This article walks you through the features you'll use to build and configure a cyber range environment from adding systems and configuring subnets to setting DHCP options and writing documentation.
Systems and Applications
Building a cyber range means designing systems, configuring software, laying out a network, setting up vulnerabilities and escalation paths, and documenting all of it for other users. Immersive Cyber Ranges gives you a suite of range-building features to help you and your team do all of that in one place.
Your range systems are the core of any range environment. They run the operating systems, software, and data that make your range a realistic training environment. Cyber Ranges maintains a core set of system images which you can deploy into any new or existing range environment and configure to your specific needs.
Adding Systems
To add a new system to a deployed range environment, select the Add System button under the Systems tab within your range. From there, you'll need to provide a number of details.
First, select a Name, Hostname, and Image.
Provided Images
We provide a set of images covering several operating systems and versions, including a growing set of systems with pre-configured toolsets under the "Security Tools" category. We also support bringing your own AWS images to the Cyber Ranges platform. You'll need the AMI ID of your image, and it will need to meet a few requirements:
- Shared with the AWS account hosting your Cyber Ranges infrastructure (you may also need to share the image's related snapshot IDs)
- Located in the same region as your Cyber Ranges infrastructure
- Marketplace images are not supported
AMIs which have the EnaSupport property set to true will be launched as t3 type instances; otherwise they will be t2 type.
After choosing your Name, Hostname, and Image, you'll need to select a System Type and Disk Size. System type has the biggest impact on the performance of your system, and also the biggest impact on its running cost. Currently, we support systems with 1 vCPU and 0.5 GiB RAM through 8 vCPU and 32 GiB RAM. We support disk sizes from 8 GB to 10 TB — though we recommend keeping your storage to a minimum, since you can always increase it later.
Note: Estimated Runtime Cost
We provide an estimated runtime cost based on your selections of System Type and Disk Size (GB) when adding a new system. This is calculated based on the hourly AWS cost of the Image and System Type, plus the static costs of disk storage (monthly) converted to an hourly amount.
This is only an estimated hourly runtime cost, and your actual costs may vary.
Please monitor your AWS bill on a regular basis to avoid unexpected expenses. Total running range cost estimates are available in the Settings of your currently running range, or the Template details of individual templates.
The next step is to choose which Subnet your system will be launched into. You can choose from any of your currently configured range subnets. You may also choose a specific IP address within that subnet — this is optional, and the IP address will be randomized if you leave the field blank. If you template this environment, future range launches will preserve the original IP address of the system.
You're now ready to Launch your system. The system will deploy in a Pending state, and will typically be in a Running state within a minute or two.
Note: New System Credentials
For every range deployed, the Cyber Ranges platform automatically generates an SSH key pair for Linux system connections. This key pair is available in the Settings tab of your range environment and will be automatically used for Console Sessions.
For Windows operating systems, AWS dynamically generates an Administrator password for the system on launch. We automatically fetch this for use by Console Sessions and make it available to you in cleartext in the Credentials settings of the system.
Modifying Existing Systems
After a system has been launched into your range environment, you can manage most of its properties directly through the Cyber Ranges dashboard. To edit system properties, select the Edit icon for the system you'd like to modify.
There are four types of system properties you have control over:
- General
- Specs
- Network
- Credentials
General
Modify the System Name, Hostname, and Student Access. By default, newly launched systems are not accessible to users with the Student role. To allow Student users to access systems in your range, you must explicitly allow this by selecting the "Allow students to access this system" checkbox and saving your changes.
This section also shows system details including operating system, launch date and time, and source (who launched the system).
Specs
Modify the System Type and Disk Size in this section. You can only modify one attribute at a time, and your system will become temporarily unavailable while the modifications take place. This section also shows the Estimated Running Cost of the system.
Network
You cannot modify the primary network interface of an existing system. To change this attribute, you must delete and relaunch the system.
You may add or delete a Secondary Network Interface, which allows your system to access multiple subnets. When you do this, multiple sets of security rules will apply to the system.
Credentials
Console Connection controls how you connect to the system when using Console Session (browser). You may specify the connection protocol, username, domain, password, and port.
File Sharing controls whether file sharing is possible through Console Sessions. This is useful for controlling access to licensed or proprietary software for guest users.
Credential Caching lets you specify additional connections to be made at range power on, or when running the Cache Creds functionality deliberately. Similar to Console Connection settings, you may choose the connection protocol, username, domain, password, and port. This is useful for facilitating specific escalation paths throughout your range environment.
Note: Sample Credential Caching Scenario
The most common use of Credential Caching is to create RDP sessions on Windows hosts for Active Directory lateral movement and privilege escalation scenarios. To create an RDP session on a Windows host:
- Make sure the user has access to RDP to the target machine. This can be done through the "Remote Desktop Users" or "Administrators" local groups.
- Add the Credential Caching configuration to the target machine.
- Cache the credentials. The "Cache Creds" functionality can be invoked manually, and is also run automatically after a short delay on range power on.
- Verify the RDP session started successfully by checking for processes running on the target machine as the appropriate user via Task Manager.
Image
After making configuration changes or installing specific tools, you may want to save this configuration to deploy into other range environments. On the Image tab within the system editing flow, you can specify an Image Name and Image Description, then select Create Image. This templates the individual system and makes it available as an option through the Add Systems list.
Attached Apps lets you select range applications that you've configured which are served from this system. These apps will be added to any range that the custom image is launched into. The App URL must use the system IP to be attached, and App URLs will be updated to the new system IP when adding to another range.
