Repository navigation
Home
A self-contained Boot-to-Breach lab on AWS. Deploy a full red-team training environment in minutes. The lab contains three C2 frameworks, Kali and Windows operator hosts, an Apache redirector, and a Guacamole portal.
This wiki is the operator handbook. The main repository's README is a thin landing page; everything you need to deploy and run the lab lives here.
Note
This wiki is being developed for the upcoming v1.0 release. Some pages may have drifted from the current main branch. Content aligns once branches merge into v1.0.
Important
Who this is for: redStack assumes a working knowledge of penetration testing and offensive security at an entry level. You should be comfortable with basic networking, Linux administration, and the concept of C2 frameworks before deploying this lab. If you are new to offensive security, build that foundation first. redStack will still be here.
Follow these in order:
| Step | Page | What you'll do |
|---|---|---|
| 1 | Prerequisites | AWS account, IAM, CLI, SSH key, Kali Marketplace subscription |
| 2 | Deploying Terraform | Configure terraform variables, terraform apply, point DNS |
| 3 | Verify | Access Guacamole, Windows, confirm internal connectivity |
| 4 | First Run | Staged walkthrough: redirector, build scripts, first beacon per C2 |
| 5 | Mythic · Sliver · Havoc | Deep-dive reference for each C2 framework |
Initial deploy (terraform apply) completes in ~10 minutes. Linux C2 hosts and Guacamole are reachable shortly after. Windows RDP and Mythic need another 10-15 minutes to finish initializing.
Tip
Returning operator who's done this before? Skip to Quick Start for the abbreviated path.
Note
After your first beacon: explore Kali for AD enumeration tooling, Cyber Ranges for cyber range routing, and Cost Management for stop-vs-destroy patterns. Stuck anywhere along the way? Troubleshooting.
[ Operator ]
Browser / MobaXterm
|
HTTPS :443
|
+-----------------------------+-------------------------------+
| TeamServer VPC (10.50.0.0/16) |
| guacamole Elastic IP: <Public IP> |
| | |
| +-- RDP / SSH --> windows kali (workstations) |
| +-- SSH --------> mythic sliver havoc (C2) |
| ( no public IPs ) |
+-----------------------------+-------------------------------+
|
VPC Peering: 10.50.0.0/16 <-> 10.60.0.0/16
|
+-----------------------------+-------------------------------+
| Redirector VPC (10.60.0.0/16) |
| redirector Elastic IP: <Public IP> |
| Apache :80/:443 (X-Request-ID + URI validation) |
+-----------------------------+-------------------------------+
^
|
Public Internet
|
[ Targets / Implants ]
The lab uses two peered VPCs. The Teamserver VPC holds Mythic / Sliver / Havoc / Guacamole / Windows / Kali. The Redirector VPC holds the public-facing redirector. Only the Guacamole portal and the redirector hold public IPs. Everything else is reachable only through Guacamole.
See Deployment Mode Architecture for the full diagram, traffic flow, and choosing between Direct Access (Let's Encrypt + domain) and Tunneled Access (cyber range via OpenVPN). See Lab Inventory for the host-by-host table.
| Framework | Style | Web UI | First-beacon walkthrough |
|---|---|---|---|
| Mythic | Modular, multi-operator, web-driven | Yes (port 7443 from Windows op) | Mythic |
| Sliver | CLI console, BishopFox | No (CLI only) | Sliver |
| Havoc | GUI client (Katana), evasion-focused C demons | Qt client over Guacamole VNC | Havoc |
All three sit behind the redirector with header validation and URI-prefix routing. See Redirector for the security model.
- Windows: Windows Server 2022 staging workstation. Pre-installed with Chromium, VS Code, MobaXterm (SSH bookmarks for every lab Linux host), and 7-Zip. Central operator hub for browsing the Mythic UI, shuttling payloads between hosts, and running Windows-side tooling. Access via Guacamole RDP.
-
Kali: Headless or GUI Kali Linux with a curated 22-package AD enumeration + attack lineup behind a single command (
sudo install-kali-tools). Proxychains via C2 beacon documented for Direct Access enumeration.
If you're working through a cyber range (Hack Smarter, HackTheBox, OffSec Portal, VulnLab, and others), the redirector can act as your OpenVPN gateway and route traffic from the entire internal lab to the target network. Jump straight to Cyber Ranges or read the full OpenVPN Tunnel Environments page.
Troubleshooting, connectivity checks, component health, fixes for the failure modes that actually come up (Mythic SSL cert, Sliver missing, Havoc build failed, agent not calling back, Marketplace OptInRequired, VPC limits, etc.).
The current instance mix runs at roughly $0.27/hr. The recommended pattern is to stop instances at the end of each session and run terraform destroy before any break of three or more days. At ~10 hrs/week of active study, costs land around $15-20/mo. Left running 24/7, costs reach roughly $200/mo. Set a CloudWatch billing alarm before your first deploy. See Cost Management for the full breakdown.
Pages are organized around what you're trying to do, not around the codebase layout. Most assume you have a running redStack deployment and are looking for a specific operation. They are not tutorials. That is what the deployment pages are for.
Cross-page links use [[Page-Name]] syntax. Image placeholders are scattered through pages where a screenshot would help, we fill these in over time. If you've taken a useful screenshot of a redStack workflow, contributions welcome via the wiki repo.
← Previous: [redStack on GitHub](https://github.com/BaddKharma/redStack) | Next: Quick Start →
“Security is a process, not a product.”
Bruce Schneier, Secrets and Lies (2000)