Victim installation

Start your VM in VirtualBox

1. Log in with:

• username: osboxes
• password: osboxes.org

2. Open a terminal

3. Test if you have a working internet connection.

ping 8.8.8.8

• If your ping is not successful, check if your NAT interface is enabled.

4. Update your OS

sudo apt-get update

5. Install Git

sudo apt install -y git

6. Clone your configuration files for Kali

git clone https://github.com/SanderSchepers1993/CyberSec2026.git

7. Go to the newly cloned Victim directory

cd CyberSec2026/Victim

8. Run the script 01_setup_server.sh with sudo privileges

sudo bash 01_setup_server.sh

• If you encounter problems with openjdk-11-jdk, see TROUBLESHOOTING at the bottom of this README.

9. Continue with the post-installation of the Attacker VM

[TROUBLESHOOTING]

Unable to locate package openjdk-11-jdk

1. Run the script 02_setup_server_java17.sh with sudo privileges

sudo bash 02_setup_server_java17.sh

2. Open your spring-gateway service with a text editor:

sudo nano /etc/systemd/system/spring-gateway.service

2. Replace ExecStart with the following

ExecStart=/usr/bin/java --add-opens java.base/java.lang=ALL-UNNAMED -jar /opt/spring-gateway/target/vulnerable-gateway-1.0.0.jar

• We are now setting up the environment with Java 17 instead of Java 11.
• Java 17 blocks the execution of external Java libraries by default.
• With the above command, you allow Java libraries outside the Java module to use reflection to look into java.lang.

3. Restart the service

sudo systemctl daemon-reload
sudo systemctl restart spring-gateway.service