CRTO
Contents · 10
Intro
Last week I passed the CRTO exam, and I have to say it was a really pleasant experience, both the certification itself and the course in general. It took me 6 months, mainly because I knew absolutely nothing about Active Directory before I started. I went in completely from zero.
Zero to hero
Like I said, at the beginning of the course I knew basically nothing about Active Directory. The only experience I had was pentesting Linux boxes on platforms like Hack The Box. Actually, the reason I decided to do CRTO was that it bugged me that I couldn't run a pentest or a red team engagement on Windows machines.
I have to say it got me hooked, and I plan on going deeper into Active Directory from here.
Even though the CRTO site says the course is meant for beginners with no experience, I think it's best to come in with a pentesting foundation, ideally with an exam like CPTS or OSCP behind you. I had the pentesting basics, but to fill in Active Directory I did the Introduction to Active Directory module on Hack The Box. And when I got to the Kerberos part of the course, I found a great YouTube playlist from Compass Security.
CRTO benefits
CRTO is my first certification, so I'm comparing from a pretty abstract point of view. Even so, I think these are the things that make it worth doing:
- The exam is included in the price of the course - you just buy the course and after a week the exam unlocks automatically. No extra charges.
- Labs mixed into the material - since the exam is practical, it's great that you can immediately try out how something works right after covering it. It teaches you to solve the same kind of problems you'll run into on the exam.
- Unlimited exam attempts - this does a great job of killing the stress of a financial penalty when an attempt doesn't work out.
- Unlimited labs - no extra fees for lab hours. Once you're done with a lab, you just wait 24 hours and you can practice again.
- PPP support - in countries where the currency doesn't have as much global purchasing power, CRTO is discounted. For the Czech Republic it's 40%.
The course
What does the course offer?
The course offers the following 24 chapters, 17 of which are aimed directly at AD tradecraft:
- Getting started
- Law and compliance
- Malware essentials
- Cobalt Strike primer
- Defense evasion
- Initial access
- Persistence
- Post-exploitation
- Privilege escalation
- Elevated persistence
- Credential access
- User impersonation
- Discovery
- Lateral movement
- Pivoting
- Kerberos
- Microsoft SQL Server
- Domain dominance
- Active Directory Certificate Services
- Forest and domain trusts
- AppLocker
- Reporting
- Course completion
- Final exam
I'm glad that topics like Microsoft SQL Server and Kerberos went into real depth. The course covers everything you need to know for the exam, but for a broader theoretical base it's good to look elsewhere too. Even though the course explains things clearly, it pays off to see the topic from more than one side.
Getting through the course took me 6 months at 2 hours a day. That's a lot compared to the average, but the way I see it, there's nowhere to rush, and since I want to keep going with AD, I'd say I ended up overprepared rather than the opposite.
While going through the course, I think two things matter:
- Take detailed notes - during the real exam they're priceless.
- Do the labs properly - it's the only place in the course where you can actually train hands-on experience.
My take on the course
I think the course is great, and not just because of the explanations. It shows several ways to do something, and above all it mixes practice and theory in an ideal ratio. Rasta Mouse is a really good instructor, and if there's something you don't understand, there's a great community on Discord where people who've already been through the course will help you out.
The exam
You get 24 hours for the exam, which you can spread out over 7 days. There's plenty of time, and that's on purpose, the exam isn't measuring speed.
There's one thing you need to understand right at the start: reaching the objective isn't enough, you have to reach it the way it would happen in a real engagement. The environment has defenses and they behave like defenses in production. If you shoot your way to the goal in a way that would have the defenders out of their chairs within the first hour, technically you're at the objective, but in reality you would have blown the engagement. This gets graded, and it's exactly the part where you can fail even with the objective done.
Which, by the way, is what happened to me.
First attempt
I went into the first attempt assuming I wouldn't pass.
Nowhere does it say the first attempt has to be the real one, and since the attempts are unlimited (see benefit number 3 above), it seemed smarter to first get a feel for what the exam actually looks like before going at it for real. I wanted to see the environment, the pace, and how my notes hold up under pressure.
I reached the objective. I didn't pass, because my OPSEC along the way wasn't good enough.
And looking back, that's the most useful thing I took away from the whole exam. If I had treated the first attempt as the real one, it would have ended the same way, I just would have gotten frustration out of it instead of data. This way I knew exactly where my gaps were, and I could work through the second attempt focusing mainly on how I get to the goal, not whether I get there at all.
Second attempt
The second time around it worked out.
The difference wasn't that I knew something new. It was that at every step I was thinking about how it looks from the defender's side, what I'm leaving behind, what shows up in the logs, and whether there's a quieter way to get to the same result. That's the whole difference between "I got there" and "I got there as an operator".
And I have to say, the road was worth it:
What's next?
Right now I'm planning to take about a month off and properly learn C. Out of all of CRTO, defense evasion was what caught my interest the most, so that's the direction I want to move in, combining low level and red teaming.
After that month I plan to start preparing for CPTS, to fill in the gaps and get a broader overview. I do have a pentesting foundation from various blogs and YouTube videos, but I'd like to tie that experience together and fill in whatever I'm missing.
And of course I'll keep posting articles here once a month like always :).