CEH Lab Setup - Kali Linux on Windows 11

This guide walks you through building a Certified Ethical Hacker (CEH) practice lab on a Windows 11 host. The attack platform is Kali Linux; targets include Metasploitable 2/3, DVWA, bWAPP, plus Windows and Ubuntu victims. Two paths follow: a 5-step quick-start for users in a hurry, and a 12-step complete setup for exam-grade coverage.

Quick-start (5 steps, ~1 hour)

Enable virtualization in BIOS/UEFI - Reboot → BIOS → Advanced / CPU Configuration → enable Intel VT-x or AMD-V. Save and exit.
Install VirtualBox 7.x from https://www.virtualbox.org/wiki/Downloads (free, cross-platform).
Download a prebuilt Kali VM from https://www.kali.org/get-kali/#kali-virtual-machines (VirtualBox 64-bit OVA). Import via File → Import Appliance.
Create an isolated Host-Only network in VirtualBox: File → Host Network Manager → Create. Keep DHCP enabled. Attach Kali and target VMs to it (Adapter 2). Keep Adapter 1 as NAT for outbound internet access (updates, exploit-db).
Provision one vulnerable target - DVWA is the easiest. Run an Ubuntu Server 22.04 LTS VM, then install DVWA via the official GitHub repo. Snapshot the VM before any test.

You can start nmap, metasploit, and Burp Suite against the DVWA target immediately. For deeper coverage (Active Directory pivots, multi-host pivots, wireless attacks), continue with the full 12-step path below.

Complete CEH Lab - 12-step Path

Step 1 - Pick a hypervisor

The four realistic choices for Windows 11 are:

Hypervisor	Cost	Wireless pass-through	Snapshots	Headless mode	Notes
VirtualBox 7.x	Free (GPL)	USB passthrough OK; built-in 802.11 not supported	Yes, branched	Yes (`VBoxHeadless`)	Easiest for beginners, runs anywhere
VMware Workstation Pro 17	Free for personal use since May 2024	Excellent USB + WiFi passthrough	Yes, branched	Yes	Best performance; cleanest snapshot UX
Hyper-V (Windows feature)	Built-in	Limited; nested virtualization required	Yes (`.avhdx`)	Yes	Coexists poorly with VirtualBox/VMware
WSL2 + Win-KeX	Built-in	N/A (no monitor mode for WiFi)	`wsl --export` snapshots	N/A	Lowest RAM, GUI via Win-KeX; no raw VM access

Recommendation: Start with VirtualBox if you also want to learn VMware later (resume-friendly). Pick VMware Workstation Pro if you can use the personal-use license and want the smoothest snapshot UX and the best USB WiFi passthrough. Pick Hyper-V only if your CEH practical exam track focuses on Windows-native VMs. Pick WSL2 + Win-KeX if your laptop has ≤ 16 GB RAM and you only need CLI tools.

Important: Hyper-V and VirtualBox/VMware cannot share the VT-x CPU feature at the same time. If you install Hyper-V, the others fall back to a slow software emulation. See Microsoft KB 3204980 for details [6].

Step 2 - Verify host prerequisites (PowerShell)

Run the following on the Windows 11 host in an Administrator PowerShell:

# Check Hyper-V/VT-x availability
Get-ComputerInfo | Select-Object HyperVRequirementVirtualizationFirmwareEnabled, HyperVRequirementVMMonitorModeExtensions, CsModel, OsName

# Verify virtualization is enabled in firmware
systeminfo | findstr /i "Virtualization"

# Confirm free RAM and disk
Get-CimInstance Win32_ComputerSystem | Select-Object TotalPhysicalMemory
Get-PSDrive C | Select-Object Used, Free

If HyperVRequirementVirtualizationFirmwareEnabled is False, reboot into UEFI and enable Intel VT-x / AMD SVM. CEH labs typically need 16 GB RAM minimum (8 GB host + 4 GB Kali + 2-4 GB per target) and 100 GB free disk.

Step 3 - Install your hypervisor

Option A - VirtualBox

Download the platform package + Extension Pack from https://www.virtualbox.org/wiki/Downloads and run the installers. The Extension Pack is required for USB 2.0/3.0 passthrough.

