Skip to content

13. Windows

Jump to bottom
BaddKharma edited this page May 8, 2026 · 48 revisions

🪟 Windows

Home > Windows

Windows Server 2022 operator workstation. The primary GUI workstation for driving the lab: Mythic web UI, Havoc Katana client (over VNC), file shuttling between C2 hosts and your local machine, and any payload work that needs a real Windows host.

On this page: Considerations · Configuration · Initial Use · File Transfer Patterns · Troubleshooting · See Also.

At a glance
Hostname windows (private VPC only)
OS Windows Server 2022 (Datacenter, latest AMI from Amazon)
Access RDP via Guacamole (no public IP, no SSH server)
Username Administrator (auto-generated password, AWS-decrypted)
Pre-installed tools Chromium, VS Code, MobaXterm, 7-Zip, Git
Defender Disabled at deploy (lab-friendly; re-enable if you want to test AV evasion against Defender)
Firewall Disabled at deploy
Cross-host DNS /etc/hosts populated with all lab hostnames

Considerations

Why a Windows workstation in the lab?

Three things only Windows can do well:

  1. Run the Mythic web UI in a browser. Mythic UI works on any browser, but having it on the lab box means you avoid the noise of routing browser traffic from your laptop through the redirector or setting up localhost:7443 SSH tunnels.
  2. Run the Havoc Katana client: Havoc's GUI is Qt-based and can run on Linux, but in this lab the Havoc desktop session runs on the Havoc host via VNC; Windows here is for parallel ops, not for running the Katana client itself. You can launch a second Katana session on Windows, but it is redundant.
  3. Generic Windows-side ops: explore C# / .NET payload behavior, run native AD tooling like RSAT, test OPSEC against Windows Defender (re-enable it first), or use it as a generic Windows endpoint for testing payload execution.

Why not skip Windows entirely?

You could, but the Mythic Apollo agent is a Windows .NET binary, and you need a Windows box somewhere to execute it for the "first beacon" walkthrough. Either you bring your own (and route traffic through the redirector), or you use the lab's Windows box and avoid the routing complexity. Most operators keep the lab Windows box.

Why is Defender disabled?

Lab convenience. Most C2 walkthroughs in this wiki test the deployment by running an unobfuscated Apollo agent or Havoc demon on this box. With Defender on, those binaries get quarantined immediately and the walkthrough fails. Re-enable Defender deliberately when you want to practice evasion (Set-MpPreference -DisableRealtimeMonitoring $false).

Why is the firewall disabled?

Same reasoning. Inbound RDP, SMB, and ad-hoc test ports work without per-port allow rules. For specific evasion or persistence work that depends on Windows Firewall behavior, re-enable selectively (Set-NetFirewallProfile -All -Enabled True).

Sizing tradeoffs

Default is t3.medium (2 vCPU, 4 GB RAM). That's enough for browser + a couple of tools. If you find Mythic UI sluggish or you want to run BloodHound CE GUI, Burp, AND Mythic UI simultaneously, bump to t3.large via windows_instance_type in tfvars.

Disk is 50 GB by default to accommodate the Server 2022 base + tools + agent generation artifacts. You can shrink to 30 GB if you're careful but cloud-init has more headroom at 50 GB.

Configuration

What's installed (and how)

The setup is in setup_scripts/windows_setup.ps1 (repo root). Cloud-init runs it as user-data on first boot:

Step What happens
1 Phase 1: disable Defender real-time monitoring + tamper protection (so phase 2 installs don't get quarantined)
2 Phase 2: rename hostname to windows, populate hosts file, install Chromium / VS Code / MobaXterm / 7-Zip / Git via Chocolatey
3 Configure RDP, GuacShare folder mount, MobaXterm session config, Chromium bookmarks
4 Configure auto-login to Administrator (so Guacamole RDP lands directly in the desktop)

MobaXterm pre-configured sessions

After deploy, MobaXterm on this box has the redStack Lab session folder with these SSH bookmarks:

  • Mythic (SSH)
  • Sliver (SSH)
  • Havoc (SSH)
  • Redirector (SSH)
  • Guacamole (SSH)
  • Kali (SSH)

All use password auth (the lab password, baked into the bookmarks). Click any of them to land in a shell on that host without typing credentials.

Chromium bookmarks

Chromium launches with two bookmarks pre-pinned to the bookmark bar:

Bookmark URL
Mythic C2 https://mythic:7443
redStack Wiki https://github.com/BaddKharma/redStack/wiki

The bookmark bar is enabled by default. Hostnames resolve via the lab hosts file. No manual IP lookup needed.

GuacShare folder

The lab Windows box has a GuacShare folder visible in This PC in File Explorer. This is a special folder that the Guacamole RDP connection mounts as a virtual drive. Files placed here are visible in the Guacamole sidebar (Ctrl+Alt+Shift > Devices) for one-click download to your host laptop.

Use it for:

  • Pulling generated agents off the lab to your laptop (e.g. Downloads/apolloTest.exe > zip > drop in GuacShare > download from Guacamole sidebar)
  • Pushing files into the lab (drag onto Guacamole sidebar > shows up in GuacShare)

Custom subdirectory: C:\redStack\

Empty by default; convention is to drop your scratch payloads, scripts, and notes here. Excluded from any later terraform destroy since EBS volumes are wiped on destroy regardless.

