> For the complete documentation index, see [llms.txt](https://blog.r00t-hunter.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.r00t-hunter.com/exam-notes-and-prep-guides/crta-certified-red-team-analyst-exam-prep-guide.md). # CRTA (Certified Red Team Analyst) - Exam Prep Guide *** The Certified Red Team Analyst (CRTA) exam by Cyber Warfare Labs is a hands-on, scenario-based red team assessment. Unlike a multiple-choice cert, you're dropped into a simulated corporate network and expected to chain together enumeration, exploitation, pivoting, and Active Directory attacks to reach a set of objectives, then document what you did. This isn't a walkthrough of the exam itself, and it won't cover specific flags, IPs, or answers from any exam build. Those change per attempt and sharing them defeats the purpose of a proctored cert. What follows is the skill map: what CRTA is actually testing, how to build those skills before you sit it, and the mistakes that trip people up. ### Why I'm Writing This A lot of the "prep material" floating around for CRTA is just leaked answer sets from Telegram groups and Discord servers - literal flag values copy-pasted from someone else's exam session. That doesn't teach you anything, it just gets you a cert you can't back up in an interview or on the job. If someone asks you to explain how Overpass-the-Hash works six months after you "passed," you want to actually know. So this is the version of prep that survives contact with a real engagement. ### Exam Format & Details * **Format:** Fully hands-on lab environment, VPN-based access * **Structure:** External foothold -> internal pivot -> Active Directory compromise -> objective completion * **Deliverable:** A written report documenting your methodology (this matters - see the reporting section below) * **Environment:** Typically a small AD environment with a parent/child domain trust, plus one or more externally-facing Linux/Windows boxes as the entry point ### What CRTA Is Actually Testing Break the exam into skill categories and study each one independently rather than trying to "learn the exam." #### 1. External Recon & Service Fingerprinting You'll be scanning a small external range and need to correctly identify what's actually running on non-standard or misconfigured ports - not just what nmap's default script database tells you. What to practice: * `nmap -sCV` as a starting point, not an ending point * Manually fingerprinting unknown services with `curl -k`, checking response headers, page titles, and error messages * Recognizing old/vulnerable software versions by banner (Tomcat, Webmin-style admin panels, outdated CMS installs) * Not skipping "boring" ports - misconfigured admin interfaces are usually the way in, not the flashy CVE #### 2. Initial Foothold via Web/App Exploitation CRTA leans on classic but still-relevant footholds: exposed admin panels, default credentials, known RCEs in management interfaces (think Tomcat manager deploy, Webmin package update RCE, similar patterns). What to practice: * Default credential lists for common admin panels (Tomcat, Webmin, Jenkins, phpMyAdmin) - know them, don't guess them * Generating and deploying payloads with `msfvenom` for the target's actual OS/arch * Setting up and catching reverse shells reliably (netcat listeners, handling shell stabilization) * Reading Metasploit module documentation instead of blindly running `search` and `use` #### 3. Post-Foothold Enumeration (Linux) Once you have a shell, the exam rewards patience over speed here. What to check every time: * `/etc/passwd` for user accounts and login shells (`nologin` vs `bin/bash` tells you who's worth pursuing) * World-readable files in other users' home directories - credential files, config files, `.bash_history` if not symlinked to `/dev/null` * SUID binaries and `sudo -l` output * Any file with "cred," "backup," "config," or similar in the name #### 4. Pivoting into Internal Networks This is where a lot of people lose time. You'll find a dual-homed box (one interface external, one internal) and need to route traffic through it to reach a network you can't touch directly. What to practice: * `ip a` / `ifconfig` habit - always check for a second interface before assuming you're stuck * SSH dynamic port forwarding: `ssh -D user@host` - understand what this actually does, not just the syntax * proxychains configuration and why socks4 vs socks5 matters * Debugging "socket error or timeout" - usually a config file mismatch, not a dead host * Understanding why some tools work fine through a SOCKS proxy and others (raw ICMP, some scan types) don't #### 5. Internal Enumeration & Second Foothold Same discipline as external recon, but now everything is routed through proxychains, which is slower and reveals less by default (banner grabbing over a SOCKS proxy is unreliable). This forces you to manually verify services rather than trust automated output. What to practice: * Being suspicious of "unknown" or unversioned services in scan output instead of moving past them * Manually querying HTTP/HTTPS services through the proxy with `curl` to identify what's really there * Recognizing exposed monitoring, file management, or admin tools by their login page titles and structure #### 6. Active Directory Fundamentals This is the core of CRTA and where most study time should go if you're weak here. Core concepts to actually