14. Kali

🐉 Kali

A dedicated Linux box for the AD enumeration, attack, and tunneling work that doesn't fit cleanly on the Windows operator. Lives in the Teamserver VPC, reachable through Guacamole (SSH always; XRDP when in GUI mode).

At a glance
Hostname	kali (private VPC only)
SSH user	admin (renamed from AMI default kali)
Default mode	headless (t3.medium, 30 GB)
GUI mode	gui (t3.medium, 50 GB, XFCE + XRDP)
Post-deploy GUI conversion	sudo kali-go-gui
Tool installer	sudo install-kali-tools (22-package AD/enum lineup)
Marketplace EULA	one-time per AWS account, see Prerequisites > Step 5

---

Before You Deploy: AMI Subscription

The official Kali Linux AMIs are shared publicly on AWS Marketplace at no charge, but AWS requires a one-time EULA acceptance per account before any instance can launch from the AMI. Skip this and your first terraform apply fails with OptInRequired.

1. Sign in to the AWS account you'll deploy redStack into.
2. Visit https://aws.amazon.com/marketplace/pp/prodview-fznsw3f7mq7to.
3. Click Continue to Subscribe, then Accept Terms.

Full walkthrough at Prerequisites > Step 5. The acceptance is permanent for the life of the AWS account.

_{[Figure 14.1.1: AWS Marketplace subscription page for the Kali Linux AMI showing the Continue to Subscribe button]}

---

Deployment Modes

Two modes, selected at deploy time via kali_deployment_mode in terraform.tfvars:

Mode	Instance	Disk	Access	Use case
headless (default)	t3.medium	30 GB	SSH only via Guacamole	Most CTF / training sessions. Fastest boot.
gui	t3.medium	50 GB	SSH + XRDP via Guacamole	When you need a desktop browser, Burp, BloodHound CE GUI, or other graphical tools. Bump to t3.large via kali_instance_type if resources are tight.

The mode picks the instance type and root disk size automatically. Override either with kali_instance_type and kali_volume_size in tfvars if you want something specific (for example, a larger box for hashcat work).

The Security Group always permits XRDP (3389) from the Guacamole SG regardless of mode. This means switching from headless to GUI later does not require Terraform changes; see Switching Headless → GUI Post-Deploy below.

---

First SSH Login

After terraform apply finishes, the connection details appear in the Terraform output under 7. KALI. Connect via Guacamole:

1. Open the Guacamole portal (URL printed in the Terraform output).
2. Sign in as guacadmin with the lab password.
3. Open the Kali (SSH) connection.
4. The MOTD banner is printed on every login showing current mode and the helper commands.

_{[Figure 14.3.1: Kali MOTD banner shown immediately after first SSH login, displaying mode (HEADLESS), helper commands, and the lab hosts list]}

Note

The AMI ships with a kali user by default. redStack renames this user to admin during user-data so SSH usernames stay consistent across all Linux lab hosts (Mythic, Sliver, Adaptix, Redirector, Guacamole, Kali). The rename runs as the first user-data action; wait for the MOTD banner before logging in to confirm it completed.

---

Curated Tool Lineup

The 22-tool AD/enum suite runs automatically during provisioning. Tools are ready on first login. To refresh or re-install after a failed package:

sudo install-kali-tools

The script is idempotent and safe to re-run; it upgrades existing packages.

What's in the lineup

Twenty-two packages, weighted toward Active Directory enumeration and attack. metasploit-framework is intentionally not in the list; exploitation flows through the C2 servers in this lab. Web app testing tools beyond gobuster (Burp, sqlmap, nikto) are similarly left out so you can install them on demand when needed.

Bucket	Tools	Purpose
Network enumeration	nmap, enum4linux-ng, smbmap, mitm6	Port scans, SMB discovery, IPv6 DNS poisoning for relay
AD enumeration	pre2k, ldap-utils, windapsearch, adidnsdump	Pre-Win2k accounts, LDAP queries, AD DNS dumps
Wordlists / web	seclists, gobuster	Wordlist library, directory/DNS/vhost brute-forcing
AD attack	coercer, impacket-scripts, netexec, evil-winrm, bloodhound.py, kerbrute, certipy-ad	Coercion, AD RPC abuse, auth spray, WinRM, BloodHound ingestion, Kerberos pre-auth, ADCS abuse
Credentials / relay	responder, hashcat, john	LLMNR/NTLM relay, GPU/CPU hash cracking
Meta	pipx, proxychains4	PEP 668-compliant Python tool installer; SOCKS proxy chain for routing tools through C2 beacons

If you need something not in the list (BloodHound CE GUI on the box, sqlmap, wireshark, ligolo-ng, chisel, etc.), apt install it directly. The lineup is meant to be a productive baseline, not exhaustive.

_{[Figure 14.4.1: `which` output after install-kali-tools completes, confirming nmap, netexec, impacket-secretsdump, certipy-ad, and bloodhound-python are all in PATH]}

Tip

If a package fails on first boot (rolling release timing), re-run sudo install-kali-tools. The script skips already-installed packages and retries only the failures.

---

Switching Headless → GUI Post-Deploy

Started in headless mode and want a desktop later? No re-apply needed:

sudo kali-go-gui

The script installs kali-desktop-xfce and xrdp, configures the X session, and enables and starts xrdp.service. The conversion takes ~4 minutes. The Security Group already allows port 3389 from the Guacamole SG.

After the converter finishes, run this on the Guacamole host to register the XRDP connection:

sudo /opt/redstack/register-kali-rdp.sh

Then refresh the Guacamole home page. Kali (XRDP) will appear in the connection list. The MOTD banner updates after conversion to reflect GUI mode.

_{[Figure 14.5.1: Kali XFCE desktop loaded inside a Guacamole RDP session, with a terminal open showing whoami returning admin, confirming the GUI conversion worked end-to-end]}

---

Important

Expand Port Forwarding for Callbacks and read the Two Operating Modes of the Redirector section before opening any port. The guidance differs significantly between Tunneled Access (cyber range via OpenVPN) and Direct Access. The wrong move in Direct Access exposes an unauthenticated handler to the internet.

Port Forwarding for Callbacks

This is the most common reason operators reach for the redirector when working from Kali: getting raw TCP callbacks back through the redirector's tun0 (OpenVPN) tunnel from a CTF target.

Two Operating Modes of the Redirector

The redirector runs in one of two modes depending on enable_vpn_tunnel in tfvars:

Mode	tfvar	Inbound surface	Port forwarding policy
Tunneled Access	enable_vpn_tunnel = true	OpenVPN tun0 to a registered cyber range only	Port forwarding is appropriate. Listeners on tun0 are isolated to the registered range.
Direct Access	enable_vpn_tunnel = false	80/443 publicly via Apache	Do not open additional callback ports. Use the C2 frameworks behind Apache.

In Direct Access, the AWS Security Group is the hard outer boundary: only 80 and 443 are reachable from the internet. Exposing a callback port to the public internet requires a deliberate SG edit, which is a conscious Terraform change. ssh -R alone cannot do it, so the SG provides a meaningful guardrail. The risk is an operator taking that deliberate step in the heat of an engagement and leaving an unauthenticated handler exposed for opportunists to find. Don't do that. Use Mythic, Sliver, or Adaptix through the redirector; the URI prefix and header validation exist for exactly this reason.

Tunneled Access caveat: the raw TCP callback path above only works when the cyber range routes the tunnel client (tun0) IP back to its targets. Hack Smarter Labs does not, so raw TCP handlers bound on tun0 will not receive a callback from HSL targets. For HSL, keep callbacks on the C2 frameworks (Mythic, Sliver, Adaptix) through the redirector public Elastic IP.

---

Note

The examples below are reference patterns, not step-by-step labs. Your specific targets, credentials, and domain configuration will vary by cyber range platform. The intent is to show how these tools connect through the redStack network path, not to walk through a specific machine.

Traffic routing reminder: Kali sits in the Teamserver VPC. In Tunneled Access, tools like nmap, netexec, and impacket reach targets with no special configuration. In Direct Access, use the Proxychains via C2 Beacon workflow below to route Kali tool traffic through an active session.

Common Workflows

BloodHound CE collection

# From Kali, against an AD domain target reachable through the lab
bloodhound-python -u <user> -p <password> -d <domain.local> -ns <dc-ip> -c All --zip

BloodHound CE is not pre-installed. The collector (bloodhound-python) runs fine on Kali and produces a .zip for import. The GUI stack is the heavy part.

Why it's excluded by default: BloodHound CE runs as a Docker Compose stack (Neo4j, PostgreSQL, and the web app), totaling roughly 1 GB of images. More importantly, Neo4j alone wants 2-4 GB of RAM, which puts it at the edge of what a t3.medium (4 GB) can handle. Installing it by default would degrade the box for everything else.

Options for visualization:

Option	What it takes	Recommended when
Windows operator	Set windows_instance_type = "t3.large" in tfvars for comfortable operation; t3.medium works for small lab datasets but is tight	Preferred; keeps Kali in headless mode
Local machine	Install BloodHound CE on your host machine	You're not using the Windows operator for anything else
Kali (GUI mode)	Set kali_deployment_mode = "gui" in tfvars (t3.medium, 50 GB disk), install Docker + CE compose	Last resort; requires a redeploy

To install on the Windows operator, download the BloodHound CE installer from github.com/SpecterOps/BloodHound/releases. The default credentials are printed on first start. Import your collector .zip from the Administration > File Ingest panel.

Proxychains via C2 Beacon (Direct Access)

In Direct Access mode Kali has no direct path to the target network. Once you have a beacon, you can route Kali tool traffic through a SOCKS5 proxy on the beacon and enumerate from Kali regardless of mode.

Step 1: Start a SOCKS5 proxy through the active session.

C2	Command
Mythic / Apollo	socks 1080 in the interact console
Sliver	socks5 start --host 127.0.0.1 --port 1080 on the active session
Adaptix	SOCKS proxy started from the beacon (Adaptix client)

The proxy binds on the C2 server's loopback (e.g. mythic:1080).

Step 2: Forward the port to Kali.

ssh -L 1080:127.0.0.1:1080 admin@mythic   # or sliver / adaptix

Step 3: Point proxychains at the local port.

# /etc/proxychains4.conf - change the last line to:
socks5 127.0.0.1 1080

Step 4: Run tools through the proxy.

proxychains netexec smb <target-ip> -u <user> -p <pass>
proxychains smbmap -H <target-ip> -u <user> -p <pass>
proxychains bloodhound-python -u <user> -p <pass> -d <domain> -ns <dc-ip> -c All --zip
proxychains impacket-secretsdump <domain>/<user>:<pass>@<target-ip>

_{[Figure 14.7.1: proxychains smbmap output showing the SOCKS5 chain routing through a C2 beacon to the target SMB share with ADMIN access confirmed]}

---

Troubleshooting

install-kali-tools reports failed packages

A handful of Kali packages occasionally fail because of upstream rolling releases. The script does not abort on per-package failures, it reports the failed list and exits with a non-zero status so automation can detect it. Re-run the script after a few hours; a stuck package usually clears with the next mirror sync.

sudo install-kali-tools 2>&1 | tee /tmp/install.log
# If specific packages still fail, investigate:
apt-cache policy <package-name>

MOTD banner shows wrong mode

The banner reads kali_deployment_mode from the time of provisioning. If you ran kali-go-gui to convert post-deploy, the converter updates the mode file but the MOTD only refreshes on next login. Log out and reconnect via Guacamole to see the updated banner.

---

← Previous: Windows | Next: OpenVPN Tunnel Environments →

---

"The quieter you become, the more you are able to hear."

_{Ram Dass (Kali Linux motto)}