Hack The Box

Pro Labs &
Endgames

Advanced red team lab environments simulating real-world enterprise networks. Multi-machine Active Directory chains, pivoting across subnets, and full domain compromise — from foothold to Domain Admin across hardened corporate infrastructure.

Pro Labs Endgames Insane Tier Red Team
Quick Stats
7
Labs
14+
Machines (avg)
Insane
Top Tier
Red Team
Focus
Pro Labs & Endgames Writeups
Endgame Insane

HTB Endgame: XEN

Complete domain compromise through Citrix VDI breakout, Kerberoasting, NetScaler PCAP analysis, password spraying, and SeBackupPrivilege abuse to extract ntds.dit from the Domain Controller. Six flags across the entire kill chain.

Pro Lab Hard

HTB Pro Lab: Dante

Red Team Operator Level I lab walkthrough. Pivoting through 14 machines across three subnets using Ligolo-ng, WordPress exploitation, LLMNR poisoning, buffer overflows, and KeePass credential extraction to achieve domain dominance.

Pro Lab Hard

HTB Pro Lab: Zephyr

Red Team Operator Level I. Assumed breach Active Directory environment starting with a standard domain user. Escalate through Kerberoasting, delegation abuse, constrained delegation, ACL attacks, and DCSync to achieve full Domain Admin compromise across a hardened enterprise network.

Pro Lab Insane

HTB Pro Lab: Offshore

Red Team Operator Level II. Advanced corporate network penetration testing requiring deep pivoting across multiple subnets, exploiting web vulnerabilities, Grafana exploitation, complex privilege escalation paths, and tunneling deep into the internal AD environment to compromise the domain.

Pro Lab Insane

HTB Pro Lab: Cybernetics

Red Team Operator Level II. Advanced Active Directory attacks across five domains including Kerberos delegation abuse, GPO exploitation, forest trust pivoting, and cross-domain compromise with 25 flags.

Pro Lab Insane

HTB Pro Lab: RastaLabs

Red Team Operator Level III. The most advanced HTB Pro Lab featuring realistic APT-style operations — Cobalt Strike C2 infrastructure, Citrix VDI exploitation, network pivoting through multiple trust boundaries, and full enterprise domain takeover with 30+ flags.

APT Lab Insane

HTB Pro Lab: APTLabs

Advanced Persistent Threat simulation environment. 18 machines across 3 AD forests — phishing initial access, Kerberoasting, RBCD, DCSync, Golden Tickets, cross-forest trust exploitation, and full domain compromise. 20 flags, 24h daily reset.