CTF VulnNet Internal

Why

Because I had lot of problems with python2 and 3 who broke my packages like wfuff.
Plus, it’s not that good to have lot of hacking tools on my main computer, it’s taking lot of space and the updates are longer.
I need more space to install cool games like nier automata.

Donwnload kali

https://www.kali.org/get-kali/#kali-virtual-machines

Install qemu

sudo pacman -S qemu

Create a bridge

sudo ip link add name br0 type bridge
sudo ip link set br0 up
sudo ip link set enp34s0 master br0
sudo ip addr add 192.168.1.70/24 dev br0

Remove the bridge

don’t do this rn, it will be used later

sudo ip link set dev enp34s0 nomaster
sudo ip link delete dev br0

Start the VM

qemu-system-x86_64 \
    -enable-kvm \
    -m 4096 \
    -smp 4 -cpu host \
	-net nic,model=virtio \
    -net bridge,br=br0 \
    -drive file=kali-linux-2022.4-qemu-amd64.qcow2,media=disk,if=virtio

Now let’s see the IP of kali:
192.168.1.111

Enable ssh in kali:

sudo systemctl start ssh
sudo systemctl enable ssh

Start without display

qemu-system-x86_64 \
    -enable-kvm \
    -m 4096 \
    -smp 4 -cpu host \
    -nographic \
	-net nic,model=virtio \
    -net bridge,br=br0 \
    -drive file=kali-linux-2022.4-qemu-amd64.qcow2,media=disk,if=virtio

Script it

Now I want a script for this, also, I don’t want the bridge to be here when I don’t use kali.
you have to replace enp34s0 by the name of your card (do ip a).
also replace 192.168.1.70 by something who can communicate in your local network.

sudo /usr/local/bin/kali

sudo ip link add name br0 type bridge
sudo ip link set br0 up
sudo ip link set enp34s0 master br0
sudo ip addr add 192.168.1.70/24 dev br0

qemu-system-x86_64 \
    -enable-kvm \
    -m 4096 \
    -smp 4 -cpu host \
    -net nic,model=virtio \
    -nographic \
    -net bridge,br=br0 \
    -drive file=/home/peanutstick/qemu_storage/kali-linux-2022.4-qemu-amd64.qcow2,media=disk,if=virtio

sudo ip link set dev enp34s0 nomaster
sudo ip link delete dev br0

Export X11

/etc/ssh/ssh_config

Host *
ForwardAgent yes
ForwardX11 yes

SSH

ssh -Y kali@192.168.1.111

Bug in ssh ?

If you can’t clear the terminal when you are logged, use this and try again.
Do this in kali.

echo "export TERM=xterm-256color" > .zsh_rc

Teste co

Just run burpsuite and see:

yep, xorg is good

RDP

Kali

Create the RDP server:

sudo pacman -S xrdp
sudo systemctl enable xrdp
sudo systemctl start xrdp

Host

Install remmina:

sudo pacman -S remmina

Encrypt the password:

remmina --encrypt-password

Then enter the password.
Output:

Enter the password you want to encrypt: kali

Encrypted password: Nq7turSoD7g=

Usage:
rdp://username:Nq7turSoD7g=@server
vnc://username:Nq7turSoD7g=@server
vnc://server?VncUsername=user\&VncPassword=Nq7turSoD7g%3D

Connect to kali:

remmina -c rdp://kali:Nq7turSoD7g=@192.168.1.111

To change the resolution, click here:

Remmina is cool but, I don’t like it very much, he can resize himself but there is too much things.
I would like to have just a window without anyhing on the borders.

You can add aliases like:

alias kalis="ssh -Y kali@192.168.1.111"
alias kalir="remmina -c rdp://kali:Nq7turSoD7g=@192.168.1.111"

Result: