Enterprise Cyber Range Guide

  • Updated
Follow

 

Welcome to the Enterprise Cyber Range. 

This article aims to provide you with all the necessary information about the technical requirements, Cyber Range labs, instructions to connect to the VPN and more useful information to maximize your experience in the training environment and labs. We encourage you to read this article thoroughly to ensure that you have all the information you need to get the most out of the training labs.

SECTION 1: DEFENSIVE CYBER RANGE (DCR)

In this section, we will walk you through getting started with your first lab. 

VPN Instructions for OffSec Website

Welcome to Defensive Cyber Range! 

This guide will walk you through how to get started with your first lab! First, you’ll need to connect to the DCR VPN, which is done using OpenVPN. 

Connect to the DCR VPN with OpenVPN for Windows:

For more information about the official OpenVPN Connect client software, please click here: https://openvpn.net/client/client-connect-vpn-for-windows/ 

If you navigated to the link above, you can click the orange download button to get the tool, alternatively use the link below to download the OpenVPN Connect client directly: https://openvpn.net/downloads/openvpn-connect-v3-windows.msi 

The download for installation file will appear in the top right hand corner of your browser:

Locate the OpenVPN client installer (a .msi file) in your downloads folder once the download is complete:

Double click the .msi file to install the OpenVPN Client software. Follow the prompts and complete the process. Once installed, an OpenVPN icon will appear on your desktop. Start the OpenVPN Client by double-clicking the icon:

 

Once OpenVPN is installed and running, you will need to download your VPN pack from the OffSec portal. Start by logging in to the OffSec portal with your credentials. Please note that we recommended using a Mozilla Firefox browser when accessing the OffSec portal, this ensures the best user experience and guaranteed functionality. : 

Once you’ve signed in successfully, locate the VPN download button, which can be seen at the left menu of the dashboard:

Click on the VPN Download icon to initiate the file download. A pop up message will confirm once the file download completed successfully, as seen below:

Return to your Downloads folder, and you will see the file named universal.ovpn.  This is referred to as your ‘VPN Pack’ and is what allows you to connect to the labs within OffSec’s portal. 

Return to the OpenVPN window and drag and drop the universal.ovpn file onto the upload box (the area with the cloud icon), and then click CONNECT. 

 

It may take a few moments for the VPN to connect (you will see an orange loading icon). Once the connection is successful, the orange icon will become green and you will see the details of your VPN connection:

Return to the OffSec portal in your Mozilla Firefox browser and look at the VPN icon where you just downloaded your VPN Pack from. It will have changed from the ‘download’ symbol, to a green dot - which indicates a successful and ongoing VPN connection. 

 

→

You are now ready to access the labs! 

 

Disconnecting from the VPN: 

Once you are done with Lab exercises, we recommend disconnecting from your VPN. 

To do this, return to the OpenVPN client and click on the green toggle bar. A pop-up will appear to inform you that you will be disconnected - click ‘CONFIRM’ to complete the process. The green icon will now turn grey, to show that there are no active VPN connections. 

 

 

2A. How to access the pfSense Firewall and SIEM

In order to start a machine/chain in the DCR Labs, the first step is to connect to the VPN (refer to the full instructions here. Please note that we recommended using a Mozilla Firefox browser when accessing the OffSec portal, this ensures the best user experience and guaranteed functionality. 

Once your VPN is connected, locate the Lab you want to work on. When you hover over the name, the entire row will highlight. Click on the start button at the far right-hand side of this row:

Once the start button has been clicked, a window will open which counts down the starting of the machines in this Lab. Please be patient while the machines in the lab start (this can take a minute or so):

Once the lab has started, the window will populate and contain all of the information you need to complete the exercises. The CREDENTIALS tab will list the IP addresses of all of the machines in your lab instance:

Then click on OBJECTIVES, for detailed instructions about how to complete this lab:

The information inside the OBJECTIVES will explain how to access tools and services like OpenSearch, Suricata and/or pfsense:

You will need to replace the placeholder x with the last octet of your VPN IP address. You can find this information in your OpenVPN client by scrolling down to “YOUR PRIVATE IP’:

You must replace the x placeholder value with the last octet of your private IP, which is 127 in this example. Return to your Firefox browser and navigate to https://10.230.127.178 and https://10.230.127.178. 

You may be met with a security warning, click on Advanced, then Accept the Risk and Continue: 

After completing this action, you will find the login pages for pfsense and OpenSearch:

Login to these services using the credentials supplied in the OBJECTIVES tab.

