Skip to content

01. Quick Start

Jump to bottom
BaddKharma edited this page May 5, 2026 · 51 revisions

🚀 Quick Start

Home > Quick Start

Abbreviated path for returning operators. If this is your first deploy, work through Prerequisites → Deploy → Verify → First Run instead.

Important

New to redStack? This page skips explanation and assumes you've been through the full flow before. Start at Prerequisites and follow the numbered pages in order.

At a glance
Active steps terraform apply ~10 min. Linux hosts and Guacamole ready shortly after. Windows RDP and Mythic UI need another 10-15 min to fully initialize.
What you deploy 7 EC2 instances (Mythic / Sliver / Havoc / Redirector / Guacamole / Windows op / Kali op) across 2 peered VPCs
Cost ~$0.25/hr compute. Stop after sessions, destroy on 3+ day breaks: ~$15-20/mo
Default mode Direct Access (public domain + Let's Encrypt). For HTB/VL/PG: see Deployment Modes

Returning Operator Steps

Active steps only. Assumes IAM is set up, aws configure is done, the SSH key pair exists in AWS, and you've accepted the Kali Marketplace EULA.

git clone https://github.com/BaddKharma/redStack.git
cd redStack
cp terraform.tfvars.example terraform.tfvars
# edit terraform.tfvars: set localPub_ip, ssh_key_name, ssh_private_key_path, redirector_domain
terraform init
terraform apply -auto-approve
terraform output deployment_info > ../deployment_info.txt

Point your domain's A record at the redirector's Elastic IP (printed in deployment_info). Instances are typically ready within a few minutes of apply completing.

SSL cert (Direct Access):

Open the Guacamole portal, click Redirector (SSH), then run:

sudo certbot --apache -d yourdomain.tld

Open the portal: https://<GUAC_PUBLIC_IP>/guacamole. Login guacadmin / lab password from deployment_info. All connections are pre-registered.

Then Pick a C2

Each C2 has its own walkthrough for first beacon:

  • Mythic, UI-driven, HTTPS profile pre-installed. Web UI at https://mythic:7443 from the Windows operator.
  • Sliver, CLI-driven. SSH into the Sliver host and sliver-client.
  • Havoc, Qt GUI client over Guacamole VNC. See Havoc for build and first-beacon steps.

Or work from Kali for AD enumeration:

  • Kali, Headless by default. sudo install-kali-tools after first SSH login pulls the curated 21-package AD/enum lineup.

Tunneled Access (HTB / VL / PG)?

Skip the domain step and the Certbot step. In terraform.tfvars:

redirector_domain                    = ""
enable_external_vpn                  = true
enable_redirector_htaccess_filtering = false

Then follow External Targets for the OpenVPN + WireGuard routing setup.

Session Wrap-Up

End of session: stop all instances via the AWS Console (EC2 > Instances > Instance State > Stop) or CLI. Compute charges stop immediately.

Before a 3+ day break:

terraform destroy

Releases EIPs, terminates instances, removes VPCs. ~5 min. State is gone. See Cost Management for the full cost breakdown.

See Also

  • Prerequisites, full first-time setup (IAM, CLI, SSH key, Marketplace)
  • Deploy, annotated walkthrough of terraform apply
  • Verify, confirm Guacamole, Windows, internal connectivity
  • Troubleshooting, when something doesn't come up cleanly

“Slow is smooth, smooth is fast.”

Naval Special Warfare adage

Clone this wiki locally