07. Lab Inventory

📋 Lab Inventory

Seven instances deployed by default. Two have public Elastic IPs (Guacamole portal + redirector); everything else lives in private VPCs and is reached through Guacamole.

Hostname	Role	Public IP	Default access
guac	Guacamole portal (web SSH/RDP/VNC)	Yes	https://<guac-eip>/guacamole
redirector	Apache reverse proxy / C2 frontend	Yes (80/443 only)	Guacamole > Redirector SSH (or ssh -J via guac)
mythic	Mythic C2 server	No	Guacamole > Mythic SSH
sliver	Sliver C2 server	No	Guacamole > Sliver SSH
havoc	Havoc C2 server + desktop (VNC)	No	Guacamole > Havoc SSH or VNC
windows	Windows Server 2022 operator workstation	No	Guacamole > Windows Operator (RDP)
kali	Kali Linux operator (AD enum + attack toolset)	No	Guacamole > Kali SSH (and XRDP if gui mode)

All credentials are in deployment_info.txt in the redStack/ directory.

---

Default Instance Sizing

Host	Instance type	vCPU	RAM	Disk	Why this size
mythic	t3.medium	2	4 GB	30 GB	Docker stack + Mythic core
havoc	t3.medium	2	4 GB	30 GB	Build-on-demand: only run ~/build_havoc.sh if using Havoc this session (~1 GB download, ~9 min build); skip if not using Havoc
sliver	t3.medium	2	4 GB	25 GB	Go cross-compiler needs headroom during implant generation
redirector	t3.small	2	2 GB	20 GB	Plain Apache + iptables
guacamole	t3.small	2	2 GB	20 GB	Postgres + Guacamole containers
windows	t3.medium	2	4 GB	50 GB	Server 2022 + browser + tools
kali (headless)	t3.medium	2	4 GB	30 GB	Tools + headroom for hashcat / netexec
kali (gui)	t3.medium	2	4 GB	50 GB	XFCE + browser + GUI tools. Bump to t3.large (8 GB) via kali_instance_type if resources are tight.

All are tunable via tfvars (mythic_instance_type, kali_instance_type, etc.). See Deploying Terraform.

---

What Gets Created in AWS

Beyond the seven instances, terraform apply creates ~91 AWS resources total:

Category	Count	What
EC2 instances	7	the seven hosts above
VPCs	2	TeamServer + Redirector
Subnets	2	one per VPC
Internet Gateways	2	one per VPC
Route Tables	2	one per VPC
Route Table Associations	2	one per VPC
Routes	5	2 default IGW + 2 VPC peering + 1 VPN CIDR (when enabled)
Default Security Groups	2	one per VPC, locked down by Terraform
Security Groups	7	one per host, with explicit rules per port
Security Group Rules	48	individual ingress/egress rules
Network Interfaces	7	pre-created so instances can reference each other's private IPs
Elastic IPs	2	Guacamole + Redirector
VPC Peering Connection	1	TeamServer ↔ Redirector
Random password	1	shared lab password
Random ID	1	C2 header token

terraform destroy reverses all of the above, plus the AWS-managed Windows password data.

---

What Doesn't Get Created

These are deliberate omissions. None are required.

• No S3 buckets, RDS, Lambda, or other services: redStack is EC2-only.
• No IAM roles or instance profiles: Operator credentials are passed via SSH key + lab password.
• No CloudWatch logs or alarms: Local logs only on each host (/var/log/user-data.log, Apache logs, etc.). You can add a billing alarm in the AWS Billing Console if you want, see Cost Management.
• No Route 53 records: You point your domain via your registrar (Direct Access only). Tunneled Access uses the public IP directly.
• No SSH key pair: You create this in Prerequisites before deploy; Terraform references it by name.

---

← Previous: First Run | Next: Guacamole →

---

"You can't protect what you don't know you have."

_{CIS Controls / SANS}