2B. How to initiate Phase1 and Phase2 attacks

Once you’re connected to the VPN and you’ve logged into the necessary Lab applications, you are ready to begin with the exercises! Return to the OffSec portal and identify the ATTACK PHASES sidebar (this can be seen in a panel on the right of the portal):

Depending on which stage of the exercise you are at, click the required Phase button (here, we are triggering Phase 1). After clicking ‘play’, the icon will change to a loading icon to indicate that the attack has commenced. 

Once the icon has stopped loading - you can return to the labs to detect the action that was described in the OBJECTIVES and carried out when you triggered the Attack Phase: 

 

Attack Phases can be triggered as many times as required, simply repeat the process described above. 

Please note that we recommended using a Mozilla Firefox browser when accessing the OffSec portal, this ensures the best user experience and guaranteed functionality. 

3. How to install OpenVPN on other Operating Systems

First, download the official OpenVPN Connect client software, which is available here: https://openvpn.net/client/ 

There are options for each operating system, please select the correct option for your Operating System if the website does not automatically highlight what you need. 

We recommend using Kali Linux and may be unable to provide VPN connectivity support (other than the instructions below) if you use another setup. Please note that we recommended using a Mozilla Firefox browser when accessing the OffSec portal, this ensures the best user experience and guaranteed functionality. 

Linux (Debian/Kali/Ubuntu):

OpenVPN can be installed in the Terminal, using the following command: 

sudo apt install openvpn

If you’re using a different distribution of Linux (not Debian, Kali or Ubuntu), please refer to these instructions: https://community.openvpn.net/openvpn/wiki/OpenVPN3Linux 

Once OpenVPN is installed, download your VPN pack from the OffSec website. 

This file will be named universal.ovpn. In the Terminal, change to the directory containing the ovpn file. 

Return to the Terminal and run the command sudo openvpn universal.ovpn to connect to the VPN:

Return to the OffSec website, and the VPN icon in the top right corner will have changed from the ‘download’ symbol, to a green dot - indicating a successful VPN connection. 

 

→

You are now ready to access the labs!

To disconnect from the VPN, return to your Terminal and press control and C on your keyboard:

Please note that we recommended using a Mozilla Firefox browser when accessing the OffSec portal, this ensures the best user experience and guaranteed functionality. 

MacOS:

Download the OpenVPN Connect client here: https://openvpn.net/downloads/openvpn-connect-v3-macos.dmg 

Once the download is complete, it will be available in the Downloads folder:

Double-click on the file, and select between Intel processor or Silicon chip by double-clicking on the correct option for your device:

If you are unsure which option is correct, click the apple icon on the top left of your screen and select ‘About This Mac’. This will open a window, which will list the device’s hardware:

After choosing between between Intel processor or Silicon chip, follow the installation prompts (and enter your password if asked to do so):

Once OpenVPN is installed, download your VPN pack from the OffSec website. This file will be named universal.ovpn. 

Open the OpenVPN client, and drag the downloaded universal.ovpn file onto the upload box, then click ‘CONNECT’. 

Once the connection is successful, the top left toggle-bar inside the OpenVPN client will turn green. 

→

Return to the OffSec website, and the VPN icon in the top right corner will have changed from the ‘download’ symbol, to a green dot - indicating a successful VPN connection.  

→

You are now ready to access the labs!

To disconnect your VPN, return to the OpenVPN client and click on the green toggle bar. Click ‘CONFIRM’:

Please note that we recommended using a Mozilla Firefox browser when accessing the OffSec portal, this ensures the best user experience and guaranteed functionality. 

Accessing DCR with Kali:

Alternatively, the IP address can be found by running the command ip a in the Terminal (look at the IP address details for tun0):

In this example, the last octet is 127 (and the lab is Flywheel). By opening a browser and navigating to https://10.230.127.178 and https://10.230.127.178, we find the login pages for pfsense and OpenSearch:

 

SECTION 2: ENTERPRISE CYBER RANGE

Minimum Technical Requirements

Minimum required hardware for your host OS:

  • CPU: 64-bit Dual Core (2.2 GHz per core)
  • RAM: 8 GB (recommended)
  • Minimum 60GB disk space

Minimum required software for your host OS:

  • Operating system: Any operating system that supports virtualization
  • Internet:
    • Minimum 5mbps Download/ 1mbps Upload speeds
    • Stable connection that does not drop

The Enterprise Cyber Range Labs

The Enterprise Cyber Range is a simulated network infrastructure that allows learners to sharpen their skills and demonstrate technical competence. It is integrated in the Learn Enterprise subscription which is accessible in the OffSec Learning Library. The environment provides learners with the ability to work with a variety of machines and networks to develop their skills in cyber security.

