0

I am trying to create a mini malware analysis environment between a few MacOS VMs to analyse the network activity of MacOS malwares.

Some context about the VMs:

  • Both VM are MacOS Catalina 10.15
  • Both are in a private network (Both VMs can ping each other)

I have installed Python3 on VM2 and installed fakedns to simulate as a DNS server.

I have also changed the DNS server of VM1 to point towards VM2 by using the following steps:

  1. System Preferences
  2. Network
  3. Under Ethernet, click "Advanced"
  4. Select "DNS" tab and click "+" and entered the IP address of VM2.
  5. Clicked "Ok" and "Apply" to apply changes.

At this time, I also started the FakeDNS by entering sudo python3 fakedns.py <IP address of VM2>

However, when I did nslookup something.com on VM1, (based on my Wireshark capture), it went out via loopback port and not the ethernet port. [Refer to picture below, this Wireshark capture was taken from VM1] Wireshark capture of loopback port

EDIT: The two screenshots below are the IP address of VM1 and DNS tab of VM1, with IP address of VM2 set as the DNS enter image description here enter image description here

This screenshot is the IP address of VM2 and I did not configure anything on VM2 enter image description here

When I entered nslookup anything.com <IP address of VM2>, I managed to get the response. However, if I am to enter nslookup anything.com, it goes via the default connection. Is there a way to change the default DNS path??

EDIT #2: This is the screenshot of the network adapter of VM1 (I'm using VMWare Fusion to run the VMs) Both VMs have the same interface as the screenshot below. enter image description here

Also, I've checked my netstat table in VM1 and realised that there's no default route. So I added route add default 172.16.6.1 and below is the Internet routing table enter image description here

I've tried nslookup anything.com after setting the default route, and flushing my DNS cache, but it still doesn't work.

6
  • What is the Ip address of VM1 and VM2? - What is listed under the DNS tab in System Preferences > Network > Ethernet (is it only the VM2 IP address, or multiple addresses?)
    – jksoegaard
    Aug 12, 2021 at 21:57
  • Hi @jksoegaard , I've edited my question to include information regarding the DNS tab of VM1, and to show the IP addresses of VM1 and VM2 Aug 13, 2021 at 2:38
  • Thanks - you question is lacking some more information. The wireshark capture - where is it taken? (inside VM1? on the host?) You have not detailed the network configuration you have made in VMware (or whatever virtualization system you use) - so there might be something there. I would suggest starting with setting a default gateway on VM1 pointing to 172.16.6.1 (or whatever you would like - doesn't really matter as long as it is within that same subnet)
    – jksoegaard
    Aug 13, 2021 at 8:20
  • Hi @jksoegaard, I've edited the post to add more configuration regarding my VMs. Hope this helps... :) Aug 13, 2021 at 9:58
  • Have you tried setting the default gateway as I suggested? (i.e. do it from System Preferences, instead of manually setting on the command line as you did)
    – jksoegaard
    Aug 13, 2021 at 11:44

1 Answer 1

0

Managed to solve it with the help of @jksoegaard.

Must set manually IP for both VM1 and VM2, with the default gateway (router) of both configurations pointing to the same IP address (I indicated 172.16.6.1 for mine). With these configurations, VM1 managed to get a nslookup response from VM2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .