Setup VMWare Virtual Machines with Port-Forwarding
by beck030
This tutorial is a "Step-By-Step Guide" to create your own VMWare virtual machine and make it fit for use with RAT tools. As this tutorial is tagged "Noob-Friendly", i will start by explaining how to create a VMWare virtual machine.
It's my first tutorial, so if you have any suggestion for improvement, please let me know.
Updated on 27.12.2010
- Have a look at my latest tutorial too: [TuT] Free VPN for RATs (and more) with proXPN | No more Port-Forwarding
What you will need
- An UpToDate VMWare Player
- A Port Listener - For example RJL Port Listener
- A Windows XP/Vista/7 ISO or CD
Step 1 - Download and install the VMWare Player
Get the VMware Player here: http://www.vmware.com/products/player/
After downloading it, run the setup. Should not be much trouble.
For some reason VMware excluded the very important "Virtual Network Editor" tool from the VMware Player setup. It is still included in the installer package, but not installed automatically. As the "Virtual Network Editor" is needed for port-forwarding, you have to install it manually.
To install the "Virtual Network Editor" manually, we have to extract the VMWare Player installer. To extract it, follow these steps:
- Open the directory containing your VMWare Player installer
- Right-click on the installer and chose "Create Shortcut"
- Now right-click on the created shortcut and go to "Shortcut" -> "Target"
- Edit the "Target" line and add "/e .\vmplayer" behind the file path. The "Target" line should look kinda like this now: "C:\Path\To\VMware-player-3.1.3-324285.exe /e .\vmplayer"
- Now run the shortcut. This will create a new directory named "vmplayer" or however you named it.
After extracting the installer, open the new directory and look for a file named "network.cab". This file contains the "Virtual Network Editor" tool - "vmnetcfg.exe". Extract "network.cab" and copy all files to the directory where you installed the VMWare Player.
To start the "Virtual Network Editor" tool, simply run the "vmnetcfg.exe", which now should be in the same directory as the "vmwareplayer.exe". You will need it later.
Step 2 - Create a virtual machine and install the OS
In this step i will explain how to create a virtual machine.
- Launch your VMWare Player and click on "Create New Virtual Machine.
Spoiler (Click to View)
- The install wizard will popup. In the first step of the wizard you have to chose an ISO or CD to install your OS from.
Spoiler (Click to View)
- In the second step you have to provide a CD-Key for your OS and a password which will be used for the admin account.
Spoiler (Click to View)
- In the third step you can change the name of your virtual machine and the directory where it will be stored.
Spoiler (Click to View)
- In the fourth step of the wizard you can change the size of the disk size of your virtual machine.
Spoiler (Click to View)
- In the fifth and last step you will see a summary of the settings for your virtual machines. Click on "Customize Hardware" to increase RAM or use multiple CPUs.
Spoiler (Click to View)
- You should now see a new virtual machine listed in your VMWare player. Click on "Play virtual machine". If you run the machine for the first time, the windows OS setup should start automatically. Just run the setup as usual.
Thats it! After finishing the setup, you should be able to start working with your virtual machine.
Step 3 - Port Forwarding with VMWare
If you want your VMWare virtual machine to run a RAT client like CyberGate, you have to forward the listening port from the host-system (where the VMWare Player is installed) to your virtual machine. in that case this shitty diagram i just made shows what happens:
[img]http://img231.imageshack.us/img231/7678/shittydiagram.png[/img]
I know the diagram really looks like crap. I can make a better one later if you guys want me to. But basically it shows what we have to do. The RAT servers on your victims computers try to send data to your RAT client using the listening port you have set. That data will end in nirvana if you dont forward the listening port to the machine, on which your RAT client is running.
In our case the RAT client is running on a virtual machine. So the port forwarding must be like this:
Router -> PC -> Virtual Machine.
Spoiler (Click to View)
In this step of my tutorial i will explain how to forward a port from your host-system to your virtual machine.
To do so you first have to find out the your virtual machines IP. At this point i just assume that you know how to find out your IP on a windows OS.
After you got the IP, run VMWare's "Virtual Network Editor" - read Step 1 of this tutorial to find out where to find and how to start it.
- In the "Virtual Network Editor" you will find a list of virtual network adapters. Each virtual network adapter has its own subnet. The IP of the subnet is in the far right column.
Spoiler (Click to View)
- Now you have to select the right virtual network adapter and hit "NAT Settings...". To find out which is the right virtual network adapter your have to compare the IP of your virtual machine with the subnet IP in the far right column.
An example: If the IP of your virtual machine is 192.168.133.15, you have to select the network adapter "VMnet6". If the IP of your virtual machine is 192.168.182.12, you have to select "VMnet8".
Spoiler (Click to View)
- This last step is pretty much self-explaining. Click on "Add" to create a new port forwarding rule. "Host port" is the incoming port of the host where you installed the VMWare Player. "Virtual machine port" is the port of the virtual machine you want to forward to. Normally both ports are the same (For example the listening port of your RAT client).
Create 2 rules for every port. One for TCP and a second for UDP Protocol.
Step 4 - Test the Port-Forwarding
After setting the port forwarding rules, we have to test if it is working right. This is where we need a Port listener. I suggest to use "RJL Port Listener", which can be downloaded here:
http://www.rjlsoftware.com/software/util...load.shtml
- Download and run the Port listener on your virtual machine.
- Type in the port you forwarded and click on "Start".
Now go to http://www.canyouseeme.org, type in the port you forwarded and click on "check" to perform a port scan.
- Go back to your virtual machine and look at the port-listener tool you started before performing a port scan. You should see a message like this:
Spoiler (Click to View)
If you see that message ("Client connected", "Client disconnected") it means, that the portforwarding was successful and all incoming traffic on the listening port will be forwarded to the virtual machine!
Something didnt work for me! / I still have questions
Port Forwarding doesnt work?
- Make sure that you have set the firewalls on the host-system and on the virtual machine have the listening port opened.
- If you are behind a router, make sure that you forward the listening port to the host-system.
Feel free to ask your questions in this thread or send me a pm.
