Repository navigation
Labs
redStackPRO ships several ranges as blueprints. Load one with Load blueprint (in Defense mode), unlock and edit it, save your copy, compile, and deploy. Each lab ships with its solution, because the solutions are operator validation references, not answer keys to hide.
Recreated natively as redStackPRO topologies, so they compile through redStackPRO's own Terraform and Ansible. Every one of these ships with a walkthrough; see Solutions below for what "walkthrough" means and how current each one is.
| Lab | What it is | Walkthrough |
|---|---|---|
GOAD-Light (goad-light) |
A two-domain Active Directory range, sevenkingdoms and its child north in one forest, two domain controllers and a member server, plus a jumpbox. The smallest full GOAD experience. |
docs/solutions/goad-light |
GOAD (goad) |
The full lab, three domains across two forests with their trusts and hosts. | docs/solutions/goad (14 parts, each with its live status) |
GOAD-Mini (goad-mini) |
One domain on a single domain controller, the smallest lab. | docs/solutions/goad-mini |
DRACARYS (dracarys) |
A separate GOAD lab with no marked path: one domain, dracarys.lab, three machines including a Linux domain member. Start with no credentials and reach Domain Admin; the path runs through a KeePass vault, Kerberos constrained delegation, and LDAPS. |
docs/solutions/goad-dracarys |
GOAD-Wazuh (goad-wazuh) |
The GOAD-Light pair of domains (sevenkingdoms and its child north) plus a Windows 11 workstation, with a Wazuh manager collecting, for detection work. |
docs/solutions/goad-wazuh (attack plus detection) |
NHA (nha, Ninja Hacker Academy) |
A GOAD community lab: two separate forests, ninja.hack and academy.ninja.lan, five machines. MSSQL links and impersonation, CredSSP, a writable share and an IIS webshell, and an ESC4 certificate-template takeover in ninja.hack reached from the other forest (the focus of its walkthrough). |
docs/solutions/goad-nha |
SCCM (sccm) |
A Configuration Manager (SCCM/MECM) lab. | docs/solutions/goad-sccm |
MINILAB (minilab) |
One domain, mini.lab, with a domain controller and a Windows 11 workstation (Windows Server 2022 on GCP and AWS). |
docs/solutions/goad-minilab |
The GOAD blueprints are derived from GOAD and carry GPLv3. They are data the canvas loads; the rest of the project is MIT.
A corporate forest of our own, with no theme, covering the path a real engagement tends to take. Walkthrough: docs/solutions/harbor (verified live).
These are attack-side blueprints, not target ranges, so none of them has a walkthrough: there is no AD forest to attack, just infrastructure to stand up and use against one of the ranges above. See Redirectors and Cover Stories for the redirector and cover-story mechanics these blueprints put in front of a teamserver.
- redStack: the attack-infrastructure blueprint. Redirector, teamservers (Mythic, Sliver, Adaptix), a jumpbox with Guacamole, Kali and Windows operators, and a collector. Blueprint only, no walkthrough.
-
Split horizon C2 (
split-horizon): two front doors that do not share a fate, Apache fronting Sliver and Nginx fronting Mythic and Adaptix, each redirector on its own peered network. Blueprint only, no walkthrough. -
Redirector rollover (
rollover): three interchangeable redirectors (two Apache, one Nginx) fronting one Sliver teamserver, so a burned or blocked front door can be dropped without losing the teamserver behind it. Blueprint only, no walkthrough. - MinimalC2-CLI: the smallest attack topology to start from, a redirector, a headless Sliver teamserver driven from a Kali operator over SSH, and a jumpbox with Guacamole. Ships a WireGuard multi-user access mode with an operator roster. Blueprint only, no walkthrough.
- MinimalC2-GUI: the same shape with a Mythic teamserver and a GUI Kali operator (an xrdp desktop reached over a Guacamole RDP tile) to drive Mythic's web UI. Blueprint only, no walkthrough.
The walkthrough solutions ship alongside the ranges, under docs/solutions/ in the
repo (linked per lab above). The written solution for a lab is generated from, or
hand-authored against, the same topology that is deployed. For
detection work, each escalation edge is a known test case; see Validation.
Not every walkthrough has been run against a live deploy yet: read the status line at the top of each page before treating a step as proven. goad is validated live part by part (its README has the status of each part), and goad-light is generated from it; goad-mini is a hand-written coverage page that points into the same series. harbor is verified live end to end; goad-wazuh's attack steps follow the validated GOAD series, with its detection axis partially verified live. nha is marked as authored from the blueprint and not yet run against a live range; minilab deploys and validates on Azure, and its attack chain is authored from the blueprint and not yet run end to end; dracarys is authored from the upstream lab definition and not fully live verified; sccm's live pass is not yet complete.
Next: stand one up in Deploying a Range.