07. Lab Inventory

📋 Lab Inventory

Home > Lab Inventory

Seven instances deployed by default. Two have public Elastic IPs (Guacamole portal + redirector); everything else lives in private VPCs and is reached through Guacamole.

Hostname	Role	Public IP	Default access	Credentials source
guac	Guacamole portal (web SSH/RDP/VNC)	Yes	https://<guac-eip>/guacamole	terraform output deployment_info
redirector	Apache reverse proxy / C2 frontend	EIP exposes 80/443 only	Guacamole > Redirector SSH (or ssh -J via guac)	terraform output deployment_info
mythic	Mythic C2 server	No	Guacamole > Mythic SSH	terraform output deployment_info
sliver	Sliver C2 server	No	Guacamole > Sliver SSH	terraform output deployment_info
havoc	Havoc C2 server + desktop (VNC)	No	Guacamole > Havoc SSH or VNC	terraform output deployment_info
windows	Windows Server 2022 operator workstation	No	Guacamole > Windows Operator (RDP)	AWS-decrypted, in terraform output deployment_info
kali	Kali Linux operator (AD enum + attack toolset)	No	Guacamole > Kali SSH (and XRDP if gui mode)	terraform output deployment_info

One command for everything: terraform output deployment_info prints all IPs, the auto-generated lab password, the Windows Administrator password, and the C2 header token. Save it once after deploy.

---

Default Instance Sizing

Host	Instance type	vCPU	RAM	Disk	Why this size
mythic	t3.medium	2	4 GB	30 GB	Docker stack + Mythic core
havoc	t3.medium	2	4 GB	30 GB	Compiles teamserver from source on first boot
sliver	t3.medium	2	4 GB	25 GB	Go cross-compiler needs headroom during implant generation
redirector	t3.small	2	2 GB	20 GB	Plain Apache + iptables
guacamole	t3.small	2	2 GB	20 GB	Postgres + Guacamole containers
windows	t3.medium	2	4 GB	50 GB	Server 2022 + browser + tools
kali (headless)	t3.medium	2	4 GB	30 GB	Tools + headroom for hashcat / netexec
kali (gui)	t3.large	2	8 GB	50 GB	XFCE + browser + GUI tools

All are tunable via tfvars (mythic_instance_type, kali_instance_type, etc.). See Deploy.

---

What Gets Created in AWS

Beyond the seven instances, terraform apply creates ~50 AWS resources:

Category	Count	What
EC2 instances	7	the seven hosts above
VPCs	2	TeamServer + Redirector
Subnets	2	one per VPC
Internet Gateways	2	one per VPC
Route Tables	2	one per VPC
Elastic IPs	2	Guacamole + Redirector
Network Interfaces	7	pre-created so instances can reference each other's private IPs
Security Groups	7	one per host, with explicit rules per port
Security Group Rules	~40	individual ingress/egress rules
VPC Peering Connection	1	TeamServer ↔ Redirector
Routes (peering)	2	one in each VPC's route table
Random password	1	shared lab password
Random ID	1	C2 header token

terraform destroy reverses all of the above, plus the AWS-managed Windows password data.

---

What Doesn't Get Created

These are deliberate omissions. None are required.

• No S3 buckets, RDS, Lambda, or other services: redStack is EC2-only.
• No IAM roles or instance profiles: Operator credentials are passed via SSH key + lab password.
• No CloudWatch logs or alarms: Local logs only on each host (/var/log/user-data.log, Apache logs, etc.). You can add a billing alarm in the AWS Billing Console if you want, see Cost Management.
• No Route 53 records: You point your domain via your registrar (Direct Access only). Tunneled Access uses the public IP directly.
• No SSH key pair: You create this in Prerequisites before deploy; Terraform references it by name.

---

See Also

• Lab Architecture, topology diagram showing how these hosts connect
• SSH Access, access patterns for each host
• Cost Management, billing implications of the resources above

---

“You can't protect what you don't know you have.”

_{CIS Controls / SANS}