What this lab is
Zephyr is a Red Team Operator Level I Pro Lab from HackTheBox that simulates a full-size, real-world enterprise environment. This is not "compromise one machine" — it is compromising an entire enterprise, start to finish.
What sets Zephyr apart from an ordinary lab is the complexity of the network: two forests plus a child domain, and dozens of machines you have to navigate between.
Environment overview
The lab is built around three main domains:
Domain I — the entry point into the main organisation. Web server, mail server and the usual Windows infrastructure.
Domain II — a second forest connected to painters.htb through a bidirectional forest trust, standing in for an acquired company. Monitoring systems, database servers and a certificate authority.
Domain III — a child domain, holding the internal infrastructure buried deepest in the lab.
Techniques you will need
Zephyr genuinely makes you work across several levels. Going through the motions will not get you there.
Initial access & web: file upload
Active Directory attacks: Kerberoasting, Pass-the-Hash, delegation, RBCD, Shadow Credentials, DCSync and local enumeration
Privilege escalation: ACL abuse, service misconfiguration, role abuse
Lateral movement: WinRM, credential reuse across machines, SQL Server linked server attacks and Chrome password extraction
Advanced Kerberos: Golden Ticket
Infrastructure: double pivot across multiple network segments
What it was actually like
What makes Zephyr stand out is that every technique connects to the next. Nothing is isolated — a credential from the first phase is what gets you access in the phase after it, like dominoes going over one at a time.
The hardest part for me:
Inter-forest Golden Ticket was a technique I had never touched before. Understanding how SID filtering behaves differently across a forest trust versus a parent-child trust took real study time — but once it landed, it clicked immediately.
Understanding how Kerberos actually works — forging tickets, requesting tickets — came up constantly, along with the MS-SQL weaknesses that carry you across into the next domain.
Minor issues:
Kerberos tickets occasionally needed several attempts before they worked, which I suspect comes down to the number of concurrent players. It did not spoil the experience.
Who is it for?
Zephyr suits you if:
- You have AD basics behind you (AD fundamentals, Kerberoasting, Pass-the-Hash)
- You want to understand a real enterprise environment, not a single machine
- You are preparing for OSCP, CRTO or PNPT
- You want exposure to advanced Kerberos attacks
If you are new to AD, do Starting Point or some easy machines first, then come back to Zephyr.
What I took away
Before Zephyr I thought Kerberos was a handful of specific tricks and not that hard. Working through it showed me how much I still did not know — and that was exactly the challenge worth having.
This is the most rewarding lab I have done. A full-system AD lab like this is hard to find. If this is your kind of thing, give it a go.
| munpao59