CRTO Study Plan

Run real adversary simulations with Cobalt Strike. A free, day-by-day CRTO schedule built from the official Red Team Ops syllabus, scaled to your exam date and weekly hours.

Approx. cost
$500–$550
Difficulty
♥♥♥♥♥
Study time
about 151h
Start level
Intermediate

▶ Build my CRTO plan

> How long does CRTO take?

The plan assumes about 151 study hours. Here is how that stretches across different weekly schedules.

Hours per weekTime to finish
5 hoursabout 31 weeks (7.2 months)
10 hoursabout 16 weeks (3.7 months)
15 hoursabout 11 weeks (2.5 months)
20 hoursabout 8 weeks (1.8 months)
30 hoursabout 6 weeks (1.4 months)

> CRTO exam format

Zero-Point Security · Red Team Ops

  • 24 hours of lab time, which you can pause across a 7-day window
  • No flags: 50% for reaching the objective, 50% for OPSEC
  • 85% to pass, so getting detected too often fails you
  • No written report and no live proctoring
  • Simulated enterprise Active Directory environment

Official CRTO page ↗

> CRTO syllabus and study hours

Every topic in the plan, in order, with its baseline hours. The planner shrinks or stretches these to fit your dates.

Red Team Fundamentals

Tradecraft, legal grounding, and Cobalt Strike basics.

  • Introduction to Red Teaming3h · learn
  • Law & Compliance2h · learn
  • Malware Essentials4h · learn
  • Cobalt Strike Primer5h · learn

Building & Hiding an Implant

Get code running on target and keep it there without tripping EDR.

  • Defence Evasion8h · learn
  • Initial Access6h · learn
  • Persistence4h · learn
  • Post-Exploitation5h · learn

Escalation & Credentials

From a foothold to domain-relevant credentials.

  • Privilege Escalation5h · learn
  • Elevated Persistence3h · learn
  • Credential Access5h · learn
  • User Impersonation4h · learn

Domain Domination

Move through the domain and take it over.

  • Discovery3h · learn
  • Lateral Movement4h · learn
  • Pivoting3h · learn
  • Kerberos & Delegation Abuse8h · learn
  • Microsoft SQL Server4h · learn
  • Domain Dominance4h · learn
  • Active Directory Certificate Services6h · learn
  • Forest & Domain Trusts5h · learn
  • AppLocker Bypasses2h · learn
  • Reporting2h · learn

Range Time

Rep the full chain against a live range.

  • Redo every module lab from memory16h · lab
  • Extra AD / Cobalt Strike ranges20h · lab

Final Boss Prep

Methodology and a full-length dry run.

  • Build a Cobalt Strike + AD cheat sheet6h · review
  • Rehearse OPSEC-safe defaults4h · review
  • 24-hour mock run, scored on stealth10h · review

> Where to practise for CRTO

Each task in your plan lists practice labs for its own topic. These are the best places to put in extra hands-on hours:

> CRTO exam-day checklist

General logistics for exam week. The official exam guide always takes priority if it differs.

One to two weeks before

  • Schedule your exam and add the start time, time zone and deadline to your calendar
  • Read the official exam guide end to end: rules, allowed and banned tools, and what counts as proof
  • Practice OPSEC-safe defaults: detections cost you points
  • Plan your pause points: your 24 hours of lab time can be spread across the 7-day window
  • Complete a full-length timed practice run (24 hours if you can) on your exam setup
  • Finalize your note-taking setup and templates (see the notes starter below)
  • Build and review your cheat sheets and command references
  • Arrange time off, tell people you will be unavailable, and plan your meals ahead

Machine and network

  • Charge and test a backup device or phone hotspot, and know how to contact support if your connection drops
  • Plug in your laptop and turn off sleep, updates and notifications for the exam
  • Test the VPN or lab connection early and know how to reconnect after a drop
  • Update your attack VM, take a clean snapshot and keep a spare
  • Install and test every tool you plan to use, and check none of them are banned
  • Test your screenshot hotkeys and make sure you have plenty of free disk space

