Simple AD Cyber Security Lab (Part 1)

    There are many good Cyber Security learning systems out there such as Hack the Box, Try Hack Me, and Blue Team Labs to name a few, but I still believe hands-on in a live(live lab anyway) environment is the best way to learn.  

    Why Active Directory?  First, according to a quick search, multiple sources are reporting that 90-95% of Fortune 500 companies are still using Active Directory to some extent. Second, Identity systems are a prime target for attackers due to the access and ability to pivot they offer.

    So let's look at what it takes to set up a Cyber Lab where we can use real red and blue team tools in an Active Directory environment.  We don't need a whole lot just a basic network(to keep this safely isolated), a Domain Controller, a workstation, and our tools(Attacker/Defender) system.  On the Network, I strongly recommend this be isolated from any other network be it a production or even your home network.

The Software

    This is where the magic really is.  Virtualization allows us to build an entire network with servers and clients all in software on just one computer.  We will need a bit more hardware than the absolute minimum for basic computing.  For software, I will be using Oracles Virtual Box software.  This is a freely available type 2 hypervisor(meaning it runs on top of an existing operating system).  Not only is it free for our use it is also available for Windows, MacOS, and Linux.

The Hardware

    Just about any  Intel or AMD based computer from the last 10 years should work as long as it has an SSD and 12 or more Gigabytes of RAM.  There are some Intel CPU's that don't support virtualization they are pretty uncommon but if you buy a used system you may want to do a bit of research first.

Where is how you can check to see if an Intel CPU supports VT-x

https://www.intel.com/content/www/us/en/support/articles/000005486/processors.html

The host I will be using is a cheap Intel N100 based system I've had for a bit.  It is a 4 core 4 thread system with 12GB of RAM.  This could just as easily be an existing or cheap used system.  You will want at least 4 threads, 12GB of RAM, and an SSD.  This could be done with 8GB of RAM but you will probably have to be selective about what VMs are enabled, you may not need both the client and tools VM active at the same time.

Again you don't need expensive hardware, brand-new systems with the same CPU and even more RAM can be had for under $150 US.  Used systems off Ebay or your local thrift store could be even less.

Host

• Windows 10 Home Standard
• 4 core 4 thread Intel N100
• 12GB of Ram
• 512GB NVME SSD
• Single 1Gbps NIC
• WiFi 5

Network Diagram

    As you can see this will be a very simple and yes flat network.  I will be using the network 172.16.254.0/24.  You can use something else but it needs to be from the private ranges described in RFC 1918 and shouldn't overlap with any networks your host will connect to.

IEEE RFC 1918 for reference https://datatracker.ietf.org/doc/html/rfc1918

Let's look at what we will need for the resources on each VM.  All in we are looking at 6GB of RAM and up to 116GB of storage, this will be dynamic so the disk files will only grow as needed.

CPU, we are going to be oversubscribed(more assigned than we actually have) this is not as big of a deal on the CPU we won't be pushing multiple VM's very often but it will be slow when we do.

RAM, 

Disk,6

Gateway

• 1 CPU
• 512MB of Ram
• 16GB Disk

Domain Controller

• 2 CPU
• 1,536MB of Ram
• 30GB Disk

Workstation

• 2 CPU
• 2.048MB of Ram
• 30GB Disk

Kali

• 2 CPU
• 2.048MB of Ram
• 30GB Disk

Easy LLM on Orange PI 5 Plus with NPU acceleration

 

    To keep this easy I am going with a particular setup that will provide basic LLM chatbot capability and a selection of models we can choose from.  This is intended to get quick access to play with some LLMs offline and inexpensively.  Even using the Rockchip NPU this will not be a fast or Chat-GPT-like experience.