# Silent install (admin PowerShell)
choco install virtualbox --version=7.0.20 -y
# Extension Pack (optional via VBoxManage)
& "C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" extpack install --replace C:\Downloads\Oracle_VM_VirtualBox_Extension_Pack-7.0.20.vbox-extpack

Option B - VMware Workstation Pro 17

Since May 2024, VMware Workstation Pro is free for personal use. Register, then download from https://www.vmware.com/products/workstation-pro.html. Run the installer, reboot, and the license key is auto-applied for personal use.

Option C - Hyper-V

# Enable Hyper-V (admin PowerShell, then reboot)
Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All -NoRestart
# Optional: Hyper-V management tools
Enable-WindowsOptionalFeature -Online -FeatureName Hyper-V-Tools -All -NoRestart
Restart-Computer

After reboot, launch Hyper-V Manager from the Start menu.

Option D - WSL2 + Kali + Win-KeX

# Single-command WSL2 install (admin PowerShell)
wsl --install
# Reboot, then add the Kali distro from the Microsoft Store (or import the official rootfs)
wsl --list --online
wsl --install -d kali-linux

Inside Kali:

sudo apt update && sudo apt full-upgrade -y
sudo apt install -y kali-win-kex
kex --win -s   # launch Win-KeX in window mode

Win-KeX provides a full Kali XFCE desktop through WSLg or RDP with audio and clipboard sharing [9].

Step 4 - Create the network topology

Use two virtual networks:

Network	Purpose	DHCP
NAT (VirtualBox default)	Outbound internet for `apt update`, exploit-db	VirtualBox internal
Host-Only (`vboxnet0` or `vmnet2`)	Isolated lab subnet for attacker ↔ targets	Enabled (192.168.56.0/24)

In VirtualBox: File → Host Network Manager → Create (DHCP enabled). In VMware: Edit → Virtual Network Editor → Change Settings → Add Network (Host-Only). In Hyper-V: create an Internal virtual switch.

Attach both adapters to every lab VM: Adapter 1 = NAT (outbound), Adapter 2 = Host-Only (lab traffic). This way the lab subnet stays isolated from your real LAN even if a target is compromised.

Step 5 - Install Kali Linux

Two paths:

A) Pre-built OVA (fastest): Download the official VirtualBox / VMware image from https://www.kali.org/get-kali/#kali-virtual-machines. Import it. Default credentials: kali / kali. The pre-built image already includes VMware Tools / Guest Additions.

B) Clean install from ISO: Download the Installer ISO from https://www.kali.org/get-kali/#kali-installer-images. Boot the VM from the ISO, run the graphical installer, choose Guided - use entire disk, set hostname kali-attacker, and create a non-root user.

After first boot:

# Update + upgrade (always do this before installing tools)
sudo apt update
sudo apt full-upgrade -y
sudo reboot

# Optional: change default password
passwd

Step 6 - Install Kali metapackages

Kali ships metapackages - collections of tools grouped by purpose. Install only what you need; kali-linux-everything is ~20 GB.

Metapackage	Size	Purpose
`kali-linux-default`	~2 GB	Common tools: nmap, netcat, John, Burp, Metasploit, Wireshark
`kali-tools-exploitation`	~1 GB	Metasploit Framework + modules
`kali-tools-web`	~2 GB	Burp, sqlmap, nikto, gobuster, wfuzz, OWASP ZAP
`kali-tools-wireless`	~1 GB	aircrack-ng, kismet, wifite, hcxdumptool, hcxpcapngtool
`kali-linux-everything`	~20 GB	All tools

Install the recommended CEH set:

sudo apt install -y kali-linux-default kali-tools-exploitation kali-tools-web
# Add wireless tools only if you have a USB adapter
sudo apt install -y kali-tools-wireless
# Verify what's installed
apt list --installed | grep -i kali-tools | wc -l