During the exam

  • Sleep well the night before, and skip last-minute cramming
  • Prepare food and water, and set timers for break reminders
  • Read the brief and scope carefully before you touch anything
  • Write notes and capture proof as you go, not at the end
  • Time-box each target and move on when stuck. You can come back later
  • Stop new attacks with enough time left to verify your evidence

Finishing

  • Review how your results are submitted or scored so nothing is missed before you close the lab

Suggested exam-day rhythm

  • Hour 0 to 0:30. Connect, confirm the VPN, read the brief and set up your notes.
  • Hour 0:30 to 2. Enumerate everything first. Rank targets by points and how promising they look.
  • Through the day. Work in blocks of about 90 minutes with a 10-minute break after each. Time-box each target and rotate when stuck.
  • Meals. Eat real meals away from your desk roughly every 5 to 6 hours.
  • Around hour 12. Decide on a sleep window of 4 to 6 hours. A rested brain spots what a tired one misses.
  • Last 3 hours. Stop new attacks unless you are very close. Verify proof, collect screenshots and outline the report.
  • After the hands-on part. Confirm your submission or score is recorded.

▶ Open the interactive CRTO exam kit

The kit lets you tick items off, download a notes starter and report template, and see a readiness score from your plan progress.

> Passed CRTO with PWN PATH

No CRTO debriefs yet

Passed a cert? A short debrief helps the next learner plan their own run, and it only takes a couple of minutes.

▶ Share my debrief

Debriefs are self-reported. See all pass stories.

> Frequently asked questions

How long does it take to prepare for CRTO?

PWN PATH builds the CRTO plan on about 151 study hours. At 10 hours a week that is roughly 16 weeks, and at 20 hours a week roughly 8 weeks. Your own timeline depends on how much of the material you already know.

What is the CRTO exam like?

24 hours of lab time, which you can pause across a 7-day window. No flags: 50% for reaching the objective, 50% for OPSEC. 85% to pass, so getting detected too often fails you. No written report and no live proctoring. Simulated enterprise Active Directory environment.

How hard is CRTO?

We rate CRTO 3 out of 5. It suits learners who want real C2 and OPSEC tradecraft, not just exploits. Active Directory fundamentals. CRTP or OSCP+ level is a good base.

How much does CRTO cost?

About £399 (roughly $500–550 depending on exchange rate), including course, labs and the exam with free attempts. Prices are approximate, in US dollars unless a currency is shown, and change often. Confirm with the vendor before you buy.

What should I study first for CRTO?

Start with the "Red Team Fundamentals" phase: Introduction to Red Teaming, Law & Compliance, Malware Essentials. The planner puts topics in a sensible order and scales the hours to the time you have.

What are the prerequisites for CRTO?

Active Directory fundamentals. CRTP or OSCP+ level is a good base.

What should I do the week before the CRTO exam?

Re-read the official exam guide for rules and banned tools, test your machine, network and VPN or lab connection, finish a full timed practice run, finalize your notes and cheat sheets, and plan your meals, breaks and sleep. The exam-day checklist on this page covers it step by step.

How should I handle breaks and sleep during the CRTO exam?

Hour 0 to 0:30: Connect, confirm the VPN, read the brief and set up your notes. Hour 0:30 to 2: Enumerate everything first. Rank targets by points and how promising they look. Through the day: Work in blocks of about 90 minutes with a 10-minute break after each. Time-box each target and rotate when stuck. Meals: Eat real meals away from your desk roughly every 5 to 6 hours.

What should I take after CRTO?

Common next steps are OSEP. See the roadmap to compare them.

Is the PWN PATH study planner free?

Yes. There are no accounts and no sign-up. Your plan and progress are saved in your browser, and you can export a backup file, add the schedule to your calendar or print it.

> Plan your path

Good stepping stones before CRTO:

CRTPCRTEOSCP+

Where it leads:

OSEP

More in active directory & red team:

CRTPCRTECAPEOSEP

Not sure CRTO is right for you? Take the one-minute cert quiz.