Help - Search - Members - Calendar
Full Version: Introduction Guide To VMware
B.I.S.S. Forums > Malware Research Forum > Malware IP Research Section
Moore
######################################

:: Introduction Guide To VMware ::

######################################

With VMware you can easlily create multiple virtual operating systems to use as a sacrificial test bed for malicious file analysis.

It's an extremely useful method for tracking & documenting the destruction created by malicious spyware , trojans and virus files without permanently damaging your own system and allows you to revert back to a previous state [snapshot] without any damage when needed.

Thanks to Paperghost for the helpful vmware install guide below:

######################################
######################################

Vitalsecurity - Using VMWare / File Analysis Forum
http://makephpbb.com/phpbb/viewforum.php?f=21

#########################
File Analysis Tutorial: The Basics - By Paperghost
#########################

http://makephpbb.com/phpbb/viewtopic.php?t=154

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

VMWare:
The virtual network , by Paperghost

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@


Why bother to reinstall and reconfigure your anti-spyware lab every single time you want to try something new, when you can do away with all the machines, cables and messing about and swop it all for a virtual PC workstation?

Using the same machine, you can run as many virtual PC's as the system can handle - with NO ill effects on the host machine. You can also take system snapshots and roll back at any time.

Your virtual PC's install messed up beyond recognition? Simply delete and start afresh.

The following is a short guide to get you started....

--------------------------------------------------------------------

1) When first loading up VMware, you are presented with two choices - new machine, or open existing machine. As you might have guessed, choose New Virtual Machine!



--------------------------------------------------------------------

2) You are given the option of the kind of install you want - for now, pick typical.


--------------------------------------------------------------------

3) At this stage, select the OS of your choice and also the distribution:



--------------------------------------------------------------------

4) Almost there - choose how much space you want to devote to your virtual PC:



--------------------------------------------------------------------

5) Want to run your virtual machine on a network? You can configure this here:




--------------------------------------------------------------------

6) At this point, installing the OS of your choice is a case of inserting your CD into the drive, and clicking the Green Arrow. If you want to install a Linux package from an ISO, you can do this too by simply selecting the "Use ISO Image" option and finding the ISO on your machine:



--------------------------------------------------------------------

7) If all goes well, you will be presented with the install options and can now install as normal. Depending on your monitor setup and also the exact type of distro, the screen may appear strange until the install is finished, or you may end up with multiple screens.

This should correct itself when you restart:



--------------------------------------------------------------------


######################################
######################################

VMWARE SUPPORT GUIDES/LINKS

######################################
######################################


Installing VMware Workstation 4 on a Windows Host
<> http://www.vmware.com/support/ws45/doc/ins...sa.html#1025548


Installing VMware Workstation 4 on a Linux Host
<> http://www.vmware.com/support/linux/doc/qu.../configure.html


######################################
######################################


http://www.linuxhelp.ca/guides/vmware/
http://www.linuxhelp.ca/guides/ipmasq/


VMWare Reviews:
http://www20.tomshardware.com/howto/20040305/
http://www.pcmag.com/article2/0,1759,1134347,00.asp


######################################
######################################

VMWARE SUPPORT :

http://www.vmware.com/
http://www.vmware.com/vcommunity/
http://www.vmware.com/support/ws45/doc/index.html
http://www.vmware.com/support/using/
http://www.vmware.com/support/resources/ws_resources.html


SELF SUPPORT LINKS :

http://www.vmware.com/support/kb/enduser/s...&p_sort_by=dflt

http://www.vmware.com/community/forum.jspa...=15&filter=NONE


######################################
######################################

http://www.vmware.com/support/pubs/

Installing XP Guest Operating System:
http://www.vmware.com/support/guestnotes/d...stos_winxp.html

Installing Windows 2000 in a Virtual Machine
http://www.vmware.com/support/kb/enduser/s...va=&p_faqid=252

Installing Windows XP in a Virtual Machine
http://www.vmware.com/support/kb/enduser/s...va=&p_faqid=245


Configuring Bridged Networking for Windows
How do I configure bridged networking for best use on a Windows host machine?
<> http://www.vmware.com/support/ws45/doc/net...ws.html#1029296


<> Installing Windows XP in a Virtual Machine
http://www.vmware.com/support/guestnotes/d...stos_winxp.html


<> Installing the VMware Software on a Windows Host
http://www.vmware.com/support/ws45/doc/ins...sa.html#1025548


<> Changing the Networking Configuration
http://www.vmware.com/support/ws45/doc/net...ws.html#1061905


---------------------------

Using Shared Folders

----------------------------

http://www.vmware.com/support/ws4/doc/runn...ws.html#1054286


With shared folders, you can easily share files among virtual machines and the host computer. To use shared folders, you must have the current version of VMware Tools installed in the guest operating system and you must use the Virtual Machine Control Panel to specify which directories are to be shared.

You can use shared folders with virtual machines running the following guest operating systems:

Windows Server 2003
Windows XP
Windows 2000
Windows NT 4.0
Linux with a kernel version of 2.4 or higher
To set up one or more shared folders for a virtual machine, be sure the virtual machine is open in Workstation and click its tab to make it the active virtual machine. Go to Edit > Virtual Machine Settings > Options and click Shared folders.


