Red Wizard – A User-friendly Infrastructure For Red Teams

Red Wizard – A User-friendly Infrastructure For Red Teams

Speakers: Ben Brucker, Penetration Tester, Secura

Conference: HITB Amsterdam

YouTube: https://www.youtube.com/watch?v=1TU1P0Wek2s

Overview

In the dynamic and often unforgiving realm of red teaming, the efficient and secure deployment of operational infrastructure is paramount to success. Ben Brucker, a seasoned Penetration Tester and Social Engineer at Secura, addressed this critical challenge at HITB Amsterdam with his talk on Red Wizard, a new open-source tool designed to streamline and automate the setup of complex red team environments. This presentation introduced Red Wizard as a server provisioning software that significantly reduces the manual overhead associated with deploying phishing campaigns, command and control (C2) servers, OSINT machines, and other essential red team components.

Red Wizard aims to eliminate the "pain" associated with manual infrastructure deployment, a common sentiment among red team operators. By automating the configuration of OpenVPN tunnels, nginx relays, Let's Encrypt certificates, and email sending profiles (for tools like GoPhish), the tool empowers red teams to spin up robust, OPSEC-aware infrastructure in minutes rather than hours or days. This not only frees up valuable time for operators to focus on actual offensive operations but also ensures consistency, security, and ease of use, even for new team members. The talk highlighted Red Wizard's commitment to user-friendliness, operational security, and transparency, making it a valuable addition to the red teaming toolkit.

Background

▶ Watch: Introduction to Red Wizard and talk agenda (0:00)

Red teaming involves performing realistic cyberattacks against an organization to test its detection, mitigation, and response capabilities across processes, people, and technology. Unlike traditional penetration testing, red teaming operates under the assumption that blue teams are actively trying to detect and neutralize the attackers. This adversarial environment places immense importance on operational security (OPSEC), as early detection can compromise the realism and effectiveness of an entire engagement. A critical aspect of maintaining OPSEC and conducting successful red team operations is the establishment of a resilient and untraceable infrastructure.

Traditionally, a basic red team infrastructure involves a command and control (C2) server from which attacks are launched, often relayed through a relay server. The relay server acts as a burnable, internet-facing proxy, preventing direct traceability back to the red team's private C2 infrastructure. If a relay is detected or compromised, it can be quickly taken offline and replaced, preserving the integrity of the C2 server. However, managing multiple assessments, dealing with highly effective blue teams, or needing to deploy diverse attack vectors (phishing, malware, OSINT) can quickly lead to a sprawling and complex infrastructure. Manually configuring each server, setting up VPNs, configuring proxies, obtaining certificates, and ensuring OPSEC-hardened configurations becomes a time-consuming, error-prone, and ultimately painful process. Existing tools often fall short, being either too limited in functionality or too opaque ("black box") for red teamers who need to understand and potentially customize every aspect of their setup. This gap is precisely what Red Wizard seeks to address, providing a flexible, transparent, and user-friendly solution to this persistent challenge.

Key Findings

▶ Watch: Red Wizard's core design principles and philosophy (8:10)

Red Wizard's primary contribution is its ability to automate the deployment of moderately complex red teaming infrastructure in a user-friendly and OPSEC-conscious manner. The tool's core strength lies in its adherence to several key design principles that address the common pitfalls of manual infrastructure management:

1. User-Friendliness and Transparency: Red Wizard is designed to be easily explainable to new team members, moving away from "black box" solutions. It uses Ansible for server provisioning, Docker for containerizing C2 tools, and Python for orchestration, ensuring that operators can understand and, if necessary, customize the underlying mechanisms. All configurations are self-documenting, providing operators with immediate access to necessary details.

1. Robust OPSEC by Design: Operational security is paramount. The infrastructure is configured to prevent traceability back to the red team. Key OPSEC features include:

• Relay Servers: Burnable, internet-facing servers that proxy traffic, allowing the C2 to remain hidden.
• OpenVPN Tunnels: Secure connections between C2 components (often Docker containers) and relay servers.
• Secret Strings: Only specific URLs containing these strings are forwarded to backend C2 instances; other traffic is redirected, preventing internet scanners from discovering C2 instances.
• IP Whitelisting: Administrative SSH access and OpenVPN connections are restricted to predefined IP ranges, limiting exposure.

