Listen to this Post
Introduction:
Red team training requires realistic, isolated environments that mimic corporate networks without breaking the bank. redStack is a self-contained Boot-to-Breach lab on AWS that deploys a complete red-team ecosystem—including three C2 frameworks, a redirector, attacker and target workstations, and a secure access portal—in roughly 45 minutes. This article extracts the core architecture, security controls, and deployment steps so you can spin up your own cloud-based cyber range for hands-on adversary simulation.
Learning Objectives:
- Deploy a production-grade red team lab on AWS using preconfigured modules (Mythic, Sliver, Havoc, Kali, Windows).
- Implement defensive gating mechanisms (header + URI filtering, scanner blocking) to protect the lab from unauthorized access.
- Route attacker traffic through an Apache redirector and access the environment via Guacamole or OpenVPN.
You Should Know:
1. Deploying redStack: AWS Infrastructure as Code
redStack leverages AWS CloudFormation or Terraform (implied by the “self-contained” claim). The stack provisions two peered VPCs—one for the red team (C2 servers, Kali, redirector) and one for the target Windows workstation. A Guacamole portal provides browser-based RDP/SSH access.
Step-by-step guide to replicate the core deployment:
- Clone the redStack repository (link from post: https://lnkd.in/g4BTQ-7v, expand using a tool like `curl -I` or visit the original GitHub: https://github.com/BaddK/redStack – inferred from credit).
- Install AWS CLI and configure credentials:
aws configure
- Deploy using Terraform (example):
terraform init terraform plan -var="key_name=your-key" terraform apply -auto-approve
- After deployment, note the outputs: Guacamole URL, OpenVPN config, Kali public IP, and Windows private IP.
- SSH into Kali using the provisioned key:
ssh -i your-key.pem kali@<kali-public-ip>
- Verify C2 frameworks are running:
systemctl status mythic sliver havoc
Windows users can use PuTTY or WSL with the same SSH command. For Guacamole, simply open the provided HTTPS URL and log in with default credentials (change immediately).
2. Understanding the Three C2 Frameworks
redStack integrates Mythic (Python/Go agent), Sliver (gRPC-based, cross-platform), and Havoc (C++/Python, Demon agent). Each serves a different tradecraft and evasion style.
Step-by-step to connect to each C2 from Kali:
- Mythic: Access web UI at `https://
:7443` (default credentials in deployment logs). Use `mythic-cli` to start agents. - Sliver: Run `sliver` in terminal, then `multiplayer` for teamserver mode. Generate an implant:
generate --http <redirector-ip> --save /tmp/implant.exe
- Havoc: Navigate to `/opt/havoc/client` and run
./havoc-client. Connect to teamserver at<kali-ip>:40056.
To verify listener configuration on the Apache redirector:
ssh ubuntu@<redirector-ip> sudo tail -f /var/log/apache2/access.log | grep "POST"
This shows beacon traffic routed through header/URI gating rules.
- Implementing Header + URI Gating for Scanner Blocking
redStack protects the lab by filtering incoming HTTP requests based on custom headers and URI patterns. Only requests containing a specific header (e.g., X-RedTeam-Key: <random-uuid>) or accessing a hidden URI path are forwarded to the C2 listeners. All other traffic (including scanners like Shodan, Censys) receives a benign 404 page.
Step-by-step to configure similar gating on Apache:
- On the redirector, edit the virtual host config:
sudo nano /etc/apache2/sites-available/000-default.conf
- Add conditional logic:
SetEnvIf X-RedTeam-Key "supersecret123" allow_red SetEnvIf Request_URI "^/api/v3/status" allow_red <Location /> Require env allow_red ErrorDocument 403 "Not Found" </Location>
- Reload Apache:
sudo systemctl reload apache2
- Test from Kali:
curl -H "X-RedTeam-Key: supersecret123" http://<redirector-ip>/ | head
Without the header, you should receive a 404 or generic response.