------------------------------------

Using Drag and Drop

-------------------------------------

http://www.vmware.com/support/ws4/doc/runn...ml.html#1054295

With the drag and drop features of VMware Workstation 4, you can move files easily between a Windows host and a Windows virtual machine. You can drag and drop individual files or entire directories.

You can drag and drop files or folders from a file manager, such as Windows Explorer, on the host to a file manager in the virtual machine or vice versa. You can also drag files from a file manager to an application that supports drag and drop - or from applications such as zip file managers that support drag-and-drop extraction of individual files.

When you drag a file or folder from host to virtual machine or from virtual machine to host, Workstation copies the file or folder to the location where you drop it. This means, for example, that if you drop a file on the desktop icon of a word processor, the word processor opens with a copy of the original file. The original file does not reflect any changes you make to the copy.

Initially, the application opens using a copy of the file that is stored in your temp directory (as specified in the %TEMP% environment variable). To protect any changes you make, choose File > Save As from the application's menu and save the file in a different directory. Otherwise it may be overwritten or deleted by mistake.

To disable or enable drag and drop for a virtual machine:

Open the Virtual Machine Control Panel (Edit > Virtual Machine Settings), click the Options tab and select Guest isolation.

Select Disable drag and drop to and from this virtual machine to disable the feature. Deselect it to enable the feature.


######################################
######################################
Moore
#########################
Reverse Engineering Hostile Code
#########################

QUOTE
This article outlines the process of reverse engineering hostile code. By "hostile code", we mean any process running on a system that is not authorized by the system administrator, such as Trojans, viruses, or spyware.

This article is not intended to be an in-depth tutorial, but rather a description of the tools and steps involved. Armed with this knowledge, even someone who is not an expert at assembly language programming should be able to look at the internals of a hostile program and determine what it is doing, at least on a surface level.

We'll cover tools native to both Unix and Windows.


http://www.securityfocus.com/infocus/1637

#########################

Detecting and Containing IRC-Controlled Trojans: When Firewalls, AV, and IDS Are Not Enough:

http://www.securityfocus.com/infocus/1605

#########################
Reverse-Engineering Malware
#########################

QUOTE
This paper discusses tools and techniques useful for understanding inner workings of malware such as viruses, worms, and trojans.

We describe an approach to setting up inexpensive and flexible laboratory environment using virtual workstation software such as VMware, and demonstrate the process of reverse engineering a trojan using a range of system monitoring tools in conjunction with a disassembler and a debugger. 


http://www.zeltser.com/reverse-malware-paper/

#########################

http://www.windowsecurity.com/articles_tut...rojans_malware/

######################################
######################################

Honeypots with VMWare

######################################
######################################

http://makephpbb.com/phpbb/viewforum.php?f=21

Honeypots are becoming more common as security professionals attempt to conduct more detailed research on current "state of the art" practices among attackers.

Honeypots are also invaluable for learning about an attackers motivations, their habits and patterns of behavior.

Unfortunately setting up a proper honeypot is a non-trivial task, and correctly configuring network sensors to capture all data, as well as the resulting forensics tasks can be rather daunting.

The good news is that there are a number of tools and techniques that can make life much easier for some honeypot administrators.

######################################
######################################


Know Your Enemy: Learning with VMware - Introduction
http://www.linuxsecurity.com/content/view/113377/65/


Honeypotting with VMware - basics
http://www.seifried.org/security/ids/20020...are-basics.html


--[ Monitoring VMware Honeypots ]--
http://honeypots.sourceforge.net/monitorin..._honeypots.html


######################################
######################################


Building Virutal Honeynets using VMware - Full Text
http://www.honeynet.org/papers/vmware/


Know Your Enemy: Honeynets
What a Honeynet is, its value, how it works, and risk/issues involved.
http://honeynet.org/papers/honeynet/


Know Your Enemy: GenII Honeynets
Easier to deploy, harder to detect, safer to maintain
http://www.honeynet.org/papers/gen2/


Open Source Honeypots: Learning with Honeyd

QUOTE
Honeyd allows you to construct networks of computers that don't exist. It can fool Nmap and ICMP scanners and build incredibly powerful honeypot systems--all running on a single low-end computer.


http://www.honeyd.org/general.php
http://www.securityfocus.com/infocus/1659
http://infosecuritymag.techtarget.com/2003...aitswitch.shtml


######################################
######################################

Here you will find tools for deploying your Honeynet.

http://honeynet.org/tools/index.html

QUOTE
All software created by The Honeynet Project is OpenSource and falls under the Revised BSD License. Software listed here not developed by the Honeynet Project must at a minimum be OpenSource. If you are deploying a honeynet, we assume you have read and understand the concepts, risks and issues disscussed in KYE: Honeynets.


####################################

QUOTE
The Honeywall CDROM combines all the tools and requirements of a GenII honeynet gateway on a (hopefully) easy to use, secure, bootable CDROM.

The intent is to make honeynets easier to deploy and customize. You simply boot off the CDROM, configure it based on your environment, and you should have a Honeywall gateway ready to go. The CDROM supports several configuration methods, including an interactive menu and .iso customization scripts.


>> http://honeynet.org/tools/cdrom/ <<

######################################
######################################
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2012 Invision Power Services, Inc.