Running Metasploitable2 on virtualBox

Metasploitable is a Linux-based vulnerable virtual machine. It is designed especially for people interested in learning system exploitation. Rapid7 maintains Metasploitable and this virtual machine is downloadable from their website. I'd played around with the 1^st version of Metasploitable, but did not have much idea about the second version. I wanted to finish one task and wanted to check the same. Yet I didn't have a vulnerable system handy, so I downloaded Metasploitable version 2. It is a zip file and needs to be extracted. When I extracted the same, it was a VMware image and I was using VirtualBox.

FREE role-guided training plans

Get 12 cybersecurity training plans — one for each of the most common roles requested by employers.

Download Now

Problem statement:

There were two major problems I ran into:

• I was unable to use the VMware image and use it as it is. For some reason, even after trying multiple times, it didn't work for me. So I needed to convert the VMware image to a VirtualBox Image.
• The second problem was more complex. The first one was a bit easier compared to the second one and this is where I was stuck, as there was no documentation available on how to resolve this problem.

Objective:

The objective of this article is to share my experience with all fellow penetration testers who want to use Metasploitable 2, but are facing the same issue that I did. This article can be used as a hands-on guide; I'll explain step by step how to set up the virtual machine, the problem I faced, and how I resolved it. By end of the article, we'll have a VirtualBox image up and running without any problem.

What won't we cover?

A detailed description of VirtualBox, VM ware or Metasploitable is out of the scope of this article. We will not cover the installation aspects of VirtualBox, either. It is left as an exercise for the end user. This article will only focus on getting the vulnerable machine up and running in an already existing VirtualBox installation.

The following section will explain each of the steps in detail. We'll also troubleshoot the problems as we face them. The first step for me was to convert the VMware image to the VirtualBox image. I normally use an ISO file and load it up in VirtualBox. This is the first time I came across a VMware image itself and I had to run it. As mentioned earlier due to one or the other reason, VMware image didn't work for me directly.

• Convert VMware Image to VirtualBox Image

This step was not very difficult and just by doing a little bit of Googling, I was able to find out how to convert the VMware image to VirtualBox. One can use the following command for image conversion:VBoxManage clonehd Metasploitable.vmdk Metasploitable2-Linux.vdi -format VDI*.vmdk files are VMware extensions and VDI is the extension for VirtualBox. The above command will do the conversion – which can be seen in following screenshot:

Once the above command completes, we have a VirtualBox compatible hard disk ready no. All we need to do is create a new virtual machine and fire it up.

• Creating a Virtual Machine

a. Now that we have the VirtualBox image ready, let's create a new virtual machine and see if this works. Open VirtualBox and Click on Add to create a new Virtual Machine and follow the screenshots in the following order:a. Enter a name of your choice – I've keyed in "exploitable."

b. Next we can choose the memory. By default, it is 256 MB. You can modify this if you want; I went with the default settings.

c. Choose the hard disk by locating the same from local machine. Here – we'll point the VirtualBox image to our converted hard disk

.

d. Once hard disk is selected, our screen should look as follows. Click on create button and If all goes well, we should be able to

see the following screen

e. Next, Click on "Exploitable" Virtual Machine and click the "Start" button to start the Virtual Machine as shown in following screenshot

f. However, upon starting, the following error is displayed

Now this is disappointing. After reaching here, if we are unable to boot, then it waters down all our efforts. This is where I was stuck and it took me some time, as I was unable to find any ready reference. I guess not many people were interested in running Metasploitable in VirtualBox! After some research, I finally figured how to fix this problem.

• Getting the VirtualBox Image Running

There is one small setting that can resolve our problem. I was able to locate this after referring VirtualBox manuals (and some background knowledge about the Metasploitable distro). Metasploitable is based on Ubuntu Linux and for the latest version of the Ubuntu based distro to work on VirtualBox, we need to Enable PAE/NX option for it to work. Go to Settings > System > Processor and enable the checkbox "Enable PAE/NX."

Let's try to boot out Virtual Machine again now.

Bingo – it worked! One small tweak and now we have Metasploitable running perfectly on VirtualBox. Following screen shows that system is ready to login for us

Default credentials are msfadmin/msfadmin.

Why did this tweak work?

As per VirtualBox Documentation, if the "Enable PAE/NX" setting is enabled on VirtualBox, and if it is supported by the operating system, then even a 32-bit x86 CPU can access more than 4 GB of RAM. Metasploitable – which again is based on Ubuntu, requires 4GB memory. Hence, when this feature is enabled, it solves the problem for us and we are able to run it, thus resolving our major problem.

The system is now up, All we need to do is change the network settings and make it host-only and we are good to go with a live penetration testing lab on which we can do all kinds of experiments without really worrying about anything. Even it crashes, all we need to do is reboot!

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

Sources

Metasploitable 2

Manual - Virtualbox