Skip to content

06. First Run

Jump to bottom
BaddKharma edited this page Jul 19, 2026 · 37 revisions

🏁 First Run

Staged walkthrough for first-time operators after a successful Verify. Covers redirector setup through a confirmed first beacon on all three C2 frameworks. Individual component pages (Mythic, Sliver, Adaptix, etc.) have the full technical deep-dives; this page tells you what order to do things in and why.

At a glance
Pre-req Verify complete: Guacamole accessible, Windows reachable, all hosts ping cleanly
Active steps Redirector setup, C2 build scripts, first beacon per framework. ~30-45 min total.
End state First beacon confirmed from Mythic, Sliver, and Adaptix. Lab fully operational.
All access Via Guacamole portal or MobaXterm sessions on the Windows host. No direct public SSH.

Note

Open all SSH sessions in this walkthrough through the Guacamole portal (https://<GUAC_PUBLIC_IP>/guacamole) or the pre-configured MobaXterm bookmarks on the Windows operator workstation. The redirector accepts only HTTP/HTTPS on its public interface. No lab host exposes SSH publicly except Guacamole, which is the break-glass path for advanced users.

Step 1: Redirector Setup

The redirector must be configured before beacons can call back. Choose your track based on terraform.tfvars:

Track A: Direct Access (public domain + Let's Encrypt)

Use this track when redirector_domain is set to a real domain.

  1. Point your domain's A record at the redirector Elastic IP (printed in deployment_info.txt under APACHE REDIRECTOR).
  2. Wait for DNS to propagate (dig +short yourdomain.tld should return the redirector EIP).
  3. In Guacamole, open the Redirector (SSH) connection.
  4. Run Certbot to issue the TLS certificate:
sudo certbot --apache -d yourdomain.tld
  1. Run the redirector test script to confirm all layers are healthy:
sudo /home/admin/test_redirector.sh

Expected: Apache active, VirtualHosts loaded, connectivity to Mythic / Sliver / Adaptix backends, header validation working, decoy page returning for unauthenticated requests.

For full details on what each layer does, see Redirector.

Track B: Tunneled Access (cyber ranges via OpenVPN)

Use this track when enable_vpn_tunnel = true and redirector_domain = "".

  1. Download your .ovpn file from your cyber range platform.
  2. In Guacamole, open the Redirector (SSH) connection.
  3. Upload the .ovpn file via the Guacamole sidebar (Ctrl+Alt+Shift > Devices > upload), then move it:
mv ~/*.ovpn ~/vpn/
  1. Start the VPN service:
sudo systemctl start vpn-tunnel
journalctl -u vpn-tunnel -f

Wait for "Initialization Sequence Completed." Your callback address is the redirector public Elastic IP from deployment_info.txt, used with HTTPS on 443. See OpenVPN Tunnel Environments Step 5 for per-C2 values and the isolated-target tun0 exception.

For full routing details and callback configuration per C2, see OpenVPN Tunnel Environments.

Step 2: Adaptix Teamserver Build (Automatic)

No action needed. The Adaptix teamserver compiles from source automatically during cloud-init (~12 min, pinned to v1.2) and starts itself. It is the slowest backend to come up, so let it finish in the background while you set up Mythic and Sliver, then confirm it in Step 5.

To watch it, from the Adaptix host (Guacamole > Adaptix (SSH)):

cloud-init status --wait; systemctl status adaptix --no-pager

active (running) with port 4321 listening means the teamserver is ready. If the build failed, run ~/build_adaptix_server.sh once to retry.

Warning

A Note on Local Antivirus: redStack does not generate production-grade evasive payloads. The beacons it produces (Apollo agents, Sliver implants, Adaptix beacons) are not obfuscated by default and will be flagged by AV on real systems, which is expected.

The lab Windows workstation has Defender disabled by default so unobfuscated beacons can run during training. However, if you transfer files from Guacamole to a local VM or personal machine, your local AV may flag them. Disable AV on any local test VM before importing lab-generated payloads.

Step 3: Mythic Test Agent

Mythic ships pre-configured with the HTTP profile and Apollo agent. The redirector's X-Request-ID token is baked in at deploy time.

Access is from the Windows host browser only. Mythic has no public IP. The Mythic web UI (https://mythic:7443) is only reachable via the Windows operator's Chromium browser (hostname resolves via the Windows hosts file). Do not attempt to access it from your local laptop browser directly.

