Skip to content

Home

Jump to bottom
BaddKharma edited this page May 2, 2026 · 74 revisions

redStack Banner

redStack Wiki

A self-contained Boot-to-Breach lab on AWS. Deploy a full red-team training environment in ~30 minutes, three C2 frameworks, a Linux operator, a Windows operator, an redirector, and a Guacamole portal.

This wiki is the operator handbook. The main repository's README is a thin landing page; everything you actually need to deploy and run the lab lives here.

🚀 Just Want to Deploy?

Follow these in order:

Step Page What you'll do
1 Prerequisites AWS account, IAM, CLI, SSH key, Kali Marketplace subscription
2 Deploy Configure tfvars, terraform apply, point DNS
3 Verify Access Guacamole, Windows, confirm internal connectivity
4 Redirector SSL certificate + connectivity test
5 One of: Mythic / Sliver / Havoc Generate first agent, confirm callback through redirector

Total clock time: 45-90 minutes. The first deploy is the longest because Havoc compiles from source on first boot.

Tip

Returning operator who's done this before? Skip to Quick-Start for the abbreviated path.

Note

After your first beacon: explore Kali for AD enumeration tooling, External-Targets for HTB / VulnLab / Proving Grounds routing, and Cost-Management for stop-vs-destroy patterns. Stuck anywhere along the way? Troubleshooting.

🗺️ Lab at a Glance

                          [ Operator ]
                       Browser / MobaXterm
                              |
                          HTTPS :443
                              |
+-----------------------------+-------------------------------+
|             TeamServer VPC (10.50.0.0/16)                   |
|   guacamole               Elastic IP: <Public IP>           |
|       |                                                     |
|       +-- RDP / SSH -->  windows   kali     (workstations)  |
|       +-- SSH -------->  mythic   sliver   havoc   (C2)     |
|                          ( no public IPs )                  |
+-----------------------------+-------------------------------+
                              |
              VPC Peering: 10.50.0.0/16 <-> 10.60.0.0/16
                              |
+-----------------------------+-------------------------------+
|             Redirector VPC (10.60.0.0/16)                   |
|   redirector             Elastic IP: <Public IP>            |
|   Apache :80/:443  (X-Request-ID + URI validation)          |
+-----------------------------+-------------------------------+
                              ^
                              |
                       Public Internet
                              |
                  [ Targets / Implants ]

Two VPCs, peered. The Teamserver VPC holds Mythic / Sliver / Havoc / Guacamole / Windows / Kali. The Redirector VPC holds the public-facing redirector. Only the Guacamole portal and the redirector hold public IPs. Everything else is reachable through Guacamole.

See Lab-Architecture for the full diagram and traffic flow, Lab-Inventory for the host-by-host table, and Deployment-Modes for choosing between public-internet mode (Let's Encrypt + domain) and closed-environment mode (HTB / VulnLab / Proving Grounds via OpenVPN).

📡 The Three C2 Frameworks

Framework Style Web UI First-beacon walkthrough
Mythic Modular, multi-operator, web-driven Yes (port 7443 from Windows op) Mythic
Sliver CLI console, BishopFox No (CLI only) Sliver
Havoc GUI client (Katana), C demons, evasion-focused Qt client over Guacamole VNC Havoc

All three sit behind the redirector with header validation and URI-prefix routing. See Redirector for the security model.

🛠️ Workstations

  • Windows: Windows Server 2022 staging workstation. Pre-installed with Chromium, VS Code, MobaXterm (SSH bookmarks for every lab Linux host), and 7-Zip. Central operator hub for browsing the Mythic UI, shuttling payloads between hosts, and running Windows-side tooling. Access via Guacamole RDP.
  • Kali: Headless or GUI Kali Linux with a curated 21-package AD enumeration + attack lineup behind a single command (sudo install-kali-tools). SSH port forwarding documented for Meterpreter callbacks through the redirector.

🌐 External Target Environments

If you're working through HackTheBox, VulnLab, or Proving Grounds Pro Labs, the redirector can act as your OpenVPN gateway and route traffic from the entire internal lab to the target network. See External-Targets.

🆘 When Something Breaks

Troubleshooting, connectivity checks, component health, fixes for the failure modes that actually come up (Mythic SSL cert, Sliver missing, Havoc build failed, agent not calling back, Marketplace OptInRequired, VPC limits, etc.).

💰 Cost Management

The default deploy is roughly $0.21/hour of compute. With terraform destroy between sessions, expected monthly cost lands around $5-9/month for typical 5-10 hr/week study cadence. See Cost-Management for the full breakdown and stop-vs-destroy tradeoffs.

🧭 How This Wiki Is Structured

Pages are organized around what you're trying to do, not around the codebase layout. Most assume you have a running redStack deployment and are looking for a specific operation. They are not tutorials from scratch, that's what the deployment pages are for.

Cross-page links use [[Page-Name]] syntax. Image and GIF placeholders are scattered through pages where a screenshot or short terminal recording would help, these will be filled in over time. If you've taken a useful screenshot of a redStack workflow, contributions welcome via the wiki repo.

Clone this wiki locally