Skip to main content

Lab 2.2: Disposable VM for Destructive Testing

Learning Objectives​

By the end of this lab, you will be able to:

  • Create a Windows VM optimized for testing
  • Use snapshots to test without risk
  • Perform destructive tests safely
  • Understand cloning and linked clones
  • Create a reusable lab environment

Estimated Duration​

25 minutes

Prerequisites​

  • VirtualBox or VMware installed
  • A functional Windows 10/11 VM
  • Minimum 20 GB of free disk space

Professional Context​

As a system administrator or security professional, you often need to:

  • Test configurations that might break the system
  • Check the impact of malware (in an isolated environment)
  • Experiment with risky system modifications
  • Train users on common errors

Disposable VMs allow:

  • Testing ANYTHING without fear
  • Instantly rolling back
  • Multiplying test environments
  • Completely isolating from the host system

Part 1: Understanding Snapshots​

Step 1.1: Snapshot Concept​

A snapshot captures the EXACT state of a VM at a given moment:

  • All files
  • All RAM memory
  • All configuration

Analogy: It's like a backup that takes 2 seconds and allows you to roll back in 5 seconds.

Step 1.2: Use Cases​

Typical scenario:

  1. Clean and functional VM
  2. Create snapshot "CLEAN"
  3. Test something destructive (delete System32, disable services...)
  4. System broken? No problem!
  5. Restore snapshot "CLEAN"
  6. VM like new in 10 seconds

Questions:

  1. Have you ever broken Windows by testing something?
  2. How long did it take you to reinstall?

Step 1.3: Create Your First Snapshot​

In VirtualBox:

  1. Select your Windows VM
  2. Machine → Take Snapshot (or 📸 icon)
  3. Name: "CLEAN_BASE"
  4. Description: "Clean Windows, just installed, before any tests"
  5. Click OK

BOOM! Snapshot created in seconds.

In VMware:

  1. VM → Snapshot → Take Snapshot
  2. Same principle

Questions: 3. How long did the snapshot creation take? 4. What is the size of your snapshot file?

Part 2: Destructive Tests - Level 1 (Recoverable)​

Step 2.1: Test 1 - Delete System Files​

ON YOUR VM (NOT your real computer!):

  1. Start the VM
  2. Open File Explorer
  3. Go to C:\Windows\System32

WARNING: Normally, NEVER do this on a real system!

  1. Try to delete notepad.exe

    • Right-click → Delete
    • Windows may block (protected file)

  2. Try with admin rights:

    • Open cmd as admin
    takeown /f C:\Windows\System32\notepad.exe
    icacls C:\Windows\System32\notepad.exe /grant %username%:F
    del C:\Windows\System32\notepad.exe

  3. Try to launch Notepad

    • Windows + R → notepad
    • Error! The file no longer exists

Observe:

  • Windows continues to function
  • But notepad is broken

Questions: 5. Did you manage to delete notepad.exe? 6. Is the system still functioning?

Step 2.2: Test 2 - Disable Critical Services​

Open services.msc:

services.msc

Find and stop these services:

  1. Windows Update (wuauserv)

    • Right-click → Stop
    • Right-click → Properties → Startup type: Disabled

  2. Windows Defender (WinDefend)

    • Same procedure

  3. Windows Search

    • Same procedure

Restart the VM

Observe:

  • Some features no longer work
  • Windows search broken
  • No updates
  • No antivirus protection

Questions: 7. Which services did you disable? 8. What immediate impact did you observe?

Step 2.3: Test 3 - Modify the Registry (Dangerous!)​

WARNING: On a real system, this can cause a BSOD!

Open regedit:

regedit

Go to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Find the key Shell (normally = explorer.exe)

Change to: cmd.exe

Restart the VM

Result:

  • Instead of the normal Windows desktop, you'll just have cmd!
  • No explorer, no desktop!

Questions: 9. What did you get after rebooting? 10. Could you still use Windows normally?