Steps:

  1. In Guacamole, open Windows (RDP).
  2. Open Chromium, navigate to https://mythic:7443.
  3. Login: mythic_admin / lab password from deployment_info.txt.
  4. Confirm the http profile shows Accepting Connections under Installed Services > C2 Profiles.
  5. Click Create Payload, generate a Test Agent, and save it to the Desktop. See Mythic > Initial Beacon for exact field values.
  6. Execute the Test Agent on the Windows workstation.
  7. Confirm the callback appears under Active Callbacks in the Mythic UI.

Full walkthrough with exact configuration values: Mythic > Initial Beacon.

✅ Checkpoint: Mythic callback confirmed.

Step 4: Sliver Test Implant

Sliver ships with a pre-generated admin.cfg operator config and the redstack C2 profile pre-installed. The X-Request-ID header value is baked into the profile.

Steps:

  1. In Guacamole (or MobaXterm from Windows), open the Sliver (SSH) connection.
  2. Launch the client:
sliver-client
  1. Import the C2 profile and generate a Test Implant:
profiles import /home/admin/redstack-c2-profile.json
generate --http https://<your-redirector-domain>/cloud/storage/objects/ --c2profile redstack --os windows --save /tmp/TestImplant.exe

For Tunneled Access, use the redirector public IP: https://<REDIR_PUBLIC_IP>/cloud/storage/objects/.

  1. Copy the Test Implant to the Windows workstation Desktop. From MobaXterm on Windows:
scp admin@sliver:/tmp/TestImplant.exe C:\Users\Administrator\Desktop\
  1. Execute the Test Implant on Windows.
  2. Back in sliver-client, run sessions to confirm the callback.

Full walkthrough: Sliver > Initial Beacon.

✅ Checkpoint: Sliver session confirmed.

Step 5: Adaptix Test Beacon

Confirm the teamserver build completed before proceeding (it builds automatically in cloud-init):

sudo systemctl status adaptix --no-pager
sudo ss -tlnp | grep 4321

If the service is missing, run ~/build_adaptix_server.sh and see Troubleshooting > Adaptix Build Failed.

Steps:

  1. On the Windows workstation (Guacamole > Windows (RDP)), launch the AdaptixClient (C:\Tools\AdaptixClient\AdaptixClient.exe, desktop shortcut) and connect to https://adaptix:4321/adaptix with any nickname and the lab password.
  2. Open Listeners (headphone icon), right-click the bottom panel > Create, and set Config to BeaconHTTP. The redStack presets (callback EIP, /edge/cache/assets/ URIs, X-Request-ID header, SSL) are already filled in; confirm and click Create.
  3. Generate a beacon: right-click the listener > Generate agent, Agent beacon, Arch x64, Format Exe.
  4. The client saves the beacon under C:\Users\Administrator\AdaptixProjects\<project>\; move it to the Desktop and execute it on Windows.
  5. Confirm the session appears in the Adaptix client's sessions view.

Full walkthrough with exact field values: Adaptix > Test Beacon.

✅ Checkpoint: Adaptix session confirmed.

Lab Fully Operational

All three beacons confirmed: Mythic Test Agent, Sliver Test Implant, Adaptix Test Beacon. The lab is fully operational.

From here, the individual component pages are your reference:

Kali Enumeration: How It Connects

If you're planning to run enumeration or attack tools from Kali against cyber-range targets, the traffic path matters:

Kali sits in the Teamserver VPC alongside the C2 servers. In Tunneled Access (OpenVPN enabled), the VPC route table directs target-network traffic through the Guacamole ENI to the redirector's WireGuard tunnel, then out through the OpenVPN connection on tun0.

Tools like nmap, netexec, or impacket that target the configured external CIDRs route through this path automatically: no special configuration needed beyond having the VPN connected.

For callback paths (getting a Meterpreter or shell back from a target into Kali), the redirector's GatewayPorts clientspecified setting enables ssh -R '*:port:host:port' to publish a listener on the redirector's tun0 interface. See Kali > Port Forwarding for Callbacks for the exact syntax.

This is not a step-by-step lab guide; your specific targets and techniques will vary by platform and scenario.

← Previous: Verify | Next: Lab Inventory →

"In preparing for battle I have always found that plans are useless, but planning is indispensable."

Dwight D. Eisenhower (~1957)

Clone this wiki locally