So I was taking a look at a blog the other day by Andrew Waite and saw him talk about a great little tutorial on Metasploit by the guys at Offensive Security. Being that half of the things I know I learned on my own and not in a formal learning environment, I thought it would be a great review and maybe learn something new along the way. The only problem is that I use a Mac, and some of this stuff became a stumbling block, so this is how I got through it.
One of the main problems with the Mac and using VMs is that the main two programs (VMware and Parallels) are not free. In Windows you can get the VMware player and converter for free, but not in OS X. So I use VirtualBox for all of my VM needs. Sure it might be missing some bells and whistles, but it works good for what I do, and it seems a bit faster than the other two.
The first thing they have you do in the tutorial is setup Ubuntu. That step is very easy, you download the zip, expand it to a directory, then mount the HD image in VirtualBox. Set up a new machine, make sure to use the HD from a SCSI/SATA interface, and your ready to go. Once up you mount the CD image they have you download for Samba and your set.
The Windows XP image is actually where I had problems. They have you download an XP VM that is cut up into four different zip files. It turns out that OS X doesn’t handle divvied up zip files (such as, .zip,.z01,.z02). One method i found was to actually ‘cat’ the files together, then tell zip to fix the headers, then unzip it. I unfortunately couldn’t get that one to work, so I sadly resorted over to an XP virtual machine that I already had, mounted the directly as a shared folder and used WinRAR to uncompress it. Once you have virtual hard drive file (which is in Virtual PC) VirtualBox can actually just mount it and use it just fine. I left it as an IDE device on the new VM setup and it seems to work just fine. Once up, you should install the VirtualBox Tools. The ‘local security options’ are going to keep you from installing the drivers. So to change that you go to Control Panels > Administrative Tools > Local Security Settings > Local Policies > Security Options > Devices: Unsigned driver installation behavior. Once you drill all of that down you can change it to ‘Warn but allow install’.
You now have your two VM machines ready to go, all you need is Metasploit installed on your Mac. You can find several ways to do that via Google or on the actual Metasploit page. One of the easiest is probably to use MacPorts, but I like to maintain the most up-to-date plugins and exploits, so use the subversion.
This should have you pretty much up and running for the whole tutorial, if any more stumbling blocks are encountered I will make sure to update this.