Red Team Ops (CRTO) Review

In this blog post, written after earning the Red Team Ops certification from Zero Point Security, I want to share my experience and thoughts about this certification.

Introduction

Red Team Ops is a course created by RastaMouse and offered by Zero Point Security. It provides an introduction to red teaming concepts, covering all the steps of the attack lifecycle.

Below is the official description:

“Red Team Ops is an online, self-study course that teaches the basic principles, tools and techniques synonymous with red teaming. Students will first cover the core concepts of adversary simulation, command & control, engagement planning and reporting.They will then go through each stage of the attack lifecycle - from initial compromise to full domain takeover, data hunting and exfiltration.  Students will learn how common “OPSEC failures” can lead to detection by defenders, and how to carry out those attacks in a stealthier way. Finally, they will learn how to bypass defences such as Windows Defender, AMSI and AppLocker.”

The course

The course is organized into specific lessons grouped into major topics, all accessible through the certification’s web portal. The lessons on various techniques consist of text and are enriched with practical examples, code, screenshots, and videos. The topics covered during the course include the following:

• Command & Control
• External Reconnaissance
• Initial Compromise
• Host Reconnaissance
• Host Persistence
• Host Privilege Escalation
• Credential Theft
• Password Cracking
• Domain Reconnaissance
• User Impersonation
• Lateral Movement
• Session Passing
• Data Protection API
• Kerberos
• Pivoting
• Active Directory Certificate Services
• Group Policy
• MS SQL Servers
• Microsoft Configuration Manager
• Domain Dominance
• Forest & Domain Trusts
• Local Administrator Password Solution
• Microsoft Defender Antivirus
• Application Whitelisting
• Data Hunting & Exfiltration
• Extending Cobalt Strike

Overall, I think the study material is of good quality, and the fact that the course is constantly updated and remains accessible for life definitely increases its value.

How I approached the course

I went through the course lessons a total of three times. First, I read through the lessons to understand the concepts in a more theoretical way, without having to think about the technical steps. Then, I went through the lessons again, using the lab to apply the various techniques and solve any issues. Finally, I went through the course again with the antivirus enabled on all the machines. I spent about 60 hours in the lab, going through the course both with and without antivirus, and had the opportunity to experiment a bit.

The exam

As described on the exam page.

“The Red Team Ops Exam is a practical CTF-style event driven by Snap Labs.  It’s an assumed breach scenario by which the student must emulate an adversary using the provided threat profile as a guide.

[…]

Each machine has a flag that must be submitted on the scoreboard as proof of progress.  Students must submit at least 6 of 8 flags (75%) to pass.

Students have a maximum allowance of 48 hours of runtime, usable within a 4-day window.  The exam VMs can be stopped at any time to preserve runtime, should an extended break be required.  If enough flags have been collected by the end of the 4-day exam period, the Red Team Operator badge will be awarded via email.”

My exam

I scheduled the start of the exam for 9:30 AM and finished it around 8:00 PM. I completed the exam by submitting all 8/8 flags, with 38.8 hours remaining. The roughly 10 hours I spent to finish the exam were all on the same day, taking two breaks (I did a total of three sessions).

The time provided is very generous, and the ability to pause the exam and spread the available hours over multiple days makes the exam a very positive experience. The infrastructure covered allows you to consolidate and verify the knowledge gained during the course. Personally, I found taking the exam very enjoyable, and it’s a positive aspect that even the final exam offers situations that allow you to experiment with new attack paths.

Tips for the exam

Based on my experience, here are my recommendations:

• Enumeration, Enumeration, Enumeration: Information is power! The more enumeration you do, the better your understanding of the infrastructure you’re dealing with. Enumeration helps you find the path to follow, so it’s probably the most important phase to focus on. Even if it feels boring, make sure to enumerate as much as possible.
• Always Double Check: Always make sure that what you’re doing or using is working correctly. Just because something works in the lab doesn’t mean it will work the same way during the exam.
• Take time in the lab before the exam to practice setting up your environment. This way, during the exam, you’ll be faster, and some configurations will become automatic.
• Leave some time in your lab during the exam. This way, if you need to check something in an environment where you have more control, you can do it.
• Community: Both during the course and the exam, remember there is a Discord channel and a community page on the Zero Point Security website. You can use these to look for errors or situations similar to what you’re encountering, but remember that asking exam-related questions is prohibited.
• When you have privileged access, in addition to establishing persistence, it’s useful to obtain and save any credentials you manage to recover.
• It’s not as important to memorize commands as it is to truly understand what you’re doing.

 

What I Appreciated

• It was very interesting to see what happens on the “defense side” when performing an attack. This view from the other side helps refine offensive techniques, making them harder to detect.
• The exam is presented as a realistic red team activity, providing details like the threat profile to emulate.
• The techniques covered are numerous and, in general, can be learned without requiring any specific prior knowledge.

 

Cons

• Access to the lab is only allowed through Guacamole, which makes some operations more cumbersome than expected.
• Some lessons don’t go into great detail on certain techniques. However, this is understandable, as adding too much detail would (perhaps unnecessarily) increase the amount of information in a single lesson, making it less practical. Also, often, the lessons provide hints for those who want to dive deeper into specific topics.
• Too focused on Cobalt Strike (is this really a con?). While it’s not a bad thing to be able to use (and add to your resume) a widely-used commercial software, some lessons are too tied to the specifics of this C2. However, I understand that making the course universally adaptable to any software would be very complicated, so a choise had to be made. Additionally, many of the concepts can be applied to other C2 tools with some effort.

 

The Price

The base price of the course is £365.00. To practice the techniques explained in the course, you can use the course lab, which is accessible through Snap Lab. The lab can be purchased with different options based on the hours/days you plan to use it. Finally, the certification exam costs £99.00, but one free attempt is included with the course purchase.

Final Thoughts

In conclusion, my thoughts on this course are positive. I’m happy with what I’ve learned throughout this process, and overall, I didn’t encounter any major limiting issues. I believe RastaMouse did an excellent job with this certification, providing quality material and an exam that offers an exam experience that’s hard to beat. With my limited experience in the certification world, I think this is an excellent certification for anyone looking to dive deeper into the topic of red teaming.