Oracle VirtualBox

What It Does

VirtualBox creates and manages virtual machines (VMs) -- isolated environments that behave like separate physical computers. Each VM gets its own virtual CPU, RAM, disk, and network adapters. You install an operating system from an ISO file, and it runs in a window on your desktop. You can snapshot a VM at any point, experiment destructively, and roll back to the snapshot in seconds.

VirtualBox supports Windows, Linux, macOS, FreeBSD, and Solaris as both host and guest operating systems. It handles NAT, bridged, host-only, and internal networking modes for building isolated lab networks.

Why You Need It

Every lab in Hexworth assumes you can spin up virtual machines. Active Directory labs need a Windows Server VM and a Windows 10 workstation VM. Penetration testing needs a Kali VM attacking a vulnerable target VM. Networking labs need multiple VMs on isolated virtual networks. Without a hypervisor, you cannot do hands-on security work.

VirtualBox is free with no license restrictions, runs on Windows/Linux/macOS, and is referenced in Forge House labs, Dark Arts attack labs, and Script House Linux administration exercises. It is the recommended hypervisor for students who do not have VMware licenses.

How to Install It

Windows:

1. Go to https://www.virtualbox.org/wiki/Downloads
2. Download Windows hosts installer
3. Run the installer with default options. It will install virtual network adapters -- allow this when prompted.
4. Also download and install the VirtualBox Extension Pack from the same page (adds USB 2.0/3.0 passthrough, RDP, disk encryption)

macOS:

1. Download the macOS / Intel hosts or macOS / ARM hosts package from the downloads page
2. Open the .dmg and run the installer
3. Go to System Preferences > Security & Privacy and allow the Oracle kernel extension when prompted

Note: On Apple Silicon (M1/M2/M3/M4), VirtualBox runs in beta. VMware Fusion or UTM may be more stable for ARM Macs.

Linux (Debian/Ubuntu):

sudo apt update
sudo apt install virtualbox virtualbox-ext-pack

Linux (Fedora/RHEL):

sudo dnf install VirtualBox

Verify installation:

VBoxManage --version

How to Use It

1. Create a new VM. Click New in VirtualBox Manager. Give it a name (e.g., "Kali-Lab"), select the OS type and version, and allocate RAM. For Linux: 2-4 GB. For Windows: 4-8 GB. For Windows Server with AD: 4+ GB.
2. Create a virtual hard disk. Select VDI format, dynamically allocated, 40-80 GB. Dynamically allocated means the file only grows as the guest OS uses space -- it does not pre-allocate the full size on your host.
3. Mount the ISO. Go to Settings > Storage > click the empty CD icon > choose your ISO file. The VM will boot from this ISO on first start.
4. Install the OS. Start the VM and follow the OS installer. After installation, go to Devices > Insert Guest Additions CD Image and install Guest Additions inside the VM for clipboard sharing, drag-and-drop, and better display resolution.
5. Take a snapshot. Before you experiment, go to Machine > Take Snapshot. Name it "Clean Install." If you break anything, restore this snapshot to get back to a known-good state in under 10 seconds.

Networking Modes

• NAT -- VM can reach the internet through your host. Simple, safe, default. The VM gets a private IP (10.0.2.x) and cannot be reached from the host or other VMs.
• Bridged -- VM appears as a separate device on your physical network. Gets its own IP from your router. Use this when the VM needs to be reachable by other devices on your LAN.
• Host-Only -- VM can talk to your host and other VMs on the same host-only network, but cannot reach the internet. Ideal for isolated lab networks (attacker VM + target VM).
• Internal Network -- VMs on the same named internal network can talk to each other. No host access, no internet. Use for fully isolated scenarios like AD domain labs.
• NAT Network -- Like NAT but multiple VMs share the same NAT network and can see each other. Combines internet access with inter-VM communication.

For a typical pentesting lab: put the attacker (Kali) and target on the same Host-Only network. For AD labs: put the Domain Controller and workstations on an Internal Network with a pfSense VM bridging to NAT for internet access.

Common Gotchas

• VT-x/AMD-V not enabled. VirtualBox requires hardware virtualization support. If you get "VT-x is disabled in the BIOS," reboot into BIOS/UEFI and enable Intel VT-x or AMD-V (also called SVM) under CPU or Advanced settings.
• Hyper-V conflict on Windows. If you have Hyper-V, WSL2, or Windows Sandbox enabled, VirtualBox may run in a slower fallback mode. To check: run systeminfo in cmd and look for "A hypervisor has been detected." You can disable Hyper-V with bcdedit /set hypervisorlaunchtype off and reboot, but this breaks WSL2 and Docker Desktop.
• Guest Additions not installed. Without Guest Additions, the VM display will be stuck at low resolution, clipboard sharing will not work, and shared folders will not mount. Always install Guest Additions after the OS install.
• Insufficient disk space on host. VDI files grow as the guest uses space. A Windows VM can easily reach 30-50 GB. Check your host drive space before creating multiple VMs. Use VBoxManage list hdds to see disk usage.
• USB passthrough not working. USB 2.0/3.0 passthrough requires the Extension Pack. Without it, only USB 1.1 is available. Install the Extension Pack from the VirtualBox downloads page (File > Preferences > Extensions > Add).

VBoxManage CLI Reference

VirtualBox includes a powerful command-line tool. Useful for scripting lab setup:

# List all VMs
VBoxManage list vms

# Start a VM headless (no GUI window)
VBoxManage startvm "Kali-Lab" --type headless

# Take a snapshot
VBoxManage snapshot "Kali-Lab" take "Clean-Install"

# Restore a snapshot
VBoxManage snapshot "Kali-Lab" restore "Clean-Install"

# Clone a VM
VBoxManage clonevm "Kali-Lab" --name "Kali-Lab-Copy" --register

# Show VM info
VBoxManage showvminfo "Kali-Lab"

# Modify VM settings (e.g., increase RAM to 4GB)
VBoxManage modifyvm "Kali-Lab" --memory 4096