CyberLab Setup Process

You've got your victim and attack images all ready and students can't wait to get started and start destroying those vulnerabilities!

Just one problem; your classroom laptops aren't capable of running a locally hosted VM, and you need to set up a server to host your VMs, and there are some huge mistakes which can plague you later down the line if it's set up incorrectly.

That's where this ESXi server setup process comes in.Here we will guide you through the process of setting up your virtual cyber lab on a VMWare vSphere Hypervisor (ESXi) server from scratch.

By hosting your virtual machines on a ESXi server setup by following this checklist, you can ensure both that it is compatible with many different tools and hardware environments, and that is truly suited to your needs.

Don't worry about any previous experience with servers or even ESXi or the tools within; we've cut the process down into simple steps that anyone can understand and follow.

So, are you ready to get your virtualization server and CyberLab up and running? Well, then read on!

Record server setup details

Kicking things off, we have a nice and easy step; recording initial information about the server being set up. Take advantage of the form fields below to easily record your information in one place!

Don't worry about any extra details which you may already have available (such as the host name or static IP) for now. All of that will be taken care of moving forward!

Next up in our server setup process, we need to start to get VMWare vSphere Hypervisor 6.5 (ESXi) onto the machine which will be hosting the server. The first step towards this is to download ESXi.

Head over to VMWare's Download Center and grab the VMware vSphere Hypervisor (ESXi) 6.5 ISO file. Make sure you get the VMware vSphere Hypervisor (ESXi ISO) image, and save it to your local hard disk. 

Make sure that you know where the ISO is downloaded to, and make sure to record your License Information (you will need this later). 

Now that you have ESXi's installer image file, you need to create installation media which your new server computer can use to install the ESXI virtualization OS from a clean slate.

Windows users can burn the ISO to optical media, or create a bootable USB disk with a utility like Rufus.

How to create a bootable Windows USB using Rufus

In this tutorial we will be creating a bootable Windows 7 Ultimate x64 USB.

Things you will need:

• Your bootable ISO of choice. I will be using a Windows 7 Ultimate x64 ISO 
• Latest version of Rufus 
• A spare USB stick (The size of the USB required will vary depending on the size of the ISO you are using. For this exercise I need an 8GB USB)

Once you have the required items, you can start by opening up Rufus. Don’t worry about any of the settings here as Rufus will automatically do this for you depending on the type of ISO you are using.

By default, it will appear to have many of the options blank until you connect your USB. Once you connect the USB, these fields will be automatically filled for you.

Next, connect your USB to your computer.

Now we need to select our ISO. (in my case the Windows 7 ISO) Select the icon highlighted as shown below, which will let you browse for the required ISO file.

Select the file by left clicking on it once and then clicking on Open.

Rufus will now have filled out the fields for you. All you have to do now is hit Start.

Note, if you are using a USB stick that is too small, like using a 4GB USB for an ISO that is larger than 4GB you will get the following error:

If your USB is the correct size then you will get a standard warning telling you that any data/partitions that was on the USB before starting the process will be permanently deleted.

Click OK, to start.

How long the process will take to complete will depend on the specs of your computer, the USB (read/write speeds) and the size of the ISO you are using.

That’s it. You now have a bootable USB.

Now you can get the ball rolling on your new virtualization server; it's time to install ESXi from the disk you just burned!

• First, insert the bootable ESXi installation media (USB Drive) into the server that you want to run ESXi, and boot up. You may have to change the Boot Device Priority in the Server's BIOS settings, and Reboot.

• After you've rebooted, and the server POST appears, you may see a message requesting that you "Press Any Key to Boot from USB". At this prompt, Press any key. 

Although installing ESXi is now as simple as following through the installer menu's choices, that is exactly what you must now do to complete the process. Follow the steps in the sub-checklist below to make sure that everything's set up correctly.

Although these steps are only a brief summary and our own personal recommendations, feel free to alter the sub-checklist as you see fit. 

Don't forget to enter your root password below for records keeping.

Here is a great music video to watch while you wait. 

Configure ESXi Network Management Settings

Now time to configure the ESXi server! First you need to login to your new ESXi server with the root user account you created during installation. Then follow the steps in the sub-checklist and record your entries below to make sure that everything's set up correctly.

Fill out the form fields below to record the Network Management settings you are using for this ESXi server.

In order to perform the next step, you will need to establish that you have at least one other computer connected to the same LAN as the ESXi server. Keep in mind that any computers that you plan to connect to the virtual machines hosted on the ESXi server should also be on the same subnet at the ESXi server. But for now you need only to have one workstation on the same subnet as the ESXi server.

To access the ESXi 6.5 Management Console:

Open a current browser session on client machine and access management console by entering the ESXi host's IP address (https:\192.168.10.10) into the address bar. Login with the root username and password you created when you installed ESXi onto your server.

By default your EXSi server will be licensed as 30 day trial. When you downloaded the ISO file in the VMware Download Center you should have recorded your License Key. Once you login, Follow the sub-checklist below to assign this License Key to your EXSi host via the vSphere Web Console.

