poolNews:Fast Food WarHow To:7 Random Uses for Used Tea BagsNORTHWAY Games:Cool Indies by a Restless Company on the RoadNews:Networking Virtual Machines Using VDENews:New Maintenance Videos!News:It's contest time! That means FREE stuff!GTA 4:Nose Picks, Cops, and CokeNews:Save Me!News:Phone Number TatsHow To:Remotely Control Computers Over VNC Securely with SSHHow To:Create an Automatic Cobblestone Generator in MinecraftHow To:Make a Soda MachineNews:Mindstorms Aircraft Factory