1. Pre-Configuration and Automation: Red Wizard automates the setup of common red team tools and services. This includes:

• GoPhish and Manual Fish for phishing campaigns, complete with pre-configured email sending profiles (Postfix, DMARC, DKIM, SPF records).
• Cobalt Strike listeners, integrated with malleable profiles (though users must supply their own robust profiles).
• Let's Encrypt certificates for HTTPS on relays, ensuring legitimate-looking infrastructure.
• Web catchers for arbitrary callbacks and Dropbox handlers for hardware implants.

1. Flexibility and Modularity: The tool supports a wide range of infrastructure setups, from single C2s with multiple relays to multiple C2s connecting to shared or dedicated relays for different campaigns. It allows for the deployment of multiple components on a single C2 machine, each potentially using a different relay. This flexibility ensures that Red Wizard can adapt to diverse engagement requirements.

1. Maturity and Reliability: Having been used internally at Secura for over two years for months-long operations, Red Wizard has proven to be robust and stable, handling the demands of real-world red team engagements. The public release, while a first version, is built on a solid foundation.

By addressing the core challenges of complexity, time consumption, and OPSEC in red team infrastructure deployment, Red Wizard significantly enhances the efficiency and effectiveness of offensive security operations, allowing red teams to focus more on simulating threats and less on infrastructure management.

Technical Deep Dive

▶ Watch: Overview of the demo infrastructure to be built (17:00)

Red Wizard leverages a combination of widely adopted open-source technologies to achieve its automation goals. The core technology stack includes Ansible for server provisioning, Docker for containerizing C2 tools, and Python for orchestrating the entire deployment process and generating configurations. This tripartite approach ensures a balance of flexibility, isolation, and automation.

The foundational architecture revolves around the critical separation of Command and Control (C2) servers and Relay servers. The C2 servers are considered private, secure backends where the actual offensive tools (e.g., Cobalt Strike, GoPhish) reside, often within Docker containers. These containers are isolated and communicate with the outside world exclusively through OpenVPN tunnels established to the Relay servers. This design ensures that if a Relay server is compromised or burned, the C2 server's IP address and identity remain protected.

Relay servers are the internet-facing components. They are designed to be "burnable" and are responsible for routing traffic securely to the C2 backend. A key OPSEC mechanism implemented on relays is the use of nginx reverse proxies combined with "secret strings". When a target interacts with a relay (e.g., clicks a phishing link or a malware beacon attempts to egress), the nginx configuration inspects the URL. Only requests containing specific, pre-configured secret strings are forwarded through the OpenVPN tunnel to the corresponding C2 Docker container. All other traffic is either redirected to a benign website (e.g., secura.com) or simply served a generic page, effectively cloaking the C2 infrastructure from broad internet scans (such as those looking for Cobalt Strike instances). This prevents general internet scanners from discovering the C2 backend.

The deployment process with Red Wizard is structured into four logical steps:

1. Basic Configuration (globals.yaml): This initial step involves defining global settings for the red team or company. This includes specifying admin access IP whitelists (for SSH), C2 IP space whitelists (for OpenVPN connections to relays), the Ansible deployment user, and default email forwarding addresses for phishing campaigns. Importantly, it also allows for the definition of team members with their SSH public keys and password hashes for user management on deployed systems. This file is secured with an Ansible Vault password.

1. Campaign Configuration: For each new red teaming engagement, a specific configuration directory is created. This configuration inherits from the globals.yaml but allows for campaign-specific overrides, such as unique email forwarding addresses, C2 tool installation preferences, and Cobalt Strike license keys. This campaign-specific configuration is also protected by an Ansible Vault.

1. Inventory Creation: This is where the actual infrastructure layout is defined. Operators interact with a script to add backend C2 servers, OSINT machines, and various relay servers (e.g., malware relay, phishing relay, OSINT relay) by specifying their IP addresses. Once servers are defined, specific components can be added:

• OSINT Campaign: Deploys an always-on OpenVPN connection from an OSINT machine to an OSINT relay, ensuring all OSINT activities appear to originate from the relay.
• Phishing Campaign: Deploys GoPhish (or a generic manual phishing container) on the C2, configures Postfix on the phishing relay for email sending (including DMARC, DKIM, SPF records), and sets up nginx with secret strings for routing. Domain names must be owned by the red team.
• Web Catcher: A simple component to catch arbitrary HTTP/S callbacks, also routed via a relay with secret strings.
• Dropbox Handler: Creates a backend handler for hardware implants, generating OpenVPN certificates for them to connect back.
• Cobalt Strike Campaign: Deploys a Cobalt Strike Docker container on the C2, configuring listeners and integrating with user-supplied malleable C2 profiles. It also supports DNS C2 (DNS beacon) functionality.

