First, you would find your Windows ISO's, VLK & MSDN Keys and all the extra Software components (where is that winzip shareware?!). Then, you get started building systems, configuring the DC, workstations, accounts and on and on. Three days later, once it was all built we could snapshot the virtual machines. Take note of all configurations, and start playing.
DetectionLab and Vagrant
DetectionLab by Chris Long makes this initial configuration a piece of cake. It is quite simply amazing; if DetectionLab was thrown into a 1RU box with blinking lights (Lockeed/Boeing/Raython) would probably sell this thing as a Cyber Range for 7+ figures. The DetectionLab will run on many operating systems and Hypervisors, but, in this quick start guide, we will use a clean Ubuntu 20.04 host, VirtualBox, and Vagrant.
The DetectionLab will run on many operating systems and Hypervisors, but, in this quick start guide, we will use a clean Ubuntu 20.04 host, VirtualBox and Vagrant.
Included Software Components
There is a lot packaged together into this popup network.
| Hostname | Operating System | Software / Role |
|---|---|---|
| Logger | Ubuntu 18.04 | Centralised logging with Splunk Enterprise (Free License - 500mb / limit), Fleet (the osquery manager), Suricata, Zeek, Velociraptor |
| DC | Windows 2016 (180 day eval) |
Domain Controller with osquery, velociraptor, sysmon |
| WEF | Windows 2016 (180 day eval) |
Windows Server with Event Collector, Splunk forwarder and osquery, Velociraptor agents |
| WIN10 | Windows 10 Workstation (180 day eval) |
Windows Workstation with agents (sysmon, osquery, velociraptor) |
Installing DetectionLab
Ok, enough with the introduction - start the stopwatch. Lets go!
Due to the number of virtual hosts, running the lab will require a minimum of an i5 with 16GB of memory. If you are planning on adding additional hosts, then more memory would be very helpful.
test@vbox:~/$ sudo apt install virtualbox virtualbox-ext-pack
This will install Virtualbox 6.1.6 from the Ubuntu repository. Keeping things fast and supported with easy updates. The name of the game in building our cyber security lab is to minimise hassle.
We will also install the latest vagrant from Hashicorp (2.2.9 is recommended - Ubuntu 20.04 ships with 2.2.6).
test@vbox:~/$ curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo apt-key add - test@vbox:~/$ sudo apt-add-repository "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main" test@vbox:~/$ sudo apt-get update && sudo apt-get install vagrant
Download the Deployment Files
Download the required files for deployment from github and kick off the prepare.sh script.
test@vbox:~/$ git clone https://github.com/clong/DetectionLab.git
test@vbox:~/$ cd DetectionLab/Vagrant
test@vbox:~/DetectionLab/Vagrant$ ./prepare.sh
[+] Checking for necessary tools in PATH...
[-] Packer was not found in your PATH.
[-] This is only needed if you plan to build you own boxes, otherwise you can ignore this message.
[?] Vagrant was found in your PATH
[?] Your version of Vagrant (2.2.16) is supported
[?] Curl was found in your PATH
[+] Checking if any boxes have been manually built...
[?] No custom built boxes found
[+] Checking for disk free space...
[?] You have more than 80GB of free space on your primary partition
[+] Checking if any Vagrant instances have been created...
[?] No Vagrant instances have been created yet
[+] Checking if the vagrant-reload plugin is installed...
[?] The vagrant-reload plugin is currently installed
[+] Enumerating available providers...
Available Providers:
[?] virtualbox
To get started building DetectionLab, run vagrant up.
If you run into any issues along the way, check out the troubleshooting and known issues page:
https://www.detectionlab.network/deployment/troubleshooting/
Before starting the vagrant builds, check that you are in a terminal that can launch the VirtualBox Guest GUI's. This means if you are connected to your test machine remotely using ssh you will want to use X forwarding in the session (ssh -X ...) and you will not want to be in tmux.
Essentially what happens with vagrant up is that each machine will be deployed and during the build the VirtualBox GUI will pop up as the machines are started. It is possible to build the hosts individually such as vagrant up logger but launching the following will build all 4 hosts. Depending on the bandwidth and CPU speed this will take some time, however here is the best part; no further interaction is required.
From a terminal the vagrant up process will need to launch the VirtualBox GUI, so we need to run this locally, or in an X forwarded session, if the host is remote & not in tmux:
In the terminal launch:
test@vbox:~/DetectionLab/Vagrant/$ vagrant up
During the installation and provisioning occasionally something may break as there are lots of moving parts. If a machine does not boot correctly check the error but if it is not obvious, you can simply try and re-provision the machine.
vagrant rebuilding and troubleshooting can be as simple as rebuilding a host.
To reattempt the provisioning try vagrant reload wef --provision. If this fails you can simply remove the broken machine from the VirtualBox console and rerun vagrant up wef, this will often just work.
These basic functions of vagrant are good to know. If you mess up a machine during testing or when something breaks; rebuilding a single machine is a piece of cake.
Further Resources
The DetectionLab project site has great documentation and resources for further information. Including the excellent network layout diagram linked below and introductory YouTube video.