Offensive Cyber Range - OCR: Attack (RED)

Initially, Offensive Cyber Range offers a wide array of Attacking chains of machines that are dedicated to each learner which are set to be powered up on demand.

The Labs machines include a mix of Windows and Linux operating systems, allowing for a comprehensive learning experience across multiple platforms. It also includes multiple networks, providing students with the opportunity to work with different network configurations. Additionally, there are multiple Active Directory chains, allowing students to gain hands-on experience with this commonly used tool in the IT industry.

Embark on a journey through an extensive range of attack vectors, covering:

  • Windows and Linux machines: Explore vulnerabilities and misconfigurations specific to both Windows and Linux operating systems. Gain insights into privilege escalation, lateral movement, and post-exploitation techniques on these platforms.
  • Active Directory: Understand the importance of Active Directory (AD) in many corporate environments and learn how to exploit AD misconfigurations, weak authentication, and insecure permissions.
  • Web application: Learn about common web application vulnerabilities, like cross-site scripting (XSS), SQL injection, and remote code execution, to effectively assess and secure web applications.
  • Phishing attacks: Delve into social engineering techniques used to deceive individuals and trick them into revealing sensitive information or performing actions that compromise security.
  • Supply chain attacks: Examine attacks that exploit vulnerabilities in the supply chain to compromise hardware, software, or services before they reach the end-users.
  • CVE attacks: Study how attackers leverage known vulnerabilities (CVEs) in software and systems to gain unauthorized access or execute malicious code.
  • XDay attacks: Explore targeted attacks, zero-day vulnerabilities, and sophisticated intrusion techniques employed by advanced persistent threats (APTs) and nation-state actors.

Defensive Cyber Range- DCR: Defend (BLUE)

We welcome you to the next frontier of cybersecurity training with the Defensive Cyber Range! Our groundbreaking addition to the renowned Attack chains of machines offers an unmatched virtual experience, where your team becomes true cyber sentinels mastering both offense and defense.

Defense Labs complements Attack Labs, empowering your experts to effectively navigate real-world threats and elevate their digital forensics, incident handling, and advanced threat hunting skills.

From refining offensive tactics in Attack Labs to crafting unyielding defense strategies in Defense Labs, your team will face hyper-realistic simulations and emerge as a unified force, ready to defend your digital landscape with unwavering expertise.

The Defend chain of machines offered provides hands-on experience in defending against real-world cyber threats, covering critical areas, including:

  • Active directory: Gain in-depth knowledge and practical skills to protect one of the most targeted assets in your network, ensuring its integrity and resilience against attacks.
  • Phishing: Learn to identify, mitigate, and prevent phishing attempts, a prevalent social engineering tactic used to compromise organizations.
  • Web: Develop the ability to secure web applications and services, safeguarding against web-based attacks and vulnerabilities that pose significant risks to your infrastructure.

Accessing Enterprise Cyber Range in the Learning Library

To access Enterprise Cyber Range, please go to "Labs" under the “Explore” menu of your Learning Library account.

Connecting to the Labs

Your connection to the lab is to be done with Kali Linux using OpenVPN. We are unable to provide any VPN connectivity support if you choose to use another setup. It is also highly recommended that you download and use the Kali VMware image for the most streamlined experience. For more information, please visit here.

Accessing mission objectives

When starting a lab machine, you will gain access to documentation that outlines your objectives. If you need a second look at your objectives while working on the machine, simply click on the IP address in the machine list.

Enterprise Cyber Range Dashboard

On your dashboard, you can:

  • Search by lab machine name on the search bar.
  • Filter by Operating system, difficulty and type
  • Sort by machine name, points, difficulty, last action or by progress.
  • Hover over the machine name to see the details of the machine such as: the machine name, the author of the machine, the release date of the machine and information if it includes a walkthrough.
  • Start a machine.
  • Revert a machine.
  • Submit a flag.
  • Provide feedback.
  • Take notes.
  • Access mission objectives.
  • Rate a machine.

Flags submission

Flag values are dynamically generated when you start a machine and they are destroyed when the machine is stopped. That means that you should submit their values while the machine is still running. 

While we recognize that learners come with different experiences and this affects the time to exploit a machine, we also expect that to get the flag values any learner will need a minimum of 15 minutes working on a machine.

Rate and submit a feedback on a machine

To rate a machine or share your feedback, simply click on the 'Rate difficulty' and 'Feedback' buttons located in the Menu.

For further guidance and details, please click here.

Related articles

Powered by Zendesk