~/adaptix-setup

Requirements

On your own machine (linux/amd64):

• git
• Docker + docker compose (recommended), or the native toolchain: Go 1.25+, gcc, g++, make, mingw-w64 (Adaptix's pre_install_linux_all.sh installs these).
• The arena-byoc CLI (for the tunnel).

Setup, step by step

1 · Pair the tunnel

arena-byoc pair        # enter the code from the Arena UI
arena-byoc status      # confirm paired + tunnel up; note your TUNNEL_IP

2 · Clone Adaptix v1.2 (official)

git clone https://github.com/Adaptix-Framework/AdaptixC2.git
cd AdaptixC2
git fetch --depth 1 origin a4b80bf370f704d6843e69433bfb5c06274f57df
git checkout FETCH_HEAD
git rev-parse HEAD     # must print a4b80bf...

Adaptix ships both a branch and a tag named v1.2 — fetching the exact commit avoids grabbing the wrong one.

3 · Build the server with extenders

Listeners are extender plugins, so build server-ext, not server:

# Docker (recommended)
docker compose --profile build-server-ext build
docker compose --profile build-server-ext up --abort-on-container-exit
docker compose --profile build-server-ext down
# output -> AdaptixServer/server-dist/  (adaptixserver + ssl_gen.sh + profile.yaml + extenders/)

# Native alternative:  make server-ext

4 · Generate the TLS cert

cd AdaptixServer/server-dist
bash ssl_gen.sh        # creates server.rsa.crt / server.rsa.key

5 · Edit profile.yaml — full example

Start from the profile.yaml shipped in server-dist/, set your password + operators, and keep the extenders list (that's what gives you listeners). The teamserver binds to localhost — your listeners bind to the tunnel IP later (step 7).

Teamserver:
  interface: "127.0.0.1"          # client runs locally
  port: 4321
  endpoint: "/endpoint"
  password: "CHANGE-ME-strong"    # teamserver password
  only_password: true
  operators:
    operator1: "CHANGE-ME-1"
    operator2: "CHANGE-ME-2"
  cert: "server.rsa.crt"
  key:  "server.rsa.key"
  extenders:
    - "extenders/beacon_listener_http/config.yaml"
    - "extenders/beacon_listener_smb/config.yaml"
    - "extenders/beacon_listener_tcp/config.yaml"
    - "extenders/beacon_listener_dns/config.yaml"
    - "extenders/beacon_agent/config.yaml"
    - "extenders/gopher_listener_tcp/config.yaml"
    - "extenders/gopher_agent/config.yaml"
  access_token_live_hours: 12
  refresh_token_live_hours: 168

HttpServer:
  # leave the error/http/tls blocks as shipped — TLS 1.2-1.3, 404 cover page,
  # Server: AdaptixC2 header. Tune these for your own OPSEC if you want.
  ...

6 · Start the teamserver

./adaptixserver -profile profile.yaml      # add -debug for logs

7 · Connect the client & create your listener

1. Open the Adaptix client (GUI) on your machine.
2. Connect to the teamserver: host 127.0.0.1, port 4321, your password.
3. Create an HTTP listener bound to your TUNNEL_IP (not 0.0.0.0). The public port + endpoint are shown in your redirector slot in Arena.
4. Generate your beacon pointing at the redirector's public URL, drop it on the scenario target, and the callback shows up in your client.

Example HTTP listener — set these in the client's Create listener form:

Host & port (Bind):  TUNNEL_IP : 443
Method:             GET, POST
URIs:               /api/v1/status
                    /updates/check.php
                    /content.html
User-Agent:         Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0
Heartbeat Header:   X-Beacon-Id
SSL (HTTPS):        on        (auto-generates a cert if you leave it empty)
Encryption key:     <random 32-hex, the form fills one in>

Pick URIs / User-Agent / headers that blend into the scenario's traffic — that is your OPSEC surface. The defaults above are a starting point, not a fingerprint to reuse verbatim.

The BYOC rule

Bind the beacon listener to your TUNNEL_IP. That routes beacons in via redirector → tunnel → your teamserver. Nothing of yours runs on Adversario infrastructure beyond the redirector.

Piece	Where it runs
Teamserver + client	Your machine
Beacon listener	Bound to your tunnel IP
Redirector + tunnel	Lent by Adversario