CRTO-Like Machines: 33 boxes by difficulty

CRTO, the Certified Red Team Operator from Zero-Point Security, tests red team tradecraft rather than single box exploitation. The exam is practical and centres on operating a command and control framework against an Active Directory environment, including lateral movement and evasion.

The 33 machines on this page are tagged CRTO in the ZeroBox catalog and come from HTB & THM. By operating system that is 33 Windows. The Windows and Active Directory boxes here let you rehearse the underlying skills the course builds on: domain enumeration, credential abuse, delegation, Kerberos attacks and moving between hosts. Treat them as a way to understand the attacks before running them through a C2 framework.

To use the list, start at the easiest group and work upward, spending real time on enumeration before looking at any help. After each box, write down the foothold, the escalation and what you would do faster next time. Each machine links to its official room. Once you are comfortable, rehearse under pressure in the exam simulator, and follow the phase-by-phase pentest methodology checklist so you do not skip steps. You can also browse the technique hubs to drill one skill at a time.

Jump to difficulty

Easy (8)Medium (17)Hard (8)

CRTO machine list by difficulty

Easy (8)

Machine	Platform	OS	Tags
Active Directory Basics	THM	Windows	Active Directory, Domain Controller, Forests, Trusts
Active Directory Enumeration	THM	Windows	Active Directory, Enumeration, PowerView, BloodHound
BloodHound Basics	THM	Windows	BloodHound, Neo4j, Graph Theory, Active Directory
Forest	HTB	Windows	AS-REP Roasting, ASREPRoasting, Active Directory, BloodHound
Living Off The Land	THM	Windows	LOLBAS, Living Off The Land, Certutil, MSHTA
Red Team Engagements	THM	Windows	Red Team, Rules of Engagement, OPSEC, Threat Intelligence
Red Team Fundamentals	THM	Windows	Red Team, Methodology, OPSEC, Engagements
Sauna	HTB	Windows	AS-REP Roasting, ASREPRoasting-Attack, Active Directory, BloodHound

Medium (17)

Machine	Platform	OS	Tags
Active Directory Hardening	THM	Windows	Active Directory, Hardening, LAPS, Tier Model
AD Certificate Templates	THM	Windows	ADCS, ESC1, Certipy, Certificates
AD Tier Model	THM	Windows	Active Directory, Tier Model, PAW, Hardening
Attacking Kerberos	THM	Windows	Kerberos, ASREPRoast, Kerberoasting, Silver Ticket
Breaching Active Directory	THM	Windows	Active Directory, NTLM Relay, LLMNR-Poisoning, Responder
Cascade	HTB	Windows	AD Recycle Bin, AES-Encryption, Active Directory, Active-Directory
Domain Privilege Escalation	THM	Windows	Active Directory, BloodHound, GPO Abuse, ACLs
Eden	THM	Windows	Active Directory, Kerberos, Pass-the-Ticket, BloodHound
Exploiting Active Directory	THM	Windows	Active Directory, Kerberoasting, ASREPRoasting, Pass-the-Hash
Intelligence	HTB	Windows	AD CS, ADIDNS-abuse, Active Directory, BloodHound
Lateral Movement and Pivoting	THM	Windows	Active Directory, Pivoting, Lateral Movement, WMI
Monteverde	HTB	Windows	Active Directory, Azure AD Connect, BloodHound, MSOL
Resolute	HTB	Windows	Active Directory, DLL Injection, DNSAdmins, DnsAdmins-Abuse
Scrambled	HTB	Windows	Active Directory, Deserialization, Deserialization-attacks, Kerberoasting
VulnNet: Active (Retired)	THM	Windows	Active Directory, Redis, GPP-Passwords, Kerberoast
Windows Local Persistence	THM	Windows	Persistence, Registry, Scheduled Tasks, Services
Za	THM	Windows	Active Directory, Kerberos, BloodHound, GPO Abuse

Hard (8)

Machine	Platform	OS	Tags
Active Directory Trusts	THM	Windows	Active Directory, Domain Trusts, SID History, Trust Abuse
AV Evasion: Shellcode	THM	Windows	Red Team, AV Evasion, Shellcode, AMSI
Blackfield	HTB	Windows	AS-REP Roasting, Active Directory, Anonymous-/-Guest, BloodHound
Enterprise	THM	Windows	Active Directory, ZeroLogon, SQLi, Privilege Escalation
Holo	THM	Windows	Active Directory, Multi-Host, Kerberos, BloodHound
Raz0rBlack	THM	Windows	Active Directory, NFS, Kerberos, AS-REP Roasting
Throwback	THM	Windows	Active Directory, Red Team, Network, C2
Wreath	THM	Windows	Active Directory, Pivoting, Chisel, Empire

Track your progress. ZeroBox keeps a Kanban board, notes and checklists for every box, offline in your browser. Open ZeroBox

Machines belong to HTB & THM. ZeroBox is not affiliated with the platforms or certification bodies named here.