OSCP Exam Playbook

Get on the exam 15 minutes in advance to get screen share and VPN setup.

Start exam, make exam directories, write down IPs on paper. Two of the differing IPs are likely internal IP's for AD network. Ignore these for now.

Turn on Responder just in case we can pull a random hash from thin air while we work. Get Neo4j console and Bloodhound and Caido going as well to make sure they are working before we start.

#AutoRecon - Start with autorecon with a targets.txt file to easily make
#all my directories easily. You can pick the IP/IPs I will start scanning manually and
#let autorecon run in the background for the rest of the IPs

Scan each host separately and output results to its own directory with -On. Scan with nmap after for UDP ports and common vulnerabilities.

# Take the time to do these scans correctly. A missed port can be the 
# difference. Don't scan multiple hosts at once. It can cause ports to be
# missed.

#Most Used
rustscan -a <IP> -- -A -sC -Pn -T4 -On rustscan.txt --script=(\"'vuln'\")
sudo nmap <IP> --top-ports=5000 -sS -A -sC -T4 -Pn -On nmapscan.txt
sudo nmap <IP> --top-ports=5000 -sU -A -sC -T4 -Pn -On UDPscan.txt
sudo nmap <IP> -p --script=vuln -T4 -Pn -On vulnscan.txt

#Everything Else
rustscan -a <IP>    #Hits all the ports wicked fast. Use this first as a first pass
sudo nmap --top-ports=1000 -Pn -T4 <IP> #Hits the top 1000 ports #Hits the top 1000 ports
sudo nmap -p- -Pn -T4 <IP>    #Hits every port with syn/ack requests
sudo nmap -p- -sT -Pn -T4 <IP>    #Hits every port with syn requests
sudo nmap -p- -sU -Pn -T4 <IP>    #Hits every port with udp requests
sudo nmap -sT -sC -A -Pn -T4 -script vuln <IP> -p <PORTS> #Hits the found ports with all the goods
sudo nmap -script='<PROTOCOL>-vuln*.nse' <IP> -p <PORT> #Hits a specific service with vuln scripts

Note all of the notable ports and services and versions on paper.

MAKE SURE TO ADD IPs AND MATCHING DOMAIN NAMES TO /etc/hosts

Look for the initial Windows (AD) host and start there. Scan other hosts after scanning Windows target while researching a vulnerability. Save a lot of time here.

Find initial entry:

Tools to enumerate:

  • dig,dnsrecon,dnsenum

  • gobuster - dir,vhost,dns,FUZZ

  • enum4linux

  • nikto

  • crackmapexec

  • BurpSuite

  • hydra

  • beef-xss

  • minitrue

  • searchsploit

  • exploitdb

  • hacktricks

  • google

DNS zone transfer

Web Enumeration

***If you run out of options and can't find anything, try .log, .py, .txt, .zip for some potential saved creds

Try a different wordlist as well. dirb/big.txt is a good start***

Wordpress

Robots.txt

Only get HTTP headers

Cewl

Drupal

Shellshock

Samba (SMB)

NFS

SNMP

Scan using the default community string:

Brute force community strings

RPC (111/tcp, 135/tcp)

msrpc/rpcbind

rpcinfo

Null session

ident (113/tcp)

Enumerate users services running as

NTP (123/udp)

NetBIOS-NS (137/udp)

enum4linux

nbtscan

Windows

After Initial Entry

After initial entry, look for privilege escalation right away. Test with basic enumeration commands first to find the obvious privilege escalation and to get an understanding of the box. This page has great info: https://infosecwriteups.com/privilege-escalation-in-windows-380bee3a2842

Move over tools with either pysrv, smbsrv, ssh, or rdp:

File Transfers

  • mimikatz

  • lazagne

  • adPEAS.ps1

  • winPEAS.bat

  • Invoke-Kerberoast.ps1

  • PowerUp.ps1

  • Seatbelt

ClearText Password - Find a cleartext password in registry somewhere from winPEAS or lazagne?

Mimikatz or ps1 script to dump tickets to file:

Lazagne to look for NTLM hashes/mscache hashes/saved creds/etc...

adPEAS for AD enumeration and Sharphound extraction for Bloodhound

winPEAS for more obvious privilege escalation routes like unquoted service paths/UAC Bypass/ insecure file permissions/kernel exploits

PowerUp for more difficult privilege escalation techniques that can be automated like DLL hijacking.

Seatbelt for thorough enumeration of lots of system info. Good info here if stuck.

If able to compile a list of domain users, test for validity with kerberos authentication or SMB authentication.

If password policy allows, use kerbrute to bruteforce passwords for domain users.

After privilege escalation, look for lateral movement. Need a user hash, user credentials, service ticket. Use lazagne, mimikatz, seatbelt for dumps.

Port Scan - Start with a simple port scan of connected hosts

Remote Desktop - Look for users that can RDP if possible. Check bloodhound for a graphical view of the Active Directory domain.

SSH - Use ssh to open a pivot if possible/needed

Pass The Hash - If I have an NTLM hash of a user, I can try to pass the hash or overpass the hash.

OverPass The Hash - If I have an NTLM hash but need to authenticate with a kerberos ticket using PsExec.

Pass The Ticket (silver ticket) - Need NTLM hash of a Machine/Service account.

Other ways to get at domain creds/hashes (https://www.tarlogic.com/blog/how-to-attack-kerberos/):

Linux

After Inital Entry

Resources

Recon and Enumeration

Tricks

Public Keys / SSH

Python sudoers

SSH update-motd

Escaping Shells

Path variable

Chrootkit

Capabilities

Overcome limited shells

PreviousAbout MeNextOSCP Exam Guide (official)

Last updated