Welcome to part six of this module.
Today we're going to be looking at how to download and install met exploited able to on Oracle virtual
box met a spoiler able to is essentially an operating system that is based on Linux but is setup to
be easily hacked by pretty much any tool or application that you would use to penetrate any system.
It's loaded with vulnerabilities and is a perfect test target for the various techniques that we will
be using as this class progresses.
It's very easy to set this up.
All we have to do is open up our browser of choice and do a quick search.
For Mitt a spoiler readable too we see the Web site which is rapid 7.
We'll go ahead and click on it and we'll navigate to the second download link.
The first one will make you fill out a form.
We'll go ahead and click download and we'll begin in a moment.
This is going to come in the form of a zip file so we will click save file OK the file will be downloaded
to the downloads folder.
Once you have unzipped it and selected a path directory for it.
Go ahead and open into it and it basically looks like this.
And as we can see from the icon this is already a virtual box system.
So all we're going to do is we're going to launch virtual box.
We're going to click new we'll name our system.
We met a split able to and we'll change it to Linux and we'll go ahead and click Next.
Next we're going to go ahead and click this radial button that says use an existing virtual hard disk.
Now because I've already done this it says Metis Floyd I will hear yours probably will not say that.
So we're going to click this little folder icon that says choose a virtual hard disk file and then we're
going to come up to add.
Once again you probably won't see anything like what is displayed here although you might if you have
a few virtual systems already installed.
But we're going to click the Add disk image button and we're going to navigate over to wherever we stored
met a split able to when we unzipped it.
In my case that's the downloads folder and we're going to navigate into the folder and we'll see this
mess Floyd able file with the blue virtual box icon and it's rather large.
We're going to click it and we're going to click open then we're going to click it on the list and again
you'll probably only see this option and we're going to select choose.
And now we're going to click Create our midst applicable to machine has now been setup.
We're going to go into settings and we're gonna need to make one very important change.
We're going to go down to network and this is going to be net by default under enable network adapter
attached to Nat.
This would be okay for some operating systems.
However our intention with met hospitable to is to use it as a target for our various hacking techniques
since we own and control this system.
We don't have to worry about most legalities where such things are concerned.
It's our system.
We can do with it as we please.
But in order for our met a split able to system to have a unique IP address on the network.
In other words in order for met hospitable to to show up when we look for it we're gonna need to click
this drag down menu and select bridged adapter and what that's going to do is it's going to mean that
the Met split able to system will have a unique IP address on the network that we can then target with
our various tools and techniques that we're going to be testing if we left.
This is not in the middle split able to machine would share the network IP of our host computer.
And we don't want that because it would make it impossible to specifically target that machine.
So provided that the setting is correct and it should be by default yours will look a little different.
Go ahead and click OK.
And now we're going to click start to start the metal splitsville to virtual machine.
This will take just a moment.
One thing to notice about men exploiting all too is there isn't really a way to get full screen mode
using it the way you can with most other virtualize operating systems.
But this is really not designed to be used as an operating system.
In fact as a security precaution you should never load metal spoil to on any network that you want to
consider secure because it absolutely is made to be hacked.
So only load this when you want to run tests against a target on your own network.
But we're going to load it right now so that I can show you how to log into it if you have the need
once the rather lengthy boot up process is complete.
We'll be presented with a log in screen.
So what we're going to do is we're going to type M S F ad men all one word and the password is the same.
M S F admin this is going to log us into the system.
Now there's various things you can do this is basically a Linux system.
It is all command line there's no graphical interface at all.
Right now the system is up and running.
We could launch attacks against it right now if we wanted to.
And that's pretty much what it's for.
Don't use this as an operating system.
Whatever you do however we're going to need to get one very important piece of information and this
will be repeated at various points in the class when it's relevant.
But so that you know right now if we type i f config we can see under Internet address under F 0 10
dot 0 0 dot 16.
That's I net a DDR.
Now this is our network IP address and that is what we would use to target.
In my case 10 0 0 dot 16.
Yours will vary.
In fact it may change at various points as you may add other things to your local network which may
change the address.
In any case the way you check is just a type I f config and that will give you the address of the target
system.
This will be repeated when it becomes relevant.
Just keep it in mind.
So when we're done using Metis political too we can shut it down in one of two ways.
Now we could just click the X button for virtual box and this would give us the option to save the machine
state and then we could restore the machine state we want to reboot the system.
This is a quick and dirty way to get in and out of any system and it works with metal supportable.
We could also power off the machine that would just beat like a hard reset however but the best thing
to do is to type sudo which stands for super user do shut down now we'll supply our password which once
again is M S F admin and that's going to bring the system down it may take a moment depending on the
speed of your virtual box.
It's a good idea to shut MIT a all down this way when you're done using it and to restart it properly
rather than saving the machine state because you can run into problems when you restore a system image
from a saved state with metal split able to.
If you haven't used it for a while because addresses can change and other things can get a little out
of whack.
So once this is done the window will either close or you'll be dropped into this recovery menu.
It isn't necessary to proceed any further because we have shut the system down properly so we're just
going to power off the system and there we go.
Metis political too is now installed.
Now some students may note that met a spoiler able to is somewhat out of date met a spoiler while 3
does exist and in fact depending on when you're watching this video there may even be a meta spoiler
bill for now.
This class is going to be using metal splitsville to as the the target machine.
That is to say the the test dummy that we're going to be launching our attacks against.
However if students prefer there's no reason that you can't go ahead and install meant a split level
3 following really the exact same instructions that you just saw.
You only need to go to the website and download it and install it exactly as you installed meant exploitable
too.
However it is worth pointing out that meant a split able to just seems to have a few more of the older
vulnerabilities met a split level 3 is fine but I think that overall you get more target vectors with
Metis Floyd all too because you can attack newer and older systems.
Again there's no reason you can't have both.
So go ahead and install metal splitting all three if you want.
Just keep in mind that this class will be using metal split able to unless otherwise noted in future
updates.
Thank you for your attention.