Operating system

Installing the necessary kernel and drivers can be challenging and more work than the scope of an "Easy" guide.  So, I used a prebuilt version of Armbian with all the components necessary to enable the NPU.  This build is from Pelochus built using the Armbian Build system.

https://github.com/Pelochus/armbian-build-rknpu-updates/releases/tag/02-11-2024

Install the OS, an SD Card will work for testing but larger models will load very slowly.  I recommend using EMC or an NVME SSD for longer-term use.

sudo dmesg | grep "Initialized rknpu"

This is what we are looking for in the output

Since this is a fresh OS install let's update.

sudo apt update && sudo apt update -y

We do have one thing we need to install before we run the next script, it can be installed if we run the script using sudo.  I have found the script tends to work better if we run it as our user, so let's install this manually.

sudo apt install python3.10-venv

Let's download the WebGUI we are going to use.

git clone https://github.com/c0zaut/rkllm-gradio && cd rkllm-gradio

This will set up a virtual Python environment for us with everything else we need.  We don't want to use sudo because we want the environment under our user.

bash setup.sh

source ~/.venv/rkllm-gradio/bin/activate

You should have a command prompt like this now with your user name at your hostname.  This 

shows us we are in the virtual Python environment the setup.py created.

Now let's grab some models to play with.  Head over to CozAut's profile on Hugging Face.  We are looking for ones that have rk3588 in the name.  These are already converted to the format required by the RK3588's NPU.  It cannot run the standard models you find on Huggingface or Ollama, they must be converted.

https://huggingface.co/c01zaut

Here are the ones I'll cover but feel free to play around.  The files are quite large and the deepseek-coder-7b will require a board with at least 16GB of RAM.

cd ~/rkllm-gradio/models/

c01zaut/Qwen2.5-Coder-3B-Instruct-rk3588-1.1.1

• 3.5GB download
• 3.9 GB of RAM when the model is loaded(substracted.3GB for OS)
• 4.8 seconds load time from class 10 micro SD Card
• 0 seconds load time from EMMC
• 7.7 Tokens per second

wget -O Qwen2.5-Coder-3cdB-Instruct-rk3588-w8a8-opt-0-hybrid-ratio-1.0.rkllm https://huggingface.co/c01zaut/Qwen2.5-3B-Instruct-rk3588-1.1.1/resolve/main/Qwen2.5-3B-Instruct-rk3588-w8a8-opt-0-hybrid-ratio-1.0.rkllm?download=true

c01zaut/Llama-3.2-1B-Instruct-rk3588-1.1.1

• 1.7GB download
• 2.18GB of RAM when the model is loaded(substracted.3GB for OS)
• 7.7 seconds load time from class 10 micro SD Card
• seconds load time from EMMC
• 18.3 Tokens per second

wget -O Llama-3.2-1B-Instruct-rk3588-w8a8-opt-1-hybrid-ratio-1.0.rkllm https://huggingface.co/c01zaut/Llama-3.2-1B-Instruct-rk3588-1.1.1/resolve/main/Llama-3.2-1B-Instruct-rk3588-w8a8-opt-1-hybrid-ratio-1.0.rkllm?download=true

c01zaut/deepseek-coder-7b-instruct-v1.5-rk3588-1.1.1

• 6.9GB download
• 9.03GB of RAM when the model is loaded(substracted.3GB for OS)
• 115 seconds load time from class 10 micro SD Card
• seconds load time from EMMC
• 3.6 Tokens per second ( Note this same model runs at 8.6 tokens per second on my Ryzen 5800x3D cpu so this is pretty impressive for the NPU)

wget -O deepseek-coder-7b-instruct-v1.5-rk3588-w8a8-opt-0-hybrid-ratio-0.0.rkllm https://huggingface.co/c01zaut/deepseek-coder-7b-instruct-v1.5-rk3588-1.1.1/resolve/main/deepseek-coder-7b-instruct-v1.5-rk3588-w8a8-opt-0-hybrid-ratio-0.0.rkllm?download=true

If you choose to use the deepseek model above or select another model from CozAut's list of pre converted models they may not automatically show up in the drop-down.  In that case, you can add them to the model_configs.py file as I will add the deepseek one below.