Deleting Systems
To delete a system, select the Edit icon for the system you'd like to delete, then select Delete and Confirm your choice. Your system will be immediately removed from the Cyber Ranges dashboard.
Range Applications
To add an Application to your range environment, navigate to the Applications tab and select the Add Range Application button. You'll be prompted to enter the following information:
- Name — a display name for your application
- Description — a brief description of the application
- URL — the location of the application within your range (must start with "http(s)://" and use an IP address)
- Student Access — whether students are allowed to access this application
After adding the Application, users can access it directly from their browser in the same way they access range systems with Console Sessions.
Creators and Admins can modify any of an application's attributes by selecting the Edit button and updating the relevant information. Applications can also be deleted from this view.
Subnets
Every Cyber Ranges environment has at least one Subnet (apart from the AdminBox subnet) that range Systems can be launched into. You can also add new subnets, modify the security rules for existing subnets, and delete existing subnets. This gives you a lot of flexibility in the networking setup of your range environments.
Warning: Existing Template Networking
Be careful when modifying the networking rules for existing range templates. Systems and software may be configured to rely on the current networking rules, and these may break if you apply changes.
Subnet information can be found for each range under the Settings page within the Subnets tab. At a glance you can see your subnets, their network ranges, and how many network interfaces reside in each.
Adding Subnets
To add a Subnet to your range, select the + Subnets button. Provide a Name, Description, and Network Range for the subnet. The Network Range must be in valid CIDR format, reside within your range's overall network parameters, and not conflict with any existing subnets.
You can modify the security rules of the subnet before or after it's created.
Modifying Security Rules
Security Rules control what network traffic can flow into and out of the subnet. These rules are specific to Cyber Ranges and AWS and don't necessarily align with standard firewall or Network ACL behavior. For more details, read the AWS User Guide on the topic.
Warning: VPN Client IP vs AdminBox IP
There are two IP addresses associated with VPN connections: VPN Client IPs (for example, 10.9.253.0/24 and 10.9.254.0/24) and AdminBox Interfaces (for example, 10.10.255.244 and 10.10.0.4). These IPs may vary depending on the lab network range.
For security group evaluation, AWS uses the AdminBox Interface for traffic within the same subnet (for example, 10.10.0.X to 10.10.0.X). For traffic between subnets, AWS uses the VPN Client IPs (for example, 10.10.0.X to 10.10.255.X).
These are important distinctions when creating inbound and outbound security rules that behave as you expect, so bear them in mind while you design your range.
To create or modify a rule, you'll need to select the following:
- Protocol
- Port Range
- Source/Destination CIDR
- Description (optional)
Below is a set of inbound and outbound security rules as an example:
Deleting Subnets
To delete a subnet, it must not contain any Network Interfaces. Before deleting a subnet, first delete any secondary network interfaces associated with it, or delete the system itself for primary interfaces.
Once you've removed any associated interfaces, you can delete the subnet by selecting the delete icon.
DHCP Options
What are DHCP Options?
DHCP Options Sets provide configurations to the systems launched into your range environments. You may specify DHCP Options for Range Systems, Admin VPN Clients, and Attacker VPN Clients. For each of these, you may provide Domain Names for the systems to be aware of, as well as DNS servers to use for resolving domain names.
Range Network DHCP
This set of options applies to systems deployed within the range network, including any attacker systems. Domain Names and DNS server IPs are pushed to new systems at launch, and any updates to these settings are eventually applied to currently deployed and running systems in the range — usually after a couple of hours.
Admin and Attacker VPN Clients
These option sets are applied to VPN Clients that connect to the range environment via either Admin or Attacker VPN configuration files. Set these if you want your connected systems to be able to resolve range system hostnames easily.
For a detailed description of DHCP Options sets, read the AWS User Guide. Note that Cyber Ranges environments do not support every available option within AWS DHCP Options sets.
Modifying DHCP Options
To modify these settings, navigate to your range Settings page under the DHCP tab. From there, enter your desired Domain Names and DNS Servers.
Range Documentation
Documentation is an important step in the range-building process. It helps users of your range environments understand the systems, software, and scenarios you've built into the range.
Cyber Ranges gives you two methods to document your range details as you build: Markdown-style Documentation (readmes) and Uploaded Files.
Creating Markdown Documentation
Every newly launched range is deployed with a sample readme. This will help you get started with Markdown syntax quickly and provides suggested details to include in your documentation.
Consider noting the following in your Markdown documentation:
- System Details
- Hostnames
- IP Addresses
- Credentials
- User Sessions
- Active Directory Details
- Trust Relationships
- Important Users and Passwords
- Additional System Details
- Descriptions
- Other User Accounts
- Configured Software
Markdown Documentation Versions: Readme and Admin Readme
Cyber Ranges is designed to make it easy to run training events, CTFs, hiring assessments, and other events where you might not want participants to have all the range details — though in other cases, you'll want them to have some information about the range or event.
To support this, you can create separate documentation for Admin users. While editing the Readme documentation, select the readme/Admin readme radio button to automatically create separate pages for your individual users and Admins, which you can maintain with different range information. This lets you target each audience with the documentation that's relevant to them. You can also choose to keep a single readme for all users — in that case, just skip the split.
Uploading Documentation Files
In some cases, specific files are better suited for pieces of the range documentation. For instance, if you're building a training environment that already has a set of PowerPoint slides, you might want to upload the slides and associate them with your range template.
To upload a standalone file, navigate to the Files tab and provide a Document Name, Document Description, and then Choose File. You can also choose to allow students to access these files or reserve them for range administrators.