Hacking

Running Metasploitable2 on virtualBox

April 23, 2013 by arD3n7

Metasploitable is a Linux-based vulnerable virtual machine. It is designed especially for people interested in learning system exploitation. Rapid7 maintains Metasploitable and this virtual machine is downloadable from their website. I’d played around with the 1st version of Metasploitable, but did not have much idea about the second version. I wanted to finish one task and wanted to check the same. Yet I didn’t have a vulnerable system handy, so I downloaded Metasploitable version 2. It is a zip file and needs to be extracted. When I extracted the same, it was a VMware image and I was using VirtualBox.

Problem statement:

There were two major problems I ran into:

  • I was unable to use the VMware image and use it as it is. For some reason, even after trying multiple times, it didn’t work for me. So I needed to convert the VMware image to a VirtualBox Image.
  • The second problem was more complex. The first one was a bit easier compared to the second one and this is where I was stuck, as there was no documentation available on how to resolve this problem.

Objective:

The objective of this article is to share my experience with all fellow penetration testers who want to use Metasploitable 2, but are facing the same issue that I did. This article can be used as a hands-on guide; I’ll explain step by step how to set up the virtual machine, the problem I faced, and how I resolved it. By end of the article, we’ll have a VirtualBox image up and running without any problem.

What won’t we cover?

A detailed description of VirtualBox, VM ware or Metasploitable is out of the scope of this article. We will not cover the installation aspects of VirtualBox, either. It is left as an exercise for the end user. This article will only focus on getting the vulnerable machine up and running in an already existing VirtualBox installation.

The following section will explain each of the steps in detail. We’ll also troubleshoot the problems as we face them. The first step for me was to convert the VMware image to the VirtualBox image. I normally use an ISO file and load it up in VirtualBox. This is the first time I came across a VMware image itself and I had to run it. As mentioned earlier due to one or the other reason, VMware image didn’t work for me directly.

  • Convert VMware Image to VirtualBox Image

This step was not very difficult and just by doing a little bit of Googling, I was able to find out how to convert the VMware image to VirtualBox. One can use the following command for image conversion:VBoxManage clonehd Metasploitable.vmdk Metasploitable2-Linux.vdi -format VDI*.vmdk files are VMware extensions and VDI is the extension for VirtualBox. The above command will do the conversion – which can be seen in following screenshot:

Once the above command completes, we have a VirtualBox compatible hard disk ready no. All we need to do is create a new virtual machine and fire it up.

  • Creating a Virtual Machine

a. Now that we have the VirtualBox image ready, let’s create a new virtual machine and see if this works. Open VirtualBox and Click on Add to create a new Virtual Machine and follow the screenshots in the following order:a. Enter a name of your choice – I’ve keyed in “exploitable.”

b. Next we can choose the memory. By default, it is 256 MB. You can modify this if you want; I went with the default settings.

c. Choose the hard disk by locating the same from local machine. Here – we’ll point the VirtualBox image to our converted hard disk

 

.

 

d. Once hard disk is selected, our screen should look as follows. Click on create button and If all goes well, we should be able to

see the following screen

e. Next, Click on “Exploitable” Virtual Machine and click the “Start” button to start the Virtual Machine as shown in following screenshot

f. However, upon starting, the following error is displayed

 

Now this is disappointing. After reaching here, if we are unable to boot, then it waters down all our efforts. This is where I was stuck and it took me some time, as I was unable to find any ready reference. I guess not many people were interested in running Metasploitable in VirtualBox! After some research, I finally figured how to fix this problem.

  • Getting the VirtualBox Image Running

There is one small setting that can resolve our problem. I was able to locate this after referring VirtualBox manuals (and some background knowledge about the Metasploitable distro). Metasploitable is based on Ubuntu Linux and for the latest version of the Ubuntu based distro to work on VirtualBox, we need to Enable PAE/NX option for it to work. Go to Settings > System > Processor and enable the checkbox “Enable PAE/NX.”

Let’s try to boot out Virtual Machine again now.

Bingo – it worked! One small tweak and now we have Metasploitable running perfectly on VirtualBox. Following screen shows that system is ready to login for us

 

Default credentials are msfadmin/msfadmin.

Why did this tweak work?

As per VirtualBox Documentation, if the “Enable PAE/NX” setting is enabled on VirtualBox, and if it is supported by the operating system, then even a 32-bit x86 CPU can access more than 4 GB of RAM. Metasploitable – which again is based on Ubuntu, requires 4GB memory. Hence, when this feature is enabled, it solves the problem for us and we are able to run it, thus resolving our major problem.

The system is now up, All we need to do is change the network settings and make it host-only and we are good to go with a live penetration testing lab on which we can do all kinds of experiments without really worrying about anything. Even it crashes, all we need to do is reboot!

Sources

Metasploitable 2

Manual – Virtualbox 

Posted: April 23, 2013
Articles Author
arD3n7
View Profile

arD3n7 works for a leading IT company and is deeply passionate about information security. As a researcher, arD3n7 loves anything and everything related to penetration testing.

5 responses to “Running Metasploitable2 on virtualBox”

  1. Pablo Rogina says:

    I found no issues using the Metasploitable2-Linux hard disk from the VMware VM in a brand new machine created with VirtualBox. It’s a known feature of VirtualBox its capability to open .vdmk files. So all the conversion steps you described appear to be useless.
    These are the steps I did so far:
    1. downloaded the Metasploitable2-Linux VM
    2. Unzip it somewhere (i.e. C:VMsMetasploitable2-Linux
    3. opened VMware machine configuration file (Metasploitable.vmx, an easy to understand text file) to see what the main configuration details are for the VM
    4. Started VirtualBox (4.2.6)
    5. Created a new VM (Metasploitable2) of type Linux/other Linux
    6. Set the RAM to 512MB (as original VMware machine)
    7. Choose and existing hard drive and point it to file C:VMsMetasploitable2-LinuxMetasploitable.vmdk
    8. Set network card to NAT (as original VMware machine)
    9. Start the VirtualBox machine
    10. Enjoy exploiting the vulnerable Linux installation!

    I can provide you with more details/screenshots so to avoid the complex conversion process you mentioned in your post. Thanks.

  2. ard3n7 says:

    Hi Pablo, It’s great that it worked for you, however this article is for people who faced the issue. Normally vmware images work as it is, but I faced some issue with getting it to run, not sure why the error, hence I converted it.

    The idea here was knowledge sharing in order to help people who are stuck like me. I am not looking for any proof of concept from anyone as to why it worked for them and didn’t for me, just trying to help other fellow pentesters – who may face issue which I ran into!

  3. Preetam Kajal Rout says:

    Thanks a lot! 🙂
    It saved my time and effort! I can start practicing 😉

  4. Sunil says:

    I installed the metasploitable 2 correctly but I am unable to scroll the metasploitable 2 screen up and down.
    Any idea.
    I am using Virtualbox in Ubuntu 14.04.

  5. mon says:

    worked for me. many thanks!

Leave a Reply

Your email address will not be published. Required fields are marked *