DOCSEARCHbyAlgolia
Submit Docs

Ludus Documentation

website·Indexed 33 days ago

https://docs.ludus.cloud/

Documentation for Ludus, featuring guides on subscription roles for deploying tools like Mythic, Zeek, Velociraptor, and Microsoft Defender for Endpoint, as well as infrastructure operations and troubleshooting for Proxmox, Ansible, and VM templates.

Tokens
118.4K
Snippets
614
Records
808
Agent score
62%

What's inside Ludus

  1. Overview of Ludus Anti-Sandbox plugin

    The Ludus Anti-Sandbox plugin is an add-on for Ludus Enterprise designed to create VMs that appear as 'real' physical hosts to evade malware that detects virtualization artifacts. It achieves this by using custom compiled QEMU and OVMF packages to remove QEMU strings and modifying the guest OS to remove virtualization markers and add realistic user activity.

  2. Overview of Ludus VM Templates

    Templates are the foundation of every VM deployed by Ludus. By design, builtin templates are minimal and contain no customizations, providing only the bare essentials (python3/powershell and SSH/WinRM) to allow Ansible to function and users to connect via RDP, SSH, or KasmVNC. This infrastructure-as-code approach ensures VMs are fresh and up-to-date upon every deployment.

  3. Overview of Ludus KMS for Windows Activation

    Ludus Enterprise provides a Key Management Service (KMS) server that runs on the Ludus host at a static IP address (192.0.2.1). This server is used to activate volume-licensed Windows virtual machines within ranges. Users are responsible for ensuring they possess valid licenses for all Windows machines activated via the KMS.

  4. Overview of Ludus Anti-Sandbox plugin

    The Ludus Anti-Sandbox plugin is an add-on for Ludus Enterprise designed to make virtual machines appear as 'real' physical hosts to evade malware that detects VM artifacts. It achieves this by using custom compiled QEMU and OVMF packages and modifying the VM in several ways:

    • Removes Virtualization Artifacts: Uninstalls VirtIO Serial Driver, removes QEMU Guest Agent/services, deletes RedHat registry keys, and removes folders like C:\ludus, C:\Tools, and C:\QEMU-ga.
    • Simulates User Activity: Adds random PDF, DOC, PPTX, and XLSX files to Desktop and Downloads with randomized timestamps (last 5 years) and creates usage history.
    • Modifies System Identity: Sets random Windows installation dates (2021-2024) and allows custom organization/owner registration.
    • Customizes Hardware Info: Allows configuration of custom processor name, vendor identifier, speed, and identifier.
    • Realistic Environment: Restores default Windows wallpaper and removes Ludus-specific backgrounds.

  5. Overview of Ludus Builtin Templates

    Ludus uses templates built from scratch (ISO) to ensure VMs are fresh and up-to-date for every deployment. Builtin templates provide the bare minimum requirements for Ansible to function (python3/powershell and SSH/WinRM) and for users to connect (RDP, SSH, KasmVNC).

    Ludus comes with 5 builtin templates:

    • debian13
    • debian12
    • kali
    • win11-22h2-x64-enterprise
    • win2022-server-x64

    Additional templates are available via the ludus-source-bsl source. Use ludus source list ludus-source-bsl to browse the full list.

  6. Overview of Ludus range configuration

    The Ludus range configuration is a YAML document used to describe the desired state of a deployment. It defines the virtual machines to be created and can optionally specify network traffic rules, router VM settings, and global deployment defaults.

  7. Overview of Ludus Key Management Service (KMS)

    Ludus Enterprise provides a Key Management Service (KMS) server that runs on the Ludus host at a static IP address (192.0.2.1). This server is used to activate volume-licensed Windows virtual machines within ranges. Users are responsible for ensuring they possess valid licenses for all Windows machines licensed via the KMS.

  8. Overview of Ludus Cyber Range Platform

    Ludus is a platform designed for the rapid installation and deployment of cyber ranges. It abstracts tedious operational tasks and security management, allowing users to focus on testing. The platform is built on Proxmox, Packer, and Ansible, and it supports extensibility through modules, allowing users to customize ranges by reusing provided templates, roles, and tasks.

  9. Overview of Ludus cyber environment automation

    Ludus is an automation overlay built on Proxmox that allows users to create and manage cyber environments, known as "ranges," for testing and development. It utilizes Packer and Ansible to create templates and deploy complex environments from a single configuration file. Users can interact with Ludus via the Ludus CLI or the Proxmox web interface. Because it is an overlay, users can still perform manual modifications or setups directly via Proxmox.

  10. Overview of Ludus cyber environment automation

    Ludus is an automation overlay for Proxmox used to build cyber environments ("ranges") for testing and development. It utilizes Packer and Ansible to create templates and deploy complex environments from a single configuration file. Users can manage their ranges via the Ludus CLI or the Proxmox web interface, and can still perform manual modifications in Proxmox alongside Ludus-managed VMs and networks.

  11. Understand Ludus Enterprise resource quotas

    Quotas allow administrators to limit the resources users can consume in shared environments. There are four resource types that can be limited:

    • RAM: Total memory in GB across all VMs in all of a user's ranges.
    • CPU: Total CPU cores across all VMs in all of a user's ranges.
    • VMs: Total number of VMs across all of a user's ranges.
    • Ranges: Total number of ranges a user can create.

  12. Understand how Ludus auto-shutdown detects inactivity

    Ludus can automatically power off all VMs in a range after a configurable period of inactivity to save host resources. Inactivity is determined by two signals:

    1. Guest agent sessions: The QEMU guest agent reports if any user is logged into any VM in the range.
    2. API activity: Any API call targeting the range (e.g., deploys, power operations, config changes) resets the timer.

    A range is powered off only when both signals are idle for longer than the configured timeout. Note that VMs without the QEMU guest agent (such as EDR appliances or anti-sandbox VMs) cannot report sessions; if a range consists entirely of such VMs, Ludus relies solely on API activity.