How to Play Pro Labs

Dante: A modern yet beginner-friendly Pro Lab that provides the opportunity to learn common penetration testing methodologies and gain familiarity with tools included in the Parrot OS Linux distribution. You will level up your skills in information gathering and situational awareness, exploit Windows and Linux buffer overflows, and gain familiarity with the Metasploit Framework.

Offshore: An Active Directory lab that simulates the look and feel of a real-world corporate network. It is designed to appeal to a wide variety of users, from junior-level penetration testers to seasoned testers and infosec hobbyists.

RastaLabs: Established in 2017, RastaLabs is a start-up provider of IT security and penetration testing services. Our consultants offer expertise, flexibility and extensive support before, during and after each engagement. RastaLabs is an ISO 27001 & 9001 certified organisation, committed to providing an unparalleled service in the Information Security industry. Along the way you'll cover phishing, situational awareness, local privilege escalation, Active Directory enumeration and exploitation, lateral movement and pivoting, exploit development, password cracking and credential theft, and token impersonation and pass-the-hash.

Zephyr: An intermediate-level red team simulation environment designed to be attacked to learn and hone your engagement skills and improve your Active Directory enumeration and exploitation skills. Zephyr includes a wide range of essential Active Directory flaws and misconfigurations to allow players to get a foothold in corporate environments.

Wanderer: In a post-apocalyptic wasteland, wander from machine to machine collecting vital information on the survivors who built the remaining IT infrastructure. Built to assess the depth and versatility of your skill set. You might need to perform some Digital Forensics and Incident Response (DFIR) tasks after exploiting a Machine to move forward. Aimed at intermediate red teamers, Wanderer emphasizes enumeration and constructing effective attack chains. While the individual exploits aren't highly technical, uncovering them can be quite challenging. Along the way you'll cover enumeration, SQL injection and filter evasion, web application attacks, basic WiFi attacks, and Asterisk attacks.

Ifrit: Users perform a red team engagement on Ifrit's internal network as an assumed breach scenario, with access to a VDI environment following a new security baseline rollout. Along the way you'll cover network and Active Directory enumeration, Active Directory and custom exploitation, Active Directory certificate services, lateral movement across multiple forests, bypassing EDR solutions, relay attacks, and operating covertly.

Wutai: Users perform a penetration test on Wutai Group following a domain username leak. Reach Enterprise Administrator in the wutai.vl domain against an active, basic SOC. Along the way you'll cover network and Active Directory enumeration, Active Directory and custom exploitation, Active Directory certificate services, lateral movement across multiple forests, bypassing EDR solutions, reverse engineering, and operating covertly.

POO: Professional Offensive Operations is a rising name in the cyber security world. Lately, they've been working on migrating core services and components to a state-of-the-art cluster offering cutting-edge software and hardware. Along the way you'll cover enumeration, Active Directory enumeration and attacks, lateral movement, local privilege escalation, situational awareness, and web application enumeration and attacks.

Unintended: Evaluate Unintended's newly migrated Active Directory infrastructure. Determine whether an attacker can move from initial access to full domain control. Along the way you'll cover Active Directory backup enumeration, enumerating Active Directory environments in Linux-integrated infrastructures, lateral movement, network pivoting, Linux privilege escalation, backup forensics, and web application attacks.

Shinra: Shinra is an electric power company with a fairly strong security stance. Your mission is to infiltrate the company as an external attacker in a red team engagement. Shinra runs a 24/7 SOC with EDR on all endpoints. Along the way you'll cover network and Active Directory enumeration, Active Directory and custom exploitation, Active Directory certificate services, lateral movement across multiple forests, phishing attacks, attacking CI/CD infrastructure, bypassing EDR solutions, backdooring applications, relay attacks, and operating covertly.

You can find the entry point listed on the upper left of the Pro Labs page, or within the Introduction section of the Flag List.

If no entry point is provided, your best approach is to thoroughly scan the network.

If you are unsure of the subnet that requires scanning, type the route command into your terminal after you have successfully deployed your OpenVPN connection. This command will output the specific subnet assigned to the tunnel interface.

Introductions: Each Pro Lab features an Introduction located at the top of the Flag List. Clicking on the Introduction will provide you with a brief description of the Pro Lab's overarching concept and the assigned Entry Point.

Progress: The Progress list shows you the available flags formatted with nicknames. Each flag's nickname provides a small hint about that specific flag. We recommend that you do not look too deeply into the meaning of the nickname until you actually reach that stage; otherwise, you risk getting lost in semantics.

Good practice: Providing a detailed explanation of what went wrong, such as specifying which Machine crashed, the exact action you took prior to the crash, or any specific error messages you received.

Poor practice: Submitting a blank request or a vague comment like "it is broken" without any context. Our team needs detailed information to effectively investigate and authorize the redeployment.

Example scenario: If you choose to cancel a monthly subscription on October 10th, but your current billing cycle does not end until October 25th, you will retain full access to the Pro Labs until October 25th. You will need to manually resubscribe at a later time if you wish to use the lab again.