1 00:00:00,390 --> 00:00:03,530 Welcome to part six of this module. 2 00:00:03,780 --> 00:00:11,580 Today we're going to be looking at how to download and install met exploited able to on Oracle virtual 3 00:00:11,580 --> 00:00:18,930 box met a spoiler able to is essentially an operating system that is based on Linux but is setup to 4 00:00:18,930 --> 00:00:29,310 be easily hacked by pretty much any tool or application that you would use to penetrate any system. 5 00:00:29,340 --> 00:00:36,600 It's loaded with vulnerabilities and is a perfect test target for the various techniques that we will 6 00:00:36,600 --> 00:00:39,050 be using as this class progresses. 7 00:00:39,060 --> 00:00:40,760 It's very easy to set this up. 8 00:00:40,770 --> 00:00:46,410 All we have to do is open up our browser of choice and do a quick search. 9 00:00:48,070 --> 00:00:53,960 For Mitt a spoiler readable too we see the Web site which is rapid 7. 10 00:00:54,010 --> 00:00:57,880 We'll go ahead and click on it and we'll navigate to the second download link. 11 00:00:57,880 --> 00:01:00,220 The first one will make you fill out a form. 12 00:01:00,310 --> 00:01:03,960 We'll go ahead and click download and we'll begin in a moment. 13 00:01:03,970 --> 00:01:12,130 This is going to come in the form of a zip file so we will click save file OK the file will be downloaded 14 00:01:12,160 --> 00:01:14,260 to the downloads folder. 15 00:01:14,260 --> 00:01:19,880 Once you have unzipped it and selected a path directory for it. 16 00:01:19,960 --> 00:01:25,010 Go ahead and open into it and it basically looks like this. 17 00:01:25,070 --> 00:01:28,940 And as we can see from the icon this is already a virtual box system. 18 00:01:28,940 --> 00:01:33,320 So all we're going to do is we're going to launch virtual box. 19 00:01:33,320 --> 00:01:39,730 We're going to click new we'll name our system. 20 00:01:40,050 --> 00:01:46,290 We met a split able to and we'll change it to Linux and we'll go ahead and click Next. 21 00:01:46,310 --> 00:01:51,980 Next we're going to go ahead and click this radial button that says use an existing virtual hard disk. 22 00:01:52,040 --> 00:01:57,480 Now because I've already done this it says Metis Floyd I will hear yours probably will not say that. 23 00:01:57,500 --> 00:02:03,230 So we're going to click this little folder icon that says choose a virtual hard disk file and then we're 24 00:02:03,230 --> 00:02:04,420 going to come up to add. 25 00:02:04,430 --> 00:02:10,670 Once again you probably won't see anything like what is displayed here although you might if you have 26 00:02:10,670 --> 00:02:12,860 a few virtual systems already installed. 27 00:02:12,860 --> 00:02:19,250 But we're going to click the Add disk image button and we're going to navigate over to wherever we stored 28 00:02:19,250 --> 00:02:21,820 met a split able to when we unzipped it. 29 00:02:21,950 --> 00:02:27,650 In my case that's the downloads folder and we're going to navigate into the folder and we'll see this 30 00:02:27,740 --> 00:02:33,900 mess Floyd able file with the blue virtual box icon and it's rather large. 31 00:02:33,950 --> 00:02:41,350 We're going to click it and we're going to click open then we're going to click it on the list and again 32 00:02:41,350 --> 00:02:46,140 you'll probably only see this option and we're going to select choose. 33 00:02:46,210 --> 00:02:51,760 And now we're going to click Create our midst applicable to machine has now been setup. 34 00:02:51,940 --> 00:02:57,390 We're going to go into settings and we're gonna need to make one very important change. 35 00:02:57,460 --> 00:03:04,780 We're going to go down to network and this is going to be net by default under enable network adapter 36 00:03:04,810 --> 00:03:06,480 attached to Nat. 37 00:03:06,550 --> 00:03:10,960 This would be okay for some operating systems. 38 00:03:10,960 --> 00:03:18,880 However our intention with met hospitable to is to use it as a target for our various hacking techniques 39 00:03:19,000 --> 00:03:21,120 since we own and control this system. 