Module Introduction


Automation becomes essential as soon as you move beyond a single infrastructure setup—especially when you’re running multiple red team engagements in parallel and need to keep customer data strictly separated. Manually cloning, configuring, and cleaning up multiple teamservers, redirectors, and log servers is time-consuming, error-prone, and difficult to scale. A professional red team should be able to spin up and tear down complete, engagement-specific infrastructure in a repeatable and auditable way—ideally using a small set of templates and scripts.

In this final module, you’ll set up the attack infrastructure control dashboard provided in this course, which supports automated deployment of redirectors, teamservers, and log servers. You’ll learn the core design principles so you can customize the dashboard, how to integrate it into your existing C2 infrastructure, and how to deploy systems and monitor overall health. Finally, you’ll implement a simple capability to manage operator access to key systems within the C2 infrastructure.

RT-C2E: Advanced Red Team C2 Infrastructure Engineering

Buy nowLearn more

Course Introduction

  • What is this course about?
  • What you will learn
  • Requirements
  • How the rest of this course is structured

Module 1 - C2 Infrastructure Design

  • Module introduction
  • 1.1 Hosting the infrastructure
  • 1.2 Operator workflow
  • 1.3 Design principles
  • 1.4 Infrastructure blue print
  • Assignment

Module 2 - Build the Core Platform

  • Module introduction
  • 2.1 Virtualization platform
  • 2.2 Debian VM template
  • 2.3 OPNsense platform
  • 2.4 Management server (P1)
  • 2.5 Remote access VPN
  • 2.6 Network firewall
  • 2.7 Remote access gateway
  • 2.8 Fine-grained access control
  • Assignment

Module 3 - On-prem essentials

  • Module introduction
  • mgmt-server-package.zip
  • 3.1 Management server (P2)
  • 3.2 Operator Clients
  • 3.3 Client deployment
  • 3.4 Teamservers
  • 3.5 Cobalt Strike
  • 3.6 Cobalt Strike connectivity
  • 3.7 Mythic
  • 3.8 Mythic logging
  • 3.9 Mythic connectivity
  • Assignment

Module 4 - Cloud essentials & Connectivity

  • Module Introduction
  • 4.1 Redirectors
  • 4.2 Providers & registrars
  • 4.3 VPS deployment
  • 4.4 Restricted VPS access
  • 4.5 RedWarden
  • 4.6 HAProxy
  • 4.7 Nebula
  • 4.8 Lighthouse
  • 4.9 Listener
  • 4.10 Forward C2 traffic
  • Assignment

Module 5 - Expand the Infrastructure

  • Module Introduction
  • 5.1 Centralized logging
  • 5.2 Grafana Loki
  • 5.3 Grafana Alloy C2 logs
  • 5.4 Grafana Alloy CLI logs
  • 5.5 Grafana data analytics
  • 5.6 Edge collectors
  • 5.7 Internal file sharing
  • 5.8 Secure data storage
  • 5.9 Operational attack infrastructure
  • Assignment

Module 6 - C2 Automation

  • Module Introduction
  • dashboard-package.zip
  • 6.1 Management dashboard
  • 6.2 Automated deployment
  • 6.3 Deployment flow
  • 6.4 Troubleshooting
  • 6.5 Guacamole connectivity
  • 6.6 User management
  • 6.7 Deployment cleanup
  • 6.8 Health monitor
  • Assignment

Bonus Content

  • B.1 Notifications via aggressor script

Closing Remarks

  • Course Wrap-Up