nano ~/rkllm-gradio/model_configs.py

"deepseek-coder-7b": {"filename": "deepseek-coder-7b-instruct-v1.5-rk3588-w8a8-opt-0-hybrid-ratio-0.0.rkllm"}

Let's make sure we have the device IP address we will need it in a few steps

ip addr

Now let's start our UI, this may take a bit

python3 ~/rkllm-gradio/rkllm_server_gradio.py

From a browser on the same network open http://<ipaddress from ip addr>:8080

Select our model, if you don't see it go back and update the ~/rkllm-gradio/model_configs.py file

Once the model loads go to the Txt2Txt tab and you can chat with the model

Yes, the UI is basic, but you can edit the ~/rkllm-gradio/rkllm_server_gradio.py file to change the name or just about anything else.  Here is the documentation for Gradio  https://www.gradio.app/docs 

Now let's create an alias so we can launch out llm with one command

echo "alias rkllm='source ~/.venv/rkllm-gradio/bin/activate && cd ~/rkllm-gradio && python3 rkllm_server_gradio.py'" >> ~/.bashrc
exec bash

Now we can launch our llm with just

rkllm

How do I back up SD Cards

    This is the primary way I back up SD cards for SBCs.  I use this when I have a working system to protect myself from SD card failure or to do mid-project backups in case I mess something up I don’t have to start over from the beginning.  I’ll be using an Orange Pi 5 Plus with Ubuntu 24.10 installed but any Debian-based system should be the same.

•  Linux Computer
• SD card reader
• Large fast disk drive, at least 2.5 times the size of your SD card of free space

 

Make an Image

Insert an SD card into the reader, this can be a built-in or external, but a good fast external card reader is preferred.

Use lsblk to find our source drive.

lsblk

 

 

For me it is “mmcblk1”, this system has EMMC storage that is on mmcblk0

Here is the same SD card plugged into a generic USB card reader. It helps if the SD card is a different size than any other disk if you are not sure what disk your SD card is.

 

 

As the image copy can take a long time I like to have a progress indicator.  You can do it either way, the result is the same.

Plain DD

The input file(if) should be your SD card “disk” from the lsblk output with “/dev/” in front of it.  This is the part of the Linux file system that represents the raw SD card.

The output file(of) is where you want to write the image to.  You will need plenty of space, this image will be the size of the SD card, and we will need space to create a second copy.

sudo dd if=/dev/mmcblk1 of=sdc_backup.img

With a progress bar

The “if” and “of” are the same as when using the plain DD method.

For pv the size(-s) use the nearest whole GB

sudo apt install pv
sudo dd if=/dev/mmcblk1 | pv -s 28G | sudo dd of=sdc_backup.img

 

Now that we have an image of the SD card let’s shrink it down using a script called PiShrink.  Please check out Drewsif’s GitHub page for more documentation and alternative methods for installing.

https://github.com/Drewsif/PiShrink

To install

cd ~
wget https://raw.githubusercontent.com/Drewsif/PiShrink/master/pishrink.sh
chmod +x pishrink.sh
sudo mv pishrink.sh /usr/local/bin

 

Let’s go back to the location of our SD card image and run PiShrink.

sudo pishrink.sh sdc_backup.img sdc_backup_shrunk.img

 

As you can see our backup image went from the original 29G(rounded up from 28.5) to less than 2!  This will be much easier to store and faster to restore onto another SD card not to mention we can now restore to a smaller SD card than the original one.

 

Testing

So now we have our new little image, let’s put in a different SD card and try it.  Just for fun, I’m going to use a much smaller SD card.

lsblk

 

sudo dd if=sdc_backup_shrunk.img of=/dev/mmcblk1

Or

sudo dd if=sdc_backup_shrunk.img | pv -s 2G |sudo dd of=/dev/mmcblk1

After imaging to the SD card and booting the image it auto-expanded!

 

If the auto-resize fails, you can do it manually with resize2fs

This time we will want the partition(part) from lsblk

 

 

To resize

sudo resize2fs /dev/mmcblk0p1