Step 7 - Provision vulnerable targets

Target	OS	Default credentials	Source	RAM	Disk
Metasploitable 2	Ubuntu 8.04 (legacy)	`msfadmin` / `msfadmin`	SourceForge (Rapid7)	1 GB	8 GB
Metasploitable 3 (Win2k8)	Windows Server 2008 R2	`vagrant` / `vagrant`	GitHub `rapid7/metasploitable3`	2 GB	40 GB
Metasploitable 3 (Ubuntu 14.04)	Ubuntu 14.04	`vagrant` / `vagrant`	GitHub `rapid7/metasploitable3`	1 GB	20 GB
DVWA	Ubuntu Server 22.04 (you build)	`admin` / `password`	GitHub `digininja/DVWA`	1 GB	20 GB
bWAPP	Debian/Ubuntu (you build)	`bee` / `bug`	GitHub `OWASP/bWAPP`	1 GB	20 GB
HackTheBox / TryHackMe	Cloud	Per challenge	https://www.hackthebox.com / https://tryhackme.com	n/a	n/a

Metasploitable 2

Download the Metasploitable.zip torrent from the Rapid7 SourceForge page (verify SHA1 against the published hash). Extract, open the .vmdk in VirtualBox/VMware, and create a VM pointing at the existing disk rather than creating a new one.

Metasploitable 3 (Vagrant + Packer)

Requires Vagrant 2.4+, Packer 1.9+, and a hypervisor (VirtualBox or VMware). Then [8]:

git clone https://github.com/rapid7/metasploitable3.git
cd metasploitable3
# Build the Windows 2008 target
packer build --only=virtualbox-iso ./packer/templates/windows_2008_r2.json
vagrant box add packer/builds/windows_2008_r2_virtualbox_0.1.0.box --name=rapid7/metasploitable3-win2k8
vagrant plugin install vagrant-reload
vagrant up win2k8    # ~10 minutes; default credentials vagrant / vagrant

DVWA on Ubuntu Server 22.04

Download the Ubuntu Server 22.04 LTS ISO, install with OpenSSH + LAMP stack tasksel.
From Kali (or via SSH into the DVWA VM):

# On the Ubuntu DVWA VM
sudo apt install -y apache2 mariadb-server php php-mysqli php-gd libapache2-mod-php git
sudo git clone https://github.com/digininja/DVWA.git /var/www/html/dvwa
sudo chown -R www-data:www-data /var/www/html/dvwa
sudo cp /var/www/html/dvwa/config/config.inc.php.dist /var/www/html/dvwa/config/config.inc.php
sudo mysql -e "CREATE DATABASE dvwa; CREATE USER 'dvwa'@'localhost' IDENTIFIED BY 'p@ssw0rd'; GRANT ALL ON dvwa.* TO 'dvwa'@'localhost'; FLUSH PRIVILEGES;"
sudo systemctl restart apache2
# Open http://<dvwa-ip>/dvwa/setup.php → "Create / Reset Database"

bWAPP

sudo apt install -y apache2 php php-mysqli mariadb-server
git clone https://github.com/OWASP/bWAPP.git /var/www/html/bwapp
# Browse to http://<bwapp-ip>/bwapp/install.php → install → login bee/bug

Step 8 - Provision supporting VMs

Windows 10/11 Evaluation (180-day): Download from https://www.microsoft.com/en-us/evalcenter/. After install, run slmgr /rearm to extend; after 180 days the VM must be rebuilt - snapshot immediately after install.

# Download an eval ISO (admin PowerShell example)
Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkID=2195680" -OutFile C:\ISOs\Win11Eval.iso

Ubuntu Server 22.04 LTS for Active Directory, Docker (vulhub containers), or custom services:

# From Kali, or via SSH
wget https://releases.ubuntu.com/22.04/ubuntu-22.04.5-live-server-amd64.iso

Step 9 - Snapshot strategy

Take a snapshot before any destructive test. Use a consistent naming scheme.

Naming convention: <purpose>__<date>__<state>.

Examples:

kali-fresh__2026-09-11__golden
kali-tools-installed__2026-09-11__ready
metasploitable2__2026-09-11__untouched
dvwa__2026-09-11__db-reset

VirtualBox CLI example (scriptable revert):

# Take a snapshot (headless)
& "C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" snapshot "kali-attacker" take "kali-tools-installed__2026-09-11__ready" --description "after kali-tools-web + wireless install"

# Revert later
& "C:\Program Files\Oracle\VirtualBox\VBoxManage.exe" snapshot "kali-attacker" restore "kali-tools-installed__2026-09-11__ready"

When to revert: always after a destructive exploit (writable exploit, ransomware demo, persistence test). Treat snapshots as save states, not backups - they live inside the VM folder.