Part 3: Snapshot Restoration​

Step 3.1: Your VM is Broken!​

After all these tests, your VM is probably:

  • Notepad deleted
  • Critical services disabled
  • Registry modified
  • Desktop broken

On a real system: Reinstallation = 1-2 hours

With snapshot: Recovery = 10 seconds!

Step 3.2: Restore the Snapshot​

In VirtualBox:

  1. Shut down the VM (or not, you can restore even while running!)
  2. Right-click on VM → Snapshots
  3. Select "CLEAN_BASE"
  4. Right-click → Restore
  5. Confirm

Wait 5-10 seconds...

MAGIC! Your VM is back to the clean state!

Restart the VM:

  • Notepad works
  • All services active
  • Normal registry
  • Normal desktop

Questions: 11. How long did the restoration take? 12. Were all your destructive tests undone?

Step 3.3: Measure the Difference​

Time for:

  • Reinstalling Windows from scratch: _____ minutes
  • Restoring a snapshot: _____ seconds

Ratio: About 100x faster!

Part 4: Multiple Snapshots - Tree Structure​

Step 4.1: Create a Snapshot Hierarchy​

Snapshots can be organized in a tree structure:

CLEAN_BASE
├── AFTER_INSTALL_CHROME
├── AFTER_INSTALL_PYTHON
│   └── AFTER_CONFIG_PYTHON
└── WITH_BACKDOOR_TEST

Create this structure:

  1. From CLEAN_BASE, start the VM
  2. Install Chrome (or other software)
  3. Create snapshot: "AFTER_INSTALL_CHROME"
  4. Restore "CLEAN_BASE"
  5. Install Python
  6. Create snapshot: "AFTER_INSTALL_PYTHON"

You now have 3 states:

  • Clean Windows
  • Windows + Chrome
  • Windows + Python

Advantage: Test different configurations without reinstalling!

Step 4.2: Navigating Between Snapshots​

Exercise:

  1. Restore "AFTER_INSTALL_CHROME"
  2. Verify Chrome is there but not Python
  3. Restore "AFTER_INSTALL_PYTHON"
  4. Verify Python is there but not Chrome
  5. Restore "CLEAN_BASE"
  6. Neither Chrome nor Python

Questions: 13. How many snapshots have you created? 14. Can you freely navigate between them?

Step 4.3: Disk Space Management​

Attention: Snapshots take up space!

Check the space:

In VirtualBox:

  1. Right-click on VM → Settings → Storage
  2. Look at the file sizes

Each snapshot stores:

  • The DIFFERENCES from the parent snapshot
  • Not the entire disk each time (delta)

Best practice:

  • Keep only necessary snapshots
  • Delete old ones
  • Merge when possible

Part 5: VM Cloning​

Step 5.1: Full Clone vs Linked Clone​

Full Clone:

  • TOTAL copy of the VM
  • Independent of the original
  • Takes as much space as the original VM
  • Can be moved, shared

Linked Clone:

  • Shares the disk with the original VM
  • Stores only the DIFFERENCES
  • Much faster to create
  • Uses much less space
  • Perfect for testing!

Step 5.2: Create a Linked Clone​

In VirtualBox:

  1. Right-click on your VM → Clone
  2. Name: "Windows_TEST_1"
  3. Clone type: Check "Linked"
  4. Snapshot: Select "CLEAN_BASE"
  5. Click Clone

BOOM! Clone created in 10-20 seconds!

Check the space:

  • Original VM: ~15-20 GB
  • Linked clone: ~500 MB initially!

Step 5.3: Create Multiple Test Clones​

Create 3 linked clones:

  1. "Windows_TEST_MALWARE" (for malware testing)
  2. "Windows_TEST_DESTRUCTIVE" (for destructive tests)
  3. "Windows_TEST_NETWORK" (for network tests)

Advantages:

  • 3 VMs in a few minutes
  • Total space: ~2-3 GB instead of 60 GB
  • Each clone can be broken and recreated in 10 seconds

Questions: 15. How many clones have you created? 16. What is the total disk space used?

