Running a downloaded machine

These are .ova files — ready-made virtual machines. You run the target VM on your computer and attack it from your Kali VM. Both live on the same host-only network.

1. Install a hypervisor

• VirtualBox (free, Windows/Linux/macOS-Intel), or
• VMware Workstation Player / Fusion.

2. Import the .ova

VirtualBox: File → Import Appliance, pick the file, click Import. VMware: just open the .ova.

3. Verify the download (recommended)

Check it matches the SHA-256 on the download page:

Get-FileHash .\machine.ova -Algorithm SHA256   # Windows PowerShell sha256sum machine.ova                            # Linux / macOS

4. Put both VMs on a Host-Only network

This is the safety step. Set BOTH the target VM and your Kali VM to a Host-Only Adapter so the vulnerable box can't reach the internet or your home network. In VirtualBox: Settings → Network → Attached to: Host-Only Adapter.

5. Find the target and attack

# from Kali, find the target's IP on the host-only subnet sudo netdiscover -i eth1 # or nmap -sn 192.168.56.0/24

Then go hunting: user flag first, then escalate to root.

Safety

• Never bridge a vulnerable VM to your real network or the internet.
• Snapshot the VM before you start, so you can roll back.
• Delete the VM when you're done. See the rules.