OSCP Made Easy

Table of Contents:

• Web
• Linux
• Windows
• Active Directory
• Practice Machines

Introduction

This is a culmination of me looking through all of the resources I could find for the OSCP exam. I will give all of the important topics, resources to learn, and commands to copy. I have also attached my CherryTree notes that I used to pass my exam.

The Exam:

You are given 23 hours and 45 minutes to complete this exam. After, you are given another 24 hours to submit your documentation. The exam must be proctored, so read the proctoring tool manual.

Exam Structure:

The OSCP exam is structured like this:

• 3 stand alone machines (60 point total):

  • 20 points for each of the 3 machines

    • 10 points for low-privilege (local.txt)
    • 10 points for privilege escalation (proof.txt in /root/ or the Administrator Desktop)

• 1 Active Directory set with 3 machines (40 point total):

  • 10 points for machine 1 (client)
  • 10 points for machine 2 (client)
  • 20 points for machine 3 (domain controller)

Possible scenarios to pass the exam (70/100):

• 40 points AD + 3 local.txt flags
• 40 points AD + 2 local.txt flags + 1 proof.txt flag
• 20 points AD + 3 local.txt flags + 2 proof.txt flags
• 10 points AD + 3 fully completed stand alone machines

Exam Restrictions:

• Spoofing (IP, ARP, DNS, NBNS, etc.)
• Commercial tools (Metasploit Pro, Burp Pro, etc.)
• Automatic exploitation tools (db_autopwn, browser_autopwn, SQLmap, SQLninja, etc.)
• Mass vulnerability scanners (Nessus, NeXpose, OpenVAS, Canvas, Core Impact, SAINT, etc.)
• AI Chatbots (OffSec KAI, ChatGPT, YouChat, etc.)
• Features in other tools that utilize either forbideen or restricted exam limitations.

Metasploit Restrictions:

The usage of Metasploit and the Meterpreter payload are restricted during the exam. You may only use Metasploit modules (Auxiliary, Exploit, and Post) or the Meterpreter payload against only one single target machine of your choice. Once you have selected your one single target machine, you cannot use Metasploit modules (Auxiliary, Exploit, or Post) or the Meterpreter payload against any other machines.

Metasploit/Meterpreter should not be used to test vulnerabilities on multiple machines before selecting your one target machine (this includes the use of check). You may use Metasploit/Meterpreter as many times as you would like against your one target machine.

If you decide to use Metasploit or Meterpreter on a specific target and the attack fails, then you may not attempt to use it on a second target. In other words, the use of Metasploit and Meterpreter becomes locked in as soon as you decide to use either one of them.

Metasploit cannot be used for pivoting, because it would thereby be used on more than one target.

However, you can use all of the following against all of the target machines:

• multi handler (aka exploit/multi/handler)
• msfvenom

Documentation

Enumeration:

Web

Linux

Windows

Active Directory

Enumeration:

Enumerate Users

net user
net user /domain
net user $domain_user /domain

Enumerate Groups

net group /domain

# Includes domain users that are part of local administrators group
net localgroup administrators

PowerView

# Import PowerView
PS> Import-Module .\PowerView.ps1

# Get info about current domain
PS> Get-NetDomain

# List all attributes of the user objects
PS> Get-NetUser

# Lists all usernames in the domain
PS> Get-NetUser | select cn

# Lists all groups in the domain
PS> Get-NetGroup | select cn

# List members of Domain Admins group
PS> Get-NetGroupMember -GroupName "Domain Admins"

# List all computers in domain
PS> Get-NetComputer

# Enumerate logged-on users
# NB: only lists users logged on to target if we have local administrator privileges on target
PS> Get-NetLoggedon -ComputerName $hostname

# Enumerate active user sessions on servers e.g. file servers or domain controllers
PS> Get-NetSession -ComputerName $hostname

# Enumerate SPNs
PS> Get-NetUser -SPN | select serviceprincipalname

Attacking:

Lateral Movement:

Examples:

Practice Machines

You should knock out a majority of the machines on these lists until you feel comfortable:

• TJNull
• LainKusanagi

It's important to save the PWK Challenge Labs for the end as these will be the closest to taking the actual exam. I will only cover up to 6th lab because the others cover material that will not appear on the OSCP exam.

Challenge Labs 0-3:

The first four Challenge Labs are called scenarios. Each scenario consists of a set of networked machines and a short background story that puts those machines in context. Your goal is to obtain access to a Domain Administrator account on an Active Directory domain, and compromise as many machines on the network. All machines contain either a local.txt file, a proof.txt file, or both. The contents of these files are randomized hashes that can be submitted to the OLP to log each compromise.

Challenge Lab 0: SECURA

In the first Challenge Lab, you are tasked with performing a penetration test on SECURA's three-machine enterprise environment. This lab serves as a ramp-up before tackling the more complex Challenge Labs 1-3. You will exploit vulnerabilities in ManageEngine, pivot through internal services, and leverage insecure GPO permissions to escalate privileges and compromise the domain. Although Challenge Lab 0 is not a mock exams, it has been setup to use the 'Assumed Breach' scenario as seen in the OSCP+ exam. The credentials below can be used to commence your attack:

• Username: Eric.Wallows
• Password: EricLikesRunning800

Challenge Lab 1: MEDTECH

You have been tasked to conduct a penetration test for MEDTECH, a recently formed IoT healthcare startup. Your objective is to find as many vulnerabilities and misconfigurations as possible in order to increase their Active Directory security posture and reduce the attack surface.

Challenge Lab 2: RELIA

You are tasked with a penetration test of RELIA, an industrial company building driving systems for the timber industry. The target got attacked a few weeks ago and now wants to get an assessment of their IT security. Their goal is to find out if an attacker can breach the perimeter and get Domain Admin privileges in the internal network.

Challenge Lab 3: SKYLARK

Skylark Industries is an aerospace multinational corporation that performs research & development on cutting-edge aviation technologies. One of their major branch offices has recently been targeted by an Advanced Persistent Threat (APT) actor ransomware attack. For this reason, the company CISO now wishes to further shield Skylark Industries' attack surface. You have been tasked to conduct a preemptive penetration test towards their HQ infrastructure and find any vulnerability that could potentially jeopardize the company's trade secrets.

Challenge Labs 4-6:

The second type of Challenge Lab consists of an OSCP-like experience. They are each composed of six OSCP+ machines. The intention of these Challenges is to provide a mock-exam experience that closely reflects a similar level of difficulty to that of the actual OSCP+ exam. To align with the OSCP+ 'Assumed Breach' scenario for the Active Directory portion of the exam, please use the credentials below for initial access:

• Username: Eric.Wallows
• Password: EricLikesRunning800

Each challenge contains three machines that are connected via Active Directory, and three standalone machines that do not have any dependencies or intranet connections. All the standalone machines have a local.txt and a proof.txt. While the Challenge Labs have no point values, on the exam the standalone machines would be worth 20 points each for a total of 60 points. The Active Directory set is worth 40 points all together:

Challenge Lab 4

Challenge Lab 5

Challenge Lab 6