CARTP certification for Azure Red Team

Last month I passed the CARTP (Certified Azure Red Team Professional) certification exam and here is my take about this course.

Course Topics

I found the course’s topics to be very interesting, probably because they revolved around what was for me a new topic. Attacking cloud environments is indeed very different from attacking traditional on-premise environments, and it’s common among those used to the second (me included) to be confused by access tokens, scopes, cloud resources, and so on.

The course is laid out logically, starting from Azure theory, passing from detailed explanation about how to use tokens (and how to find them in the first place), including a wide range of attacks against cloud resources and finally techniques for full compromise and lateral movement from on-prem to cloud and viceversa.

Course Materials

While the topics are very interesting, the course material could be improved in my opinion.

The main study support is the “Lab Manual”, which is basically a step-by-step walkthrough to solve all challenges presented by the lab (around 50 “flags” to capture here and there). The manual is well written, clear and easy to follow, yet this walkthrough approach felt really strange at a times (for example it feels like 90% of the flags could be answered just by reading the lab manual without ever actually executing the techniques in the lab). There are no surprises and completing the course feels a bit like going through a checklist.

A similar approach is used for the lab “Tools”. This is a zip folder you can download upon registration with all tools that you will need to finish the lab and pass the exam. Other than public third-party tools, the collection also includes small scripts and utilities (powershell, webshells in python or php), and a series of custom tools for evasion (loader, modified mimikatz versions and so on). These executables are often provided already compiled, without source code, which is something I dislike. These tools fit perfectly in the course, as they are specifically designed to work with the lab and they work at first try with the exact commands in the walkthroughs, however I find this distribution system to only reinforce the feeling of just following a checklist.

The Exam

The exam is short an easy. You have 24 hours for the exam, and 48 hours for the report.

I personally finished the exam in just 2 hours and then spent like 5-6 hours for reporting. The exam is straightforward and you can easily find your next move (and credentials), there’s no need to use automated enumeration tools, as the exam lab is small and everything is clearly visible with basic enumeration commands.

Is it worth it?

Yes. For its price and the unique topic it covers, this certification is definitely worth it. If you feel you are lacking the theory to successfully attack Azure environments, this is a great starting point.