DIY Malware Analysis Lab for Free (with CrackMe Challenge!) | master0Fnone Ep. 2.1: Sandbox in a Box

[@jeFF0Falltrades]

To my loyal and wonderful subs: I apologize again for the delay on this one - our 10,000 sub celebration is now an 11,000 sub celebration, which is awesome, but I am sorry it took this long to push this out and I hope the wait was worth it ❤️ Check this pinned comment for corrections and updates and thanks for watching! EDIT: Thanks to @BrakeSec for the suggestion, I added a simple helper script so you don't have to worry about commenting out the netplan configuration yourself; It's added to the repo!

[@0ri0nexe]

The king posted ! Stop what ur doing and open your best disassembler ;) Jokes aside i like how you introduction more and more useful tools each video

[@jeFF0Falltrades]

@@0ri0nexe Man you made my day hahaha. I’m in the middle of finishing up editing Part 2 (which I can say DEFINITIVELY will be out tomorrow AM, Eastern Time), and I really needed this motivation. Thanks for being a great hype man and I am glad you find the tools useful! I’m so happy to finally share my lab setup as it’s been good to me all these years.

[@0ri0nexe]

​@@jeFF0Falltrades Two videos in a row, what a time to be alive.

[@jeFF0Falltrades]

@@0ri0nexe 🤣

[@lukefidalgo8154]

Just as I bought Practical Malware Analysis (the alien book), this video comes out! Some really good timing! :P

[@jeFF0Falltrades]

YES!!! I'm so happy for you because that book is a treat. And you'll find my set up is very akin to the one in the book, so I hope this complements it well :-). Also, if you're interested, No Starch Press just this month came out with another book called "Evasive Malware" that I call out in this video. I haven't read through all of it yet, but what I have read has been really good! Thanks for watching and I hope you enjoy both this and PMA!

[@Jarvx]

The alien book is top tier :)

[@CrusaderMen]

Thank you I love your content

[@jeFF0Falltrades]

@@CrusaderMen Thank *you*! I hope you enjoy this one too

[@micha7863]

Great job! Appreciate it veeery much. Also congrats on becoming a dad. BTW: I have tested VBox 7 Unattended installation for Win10 and I always had problems with the VM - freezes/slow running (problem is confirmed by other users having the same issue).

[@jeFF0Falltrades]

Thanks so much on both accounts, and thanks for being here!

[@jeFF0Falltrades]

@@micha7863 thanks for attesting to the unattended installation stuff as well - as you’ll see (if you haven’t already) it DOES cause issues for me as well 🥴

[@micha7863]

@@jeFF0Falltradesoh ok, i was commenting while watching, thanks again!

[@jeFF0Falltrades]

I figured haha. Didn't mean to spoil it for you, but yeah, had quite a few "live" troubleshooting instances with VirtualBox/Windows

[@Nightguii]

Awesome video! question though.. How do I increase the storage of my shared folders? its saying something along the lines of 21 gb out of 296 gb available but when I go into the folder not much is in there..

[@jeFF0Falltrades]

@@Nightguii Thanks so much and so glad you’re enjoying! And the only limitations on your Shared Folder size should be 1) how much storage you have allocated for your VM in total and 2) how much storage you have on your host machine. I’m wondering if that’s not telling you how much storage is used on your VM in total out of how much is available? Otherwise, it doesn’t make much sense for your folders to be limited. I’d check how much storage you have allocated vs how much is used for the VM as a whole, and see if the numbers add up to what you see there.

[@ghaBBster]

Hello, Jeff! I got some issues on REMnux installation process, still fighting with same problem, "issues" board on github doesn't make sense for me, and i really want to step through the process with your video, so idk what to do with that, right now i'm installing Flare-VM is it ok to contribute in crackme challenge with my own Flare-VM setup? thank you for your time!

[@jeFF0Falltrades]

@@ghaBBster Absolutely! No need to use this particular sandbox for the challenge! If you do need help troubleshooting with anything Remnux related, feel free to leave a comment or Issue to talk further about it :-)

[@ghaBBster]

@@jeFF0Falltrades thanks for reply, Finally i figured out how to install and prepare REMnux, Right now i got some challenge with establishing the connection between REMnux network and victim's Windows machine, I configured the REMnux (burpsuite and inetsim) and Windows network settings, but don't get a connection on 10.10.10.3:8080 on Windows machine btw i use VMWare pro 17 on Windows 10 and maybe that virtualization tool is what makes the deal between yours and mine implementation Whatever comes to mind to make clear on this situation - i would be glad to see your reply thanks for your time!

[@ghaBBster]

@@jeFF0Falltrades finally i figured out REMnux installation and further configuration, thanks for detailed sections of setting up the REMnux machine Right now I have challenge with establishing the connection between REMnux (burpsuite) and Windows victims's machine, don't get any reply on 10.10.10.3:8080 i rewatched and rechecked all sections in tutorial (before this section about connection) but have the same issue Btw i use VMware pro 17 on Windows 10 machine, maybe this difference makes the deal, but i doubt it, So, if you have any ideas - please let me know And congratulations on being a dad and 11k subs, i really enjoy watching your content!

[@jeFF0Falltrades]

@@ghaBBster Thank you so much for the kind words, and congrats on the progress!!! Regarding the connectivity: Are you able to do a simple ping from the windows to the remnux machine? Or pull a regular page by opening the browser and going to any site (while inetsim is running)? If so, we can move on to Burp troubleshooting; if not it may be a broader networking issue between your VMs. Let me know and we can work through it.

[@moshedo7975]

sorry coming back here where can I find the example_https_call program to test my https connections? NEVER MIND I succeeded

[@jeFF0Falltrades]

@@moshedo7975 If you still need the example let me know but any HTTPS traffic should do! Glad to hear you’re progressing!!!