Tip

The session config is baked into setup_scripts/windows_setup.ps1 and written to %APPDATA%\MobaXterm\MobaXterm.ini during cloud-init. To re-apply it manually (e.g. after a MobaXterm reinstall), run setup_scripts/configure_mobaxterm.ps1 on the Windows box. To add your own bookmarks, edit the ini directly in VS Code and restart MobaXterm.

Initial Use

After Verify confirms the desktop loads:

  1. Open Chromium: It's pinned to the taskbar.
  2. Navigate to https://mythic:7443: Hostname resolves via hosts file. Accept the self-signed cert warning. Login as mythic_admin (password from terraform output deployment_info).
  3. Generate an Apollo agent: Follow the Mythic walkthrough.
  4. Execute the agent: From PowerShell, run Start-Process -FilePath "C:\Users\Administrator\Downloads\apolloTest.exe" -WindowStyle Hidden. See Mythic > Initial Beacon for details on why to use this over double-clicking.
  5. Watch the callback appear in Mythic Active Callbacks within ~10 seconds.

For Sliver and Havoc, the corresponding flows are in Sliver and Havoc.

File Transfer Patterns
Direction Method
Lab Linux host → Windows scp from Windows PowerShell: scp admin@mythic:/tmp/payload.exe C:\Users\Administrator\Desktop\
Windows → Lab Linux host scp from Windows: scp .\file.txt admin@mythic:/tmp/ (or use MobaXterm's SFTP browser)
Lab Windows → your laptop Place file in GuacShare, click it in Guacamole sidebar > Devices, browser downloads
Your laptop → Lab Windows Drag file onto Guacamole sidebar > Devices, lands in GuacShare

The scp direction works because OpenSSH client is built into Windows Server 2022. Hostnames resolve via C:\Windows\System32\drivers\etc\hosts.

Troubleshooting

Can't connect to Windows via Guacamole RDP

Most common cause: Windows is still initializing. The AMI takes ~10-15 minutes from terraform apply complete to RDP-reachable, vs ~5 minutes for the Linux hosts. The AWS Administrator password generation (which Terraform consumes via rsadecrypt) happens late in cloud-init.

Verify:

# From Guacamole or any Linux host:
nc -zv windows 3389

Should return Connection succeeded. If not, wait five more minutes and retry.

If still failing:

  • Check terraform output deployment_info for the Windows password. If it shows (not yet available), AWS hasn't finished generating it. Wait and re-run terraform refresh && terraform output deployment_info.
  • In the AWS Console, EC2 > Instances > windows > Get system log. Look for cloud-init errors near the end of the log.

MobaXterm sessions don't appear

The session config is dropped at %APPDATA%\MobaXterm\MobaXterm.ini during cloud-init. If MobaXterm was running during cloud-init it may not have picked up the config.

# Restart MobaXterm
Stop-Process -Name "MobaXterm*" -Force -ErrorAction SilentlyContinue
Start-Process "C:\ProgramData\chocolatey\bin\MobaXterm.exe"

Mythic UI returns "connection refused"

Mythic's container stack takes 5-10 minutes to come up after cloud-init starts on the Mythic host. During that window, https://mythic:7443 will fail. Wait, then retry. If still failing after 15 minutes, see Troubleshooting > Mythic Not Starting.

Chromium / VS Code / MobaXterm missing

Chocolatey install ran during cloud-init. If any package failed to install, check the cloud-init log:

# View Windows user-data log
Get-Content C:\Windows\Temp\user-data.log | Select-String -Pattern "ERROR|FAIL"

To re-install a missing package:

choco install chromium vscode mobaxterm 7zip git -y

Defender re-enabled itself after a Windows Update

Microsoft's update cadence sometimes flips Defender real-time monitoring back on. Re-disable:

Set-MpPreference -DisableRealtimeMonitoring $true
Set-MpPreference -DisableBehaviorMonitoring $true
Set-MpPreference -DisableIOAVProtection $true

Or, if you want to start practicing evasion against Defender, leave it on and make your payloads stealthier.

File transfer to/from Windows fails

If scp from Linux to Windows fails, OpenSSH server isn't running on Windows by default in the lab (only the OpenSSH client is). Push from Windows instead, or use the GuacShare drag-and-drop pattern.

Hostname is still EC2AMAZ-XXXXX instead of windows

The rename happens via Rename-Computer in windows_setup.ps1, which requires a reboot to take effect. AWS reboots the instance automatically as part of the rename, but if cloud-init was interrupted, the hostname change may not have stuck. Manual fix:

Rename-Computer -NewName "windows" -Force -Restart

See Also

  • Mythic, Mythic UI walkthrough (run from this Windows host)
  • Sliver, Havoc, C2 walkthroughs that involve transferring payloads to this box
  • Kali, the Linux counterpart to this Windows host; AD enumeration / attack tooling lives there
  • SSH Access, how MobaXterm bookmarks work and the RSA-key + lab-password model
  • Troubleshooting, broader lab troubleshooting reference

“Know your tools. The bad guys do.”

DFIR / SANS adage

Clone this wiki locally