CRTM extends red-team depth into advanced AD trust abuse, evasion, and multi-domain operations. For 2026, candidates should train on complex enterprise pathing and reproducible attack narratives.
Official PageVisualize Active Directory attack paths.
docker compose up -d # bloodhound stackbloodhound-python -d <domain> -u <user> -p <pass> -ns <dc_ip> -c allSMB/WinRM/RDP/LDAP assessment and credential checks.
pipx install netexecnetexec smb <target> -u <user> -p <pass>Network discovery and service fingerprinting.
sudo apt install -y nmapnmap -sC -sV -Pn <target>Understand credential material handling and AD abuse paths in controlled labs.
Use in sanctioned lab scope onlyPassword cracking for recovered hashes.
sudo apt install -y hashcathashcat -m <mode> <hashes> <wordlist>Exploit/proof-of-concept and post modules.
sudo apt install -y metasploit-frameworkmsfconsoleUserland pivoting and tunnel setup.
go install github.com/nicocha30/ligolo-ng/cmd/...@latestligolo-proxy -selfcert