understand, not memorize: * **Keytab files** - what they are (a way to store Kerberos principal keys, often for service accounts), how they leak credential material, and how to extract usable hashes from them * **NTLM hashes vs Kerberos tickets** - know the difference and when each is used for auth * **Overpass-the-Hash** - using an NTLM hash to request a legitimate Kerberos TGT, rather than passing the hash directly over SMB. Understand why this works (Kerberos pre-auth accepts the NTLM hash as a key) and why it's stealthier in real environments than raw Pass-the-Hash * **Golden Ticket attacks** - forging a TGT using the krbtgt hash. You need to understand what each parameter in the forging command actually represents (domain SID, target domain SID for cross-domain trust abuse, the krbtgt hash itself) rather than copy-pasting a template command * **SID history and cross-forest/cross-domain trust abuse** - why adding a foreign domain's SID to a forged ticket grants access across a trust boundary, and why this is such a critical AD misconfiguration in the real world * **PowerView / AD enumeration scripts** - `Get-DomainSID`, `Get-DomainUser`, group membership enumeration - know what questions these are answering, not just the commands Tools to have genuine command-line fluency with before exam day: * Mimikatz (`lsadump::lsa`, `kerberos::golden`, `sekurlsa::logonpasswords`) * Impacket suite (`psexec.py`, `secretsdump.py`, `wmiexec.py` - know when to use which) * PowerView\.ps1 or equivalent * A keytab extraction tool and understanding of what it's actually doing (decoding the Kerberos principal/key structure) #### 7. Report Writing CRTA grades your report, not just whether you popped a shell. This is the part people skip in prep and then scramble on during the exam. What good reporting looks like: * Document as you go, not after - screenshot or log every command and its output in real time * Explain the "why," not just the "what" - don't just paste a command, explain what vulnerability or misconfiguration it's exploiting * Structure matters - a clear narrative from initial access through to final objective is easier to grade (and easier for you to write under time pressure) than a dump of terminal output * Findings/key findings section - practice summarizing root-cause issues (weak credential storage, missing segmentation, unpatched services) separately from the play-by-play ### Common Mistakes That Cost People Time * Not checking for a second network interface after landing an initial shell - assuming the box is single-homed and missing the pivot path entirely * Proxychains misconfiguration - wrong SOCKS version, stale port number in the conf file, or forgetting the SSH pivot session needs to stay alive in the background * Skipping "boring" default credential checks - trying complex exploits before testing `tomcat:tomcat` or `admin:admin` * Treating unversioned/unrecognized nmap output as "nothing to see here" instead of manually investigating * Forging a Golden Ticket with the wrong SID or missing the target domain's SID for cross-domain access, then not understanding why it silently fails * Not extracting all available domain SIDs before attempting lateral movement across a trust * Writing the report entirely at the end instead of documenting incrementally - running out of time and submitting a thin writeup despite doing solid technical work ### How to Actually Prepare (Legitimately) * HTB Active Directory content - the "Cybernetics," "Sauna," "Forest," and similar AD-focused boxes cover the same skill categories * TryHackMe's AD modules - decent for building the conceptual foundation on Kerberos before jumping into attack tooling * Build your own small AD lab - two forests/domains, a trust relationship, a handful of VMs. If you've already got something like this (I run a two-forest lab myself for this exact reason), use it specifically to practice keytab extraction, Overpass-the-Hash, and Golden Ticket forging until the commands don't need a cheat sheet * Read the actual Impacket and Mimikatz documentation once, fully, instead of only ever using command templates from blog posts * Practice writing a short report after every practice box - this is the skill people neglect most and it's graded ### Should You Pay For It / Is It Worth Doing CRTA is a legitimate, hands-on assessment of red team fundamentals - external foothold, pivoting, and AD attack chains - and it's a reasonable way to validate that you can actually do the work, not just recognize multiple-choice terminology. If you're building toward red team or pentest roles and don't yet have hands-on AD attack experience, the prep for this exam (not the cert itself) is where the real value is. ### Final Thoughts Don't chase the specific exam's answers - the environment changes, and even if it didn't, memorized flags don't survive a technical interview or a real engagement. Build fluency in the skill categories above, practice on your own lab or HTB/THM boxes until the AD attack chain feels like muscle memory, and treat the report as part of the deliverable, not an afterthought. That's what actually gets tested, and it's what actually transfers. Good luck. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://blog.r00t-hunter.com/exam-notes-and-prep-guides/crta-certified-red-team-analyst-exam-prep-guide.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.