Background
I had just passed TryHackMe's PT1 certificate and got the chance to start looking into Operational Technology (OT), so I went hunting for a lab to learn on. I found some OT rooms on HTB, worked through several of the free ones and enjoyed them — which is how I ended up looking at HTB's OT Pro Lab, a simulation of the Sogard Brewing Co plant. I wanted to play it and learn from it.
This write-up is here in case it helps anyone who is considering the lab make up their mind.
What this lab is
Alchemy is a HackTheBox Pro Lab simulating a complete Industrial Control System (ICS/OT) environment — 16 machines and 21 flags spread across both the IT and the OT network.
What you are up against:
- IT — website, Active Directory, printer
- OT — Modbus, HMI, PLC
The attack, broadly
IT
You start by enumerating the website looking for a way in, run into Active Directory and have to work out how to keep going until you reach the innermost zone. Pivoting — and double pivoting — is essential here. Only after that do you find the way through into OT.
ENUM IS KEY. Collect every detail.
OT
Once you are inside the OT zone there are four areas — 100, 200, 300 and 400. You have to understand how each one works and read up on it to analyse the process before you can find the weakness.
Read the Structured Text and look at the HMI to see what the task wants — there is a mission in there.
Every HMI is different. Read the documentation properly.
What you will learn — Modbus in depth
- Enumeration of IT and OT networks
- Exploiting misconfigurations
- Lateral movement
- Privilege escalation
- Tunnelling and pivoting
- Documentation analysis
- Modbus network analysis
- Web application attacks
- In-depth understanding of the Modbus protocol
- Structured Text PLC code review
- Dynamic analysis of ladder logic
All of it sits at HTB's Red Team Operator Level 2.
Verdict
Alchemy Pro Lab is a serious challenge for anyone who wants to properly understand OT security — not the theory, but hands-on work with real protocols, real tools and vulnerabilities you would genuinely run into.
If you are looking for a lab to practise ICS/OT security on, this is the one I would recommend. Excellent value.
My personal rating: medium-to-hard. If you are not used to OT yet, it will be hard.
Certificate
21 flags and 16 machines in total — finish it and you get a rather nice certificate too.
Good luck and happy hacking
Written by Sun — Munpao59