This page contains the instruction to build DetectionLab for Qemu/LibVirt. This is the provider for you if:
A step-by-step guide is available at https://selorasec.wordpress.com/2019/12/03/ad-in-a-box-for-pocs-and-iocs-on-the-cheap-detectionlab-on-libvirt/#Setting_Up_Vagrant.
A big thank you to @Selora for adding this in PR #254
I do not officially support or troubleshoot DetectionLab issues using the LibVirt provider. You’re welcome to open issues for community support, but I will not personally be able to assist with them.
virt-manager installation walkthrough and documentation is out of scope of this project. To follow along, you need an already working installation of
virtio_win_iso: The ISO containing the lastest VirtIO drivers
packer_build_dir: Where to output the QCOW2 images. It’s a temporary directory, the .box files will still be in DetectionLab/Packer
env TMPDIR=/path/to/large/storage/ PACKER_LOG=1 PACKER_LOG_PATH="packer_build.log" packer build --only=qemu windows_2016.json env TMPDIR=/path/to/large/storage/ PACKER_LOG=1 PACKER_LOG_PATH="packer_build.log" packer build --only=qemu windows_10.json
vagrant plugin install vagrant-reload vagrant-libvirt vagrant-winrm-syncedfolders
vagrant box add windows_10_libvirt.box --name windows_10_libvirt
vagrant box add windows_2016_libvirt.box --name windows_2016_libvirt
vagrant up --provider libvirt --no-parallel --provision
The libvirt builder is highly experimental. This sections describes the trade-offs and the differences between the vanilla DetectionLab.
The synced folder is using an old, slow and buggy plugin. While this barely works, it’s enough to push the provisioning scripts to the Windows instances. Any modifications to the
vm.synced_folder in the VagrantFile libvirt provider will likely break the provisionning process
The graphical and input settings assume the use of virt-manager with the SPICE viewer on Windows and the VNC viewer on Linux (logger). The spice agent for copy/pasting and other quality of life improvement, like auto-resolution changes is NOT installed on the Windows hosts. Guacamole is a better way to access your VMs.