Red Team Ops II (CRTL) Review

Pleased with my experience with the RTO I certification, I decided to move forward with RTO II. In this post, I’ll share my personal experience with this certification.

Introduction

Red Team Ops II is a course created by RastaMouse and offered through ZeroPointSecurity. Building on the knowledge gained in the RTO I course, RTO II goes deeper into red team operations, with a particular focus on research-oriented aspects. It introduces topics such as offensive tool development, advanced evasion techniques, and the creation of a custom operational environment.

Here is the official course description:

“RTO II is a continuation (not a replacement) of Red Team Ops and aims to build on its foundation.  The primary focus of this course is to provide more advanced OPSEC tactics and defence bypass strategies.

Students will:

Learn how to build secure and resilient on-premise C2 infrastructure, using public cloud redirectors and HTTPS.

Go deeper into C++ and C# programming with Windows APIs, leading into writing custom tooling for a variety of offensive actions including process injection, PPID spoofing, and command line spoofing.

Learn how to clean up memory indicators of Cobalt Strike’s Beacon, and leverage in-memory obfuscation to bypass some memory scanning techniques.

Employ strategies for enumerating, identifying, and exploiting weaknesses in Attack Surface Reduction and Windows Defender Application Control technologies.

Bypass AV and EDR agents by circumventing ETW, userland hooking, and kernel callbacks”

The course

The course is structured into specific lessons grouped under broader topics, all accessible via the web portal. The lessons are entirely text-based and enriched with examples, code snippets, and screenshots.

The main topics covered in the course are:

• C2 Infrastructure
• Windows APIs
• Process Injection
• Defence Evasion
• Attack Surface Reduction
• Windows Defender Application Control
• Protected Processes
• EDR Evasion

The course covers a wide range of topics, with a strong emphasis on EDR evasion and offensive development. In fact, RTO II is heavily programming-oriented, and you’ll frequently be required to write code, mostly in C++ and C#.

The lessons are generally concise but packed with insights. Occasionally, certain parts may feel a bit underexplored, but I believe this is intentional and aligns with the spirit of the course: encouraging independent research. While RTO I guides you step by step with clear objectives, RTO II is more focused on research and experimentation, often leaving you to look for information on your own and try out things you find online

Because of this, despite being shorter compared to RTO I, RTO II required significantly more preparation time (though that’s very personal). Not everything you explore independently will be directly relevant to the exam, but it presents a great opportunity to experiment and learn new things hands-on.

In general, RTO II doesn’t include specific goals in each lesson, and it’s more like a set of techniques, suggestions, and best practices. It’s up to the student to connect the dots and build their own operational environment.

How I approached the course

The lessons are supported by excellent labs that allow you to test the topics covered in each module.

I also found it very useful to build my own homelab, it allowed me to experiment freely at any time without relying exclusively on the official course labs. Of course, not everything covered in the course can be easily replicated in a personal environment (at least not quickly), but many projects, especially the ones where you write code, can be done more slowly and in your own time.

I spent about 80 hours working on the course labs, and many more in my own homelab definitely going over 100 hours total. The course gives a lot of interesting ideas that you can explore more, if you have the time. For instance, I found it really useful to rewrite several payloads in C# in addition to C++, and to experiment with techniques like direct and indirect syscalls within my own code.

My general recommendation would be to take your time, if possible, to conduct some personal research and experiment as much as you can. In my case, I tried to test as much as possible, though I had to rush a bit due to the course being moved to a new domain soon.

The exam

As written on the official page:

” The Red Team Ops II examination is a practical CTF-style event driven by Snap Labs.  […] The objective is to compromise the domain, bypass defenses, and collect the flags.   There are 6 flags, which must be submitted on the scoreboard as proof of progress.  Students must submit at least 5/6 flags to pass. Students have a total of 96 hours runtime within an 8-day window.  The exam VMs can be stopped at any time to preserve runtime.  If enough flags have been collected by the end of the 8-day exam period, the Red Team Lead badge will be awarded via email.”

My exam

I scheduled the exam at 10:30 AM and finished it around 8:00 PM. I completed the challenge by submitting all 6 out of 6 flags, with 88.1 hours left. I spent about 8 hours total on the exam, all in one day, with one break (two sessions in total).

Just like in RTO I, the available time is very generous and gives you enough flexibility to manage unexpected problems. I had just one technical issue during the exam, where the lab environment was blocking a technique I needed to use, but after I contacted RastaMouse on Discord, he solved it almost immediately.

The setup of your own environment is a critical step, and it strongly affects the rest of the exam. In my case, I spent around 2 hours just configuring everything, but I already had my files and configurations prepared beforehand.

The RTO II exam is basically a red team operation, but with the addition of an EDR and mitigations like ASR and WDAC. It assumes that you already know all the content from RTO I, that’s why I recommend reviewing the RTO I topics and trying them in the labs before taking the exam so that you understand what works and what doesn’t, and helps you get ready for some parts that require extra attention.

In general, I think the exam is well balanced and really tests the skills you’ve learned during the course.
Even with the lab issue, I found the exam very enjoyable, and the long-time window plus the option to pause and resume over several days made the experience even better.

Tips for the exam

• Take your time to fully understand the topics and to experiment before the exam.
• Go into the exam with a stable environment that can bypass the different security measures.
• Review all the topics from RTO I and try to replicate as many techniques as possible in the lab.
• During the exam, you will be provided with the necessary tools, which can give you hints about possible attack paths you need to follow.
• There is plenty of time to work on the exam, so don’t stress about it

The price

At the time I took it, the base price of the course was £399.00. To practice the techniques taught in the course, you can use the course lab, which is accessible through Snap Lab. The lab can be purchased with different options depending on how many hours or days you plan to use it. Finally, the certification exam costs £99.00, but one free attempt is included when you buy the course.

Final Thoughts

In conclusion, I believe that RTO II is an excellent certification for anyone who wants to deepen their knowledge of Red Team Operations, especially focusing on the research aspect. The high-quality materials, lifetime access to the content, and the great exam experience make it a truly valuable certification in the offensive cybersecurity field.