Part 6: Destructive Tests - Level 2 (More Advanced)​

Now that you have disposable VMs, let's test REALLY destructive things!

Step 6.1: Test 1 - Deleting System32​

ON A LINKED CLONE only!

Internet Myth: "Deleting System32 speeds up Windows"

Reality: It completely destroys Windows!

Let's test (on clone!):

  1. Start "Windows_TEST_DESTRUCTIVE"
  2. cmd as admin:
takeown /f C:\Windows\System32 /r /d y
icacls C:\Windows\System32 /grant %username%:F /t
  1. DO NOT DO (too long): rd /s /q C:\Windows\System32
  2. Instead, just delete an important folder:
rd /s /q C:\Windows\System32\drivers
  1. Restart

Result: BSOD or boot failure!

Recovery: Delete the clone, create a new one in 10 seconds!

Step 6.2: Test 2 - Test Malware (EICAR)​

EICAR = Standard antivirus test file (not a real virus, just a test)

On test clone:

  1. Disable Windows Defender
  2. Create a file test.txt
  3. Paste inside:
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
  1. Save
  2. Rename to test.com
  3. Reactivate Defender

Result: Defender detects and deletes!

Observe:

  • Quarantine
  • Notifications
  • Logs

Questions: 17. Did Defender detect EICAR? 18. How long after reactivation?

Step 6.3: Test 3 - Fork Bomb (DoS)​

Fork Bomb = Program that duplicates itself infinitely until the system is saturated

WARNING: This will FREEZE your VM!

Create forkbomb.bat:

:loop
start %0
goto loop

Execute: Double-click on forkbomb.bat

Result in 10 seconds:

  • CPU at 100%
  • Memory saturated
  • VM completely frozen
  • Impossible to do anything

Recovery:

  1. Force shutdown of the VM
  2. Restore snapshot or recreate clone
  3. 10 seconds, everything is OK!

Questions: 19. Did your VM freeze? 20. How many cmd.exe processes were created? (Task Manager before freeze)

Part 7: Automation and Scripts​

Step 7.1: Automatic Reset Script​

Create a script that:

  1. Deletes the test clone
  2. Creates a new clean clone
  3. Starts the new VM

PowerShell Example:

# Stop and delete test VM
VBoxManage controlvm "Windows_TEST_1" poweroff
VBoxManage unregistervm "Windows_TEST_1" --delete

# Recreate linked clone
VBoxManage clonevm "Windows_Original" --name "Windows_TEST_1" --snapshot "CLEAN_BASE" --options link --register

# Start
VBoxManage startvm "Windows_TEST_1"

Step 7.2: Complete Test Environment​

Ideal architecture for labs:

VM_BASE (never touched, multiple snapshots)
├── CLEAN_BASE (snapshot)
├── WITH_TOOLS (snapshot - tools installed)
└── HARDENED (snapshot - hardened)

Test clones (recreated at will):
├── TEST_MALWARE_1
├── TEST_MALWARE_2
├── TEST_NETWORK
└── TEST_EXPLOIT

Workflow:

  1. Break a clone by testing
  2. Delete it
  3. Create a new one in 10 sec
  4. Start again!

Part 8: Security Measures​

Step 8.1: Network Isolation​

IMPORTANT: Test VMs must be isolated!

Recommended network configuration:

For offensive tests:

  • Network: Host-Only or Internal Network
  • No Internet!
  • Communication only between test VMs

How to configure:

  1. VM Settings → Network
  2. Network access mode: Internal Network
  3. Name: "TestLab"

Check isolation:

  • Try to ping google.com (should fail)
  • Try to ping another VM on the same internal network (should work)

Step 8.2: Snapshots Before Each Test​

Best practice:

Before EACH potentially destructive test:

  1. Create a snapshot with a descriptive name
  2. Perform your test
  3. If it works, merge or delete snapshot
  4. If it breaks, restore

Example:

  • Snapshot: "BEFORE_ROOTKIT_TEST"
  • Test the rootkit
  • If it crashes: Restore → Analyze why
  • Retry with corrections