40 00:03:21,130 --> 00:03:25,870 We don't have to worry about most legalities where such things are concerned. 41 00:03:25,870 --> 00:03:27,370 It's our system. 42 00:03:27,370 --> 00:03:29,110 We can do with it as we please. 43 00:03:29,110 --> 00:03:35,470 But in order for our met a split able to system to have a unique IP address on the network. 44 00:03:35,470 --> 00:03:42,220 In other words in order for met hospitable to to show up when we look for it we're gonna need to click 45 00:03:42,340 --> 00:03:48,610 this drag down menu and select bridged adapter and what that's going to do is it's going to mean that 46 00:03:48,610 --> 00:03:56,200 the Met split able to system will have a unique IP address on the network that we can then target with 47 00:03:56,200 --> 00:04:00,430 our various tools and techniques that we're going to be testing if we left. 48 00:04:00,430 --> 00:04:06,370 This is not in the middle split able to machine would share the network IP of our host computer. 49 00:04:06,400 --> 00:04:11,860 And we don't want that because it would make it impossible to specifically target that machine. 50 00:04:12,040 --> 00:04:17,310 So provided that the setting is correct and it should be by default yours will look a little different. 51 00:04:17,320 --> 00:04:19,210 Go ahead and click OK. 52 00:04:19,630 --> 00:04:25,330 And now we're going to click start to start the metal splitsville to virtual machine. 53 00:04:25,330 --> 00:04:27,260 This will take just a moment. 54 00:04:27,280 --> 00:04:32,980 One thing to notice about men exploiting all too is there isn't really a way to get full screen mode 55 00:04:33,100 --> 00:04:37,710 using it the way you can with most other virtualize operating systems. 56 00:04:37,720 --> 00:04:42,230 But this is really not designed to be used as an operating system. 57 00:04:42,280 --> 00:04:49,900 In fact as a security precaution you should never load metal spoil to on any network that you want to 58 00:04:49,900 --> 00:04:55,210 consider secure because it absolutely is made to be hacked. 59 00:04:55,210 --> 00:05:03,440 So only load this when you want to run tests against a target on your own network. 60 00:05:03,460 --> 00:05:08,110 But we're going to load it right now so that I can show you how to log into it if you have the need 61 00:05:08,560 --> 00:05:11,220 once the rather lengthy boot up process is complete. 62 00:05:11,230 --> 00:05:13,420 We'll be presented with a log in screen. 63 00:05:13,450 --> 00:05:23,770 So what we're going to do is we're going to type M S F ad men all one word and the password is the same. 64 00:05:23,770 --> 00:05:31,180 M S F admin this is going to log us into the system. 65 00:05:31,180 --> 00:05:35,800 Now there's various things you can do this is basically a Linux system. 66 00:05:35,800 --> 00:05:39,510 It is all command line there's no graphical interface at all. 67 00:05:39,550 --> 00:05:41,920 Right now the system is up and running. 68 00:05:41,950 --> 00:05:45,700 We could launch attacks against it right now if we wanted to. 69 00:05:45,700 --> 00:05:47,130 And that's pretty much what it's for. 70 00:05:47,130 --> 00:05:49,330 Don't use this as an operating system. 71 00:05:49,330 --> 00:05:54,190 Whatever you do however we're going to need to get one very important piece of information and this 72 00:05:54,190 --> 00:05:58,060 will be repeated at various points in the class when it's relevant. 73 00:05:58,270 --> 00:06:10,630 But so that you know right now if we type i f config we can see under Internet address under F 0 10 74 00:06:10,750 --> 00:06:13,980 dot 0 0 dot 16. 75 00:06:14,230 --> 00:06:16,750 That's I net a DDR. 76 00:06:16,810 --> 00:06:22,690 Now this is our network IP address and that is what we would use to target. 77 00:06:22,690 --> 00:06:25,930 In my case 10 0 0 dot 16. 78 00:06:25,960 --> 00:06:27,640 Yours will vary. 79 00:06:27,640 --> 00:06:34,810 In fact it may change at various points as you may add other things to your local network which may 80 00:06:34,810 --> 00:06:36,070 change the address. 