Step 10 - Wireless attacks (Alfa AWUS036ACH)

Internal laptop WiFi cards cannot inject packets or enter monitor mode reliably. Buy a USB adapter with an Atheros AR9271 or Realtek RTL8812AU chipset - the Alfa AWUS036ACH (RTL8812AU, 2.4 + 5 GHz, monitor + injection) is the community default.

# Plug adapter into host; attach USB filter to Kali VM in hypervisor UI
# Inside Kali:
ip link                  # confirm wlan0 appears
sudo apt install -y realtek-rtl88xxau-dkms   # driver for RTL8812AU
sudo airmon-ng start wlan0
sudo airodump-ng wlan0mon

For 802.11 monitor-mode on VirtualBox, attach the adapter as a USB 3.0 device to the Kali VM and use a chipset supported by Kali’s aircrack-ng driver pack.

Step 11 - Power-user additions

Parrot Security OS - drop-in Kali alternative; lighter weight, includes AnonSurf for anonymity. https://www.parrotsec.org/
BlackArch - Arch-based, 2,800+ tools, rolling release; heavy install, not for beginners. https://blackarch.org/
Commando VM - Windows attack VM packed with offensive tools. Built on Windows 10 + Chocolatey + windows-kex style automation. https://github.com/mandiant/commando-vm
Flipper Zero - hardware RF/IR/NFC tool for Sub-GHz, RFID, NFC, Infrared. Out-of-scope for install but invaluable for IoT and physical CEH domains.
HackTheBox / TryHackMe - cloud-hosted targets, VPN-based. Excellent for practising on boxes you cannot legally host at home.

Step 12 - Common gotchas

VT-x / AMD-V not enabled. Symptom: hypervisor shows “VT-x disabled in BIOS” or VM refuses to start. Fix: reboot into UEFI → enable virtualization.
Hyper-V conflicts with VirtualBox/VMware. Symptom: VMs boot very slowly or fail with “raw-mode not available”. Fix: either disable Hyper-V entirely (bcdedit /set hypervisorlaunchtype off) or use only Hyper-V. See KB 3204980 [6].
No USB WiFi passthrough. Symptom: adapter visible in host but not in Kali. Fix: install the Extension Pack (VirtualBox) and add a USB filter for the adapter’s vendor/product ID. Reboot the VM after attaching.
No monitor mode on internal WiFi. Symptom: airmon-ng start wlan0 fails. Fix: use a USB adapter (Alfa AWUS036ACH / AWUS036NHA).
Nested virtualization. Required to run a VM inside another VM (e.g., a Metasploitable VM inside a Kali VM). Enable per-VM: VBoxManage nested-hw-virt on, VMware Expose hardware assisted virtualization to guest.
Kali update breaks tools. Pin kali-tools-* versions after a clean install; avoid dist-upgrade mid-engagement.
Time drift. Multi-VM labs lose time sync. Install open-vm-tools/virtualbox-guest-utils and enable NTP inside every VM.

Sources

Kali Linux Documentation - Installation. https://www.kali.org/docs/installation/
Kali Linux Metapackages. https://www.kali.org/docs/general-use/metapackages/
Kali Linux Virtualization (VMware, VirtualBox, Hyper-V). https://www.kali.org/docs/virtualization/
Oracle VM VirtualBox User Manual - Chapter 6: Virtual Networking. https://www.virtualbox.org/manual/ch06.html
VMware Workstation Pro - Personal Use License (May 2024). https://www.vmware.com/products/workstation-pro.html
Microsoft Learn - Virtualization applications don’t work together with Hyper-V (KB 3204980). https://support.microsoft.com/help/3204980
Microsoft Learn - Install WSL. https://learn.microsoft.com/en-us/windows/wsl/install
Rapid7 Metasploitable 3 GitHub repository. https://github.com/rapid7/metasploitable3
Kali Linux Win-KeX (WSL 2 GUI). https://www.kali.org/docs/wsl/win-kex/
digininja/DVWA GitHub repository. https://github.com/digininja/DVWA