Certified Red Team Infra Developer [CRT-ID] Review
14 Feb 2024 (861 Words, 5 Minutes)
Introduction
Credential Link
Red Team Infra Developer course
The Red Team Infra Dev [CRT-ID] course is a great primer for anyone who’s interested in setting up their own C2 Infrastructure. The course is divided into several modules which gives us freedom to integrate and customize it as per our requirements. Check out the syllabus here. Note that they don’t say that this is a full fledged course on C2 Infra and that’s gonna be it. I will like to put it as - “It’s just the beginning”. One will get value addition out of this course as it would vary for each Individual’s skill level.
Certification Process
The CRT-ID certification process goes roughly like this:
- Enroll in CRT-ID On-Demand Course
- Complete the Study Materials [Videos +PDF] & Practice the Exercises
- Complete the Task based exam present in the portal
- Submit the Exam PDF Report to:
[email protected] - Instructors will review & within 2 working days provide the results
Exam Instructions on reporting:
- Feel free to follow any report template, as soon as it follows linear approach
- Users are restricted to not use any automated scripts generator like OpenAI GPT versions etc
- Timeline is to complete the project & share us the PDF documentation within 3 months
Certification Exam Review
The exam was basically an assessment which I had to do on my end, over the weekend it felt like a fun little activity to do. Since it’s a mini course, I consumed the content at a decent pace. The world is your oyster once you get through the course material and the activity-based exam, at least in terms of C2 Infrastructure development. I have had experience provisioning many C2 Infra setups in the past, and with the knowledge I gained via the exam and the course, it’s all reinforced and helps solidify the concepts.
You can then use the skills learnt here to build your own custom C2 Infrastructure, Phishing channels, Payload delivery mechanisms, complex chain of redirectors with higher OPSEC, host your malware and phishing kit safely etc…
I felt that the activity based exam could have asked for more from the trainee’s end. To get the most value out of this course and exam, I would highly recommend anyone taking the courseware to follow up with the architecture. Try, experiment and Innovate.
How to prepare for the exam?
Preparation for the exam is pretty straightforward, just follow up with their C2 Infrastructure, first watch the module then replicate it at your end, and check out their free webinar videos at - workshops-webinars.
You can follow Nairuz Abulhul’s blog on setting up the Mythic C2 Infra with Azure CDN as redirectors.
Way Forward
For sure you won’t wanna end up being busted or caught in the act while doing a real world Red Team assessment. Check out this recent blog by censys, on how to track a malware infrastructure, and it’s not uncommon for one to see the adversarial Infrastructure being wide open in the Internet for a while until it’s pointed out by someone on Twitter or likewise. The course doesn’t delve deeper from the lens of the defender watching your DNS and HTTPS traffic spikes, but let’s be real, any network activity will leave network artifacts for the defenders to look after, likewise on host there are several host based artifacts. The OPSEC elements in the course was to blend in to the benign traffic and successfully setup the C2 Infra and perform an Initial access via phishing the target domain, which is just effective. As the techniques evolve, and like a true Red Teamer, we should enhance our skills to incorporate the best out there in our day to day operations.
Closing Thoughts
This blog post will mark the beginning of CWL - Red Team Certification Gallery, i.e., a compilation of various red teaming oriented certifications offered by the Cyberwarfare.live, I found them valuable, it contains wealth of knowledge and most importantly it has the Industry relevant offensive techniques which actually works. The series will roughly look like this (but in no particular order):
- Enterprise Lateral Movement Specialist
- Enterprise Security Controls Attack Specialist
- Red Team Analyst
- Red Team Specialist v2
- Process Injection Analyst
- Red Team CredOps Infiltrator
- Stealth Cyber Operator
- Windows Internal Red Team Operator
as one can see they’re mostly geared towards the Red-Teaming, some are byte-sized courses, meanwhile others are full-fledged courseware, some have MCQs as their exam criteria, some have specific activity-oriented exam with reporting, meanwhile others do require one to tackle 24-48 hours long exam in their environment. I have gone through the way they have designed courses over their academy, it briefly covers the major segments of the Enterprise Red-Team engagement or adversary emulation. That leaves me asking for more use cases and updated content over there. As I progress, it might change, but then we can expect Reverse Engineering, Exploit Development and Malware Development courses, who knows it’s in their pipeline already.
I hope this series and the courses along with their certifications bring value to you.
On a light note I would like to say that I will push some blogs once in a while, over the past years I have given 3 different blue teaming certifications
- eLearnSecurity Certified Threat Hunting Professional (eCTHPv2.0)
- Certified CyberDefender (CCD)
- Certified Digital Forensics Professional (eCDFPv2.1)
the most recent one being eCDFPv2.1, I will review them among others over here. I also plan to ace the Certified Defensive Security Analyst (CDSA) by HTB Academy.
If you have any questions or need personal guidance then feel free to contact me here
Thanks for spending your time and giving it a read.