Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  1. Start with a CERT Tapioca VM with dual ethernet adapters.  I've found that Ubuntu 17.10 Server works well. For some reason, 18.04 Server has some issues related to VMware tools (copy/paste, HGFS) don't seem to be working well (yet?).
  2. Disable systemd-resolved.  It gets greedy with what it uses are DNS resolvers, and ends up picking up our wildcard DNS.  This breaks DNS lookups on the wildcard VM itself, which we don't want.

    Code Block
    languagebash
    themeMidnight
    sudo systemctl disable systemd-resolved.service
    sudo service systemd-resolved stop

    Put the following line in the {main] section of your /etc/NetworkManager/NetworkManager.conf:

    Code Block
    languagebash
    themeMidnight
    dns=default

    Delete the symlink /etc/resolv.conf

    Code Block
    languagebash
    themeMidnight
    rm /etc/resolv.conf

    Restart network-manager

    Code Block
    languagebash
    themeMidnight
    sudo service network-manager restart
  3. Reconfigure your second (LAN side) NIC. When I made the changes above, it made an additional network adapter, leaving the already-configured one as a zombie.  In my case, I clicked the network icon in the top right corner, deleted the old one, and reconfigured the new one.
  4. Install tinydns

    Code Block
    languagebash
    themeMidnight
    sudo apt install tinydns
  5. Configure tinydns

    Code Block
    languagebash
    themeMidnight
    sudo adduser --no-create-home --disabled-login --shell /bin/false dnslog
    sudo adduser --no-create-home --disabled-login --shell /bin/false tinydns
    sudo tinydns-conf tinydns dnslog /etc/tinydns/ 10.0.0.1
    sudo mkdir -p /etc/service ; cd /etc/service ; sudo ln -sf /etc/tinydns/

    Edit /etc/tinydns/root/data to resolve everything to 10.0.0.1:

    Code Block
    themeMidnight
    title/etc/tinydns/root/data
    .local:10.0.0.1:a:259200
    .0.0.10.in-addr.arpa:10.0.0.1:a:259200
    .:10.0.0.1
    +*:10.0.0.1:86400
    +*.local:10.0.0.1:86400

    build the configuration in /etc/tinydns/root/data:

    Code Block
    languagebash
    themeMidnight
    sudo make
  6. Restart tinydns:

    Code Block
    languagebash
    themeMidnight
    sudo svc -h /etc/service/tinydns
  7. Confirm your dns lookups:

    Code Block
    languagebash
    themeMidnight
    tapioca@ubuntu:~/tapioca$ nslookup asdf 10.0.0.1
    Server:		10.0.0.1
    Address:	10.0.0.1#53
    
    Name:	asdf.localdomain
    Address: 10.0.0.1
  8. Edit the ~/tapioca/iptables_noproxy.sh file, wiping out the NAT Magic part at the end, replacing it with:

    Code Block
    languagebash
    themeMidnight
    # NAT magic
    iptables -t nat -F PREROUTING
    iptables -t nat -A PREROUTING -i $internal_net -j DNAT --to-destination 10.0.0.1

    The iptables DNAT line will rewrite the target of traffic arriving on the LAN-side adapter to be handled by 10.0.0.1

  9. Edit the ~/tapioca/iptables_mitmproxy.sh file, wiping out the NAT Magic part, replacing it with:

    Code Block
    languagebash
    themeMidnight
    # mitmproxy interception
    iptables -t nat -F PREROUTING
    iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 8080
    iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8080
    iptables -t nat -A PREROUTING -i $internal_net -j DNAT --to-destination 10.0.0.1
  10. Create a ~/tapioca/wildcard.sh script to start mitmproxy HTTP(S) interception automatically on boot:

    Code Block
    languagebash
    themeMidnight
    title~/tapioca/wildcard.sh
    #!/bin/bash
    
    echo Setting network redirection rules...
    cd /home/tapioca/tapioca
    /home/tapioca/tapioca/proxy.sh

    Ensure that the ~/tapioca/wildcard.sh is executable

    Code Block
    themeMidnight
    chmod +x ~/tapioca/wildcard.sh
  11. Configure the script to start automatically on X starting.

    Code Block
    languagebash
    themeMidnight
    mkdir -p ~/.config/autostart
    nano -w ~/.config/autostart/.desktop

    Edit the .desktop file to look like this:

    Code Block
    themeMidnight
    title~/.config/autostart/.desktop
    [Desktop Entry]
    Encoding=UTF-8
    Name=Wildcard
    Comment=Wildcard network redirection 
    Exec=/home/tapioca/tapioca/wildcard.sh
    Terminal=false
  12. Click the Red 'X' in the wildcard VM to run the new wildcard rules (or just reboot).

  13. Connect a testing VM to the same vmnet network as the LAN adapter of your new wildcard VM, and try some network  stuff.



  14. Confirm the traffic on the server side:


  15. (optional) configure wildcard VM to automatically log in the tapioca user

    Code Block
    languagebash
    themeMidnight
    sudo apt install mingetty
    systemctl edit getty@tty1

    Configure it to look like this:

    Code Block
    languagebash
    themeMidnight
    [Service]
    ExecStart=
    ExecStart=-/sbin/mingetty --autologin tapioca --noclear %I
  16. Install apache and php, as you'll likely at least want a web server to simulate

    Code Block
    sudo apt-get install apache2
    sudo apt-get install php libapache2-mod-php
    sudo a2enmod ssl
    sudo a2ensite default-ssl
    sudo systemctl reload apache2
  17. Create a shortcut for the apache2 log tail
    1. Right click in the XFCE panel
    2. Click Panel → Add new items
    3. Click Launcher and then Add
    4. Right-click the new panel icon and click Properties
    5. Click Add a new empty item
    6. Call it what you want in the Name field.  e.g. "Apache log tailer"
    7. In the Command field, enter: sudo tail -F /var/log/apache2/access.log
    8. For the icon, select logviewer
    9. Check the Run in terminal checkbox

...