> For the complete documentation index, see [llms.txt](https://dudisamarel.gitbook.io/crtp-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dudisamarel.gitbook.io/crtp-notes/crtp-methodology.md).

# CRTP Methodology

{% hint style="info" %}

### **Important to know:**

{% hint style="warning" %}
CRTP consists on **Live Of The Land** then no phishing, no exploits, and no CVEs.
{% endhint %}

{% hint style="info" %}
The exam environment won't include any tools, but we can add the tools we need to a specific folder in Windows Defender exclusion settings.
{% endhint %}

{% hint style="success" %}
What you have learned in the course is everything you need in order to pass the exam.
{% endhint %}

{% hint style="info" %}
The exam goal is to execute OS command on 5 targets not matter what privileges the user have
{% endhint %}
{% endhint %}

## 0. Defenses 

### Policy language mode

Enumerate PS Language Mode - [Protection](/crtp-notes/basic-enumeration/protection.md#language-mode)

if the Language is constrained:\
try to bypass using PS v2 or  [Protection](/crtp-notes/basic-enumeration/protection.md#list-applocker-rules)

### Bypass AMSI 

Bypass AMSI every new PowerShell session -[Bypass defenses](/crtp-notes/misc/bypass-defenses.md#amsi-bypass)

Also [Bypass defenses](/crtp-notes/misc/bypass-defenses.md#invisi-shell) can be used

### Bypass Defender

[Bypass defenses](/crtp-notes/misc/bypass-defenses.md#windows-defender)

### Turn off Firewall

[Bypass defenses](/crtp-notes/misc/bypass-defenses.md#firewall)

***

## 1. Local Privilege Escalation

check our privileges using `whoami /all`

Use [Local Privilege Escalation](/crtp-notes/privilege-escalation/local-privilege-escalation.md#powerup-1) and discover the vectors:

* Unquoted Service
* Modifiable Service File
* Modifiable Service

Once we are Local admin use [Credentials Dumping](/crtp-notes/lateral-movement/lsass-dump.md) to find other users logons

***

## 2. Domain Enumeration

### ACL

[ACL](/crtp-notes/ad-enumeration/acl.md)

Better to write down the interesting ACL so they might be useful later

**BloodHound** is very useful visualizing ACLs

### General

[Gnereral](/crtp-notes/ad-enumeration/gnereral.md)

Start to build up a mind map for attacking paths

* Domain
* Domain Controller 
* Users
* Computers
* Domain and Enterprise Administrators
* OUs
* GPOs
* SPNs

### Forests and Trusts

Understand trusts and map them between the domains

[Forests and Trusts](/crtp-notes/ad-enumeration/forests-and-trusts.md)

***

## 3. Domain Privileges Escalation

### Reverse shell by abusing Jenkins

### User Hunting

[Gnereral](/crtp-notes/ad-enumeration/gnereral.md#user-hunting) - Hunt for local admin access

### AD CS

[AD CS](/crtp-notes/privilege-escalation/cross-domain-privilege-escalation/ad-cs.md) 

### Delegations

[Delegations](/crtp-notes/privilege-escalation/domain-privilege-escalation/delegations.md) - Search for Delegations

### ACL

[ACL](/crtp-notes/persistence/acl.md) 

abusing ACL can lead 

*  [Delegations](/crtp-notes/privilege-escalation/domain-privilege-escalation/delegations.md#resource-based-delegation)
* [DC Sync](/crtp-notes/lateral-movement/dc-sync.md)
* [Security Descriptors](/crtp-notes/persistence/security-descriptors.md)
* Reset user password

***

## 4. Lateral Movement

### Bypass Defenses

[#0.-defenses](#0.-defenses "mention")

### OPTH

[Credentials Dumping](/crtp-notes/lateral-movement/lsass-dump.md) after getting Admin privileges then moving inside the domain using [Over Pass The Hash](/crtp-notes/lateral-movement/over-pass-the-hash.md)then spawn PowerShell session using [WinRM](/crtp-notes/lateral-movement/winrm.md).

### User Hunting

[Gnereral](/crtp-notes/ad-enumeration/gnereral.md#user-hunting) - Hunt for local admin access

***

## 5. Cross Domain Privilege Escalation

### MSSQL

[MSSQL Servers](/crtp-notes/privilege-escalation/cross-domain-privilege-escalation/mssql-servers.md) 

### Inter-Realm TGT

[Trusts](/crtp-notes/privilege-escalation/cross-domain-privilege-escalation/trusts.md) - After abusing Trust keys or krbtgt of trusted domain it is possible to abuse other forest abusing Inter-Realm TGT