1. Deployment: Once the inventory is defined, a single command kicks off the Ansible playbooks. Red Wizard performs sanity checks (e.g., IP ranges, DNS resolution) before initiating the deployment. The entire process, from inventory creation to full deployment, can take between 20 to 40 minutes, depending on the complexity and number of components.

Post-deployment, Red Wizard automatically generates several useful artifacts:

• Infrastructure Diagram: A visual representation of the deployed C2s, relays, and their interconnections, aiding in team communication and client reporting.
• SSH Config: A ready-to-use SSH configuration file for team members to easily connect to the deployed servers.
• DNS Configuration: Comprehensive DNS records (A, MX, TXT for DMARC/DKIM/SPF) required for legitimizing phishing domains, ready for copy-pasting into domain registrars.
• Key Material Exports: Critical files like OpenVPN client profiles, Let's Encrypt certificates, and Dropbox keys are exported and stored locally, allowing for recovery or re-deployment if servers crash.

Red Wizard supports Ubuntu 20.04 for deployment and target systems (with 22.04 support planned). It requires a single deployment user with SSH access and sudo privileges on all target machines. The tool's modularity also allows for dynamic adjustments during an engagement, such as adding new phishing campaigns or reconfiguring existing components, by simply re-running the deployment script.

Demo / Proof of Concept

▶ Watch: Live demo: Configuring servers and adding campaigns (30:00)

Ben Brucker provided a live demonstration showcasing Red Wizard's capabilities, from initial setup to deploying a moderately complex red team infrastructure. The demo environment comprised five virtual servers: an OSINT backend, a C2 backend, an OSINT relay, a Malware relay, and a Phishing relay.

The demonstration began with the Step Zero setup, which installs necessary packages and provides initial guidance. Ben then edited the globals.yaml file, configuring admin access IP ranges, C2 IP ranges for OpenVPN, and defining two user accounts (Ben and Daniel) with their respective SSH public keys and password hashes. This established the baseline security and user access for the entire infrastructure.

Next, a campaign-specific configuration was created, generating a new Ansible Vault-protected file containing details like the Cobalt Strike license key and default passwords for tools like GoPhish. The core of the demo involved building the infrastructure inventory interactively:

1. Adding Servers: The five backend and relay servers were added by specifying their IP addresses.
2. Adding Components:

• An OSINT campaign was configured, linking the OSINT backend to the OSINT relay, resulting in an always-on VPN connection for OSINT activities.
• A phishing campaign named "Helpdesk" was added, deploying GoPhish on the C2 backend and configuring the Phishing relay with Postfix, nginx, and a user-supplied domain (helpdesk.com). Crucially, the concept of secret strings was demonstrated, where specific URL paths (nevergonnagiveyouup, nevergonnaletyoudown, etc.) would trigger forwarding to the GoPhish backend, while other requests would redirect to secura.com.
• A web catcher component was added to the C2, also routed via the Phishing relay and its domain, to catch arbitrary callbacks.
• A Dropbox handler was configured on the C2, using the Malware relay, to manage hardware implant callbacks.
• Finally, a Cobalt Strike campaign was deployed, linking the C2 backend to the Malware relay with a custom domain (malware.com) and demonstrating the integration with malleable C2 profiles and DNS beaconing (really.malware.com).

Throughout the inventory creation, Red Wizard dynamically generated a visual diagram of the infrastructure, illustrating the connections and components. Although the full deployment was not run live due to time constraints (it takes 20-40 minutes), Ben showed the pre-deployment sanity checks and the generated outputs from a previously deployed environment. These outputs included:

• A comprehensive SSH configuration file for team members.
• Detailed DNS records (A, MX, TXT for DMARC/DKIM/SPF) for the phishing domains, ready for registrar configuration.
• Exported key material (OpenVPN client profiles, Let's Encrypt certificates, Dropbox keys) for recovery.

The demo effectively showcased Red Wizard's user-friendly interface, its robust automation capabilities, and its commitment to providing OPSEC-hardened and self-documenting red team infrastructure.