You now need to setup the virtual switches that will allow the virtual machines you create to communicate with each other inside the ESXi environment and/or the outside WAN. 

Under Navigator frame, click Networking. You should see that vSwitch0 is already be configured by default. We will keep its default settings. 

Follow the sub-checklist below to configure vSwitch1

Before we get started with any installations we need to download the necessary ISO installers and upload them to EXSi's Datastore Browser. Below are sub-checklists for downloading the installers that you will need to configure and run your virtual lab environment.

To install PFSense onto the VM that we just created to serve as the PFSense router, we need to download it. The latest stable version of the PFSense ISO is available on the PFSense website's download page - https://www.pfsense.org/download/

Before downloading, make sure you've select the appropriate dropdowns for the type of installation you wish to run. In our case, we need...

• File Type: Install
• Architecture: AMD64
• Platform: CD image (ISO) Installer
• Mirror: New York City, USA

Click "Download" and make sure that you know where the ISO has been downloaded.

For the CyberPatriot competition, teams are encouraged to create their own practice images by downloading desktop OS images from the MSDN | Imagine and Ubuntu websites. And installing the CyberPatriot Scoring Engine.

​WINDOWS 7, WINDOWS 8.1, AND WINDOWS SERVER 2008

*****New Version for CyberPatriot VIII*****

CyberPatriot now offers a self-scoring system for Windows 7, Windows 8.1, and Windows Server 2008 images. To use this client, follow these steps:

1. Download a Windows 7 or 8.1 Professional or Windows Server 2008 Standard (not R2) image using the MSDN account you receive when registering for the program. For help with using MSDN, see this presentation.​
2. Download the Scoring Engine ​​To​ol v3.0.1​​ for the image.
3. ​Implement vulnerabilities in the image and configure the scoring client found in the SEHelp.chm file in the SEHelpv3 folder in the zipped Scoring Engine Tools v3.0.1​ folder.

Previous versions of the scoring client only registers a vulnerability as fixed if a Competitor matches exactly what the Coach has configured in the system. However, version 3 of the scoring engine now allows a range of values to be scored as correct for some variables. See the SEHelpv3.chm file for more details.
​

​UBUNTU (LINUX)

Ubuntu is the Linux distro that is used for the Air Force Association's CyberPatriot cybersecurity competition image. Students can use a base install image to create their own purposefully vulnerable images as practice for the competition rounds.

Students can build their own Ubuntu practice images by downloading the base Ubuntu installer. To install Ubuntu onto the VM that we just created to serve as a base installation of a Linux OS, we first need to download it. 

Head over to Ubuntu's desktop download page and grab your preferred version in either 32 or 64-bit. Chances are that your virtual machine will have more than 2Gb of RAM, so we can fairly safely say to go for the 64-bit version.

Make a donation if you wish, but, either way, make sure that you know where Ubuntu is downloaded to.

____________________________

Alternatively, teams may take advantage of two other practice image options that do not use our scoring system. These options have been provided to the program by Texas A&M University Corpus Christi on a National Science Foundation grant. These images are to be used only for CyberPatriot training and may not be used in a for-profit manner. 

The below practice images are not self scoring, but instead have a set of pre-configured vulnerabilities. Each of these zipped folders contain​​​ two PDF documents in addition to the image. One of these documents outlines the scenario for the image and contains a few hints about the vulnerabilities that exist inside it. The other document contains information about the vulnerabilities in the image, as well as the solutions to those problems.

• ​​​​Click here to download Ubuntu Practice Image #1
  
• Click here to download Ubuntu Practice Image #2

The login information for each image is:

• Account: argus
• Password: Windows12

To install this purposefully vulnerable linux image onto the VM that we just created to serve as a practice Linux image, we first need to download it. 

Head over to the Metasploitable2 GitHub download page and grab the README.txt and metasploitable-linux-2.0.0.zip

Make sure that you know where Ubuntu is downloaded to.

Create, Install, and Configure PFSense (CLI)

Follow the sub-checklist below to...

• upload the PFSense ISO Installer file,
• create a PFSense VM, and
• install the PFSense image that will host virtual machine environment's router and firewall, 

Upload PFSense ISO

Create a PFSense VM

Click Next

Scroll to the top of the window.

Click Next

Install PFSense

After we have created the VM that will host the PFSense router we need to run the PFSense Router installation and configure it as your virtual machine environment's router and firewall.

After reboot, Enter the ESXI Actions menu for the PFSense VM and delete the CD/DVD drive (this will remove the Boot to PF Sense ISO Installer and allow us to boot to the PFSense VM)

Configure PFSense Virtual NICS

After the PFSense VM has rebooted, open/enlarge the console window to the running PFSense VM, and at the PFSense Main Menu, we need to configure the PFSense virtual NICs...

Create, Install, and Configure Ubuntu VM:

We have already downloaded a base install of Ubuntu Desktop, and uploaded the ISO to the ESXi datastore. Below is a subchecklist for the creation, installation, and configuration of a Ubuntu (Base Install) virtual machine. 

