A hands-on cybersecurity lab demonstrating secure Ubuntu server deployment, service configuration, network reconnaissance, centralized log monitoring with Splunk, and Linux privilege escalation in a controlled virtual environment.
This project demonstrates the implementation of a small Security Operations Center (SOC) lab using Ubuntu Server running inside Oracle VirtualBox.
The objective was to understand Linux server administration, configure common network services, perform security monitoring, detect malicious activities, and study privilege escalation techniques in a safe laboratory environment.
The project includes:
- Ubuntu Server Deployment
- FTP Server Configuration (vsftpd)
- SSH Server Configuration
- Network Enumeration using Nmap
- Splunk Enterprise Log Monitoring
- Alert Creation in Splunk
- Hydra Brute-force Detection
- Linux SUID Privilege Escalation Demonstration
- Deploy Ubuntu Server in VirtualBox
- Configure FTP and SSH services
- Scan the server using Nmap
- Collect Linux logs using Splunk
- Configure Splunk alerts
- Detect brute-force login attempts
- Understand Linux SUID privilege escalation
- Gain practical SOC and system administration experience
| Category | Tools |
|---|---|
| Operating System | Ubuntu Server 24.04 LTS |
| Virtualization | Oracle VirtualBox |
| Security Monitoring | Splunk Enterprise |
| Remote Access | OpenSSH |
| File Transfer | vsftpd |
| Network Scanning | Nmap |
| Attack Simulation | Hydra |
| Programming | C |
| Compiler | GCC |
| Client Machine | Kali Linux |
Linux-Security-Lab
│
├── README.md
├── docs
├── configs
├── exploit
├── screenshots
└── scripts
- Oracle VirtualBox
- Ubuntu Server 24.04 LTS
- Kali Linux Attacker Machine
- Local Virtual Network
This module covers:
- Creating the virtual machine
- Ubuntu Server installation
- Storage configuration
- User creation
- SSH installation
- Initial server configuration
Documentation:
docs/Ubuntu_VM.pdf
Screenshots:
- VirtualBox Manager
- SSH Installation
- Ubuntu Login
The FTP server was configured using vsftpd.
Tasks performed:
- Installed vsftpd
- Configured anonymous access
- Configured local users
- Configured FTP root directory
- Allowed FTP through firewall
- Tested FTP connectivity
Configuration File:
configs/vsftpd.conf
Screenshots:
- FTP Configuration
- vsftpd Configuration
- FTP Login
- Nmap Scan
The OpenSSH server was configured for secure remote administration.
Tasks performed:
- Installed OpenSSH
- Started SSH service
- Enabled auto-start
- Allowed Port 22
- Verified remote login
Configuration File:
configs/sshd_config
Screenshots:
- SSH Configuration
- SSH Login
- Successful Remote Login
Splunk Enterprise was configured to collect and analyze system logs.
Activities performed:
- Installed Splunk Universal Forwarder
- Configured log forwarding
- Indexed system logs
- Created dashboards
- Created search queries
- Configured security alerts
Features:
- Log Collection
- Dashboard Monitoring
- Search & Reporting
- Real-time Alerting
Screenshots:
- Splunk Dashboard
- Search Interface
- Alert Configuration
- Hydra Detection
Nmap was used to identify exposed services.
Tasks performed:
- Port Scanning
- Service Detection
- Host Discovery
- Enumeration
Tools:
- Nmap
A simple SUID-enabled C program was created to demonstrate privilege escalation concepts.
Steps:
- Wrote C program
- Compiled using GCC
- Changed ownership to root
- Applied SUID permission
- Executed binary
- Obtained root shell
Source Code:
exploit/code.c
- Virtual Machine Setup
- SSH Installation
- Ubuntu Login
- FTP Configuration
- FTP Login
- Nmap Scan
- SSH Configuration
- Remote Login
- Dashboard
- Search Interface
- Alert Creation
- Hydra Detection
- Writing Exploit
- Compilation
- Permission Assignment
- Root Shell
This project helped strengthen practical knowledge in:
- Linux Administration
- Ubuntu Server Deployment
- FTP Server Configuration
- SSH Administration
- Network Enumeration
- Splunk Enterprise
- Security Monitoring
- SIEM Fundamentals
- Log Analysis
- Linux File Permissions
- SUID Privilege Escalation
- Basic Incident Detection
All demonstrations, including brute-force testing and privilege escalation, were performed in an isolated virtual lab environment for educational purposes only.
Detailed reports are available in the docs folder.
- Ubuntu VM Configuration
- FTP & SSH Configuration
- Splunk Implementation
- SUID Privilege Escalation
B.E. Computer Science and Engineering
Cybersecurity Enthusiast | SOC Analyst Aspirant
- Linux Administration
- Splunk
- Wazuh
- IBM QRadar
- Nmap
- Nessus
- OpenVAS
- Metasploit
- Network Security
- Vulnerability Assessment
- Log Analysis
LinkedIn: https://www.linkedin.com/in/chaithanyasankar-s/
Portfolio: https://sharp-showcase--Cshankar.replit.app
Email: chaithanyasankar22@gmail.com
If you found this repository useful, consider giving it a ⭐ on GitHub.