RastaLabs Hack The Box ProLab Review

After completing the CRTO certification from Zero Point Security, I felt the need to test the knowledge I had gained by applying it in a specific context. Among the many (and valid) options available, I decided to dive into the Rastalabs ProLab from Hack The Box. This lab allowed me, at the cost of a bit of sanity, to experiment with my skills and turned out to be a great opportunity to learn something new.

What is RastaLabs

The objective of the lab is to attack a full-fledged Active Directory corporate network, starting as an external attacker. The network includes various software and hardware solutions typical of enterprise environments, segregated subnets, and active mitigations such as Windows Defender and AppLocker. Therefore, it is not an assumed breach scenario, meaning you must first gain an initial foothold in the internal network through phishing techniques. Once inside the domain network, you need to find ways to perform lateral movement and privilege escalation until you fully compromise the domain. However, the final certificate is not awarded upon obtaining Domain Admin privileges; instead, you must capture 100% of the flags. Additionally, the lab does not lack more CTF-style challenges covering topics such as binary exploitation and cryptography.

As reported on the official page:

“RastaLabs is a virtual Red Team simulation environment, designed to be attacked as a means of learning and honing your engagement skills. The focus of the lab is operating within a Windows Active Directory environment where players must gain a foothold, elevate their privilege, be persistent, and move laterally to reach the goal of Domain Admin.”

The topics covered include the following:

• Phishing
• Situational Awareness
• Local Privilege Escalation
• Active Directory Enumeration and Exploitation
• Evading endpoint protections
• Lateral Movement and Pivoting
• Exploit Development
• Password Cracking and Credential Theft
• Token Impersonation and Pass-The-Hash
• Creative Thinking

Advice Before Starting the Lab

1. The lab is not beginner-friendly – It requires prior knowledge of Active Directory exploitation. If you don’t have a solid foundation, I recommend starting with a course on Active Directory before attempting the lab. Courses such as CRTO from Zero Point Security (my review here) or specific HTB modules on Active Directory provide a great starting point.
2. Be familiar with your c2 – Although using a c2 is not strictly necessary to complete the lab, I highly recommend it, as it will make your life easier. I used Sliver since I was already familiar with it, but there are many other valid alternatives. If you have never worked with a c2 before, it would be wise to experiment a bit—either by studying the official documentation of your chosen c2 or by taking a relevant course, such as CRTO or HTB’s c2 module.
3. Test with Defender enabled – Take some time to perform tests with Windows Defender running locally. If you don’t already have a home lab, consider setting one up. Try developing different loaders for your beacons—they will definitely come in handy later.
4. Improve your binary exploitation skills – If you are not a CTF player, spend some time working on binary exploitation challenges. Get comfortable with well-known techniques such as buffer overflow and Return-Oriented Programming (ROP).

Advice to Follow During the Lab

1. Don’t lose your mind – The lab is a complex environment that will make you question your decisions more than once. Stalemates are always around the corner, and it’s easy to lose track of what to do next. Take some time to relax and reflect on what you have and what you could do with it. If possible, go through the lab with a friend (as I did). Sometimes, all you need is a fresh perspective—the solution might be simpler than what you were thinking. Moreover, this will make the experience more enjoyable and help you stay sane (or at least go crazy in good company).
2. Take good notes – If possible, structure them hierarchically so that you can quickly find the information you gathered during enumeration. You can use tools such as Obsidian or CherryTree.
3. Create a checklist – Make a structured checklist for both local and domain enumeration, and apply it consistently to every machine and user you gain access to.
4. Don’t think of the lab as a static environment – It is designed to be as realistic as possible, meaning that users inside the network will perform actions that you can potentially exploit while you are inside.
5. Check the missing flags – If you have obtained Domain Admin but still haven’t collected all the flags (which is very likely), take a closer look at the missing ones. Their names and locations are not random—they often hint at areas you should investigate further.

Pros

• The lab offers a really good and challenging vulnerable Active Directory environment – You can assess and experiment with your skills while learning new techniques.
• The lab encourages you to build your own toolkit – This toolkit can be reused in other Red Team scenarios.

Cons

• Very time-consuming – If you can’t find the time to dedicate to the lab, it might not be the right moment to start. Most tasks in the lab are very time-consuming (from enumeration to exploitation). Moreover, if your goal is to complete it in the shortest time possible, be prepared for a heavy dose of stress.
• The lab is shared with other players – This means you might encounter payloads or malfunctions generated by other users. However, I was only stopped a couple of times due to issues, and the lab is reset once a day.

The Price

At the time I took the lab, RastaLabs was accessible through the Hack The Box ProLabs subscription, which costs €44 monthly or €440 yearly. Obviously, the time required to complete this lab depends on your skills and the amount of time you can dedicate each day. Completing the lab in one month is possible, but it might not be the best choice for your sanity.

Final Thoughts

In conclusion, the experience with RastaLabs was very productive. It provided a great challenge that led me to experiment and learn new things. I recommend this lab to anyone who wants to apply their knowledge in an Active Directory environment with active mitigations, provided they have enough time to dedicate to the lab.