Defensive Implications

▶ Watch: Q&A: Phishing challenges and alternative C2 support (50:50)

Red Wizard, by making advanced red team infrastructure deployment more accessible and efficient, inherently raises the bar for defensive security. Blue teams must anticipate and prepare for adversaries leveraging such streamlined capabilities. The tool's design principles and deployed components offer several critical insights for defenders:

1. Focus on Egress Filtering and C2 Detection: Red Wizard's reliance on OpenVPN tunnels and nginx relays with secret strings for C2 traffic highlights the importance of robust egress filtering. Blue teams should not only block known malicious IPs but also focus on detecting unusual outbound connections, especially those over standard ports (like 443) that might be tunneling C2 traffic. Deep Packet Inspection (DPI) and behavioral analytics are crucial for identifying encrypted tunnels or anomalous traffic patterns that might indicate C2 activity, even if it's masquerading as legitimate web traffic with specific URL paths.

1. Advanced Phishing Detection: The tool's comprehensive phishing infrastructure, including GoPhish, fully configured Postfix mail servers with DMARC, DKIM, and SPF records, and Let's Encrypt certificates, means that phishing attacks will appear highly legitimate. Defenders need to move beyond simple sender reputation checks. Employee training on recognizing sophisticated phishing, robust email security gateways with advanced threat intelligence, and sandboxing capabilities for suspicious links and attachments are essential. Furthermore, monitoring for newly registered domains that suddenly become active with email sending can be an early warning sign.

1. Threat Intelligence on Red Team Tools and Techniques: Red Wizard explicitly supports tools like Cobalt Strike. While the tool encourages users to deploy their own malleable C2 profiles, defenders should maintain up-to-date threat intelligence on common C2 frameworks, their default configurations, and known malleable profiles. Endpoint Detection and Response (EDR) solutions should be tuned to detect the behaviors associated with these tools, not just their signatures.

1. Rapid Incident Response and Infrastructure Tracking: The ability for red teams to quickly burn and redeploy infrastructure (relays) means blue teams must have rapid incident response capabilities. Detecting a compromised relay should trigger immediate analysis to identify the C2 communication patterns, but also an awareness that the adversary can quickly shift. Automated threat intelligence feeds that track new infrastructure registrations and changes can provide valuable context.

1. Importance of Internal Network Segmentation: Even if external relays are compromised, robust internal network segmentation can limit the lateral movement and impact of an adversary. If a hardware implant (like those using Red Wizard's Dropbox handler) makes it into the network, strong segmentation can prevent it from reaching critical assets.

1. Continuous Monitoring and Logging: Red Wizard emphasizes comprehensive logging of red team actions. This underscores the need for blue teams to have robust, centralized logging across all their infrastructure, endpoints, and network devices. Effective security information and event management (SIEM) systems are vital for correlating events and detecting subtle indicators of compromise that might be part of a larger, coordinated attack.

By understanding the capabilities and operational methodologies that tools like Red Wizard enable, blue teams can proactively strengthen their defenses, refine their detection strategies, and improve their overall resilience against sophisticated adversaries.

Key Takeaways

• Red Wizard automates complex red team infrastructure deployment, significantly reducing manual effort and time, allowing operators to focus on offensive operations.
• The tool prioritizes OPSEC by design, utilizing burnable relay servers, OpenVPN tunnels, specific URL "secret strings," and IP whitelisting to protect C2 infrastructure from detection and traceability.
• It leverages Ansible, Docker, and Python to provide a flexible, transparent, and user-friendly platform for provisioning C2s, phishing campaigns, OSINT machines, and other components.
• Red Wizard provides self-documenting configurations and generates useful artifacts like infrastructure diagrams, SSH configs, and comprehensive DNS settings (DMARC, DKIM, SPF) to streamline team collaboration and post-engagement reporting.
• While supporting core tools like GoPhish and Cobalt Strike, users are encouraged to supply their own malleable C2 profiles and OPSEC patches to enhance evasion capabilities, highlighting the ongoing need for custom security measures.
• The efficiency gained by red teams through tools like Red Wizard necessitates that blue teams bolster their egress filtering, C2 detection, advanced phishing defenses, and rapid incident response capabilities to counter sophisticated, rapidly evolving threats.

About the Speaker(s)

Ben Brucker is a seasoned Penetration Tester and Social Engineer with over eight years of experience at Secura. His extensive background in offensive security, particularly in red teaming, led him to develop Red Wizard. Brucker's motivation stemmed from the "painful" and time-consuming process of manually deploying and managing complex red team infrastructure. He envisioned a user-friendly tool that would simplify these operations, enhance operational security, and allow red teams to focus more on the strategic aspects of their engagements.