redStack - Terraform-deployed red team operator lab on AWS: M

项目说明

<!-- markdownlint-disable MD001 MD012 MD013 MD028 MD033 MD036 MD040 MD051 MD060 -->
<!-- Lint suppressions: GFM features (alerts, inline HTML, anchor slugs) and table style. -->
<!-- Documented rationale lives at assets/markdownlint.jsonc. -->

redStack

!redStack Banner

<p align="center"><strong>Attending DEF CON 34?</strong> <a href=" here</a> to see presentation times and the prerequisites needed for the workshop.</p>

<p align="center">
<img src=" alt="DEF CON 34">
<a href=" src=" alt="Ad "></a>
<a href=" src=" alt="Red Team "></a>
<a href=" src=" alt="Noob "></a>
<a href=" src=" alt="Session Docs &amp; Prereqs"></a>
</p>

> A red-team operator stack on AWS, up in ~45 minutes: three C2 frameworks (Mythic, Sliver, Adaptix), an Apache redirector, Kali and Windows workstations, and a Guacamole portal, across two peered VPCs with header + URI gating and scanner blocking. Run it two ways: Direct Access against your own self-hosted cyber range, or Tunneled Access o into a hosted training platform, Hack Smarter Labs, Hack The Box, OffSec Proving Grounds/Labs, , or any platform that provides an .ovpn.

> [!TIP]
> redStack now has a pro successor: redStackPRO.
> It is a web canvas that composes red team infrastructure and cyber ranges as a pro topology, then compiles that topology to a complete, runnable directory of Terraform and Ansible you run yourself. GCP and AWS are tested end to end; Azure, Proxmox, and ESXi are on the roadmap. Built and maintained under devZero Security. See redstackpro.com.

📖 Full documentation lives in the redStack Wiki →

The wiki is the de facto operator handbook. This README is a thin landing page so you can find your way in. E you need to deploy, , run the C2 walkthroughs, troubleshoot, or extend the lab li.

---

> [!IMPORTANT]
> redStack is not a tutorial on how to use C2 frameworks. It's an en that removes the infrastructure hurdle so you can focus on learning. This lab is strictly for authorized training and lab en only (cyber ranges, self-hosted en, personal lab VMs, etc.). Not intended for use in real-world engagements or against targets you do not own and ha written permission to test.

> [!CAUTION]
> AWS TOS: use at your own risk. Hosting C2 infrastructure on AWS may raise concerns under the AWS Acceptable Use Policy. Before deploying, review the AUP and submit the AWS Penetration Testing / Simulated Events request form. As long as you're using redStack exclusively for personal lab work and authorized training platforms, you're generally in the clear. To be safe, run redStack from a dedicated, single-purpose throwaway AWS account.

---

Deploy in 5 Steps

| # | What | Where |
|---|------|-------|
| 1 | First-time AWS setup (account, IAM, CLI, SSH key, Kali Marketplace subscription) | Prerequisites |
| 2 | Pick open or closed en | Deployment Modes |
| 3 | Configure tfvars and terraform apply | Deploy |
| 4 | Confirm Guacamole + Windows + internal DNS | |
| 5 | Land first beacon: pick a C2 | Mythic · Sliver · Adaptix |

Total time: ~30-60 minutes on first deploy. Subsequent deploys: ~20-30 minutes.

Returning operator? Quick-Start is the abbre path.

---

What Gets Deployed

Seven EC2 instances across two peered VPCs. Two ha Elastic IPs (Guacamole portal + redirector); e else is reachable only through Guacamole.

| Hostname | Role | Public IP |
|----------|------|-----------|
| guac | Guacamole portal (web SSH/RDP) | Yes |
| redirector | Apache reverse proxy + C2 frontend | EIP exposes 80/443 only |
| mythic | Mythic C2 server | No |
| sliver | Sliver C2 server | No |
| adaptix | Adaptix C2 teamserver (headless) | No |
| windows | Windows Server 2022 workstation | No |
| kali | Kali Linux workstation (AD enum + attack toolset) | No |

Full in and sizing details: Lab-In.
Architecture diagram: Lab-Architecture.

---

Cost

Roughly $0.27/hour of compute while running. With terraform destroy between sessions (recommended), expected monthly cost is ~$15-20/month for typical 5-10 hr/wk study cadence. Full breakdown including stop- tradeoffs: Cost-Management.

> [!CAUTION]
> Forgetting a deployed lab is the #1 cause of unexpected AWS bills. Set a CloudWatch billing alarm before your first terraform apply.

---

When Something Breaks

Troubleshooting covers the failure modes that actually come up: Mythic SSL cert, Sli, Adaptix build failed, agent not calling back, Marketplace OptInRequired, , redirect.rules download issues, Kali user rename, ssh -R binding behavior, and more.

---

Wiki Page Map

Getting started: Home · Quick-Start · Prerequisites · Deployment Modes · Deploy · · First-Run

Reference: Lab-Architecture · Lab-In · Guacamole · Cost-Management

C2 backends: Mythic · Sliver · Adaptix

Workstations: Windows · Kali

Infrastructure: Guacamole · Redirector · Open

Help: Troubleshooting

---

Repository Layout

The Terraform code is one file per role: Sliver, Adaptix, Redirector, and Kali each own their own .tf; Mythic / Guacamole / Windows live in main.tf alongside the shared . Setup scripts in terraform/setup_scripts/ are rendered into user-data at apply time.

Workflow:

The SSH private key (rs-rsa-key.pem) lives at the repo root; terraform.tfvars.example references it as ../rs-rsa-key.pem from inside terraform/.

---

Acknowledgments

Thanks to P3n3tr@t0r, Cr4ck3rj4ck5, cyberbandit74, and wcmocha for testing redStack and pro feedback that shaped the platform and its documentation.

---

License

MIT License with Commons Clause. Free to use, deploy, modify, and share for any purpose.
Commercial use (selling redStack or building a paid product or service on it) requires
written permission.

For commercial licensing: . See LICENSE for full terms.

项目信息

开发语言：Shell

Star 数：286

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Terraform-deployed red team operator lab on AWS: Mythic, Sliver, and Adaptix C2 behind a production-style Apache redirector, with Kali/Windows hosts and a Guacamole portal. Built for authorized training and self-hosted cyber ranges.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。