My Experience as a Certified Red Team Operator
As a newly certified Red Team Operator, I wanted to share my experiences preparing for and taking the CRTO certification exam. Overall, the process took me over four months of dedicated study, and the exam itself was a grueling 17-hour marathon. However, all of the hard work and dedication paid off in the end, as I was able to achieve a score of 7 out of 8 flags.
Throughout my preparation, I found it helpful to use a variety of study strategies. I started by reviewing the CRTO syllabus and familiarizing myself with the content covered on the exam. I also spent a lot of time practicing with online practice exams and lab environments, which helped me get a feel for the types of challenges I would face on the actual exam.
One thing that I found particularly helpful was working through practice questions and scenarios with other people. Collaborating with others allowed me to see different perspectives and approaches to solving problems, and it also helped to keep me motivated and accountable.
Of course, no amount of preparation can completely eliminate the challenges of taking a certification exam. The CRTO exam was no exception, and I faced a number of obstacles along the way. However, I was able to overcome these challenges through persistence and determination.
For anyone considering pursuing the CRTO certification, my advice would be to start studying well in advance and to make use of all the resources available. Practice exams and lab environments are particularly valuable, as they can help you get a feel for the types of challenges you’ll face on the actual exam. And don’t be afraid to ask for help or seek guidance from others who have gone through the process – it can make all the difference.
In the end, the hard work and dedication required to earn the CRTO certification is well worth it. Not only does it demonstrate a high level of expertise in red teaming, but it also opens up new career opportunities and can lead to increased credibility and respect within the industry. So, if you’re considering pursuing the CRTO certification, I encourage you to go for it – the rewards are well worth the effort.
Cobalt-Strike
One of the highlights of the CRTO lab environment was the inclusion of the Cobalt Strike (CS) toolset. For those unfamiliar with CS, it is a highly sought-after tool used in red teaming operations. As someone who has been eager to use this tool for years, I was thrilled to finally have the opportunity to work with it during my CRTO preparation.
In addition to providing hands-on experience with CS, the Rasta content also covers configuring the tool to meet specific needs. This is extremely valuable for anyone looking to use CS in real-world scenarios.
It’s worth noting that, to the best of my knowledge, the CRTO exam is currently the only legal way to gain hands-on experience with CS without purchasing a license. So, for those interested in getting a taste of what this powerful tool can do, the CRTO course is a great place to start.
Exam :
The CRTO exam is a 48-hour assessment that requires students to gather 6 out of 8 flags in order to pass. This 48 hours of lab time is spread out over a 4-day window, allowing students to pause and resume the exam environment as needed. To pass the exam, students must simply submit the flags they have gathered – no additional reporting is required.
Once the exam begins, students will receive a packet containing a set of tactics, techniques, and procedures (TTPs) to emulate. In order to progress through the exam environment and collect all of the flags, students must successfully emulate these TTPs. If necessary, students can also pause the exam and return to a “pseudo-dev” environment to double-check their work.
Overall, I would describe the CRTO exam as challenging but fair. It may require students to step out of their comfort zone, but the course content provides everything they need to pass. To increase their chances of success, students should consider the following key strategies:
- Read the course and exam FAQs thoroughly. There are many questions asked on the Zero-Point Security Discord server that are already answered in these resources.
- Join the Zero-Point Security Discord server. This can be a valuable resource for connecting with other students, finding answers to questions, and staying motivated during the exam process.
- Review all course content related to Cobalt Strike and its configuration. It can also be helpful to take a look at some Malleable C2 Profiles and understand how they work.
- Have fun during the exam! The challenges within the exam can be extremely enjoyable, so start the exam with a positive attitude, get Cobalt Strike configured correctly, and start progressing through the environment. If you’ve worked your way through all of the course content and taken good notes, you should have a good experience.
My Exam:
Although it was a challenging experience, it was also the most fun I’ve had on an exam so far. I scheduled my exam for a Saturday at 9:00 AM and arrived well-prepared, with notes and a small breakfast to fuel me through the day.
However, as soon as the exam began, I realized that I had forgotten to review the course material on configuring Cobalt Strike. This caused me to panic, as I was worried that I wouldn’t even be able to complete the first step of the exam. I ended up spending most of the first day pausing the exam environment and reviewing documentation, course content, and generating my profile for Cobalt Strike.
Despite my efforts, I was still unsuccessful when I tried to resume the exam on Saturday morning. Frustrated and stressed out, I decided to take a break and go to bed. The next day, I woke up refreshed and ready to try again. This time, I approached the problem from a different angle and finally had the breakthrough I needed.
At this point, I felt confident and ready to truly begin the exam. I was able to progress through the lab environment without having to reset.
My CRTO Badge!
Closing notes:
In conclusion, I found the CRTO exam to be a refreshing change from the lengthy other exams like (Offensive Security Exams). The course material was presented in a clear and concise manner, and I actually looked forward to going through it. I would highly recommend this course to anyone interested in improving their red team skills, whether they are transitioning into a threat emulation role, looking to take their internal network pentests to the next level, or simply want to use Cobalt Strike at a lower cost. Overall, CRTO was a great learning experience, and I would definitely recommend it to others.
I appreciate you reading this blog. If you think it has been valuable, please give it a thumbs up. If you enjoy it, share with your friends and other members of your community. Stay tuned for the next blog!
GitHub : https://github.com/prashanthpulisetti
Twitter : https://twitter.com/pulisettis