Skip to content

Home

Jump to bottom
BaddKharma edited this page May 2, 2026 · 74 revisions

redStack Wiki

Welcome to the redStack operator reference. The main repository's README covers everything you need to deploy the lab. This wiki covers everything you need to operate it.

If you're new here, deploy first using the README, then come back here when you have a running lab and want to start doing things with it.

What's in this wiki

Per-C2 walkthroughs

Each C2 framework has its own page covering server access, listener setup, payload generation, and the full flow to land an initial beacon on the Windows operator workstation.

  • Mythic-C2 — Pre-installed C2 profiles, agent generation, deployment, callback verification
  • Sliver-C2 — Server access, C2 profile import, HTTP listener, implant generation, callback verification
  • Havoc-C2 — Build script, teamserver, desktop client, listener, demon generation, callback verification

Operator workstations

  • Kali-Operator — Headless vs GUI, the curated 21-package AD/enum tool installer, SSH port forwarding for callbacks, AD attack workflows

Infrastructure deep dives

  • Apache-Redirector — SSL certificate management, header + URI gating, request flow, log review
  • External-Targets — HTB / VulnLab / Proving Grounds Pro Lab routing via OpenVPN + WireGuard

Reference

  • Troubleshooting — Connectivity checks, component health, fixes for common failures

How this wiki is structured

The wiki is intentionally light. Most pages assume you have a running redStack deployment and want to do something specific with one component. They're not tutorials from scratch — the README handles that. Cross-links between pages use [[Page-Name]] syntax.

Image and GIF placeholders are scattered through pages where a screenshot or short terminal recording would help — these will be filled in over time. If you've taken a useful screenshot of a redStack workflow, contributions welcome.

Clone this wiki locally