Step 8.3: Documentation​

Document each snapshot:

Good example:

Name: AFTER_INSTALL_METASPLOIT
Description: 
- Kali Linux
- Metasploit Framework installed and updated
- PostgreSQL database configured
- Ready for pentest tests
Date: 2024-11-08

Bad example:

Name: test1
Description: (empty)

Deliverables​

To submit:

  1. Test Document (Word/PDF) containing:

    • List of destructive tests performed
    • Observed results
    • Recovery time via snapshot
    • Answers to the 20 questions

  2. Screenshots (minimum 6):

    • List of your snapshots (tree structure)
    • Broken VM (e.g., desktop replaced by cmd)
    • Restoration in progress
    • Restored and functional VM
    • List of created clones
    • EICAR test detected by Defender

  3. Lab Architecture (diagram):

    • Your base VM
    • Your snapshots
    • Your test clones
    • Network configuration

  4. PowerShell Script (Step 7.1)

Evaluation Criteria​

CriteriaPoints
Creation and management of snapshots25%
Destructive tests performed and documented25%
Cloning and linked clones20%
Understanding of isolation and security15%
Quality of documentation10%
Automation script5%

VirtualBox Reference Commands​

Snapshot Management​

# List snapshots
VBoxManage snapshot "VMName" list

# Create a snapshot
VBoxManage snapshot "VMName" take "SnapshotName" --description "Description"

# Restore a snapshot
VBoxManage snapshot "VMName" restore "SnapshotName"

# Delete a snapshot
VBoxManage snapshot "VMName" delete "SnapshotName"

Cloning​

# Full clone
VBoxManage clonevm "SourceVM" --name "CloneVM" --register

# Linked clone
VBoxManage clonevm "SourceVM" --name "CloneVM" --snapshot "SnapshotName" --options link --register

VM Management​

# Start
VBoxManage startvm "VMName"

# Graceful shutdown
VBoxManage controlvm "VMName" acpipowerbutton

# Force shutdown
VBoxManage controlvm "VMName" poweroff

# Delete
VBoxManage unregistervm "VMName" --delete

Troubleshooting​

Problem: Snapshot takes a long time​

Solution: If your VM has a lot of RAM (8 GB+), the memory snapshot can be long. Shut down the VM before creating the snapshot.

Problem: Lack of disk space​

Solution:

  • Delete unnecessary snapshots
  • Merge snapshots (right-click → Delete - data is preserved)
  • Use linked clones instead of full clones

Problem: Linked clone won't start​

Solution: The linked clone depends on the parent VM. If you delete or move the parent VM, the linked clones will no longer work.

Going Further (Optional)​

Challenge 1: Multi-VM Lab​

Create a lab with:

  • 1 Windows VM (target)
  • 1 Kali Linux VM (attacker)
  • Internal network connecting them
  • Coordinated snapshots of both

Challenge 2: Vagrant for Automation​

Research Vagrant - VM automation tool.

Create a Vagrantfile that:

  • Automatically configures a Windows VM
  • Installs tools
  • Creates snapshots
  • All in one command!

Challenge 3: VM Templates​

Create templates for different scenarios:

  • "Windows Vulnerable" template (old, unpatched)
  • "Windows Hardened" template (maximally hardened)
  • "Windows Default" template (basic installation)

Document the differences and use cases.

Conclusion​

This lab taught you:

  • Use snapshots to test without risk
  • Create disposable environments
  • Perform destructive tests safely
  • Optimize disk space with linked clones
  • Create a reusable lab infrastructure

Key lessons:

  1. Snapshots = Total freedom - Test everything without fear
  2. Linked clones = Efficiency - Multiple environments, little space
  3. Network isolation = Security - No impact on real network
  4. Documentation = Productivity - Know where you stand
  5. Automation = Speed - Scripts for repetitive tasks

Next step: Lab 2.3 where you will explore BIOS/UEFI security options and firmware-level protection!

Lab developed as part of the Operating Systems course - MODULE 2