81 00:06:36,070 --> 00:06:42,490 In any case the way you check is just a type I f config and that will give you the address of the target 82 00:06:42,490 --> 00:06:43,240 system. 83 00:06:43,240 --> 00:06:45,840 This will be repeated when it becomes relevant. 84 00:06:45,850 --> 00:06:47,440 Just keep it in mind. 85 00:06:47,440 --> 00:06:52,780 So when we're done using Metis political too we can shut it down in one of two ways. 86 00:06:52,780 --> 00:07:00,460 Now we could just click the X button for virtual box and this would give us the option to save the machine 87 00:07:00,460 --> 00:07:05,290 state and then we could restore the machine state we want to reboot the system. 88 00:07:05,290 --> 00:07:10,500 This is a quick and dirty way to get in and out of any system and it works with metal supportable. 89 00:07:10,510 --> 00:07:16,120 We could also power off the machine that would just beat like a hard reset however but the best thing 90 00:07:16,120 --> 00:07:28,210 to do is to type sudo which stands for super user do shut down now we'll supply our password which once 91 00:07:28,210 --> 00:07:34,240 again is M S F admin and that's going to bring the system down it may take a moment depending on the 92 00:07:34,240 --> 00:07:35,830 speed of your virtual box. 93 00:07:35,830 --> 00:07:43,630 It's a good idea to shut MIT a all down this way when you're done using it and to restart it properly 94 00:07:44,170 --> 00:07:50,770 rather than saving the machine state because you can run into problems when you restore a system image 95 00:07:50,770 --> 00:07:53,860 from a saved state with metal split able to. 96 00:07:53,860 --> 00:07:58,600 If you haven't used it for a while because addresses can change and other things can get a little out 97 00:07:58,600 --> 00:07:59,110 of whack. 98 00:07:59,140 --> 00:08:06,080 So once this is done the window will either close or you'll be dropped into this recovery menu. 99 00:08:06,140 --> 00:08:10,700 It isn't necessary to proceed any further because we have shut the system down properly so we're just 100 00:08:10,700 --> 00:08:16,040 going to power off the system and there we go. 101 00:08:16,070 --> 00:08:18,670 Metis political too is now installed. 102 00:08:18,770 --> 00:08:26,510 Now some students may note that met a spoiler able to is somewhat out of date met a spoiler while 3 103 00:08:26,630 --> 00:08:32,710 does exist and in fact depending on when you're watching this video there may even be a meta spoiler 104 00:08:32,720 --> 00:08:33,890 bill for now. 105 00:08:33,890 --> 00:08:40,900 This class is going to be using metal splitsville to as the the target machine. 106 00:08:40,910 --> 00:08:46,070 That is to say the the test dummy that we're going to be launching our attacks against. 107 00:08:46,070 --> 00:08:51,820 However if students prefer there's no reason that you can't go ahead and install meant a split level 108 00:08:51,850 --> 00:08:56,330 3 following really the exact same instructions that you just saw. 109 00:08:56,330 --> 00:09:01,760 You only need to go to the website and download it and install it exactly as you installed meant exploitable 110 00:09:01,760 --> 00:09:02,740 too. 111 00:09:02,780 --> 00:09:10,310 However it is worth pointing out that meant a split able to just seems to have a few more of the older 112 00:09:10,310 --> 00:09:19,070 vulnerabilities met a split level 3 is fine but I think that overall you get more target vectors with 113 00:09:19,070 --> 00:09:23,420 Metis Floyd all too because you can attack newer and older systems. 114 00:09:23,420 --> 00:09:25,610 Again there's no reason you can't have both. 115 00:09:25,610 --> 00:09:27,980 So go ahead and install metal splitting all three if you want. 116 00:09:27,980 --> 00:09:34,460 Just keep in mind that this class will be using metal split able to unless otherwise noted in future 117 00:09:34,460 --> 00:09:35,300 updates. 118 00:09:35,300 --> 00:09:36,320 Thank you for your attention.