Windows_Bootkit_Remediate Challenges Setup Guide

The purpose of these instructions is to provide students with clear, consistent, and repeatable steps for interacting with the Win_Bootkit.vdi file towards completing the Windows_bootkit_remediate challenges.

Pre-Challenge Prep

On Admin-Station via Mobaterm and Terra

  1. Open mobaterm and ssh into 10.xx.0.6

Mobaterm allows for forwarding of graphics from Linux machines to Windows

On ssh connection to 10.xx.0.6 in Mobaterm

  1. Unzip Win_Bootkit.vdi.7z (this takes about 15 minutes)

    1. p7zip -d Win_Bootkit.vdi.7z Win_Bootkit.vdi

  2. Start the Virtual Machine

    1. qemu-system-x86_64 -device usb-ehci -m 2G -net none Win_Bootkit.vdi


On Op Station via in-class Ubuntu workstation

  1. Find your IP address from your project space in vta.cybbh.space

    1. Left side nav bar → Project → Compute → Instances → linux_opstation_xxxx - 10.50.x.x

      1. If you do not have a set of Op Stations refer to https://cctc.cybbh.io/students/students/latest/Day_0_Setup.html#_vta_stack_build_for_opstations

  2. SSH into your personal Linux Op Station, using -X to forward graphics

    1. Ex. ssh -X student@10.50.x.x

  3. Download Win_Bootkit.vdi.7z (takes a couple minutes)

    1. wget http://10.50.0.1:8080/class/linux_stu_img/Win_Bootkit.vdi.7z

  4. Install prerequisites

    1. sudo apt-get update

    2. sudo apt install qemu-utils qemu-system-x86 p7zip-full -y

    3. Extract the Virtual Disk Image (vdi) (this takes about 15 minutes)

    4. p7zip -d Win_Bootkit.vdi.7z Win_Bootkit.vdi

  5. Start the Virtual Machine

    1. qemu-system-x86_64 -device usb-ehci -smp 2 -m 2G -net none Win_Bootkit.vdi

The switch -smp allocates two CPU cores; memory is specified with -m


On in-class Ubuntu workstation

  1. Pull up terminal on classroom workstation

  2. Download Win_Bootkit.vdi.7z (takes a couple minutes)

    1. wget http://10.50.0.1:8080/class/linux_stu_img/Win_Bootkit.vdi.7z

  3. Extract the Virtual Disk Image (vdi)

    1. file-roller -h Win_Bootkit.vdi.7z

This may take a while

  1. Start the Virtual Machine

    1. qemu-system-x86_64 -device usb-ehci -smp 2 -m 2G -net none Win_Bootkit.vdi

  2. Remove the files from the workstation when challenge complete

    1. rm Win_Bootkit.vdi*

You must delete your files when done with them!


Manual setup on Admin-Station via Mobaterm and Terra

  1. Download Mobaterm using the command below

    1. $webclient=New-Object System.Net.Webclient; $webclient.DownloadFile("https://download.mobatek.net/2152021112100754/MobaXterm_Portable_v21.5.zip", "C:\Users\andy.dwyer\Desktop\mobaterm.zip")

    2. If this fails see Troubleshooting #6 below.

  2. Extract Mobaterm and put it on andy.dwyer’s Desktop

    1. Expand-Archive C:\Users\andy.dwyer\Desktop\mobaterm.zip -DestinationPath C:\Users\andy.dwyer\Desktop\mobaterm

  3. Install Mobaterm

    1. C:\Users\andy.dwyer\Desktop\mobaterm\MobaXterm_Personal_21.5.exe /passive

  4. Open mobaterm and ssh into 10.xx.0.6

On ssh connection to 10.xx.0.6 in Mobaterm

  1. Download Win_Bootkit.vdi.7z

    1. wget http://10.50.0.1:8080/class/linux_stu_img/Win_Bootkit.vdi.7z

  2. Unzip Win_Bootkit.vdi.7z (this takes about 15 minutes)

    1. p7zip -d Win_Bootkit.vdi.7z Win_Bootkit.vdi

  3. Start the Virtual Machine

    1. qemu-system-x86_64 -device usb-ehci -m 2G -net none Win_Bootkit.vdi


Troubleshooting

1. "Win_Bootkit.vdi is corrupted or the file doesn’t work."

  1. Remove the old file and re-extract.

    1. rm Win_Bootkit.vdi

    2. 7z x /root/Win_Bootkit.vdi.7z

    3. Create a backup copy of Win_Bootkit.vdi so you don’t have to re-extract if you break something.

2. "There is no Win_Bootkit.vdi.7z on my system."

  1. If wget isn’t working, have a fellow classmate send you a copy of their file with the 'scp command'.

    1. scp /root/Win_Bootkit.vdi.7z <Your Linux Opstation IP>:./Win_Bootkit.vdi.7z

3. "I tried to qemu and got the following error"

  1. qemu-system-x86_64: cannot set up guest memory 'pc.ram': Cannot allocate memory

  2. It’s likely that the bootkit did not close properly.

    1. While ssh’d into the Linux OpStation, run reboot in terminal.

    2. Let it boot back up and ssh back into the Linux Opstation.

    3. If you find another fix, let your instructor know and we’ll document it.

4. "I tried to qemu and got the following error."

  1. qemu-system-x86_64: -show-cursor: Failed to get "write" lock

  2. Is another process using the image?

    1. ps -elf | grep qemu

    2. Find the Process ID (PID) for the qemu process.

    3. kill -9 <qemu pid>

    4. Run qemu.

5. "When I run qemu, it says it doesn’t have video functions."

  1. Did you ssh -X into the Linux Machine?

  2. Make sure it’s a capital X, not a lowercase x.

6. "The Mobaterm download instructions didn’t work for me."

  1. Navigate to https://mobaxterm.mobatek.net/download-home-edition.html via browser.

  2. Download the Portable Edition (of the Home Edition).

  3. Unzip the archive.

  4. Run the executable.