For Windows red teamers, use PowerShell:
Invoke-WebRequest -Uri "http://<redirector-ip>/" -Headers @{"X-RedTeam-Key"="supersecret123"}
4. Optional OpenVPN Routing for Cyber Ranges
redStack supports OpenVPN to route attacker traffic directly into the peered VPCs, enabling low-level network attacks (ARP spoofing, NBNS poisoning) that require layer-2 adjacency.
Step-by-step to connect via OpenVPN:
- Download the `.ovpn` config from the deployment outputs or generate on the OpenVPN server:
ssh openvpn@<vpn-server-ip> sudo cat /etc/openvpn/client.ovpn
- On your local machine (Linux/macOS/WSL), install OpenVPN:
sudo apt install openvpn -y Debian/Ubuntu
- Connect:
sudo openvpn --config client.ovpn
- Verify route to Windows workstation (private IP, e.g., 10.0.2.10):
ping 10.0.2.10
- Use Impacket or CrackMapExec from your local Kali (now routed through VPN):
crackmapexec smb 10.0.2.10 -u administrator -p 'P@ssw0rd'
Windows OpenVPN GUI users: import the .ovpn file, right-click and connect. Use `tracert 10.0.2.10` to confirm hops go through the VPN tunnel.
5. Hardening the Boot-to-Breach Lab
To prevent accidental exposure or abuse, redStack includes scanner blocking (as above) and VPC isolation. Additional hardening steps you should apply:
- Restrict Guacamole access by IP using an AWS WAF or security group:
aws ec2 authorize-security-group-ingress --group-id <guac-sg> --protocol tcp --port 443 --cidr <your-ip>/32
- Rotate all default credentials (Mythic, Guacamole, Windows local admin) immediately after deployment.
- Enable CloudTrail and VPC Flow Logs for audit:
aws logs create-log-group --log-group-name redStack-flow-logs aws ec2 create-flow-logs --resource-type VPC --resource-ids <vpc-id> --traffic-type ALL --log-destination-type cloud-watch-logs --log-group-name redStack-flow-logs
- For Linux persistence simulation, disable SSH password auth and use only keys:
sudo sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config sudo systemctl restart sshd
Windows hardening (target machine): Disable SMBv1, enable Defender real-time protection (if allowed by exercise rules), and apply AppLocker policies via PowerShell:
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" SMB1 -Type DWORD -Value 0 -Force
What Undercode Say:
- Key Takeaway 1: redStack democratizes advanced red team training by packaging multiple C2 frameworks and defensive gating into an automated cloud deployment.
- Key Takeaway 2: Header/URI gating and scanner blocking are essential for public cloud labs—without them, your infrastructure will be compromised by internet scanners within hours.
- Analysis: The combination of Guacamole + OpenVPN provides flexible access control: browser-based for quick tasks, full VPN for network-level attacks. The 45-minute deployment time is realistic if you have AWS quotas and pre-existing key pairs. However, note that the Windows workstation may require manual post-deployment steps (e.g., joining a domain, disabling Windows Firewall for certain attacks). The use of three C2 frameworks is educational but could be overkill; most teams will default to Sliver for its stability and Mythic for advanced evasion. From a defensive perspective, redStack also serves as a blue team detection lab—you can point your SIEM at the VPC Flow Logs and Apache logs to generate attack telemetry.
Prediction:
As cloud costs drop and Infrastructure-as-Code matures, Boot-to-Breach labs like redStack will replace physical and local VM-based training. Expect future iterations to incorporate serverless redirectors (Lambda@Edge), ephemeral Windows environments that reset automatically, and integrated LLM-based coaching agents that guide red teamers through attack chains. The biggest challenge will be preventing abuse—attackers will inevitably scan for publicly exposed redStack deployments and use them as jump boxes. To counter this, providers will likely require mandatory MFA for Guacamole and automated instance termination after a set time. redStack sets a precedent for “training as code,” and we predict that certification bodies (OSCP, CRTO) will soon offer cloud-based labs as the default examination environment.
▶️ Related Video (82% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: 0xfrost Redstack – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
