Repository navigation
Home
A self-contained Boot-to-Breach lab on AWS. Deploy a full red-team training environment in ~30 minutes — three C2 frameworks, a Linux operator, a Windows operator, an Apache redirector, and a Guacamole portal.
This wiki is the operator handbook. The main repository's README is a thin landing page; everything you actually need to deploy and run the lab lives here.
Follow these in order:
| Step | Page | What you'll do |
|---|---|---|
| 1 | Prerequisites | AWS account, IAM, CLI, SSH key, Kali Marketplace subscription |
| 2 | Deploy | Configure tfvars, terraform apply, point DNS |
| 3 | Verify | Access Guacamole, Windows, confirm internal connectivity |
| 4 | Apache-Redirector | SSL certificate + connectivity test |
| 5 | One of: Mythic-C2 / Sliver-C2 / Havoc-C2 | Generate first agent, confirm callback through redirector |
Total clock time: 45-90 minutes. The first deploy is the longest because Havoc compiles from source on first boot.
Tip
Returning operator who's done this before? Skip to Quick-Start for the abbreviated path.
Important
[!IMAGE PLACEHOLDER — lab architecture diagram] A clean architecture overview screenshot or hand-drawn diagram showing the two VPCs, the redirector as the public entry point, the C2 servers behind it, and the operator workstations (Windows + Kali) attached to Guacamole.
Two VPCs, peered. The Teamserver VPC holds Mythic / Sliver / Havoc / Guacamole / Windows operator / Kali operator. The Redirector VPC holds the public-facing Apache redirector. Only the Guacamole portal and the redirector hold public IPs. Everything else is reachable through Guacamole.
See Lab-Architecture for the full diagram and traffic flow, Lab-Inventory for the host-by-host table, and Deployment-Modes for choosing between public-internet mode (Let's Encrypt + domain) and closed-environment mode (HTB / VulnLab / Proving Grounds via OpenVPN).
| Framework | Style | Web UI | First-beacon walkthrough |
|---|---|---|---|
| Mythic | Modular, multi-operator, web-driven | Yes (port 7443 from Windows op) | Mythic-C2 |
| Sliver | CLI console, BishopFox | No (CLI only) | Sliver-C2 |
| Havoc | GUI client (Katana), C demons, evasion-focused | Qt client over Guacamole VNC | Havoc-C2 |
All three sit behind the Apache redirector with header validation and URI-prefix routing. See Apache-Redirector for the security model.
- Windows Operator — Server 2022 with Mythic / Sliver / Havoc clients, Chromium, MobaXterm, 7-Zip pre-installed. Access via Guacamole RDP.
- Kali-Operator — Headless or GUI Kali Linux with a curated 21-package AD enumeration + attack lineup behind a single command. SSH port forwarding documented for Meterpreter callbacks through the redirector.
If you're working through HackTheBox, VulnLab, or Proving Grounds Pro Labs, the redirector can act as your OpenVPN gateway and route traffic from the entire internal lab to the target network. See External-Targets.
Troubleshooting — connectivity checks, component health, fixes for the failure modes that actually come up (Mythic SSL cert, Sliver missing, Havoc build failed, agent not calling back, Marketplace OptInRequired, VPC limits, etc.).
The default deploy is roughly $0.21/hour of compute. With terraform destroy between sessions, expected monthly cost lands around $5-9/month for typical 5-10 hr/week study cadence. See Cost-Management for the full breakdown and stop-vs-destroy tradeoffs.
Pages are organized around what you're trying to do, not around the codebase layout. Most assume you have a running redStack deployment and are looking for a specific operation. They are not tutorials from scratch — that's what the deployment pages are for.
Cross-page links use [[Page-Name]] syntax. Image and GIF placeholders are scattered through pages where a screenshot or short terminal recording would help — these will be filled in over time. If you've taken a useful screenshot of a redStack workflow, contributions welcome via the wiki repo.