hackalex
EN
Menu

Building a Red Team lab at home: Ludus + GOAD-Light + Elastic

Technical note

What we are building

A vulnerable Active Directory lab to practise Red Team, with defensive telemetry to see what each attack leaves behind. Everything runs on a single Proxmox server, reachable over VPN from your PC.
  • Ludus → orchestrates the VMs, the network and the VPN on top of Proxmox
  • GOAD-Light → Orange Cyberdefense's vulnerable domain with 3 Windows Server 2019 machines: two domains (sevenkingdoms.local and north.sevenkingdoms.local) and a member server with IIS and SQL Server
  • Elastic Security → Elasticsearch, Kibana and Fleet on a separate VM, with Elastic Agent and Sysmon on the three Windows hosts
  • WireGuard → access from your machine to the lab network
The idea for the setup comes from stillbigjosh's guide. Here is what I did, the failures I ran into and how to practise afterwards.

Architecture

  • Proxmox (host) → runs Ludus and all the VMs
  • Router (Debian 13) → 10.2.10.254, connects the lab network
  • VLAN 10 → GOAD-Light
  • kingslanding (DC01, sevenkingdoms.local) → 10.2.10.10
  • winterfell (DC02, north.sevenkingdoms.local) → 10.2.10.11
  • castelblack (SRV02, member of north) → 10.2.10.22
  • VLAN 20 → Elastic (Debian 12) → 10.2.20.2
  • Your PC → comes in through the WireGuard tunnel towards 10.2.0.0/16
The lab stays isolated from your home network. You reach it through the VPN, and the vulnerable machines cannot see the rest of your home.

Hardware I used

  • CPU: Intel i5-9600K (6 cores, 6 threads)
  • RAM: 32 GB (31 GiB visible)
  • Disk: about 350 GB free on local-lvm and a 1 TB disk for GOAD and backups
  • Network: Ethernet
The PC acting as the Proxmox server: an ordinary desktop, no rack involved
The PC acting as the Proxmox server: an ordinary desktop, no rack involved
The original guide runs it on 24 GB of RAM; with 32 GB you have more headroom. The bottleneck is RAM; CPU and disk are more than enough. More detail in Problems and fixes.

Setup order

Before you start

  • Ludus modifies the Proxmox host: it updates packages and the kernel, creates its internal network (vmbr1000) and configures WireGuard. If you already use that Proxmox for other things, do not install it blindly
  • Before installing, back up anything you do not want to lose. I saved the host network configuration and a copy of my AdGuard container
  • Do not expose the lab to the Internet: these machines are vulnerable on purpose