Solution: Redownload the OVA (if from a third party) or re-export it from Vagrant. Use 7-Zip to extract the .ovf and .vmdk, then manually create a new VM.
Do not underestimate the resources required. Unlike its lightweight predecessor, Metasploitable 3 demands:
| Component | Minimum | Recommended | | :--- | :--- | :--- | | CPU | 2 cores | 4+ cores | | RAM | 4 GB (total system) | 8 GB+ (total system) | | Disk Space | 30 GB free | 50 GB free | | Hypervisor | VirtualBox 6.1+ / VMware 15+ | VMware Workstation Pro / Hyper-V |
Note: The Windows 2008 VM alone will consume 2-3 GB of RAM.
Solution: Disable Windows updates in the Vagrantfile or run the build during off-peak hours. Microsoft servers can be slow.
Alex navigated back to the official Rapid7 documentation. There, buried in the README, was a section for "Pre-built Images."
It turns out, Rapid7 hosted the OVA files on their Amazon S3 buckets or provided official torrent magnets. It wasn't as flashy as the download buttons on the sketchy sites, but it had the one thing Alex needed: Integrity.
Alex found the link: Metasploitable3-ubuntu1404.ova (for Linux practice) and Metasploitable3-win2k8.ova (for the Windows experience).
Alex clicked the Windows link. The download bar at the bottom of the screen flickered to life.
Downloading: Metasploitable3-win2k8.ova (1.8 GB)
Before you hit that download button, understand what you are getting. Metasploitable 3 is a virtual machine (VM) intentionally built to be vulnerable. It was created by Rapid7, the company behind the Metasploit Framework, in collaboration with the open-source community.
Unlike its predecessor (Metasploitable 2, which is based on Ubuntu 8.04), Metasploitable 3 offers two flavors:
Why choose Metasploitable 3 over version 2?