Create a Ubuntu (Base Install) VM

  **Now your Linux VM is set to boot to the OS rather than the ISO installer

Installing Ubuntu (Base Image)

Although installing Ubuntu is now as simple as following through the installer menu's choices, that is exactly what you must now do to complete the process. Follow the steps in the sub-checklist below to make sure that everything's set up correctly. 

These steps are only a brief summary and our own personal recommendations, feel free to alter the sub-checklist as you see fit. 

Configuring Ubuntu (Base Image) VM

To prevent our student VMs from getting mixed up we need to set static IP addresses for their Linux guestOS (Ubuntu_scratch). Otherwise if we were using DHCP, if the IP address on a student's VM were ever to change on a particular VM, the student that had been working on that VM would not be able to access it via their assigned SSH session.

Enable SSH ports for Ubuntu guestOS

In order allow students remote access to the Ubuntu VMs over SSH we need to first enable the SSH service on the Ubuntu VMs. Later we will setup Port Forwarding Rules in our PFSense router configuration to Allow this traffic and Assign Dynamic Ports to each VMs so students can use PuTTy to SSH into the VMs. 

• Login to the Ubuntu guestOS from inside ESXi's web console.
• Open Terminal
• Install OpenSSH server

  sudo apt-get install openssh-server

• press <Y> to confirm

• Open Text Editor

  sudo gedit

• In Text Editor; Click Open >> Other Documents
• Browse to > Other Locations
• Select  the 'Computer' >> 'etc' >> 'ssh' >> ssh_config.txt
• Examine the file to ensure that line that states "SSH yes" is not commented out 
  • If it is, just delete the '#' and/or change the line to state "SSH yes"
• Return to Terminal, and enter

  sudo service ssh restart

Create, Install, and Configure Windows VM:

We have already downloaded a base install of Windows 7 from our CyberPatriot Imagine (formerly MSDN DreamSpark) account and uploaded the ISO to the ESXi datastore. Below is a sub-checklist for the creation, installation, and configuration of a Windows 7 (Base Install) virtual machine. 

Create a Windows (Base Install) VM

Installing Windows 7

Windows is now as simple as following through the installer menu's choices, that is exactly what you must now do to complete the process. Follow the steps in the outlined in this tutorial to make sure that everything's set up correctly. The steps listed on this website are only a brief summary and only one person's personal recommendations, feel free to alter the sub-checklist as you see fit. 

  **Now your Windows VM is set to boot to the OS rather than the ISO installer

Configuring Windows (Base Image) VM

To prevent our student VMs from getting mixed up we need to set static IP addresses for their Win7 guestOS (Ubuntu_scratch). Otherwise if we were using DHCP, if the IP address on a student's VM were ever to change on a particular VM, the student that had been working on that VM would not be able to access it via their assigned RDP session.

**Your first Win7 VM is now setup and configured properly for our ESXi CyberLab settings. Proceed to setting up your PFSense Router rules.

Set PFSense to only allow HTTPS traffic from WAN

*** if the PFSense login page doesn’t load make sure you are using https://192.168.10.254  (this is necessary because you just set PFSense WAN port traffic restrictions to port 443)

Port Forwarding & NAT (MS RDP & SSH)

Setup Port Forwarding Rules in PFSense to allow students to RDP into Windows VMs.

The instructor will need to keep a spreadsheet/table that details the assignments of the dynamic port numbers that are assigned to each VM, and assign teams/students to each VM. **Remind students to NOT change the static IP addresses on their VMs"

Setup Port Forwarding Rule for SSH access to Ubuntu VMs across a Dynamically Assigned Port

After we completed our checklist, it is a good idea to test that the student devices are able to access both a Windows and a Linux VM to make sure that we haven't made any mistakes and our changes have been saved properly.

Test access to Windows VMs over RDP

To test the students RDP access, they can use the built in Windows Remote Desktop client for remote GUI access into their Windows VMs. Thankfully this tool is already built into the Windows OS that students will be using to access their Windows VMs. Use the following checklist to test access to the Windows VMs that have been setup on the EXSi server. 

Viola! At this point you know "ya done good". Now onto test SSH to Ubuntu.

Test access to Ubuntu VMs over SSH

To test the students SSH access to Ubuntu they can use PuTTY to SSH into the VMs. Follow the instructions below to configure PuTTY for this task.  To download the latest stable version of PuTTY visit the download page - http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html - and download the Putty.exe file.

Use the following checklist to install and configure PuTTY so that you can test access to the Ubuntu VMs that have been setup on the EXSi server. 

If a terminal window opens to a CLI prompt, enter the root username for the Ubuntu VM, followed by its password. And you should see something very similar to the following SSH terminal.

SUCCESS!!

PFSense Wiki - PfSense 2 on VMware ESXi 5

TechFleece - How to create a bootable Windows USB using Rufus

Rapid7Community - Metasploitable 2 Exploitability Guide

uscyberpatriot.org - Microsoft DreamSpark (MSDN) User Guide

Ubuntu - Install Ubuntu 14.04.3 LTS

obivate.io - Tutorial: Using VMWare ESXi and PFsense as a network firewall/router

uscyberpatriot.org - Build Your Own Practice Images

StackExchange - How to forward X over SSH from Ubuntu machine?