Updated 11 Mar 2021: With some changes to the functions in Windows 10, version 2.0 of my LabNet script, and some clarifications suggested, I’ve updated this post to match the new steps.

The blog post that goes along with this can be found here.

Logical diagram

My Lab

Host Machine

  1. Install Virtualbox
    1. https://www.virtualbox.org/wiki/Downloads
    2. Open command prompt
    3. vboxmanage dhcpserver add --netname Lab --ip 10.0.1.1 --netmask 255.255.255.0 --lowerip 10.0.1.2 --upperip 10.0.1.10 --enable

Linux Mint Gateway

VM setup:
CPU: 2 cores
RAM: 2 GB
HD: 32 GB
Network: Set up 2 NICs. The first set as NAT, the second as Internal (named Lab)
Enable: Shared Clipboard, Drag and Drop

  1. Install Linux Mint and all updates
    1. Download and install https://linuxmint.com/download.php
      • When creating the user account, select to Log in automatically
    2. Once installed and running, open a terminal
    3. Run sudo apt update && sudo apt upgrade
    4. Click the Linux Mint start menu, and type Screensaver
    5. Change “Delay before starting screensaver” to Never
    6. Reboot
  2. Virtualbox Guest Additions
    1. Virtualbox menu > Devices > “Insert Guest Additions CD image”
    2. Run the installer
    3. Virtualbox menu > Optical Drives > Remove disk from virtual drive
  3. Snapshot
    1. Linux Mint menu > Quit > Shutdown
    2. Virtualbox > Snapshot named “Fresh install”
    3. Start VM again
  4. Install software:
    1. Tools via APT: sudo apt install wireshark python3-pip
      • Wireshark: Choose yes when asked to allow non-super users capture packets
    2. Oletools: sudo -H pip3 install oletools
      • If there are errors try running first: sudo -H pip3 install --upgrade setuptools
  5. Snapshot
    1. Linux Mint menu > Quit > Shutdown
    2. Virtualbox > Snapshot named “Software installed”
    3. Start VM again
  6. LabNet setup
    1. Follow the setup instructions on https://github.com/netsecninja/LabNet
  7. Snapshot
    1. Linux Mint menu > Quit > Shutdown
    2. Virtualbox > Snapshot named “Baseline”
    3. Start VM again
  8. Run Labnet and select “Actual Internet” in preparation for setting up the Windows VM

Windows 10 Victim

VM setup:
CPU: 2 cores
RAM: 2 GB
HD: 32 GB
Network: Internal (named Lab)
Enable: Shared Clipboard, Drag and Drop

  1. Install Windows 10
    1. https://www.microsoft.com/en-us/software-download/windows10ISO
    2. Download oldest version available (less patches means more vulnerable for testing!)
    3. Click “I don’t have internet” during the install to bypass having to log in with a Microsoft account
    4. Set your local timezone
    5. Install VM Guest tools, then remove tools disk from virtual drive
  2. Snapshot
    1. Start menu > Power > Shutdown
    2. Virtualbox > Snapshot named “Fresh install”
    3. Start VM again
  3. Disable patches
    1. Right-click network icon in task tray > Open Network & Internet settings
    2. Click on “Properties” for Ethernet
    3. Enabled Metered connection
  4. Set up Networking
    1. Right-click network icon in tray, Open Network & Internet Settings
    2. Change adapter options
    3. Right-click Ethernet > Properties
    4. Double-click on IPv4
    5. Set Primary DNS to 1.1.1.1 and Secondary to your Linux Mint Lab IP
    6. Click Advanced
    7. Add Default Gateway, enter your Linux Mint Lab IP
    8. Click OK to close all the screens
  5. Set up Polar Proxy cert
    1. On Linux Gateway, run labnet and choose “Actual internet with SSL interception”
    2. On Victim: Open IE, <Linux Mint Lab IP>:10080, and open the downloaded .cer file
    3. Install the Certificate in “Trusted Root Certificate Authorities” folder
    4. On Linux Gateway, Use Ctrl-C to stop the SSL interception, run labnet again and choose “Actual internet”
  6. Autologin
    1. Open IE, go to https://live.sysinternals.com/Autologon.exe and choose Run
    2. Add the user password, and click Enable
  7. Reboot
  8. Install Notepad++
  9. Install 7-zip
  10. Install Sysmon
    1. Download files to Victim and unzip
    2. Open PowerShell as an Admin, change into unzipped directory
    3. Run set-executionpolicy bypass
    4. Run ./install_sysmon.ps1
    5. Open Event Viewer > right-click on any folder > “Create Custom View”
    6. For the By Log - Event Logs dropdown, enter “Microsoft-Windows-Sysmon/Operational”, and click OK
    7. Name it Sysmon, and click OK
  11. Install Wireshark
  12. Download Procmon
    1. Create a “Tools” folder on your Desktop, save Procmon in there
    2. Run Procmon
    3. Options > Disable “Show Resolved Network Addresses”
    4. Options > Select columns > Add “Thread ID”
    5. Close Procmon
  13. Install Graphviz (Prereq for ProcDOT)
    1. During install, select “Add Graphviz to the system PATH for all users”
  14. Install Winpcap (Prereq for ProcDOT)
  15. Download Windump (Prereq for ProcDOT)
    1. Save in your Tools folder
  16. Install ProcDOT
    1. Unzip in your Tools folder
    2. Zip password: procdot
    3. Navigate to Tools\Procdot\win64, and run procdot.exe
    4. Set WinDump path
    5. Set Graphviz dot.exe path (C:\Program Files\Graphviz\bin\dot.exe)
    6. Close ProcDOT
  17. Install Office or LibreOffice
  18. Install Python
    1. Make sure to check the “Add Python to Path” box during install
  19. Install OLETools
    1. Open a Command prompt as admin and run pip install oletools
  20. Disable sleep
    1. Start > Power & sleep settings
    2. Under Screen change both Battery and Plugged In to Never
  21. Create shortcuts in Tools folder for:
    1. Wireshark (C:\Program Files\Wireshark\wireshark.exe)
    2. Procdot.exe (Tools\Procdot\win64\procdot.exe)
    3. Event Viewer (Start > Event Viewer > Open File Location > COPY the shortcut)
  22. Snapshot
    1. Start menu > Power > Shutdown
    2. Virtualbox > Snapshot named “Baseline”