c4ri0c4

#!/usr/bin/env python
import sys
import msfrpc
import time

if __name__ == '__main__':
    # Create a new instance of the Msfrpc client with the default options
    client = msfrpc.Msfrpc({})

    # Login to the msf server using the password "abc123"

c4ri0c4

How to pass the OSCP

1. Recon
2. Find vuln
3. Exploit
4. Document it

Recon

Unicornscans in cli, nmap in msfconsole to help store loot in database.

c4ri0c4

24x7x365 SUPPORT http://www.captiongenerator.com/320492/Offsec-Student-Admins

https://natesubra.com/go/oscp

OSCP Syllabus:

https://www.offensive-security.com/information-security-training/penetration-testing-training-kali-linux/

Windows Privilege Escalation:

http://www.fuzzysecurity.com/tutorials/16.html https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/

c4ri0c4

OSCP Handy Commands

Nmap Full Web Vulnerable Scan:

mkdir /usr/share/nmap/scripts/vulscan

cd /usr/share/nmap/scrripts/vulscan

wget http://www.computec.ch/projekte/vulscan/download/nmap_nse_vulscan-2.0.tar.gz && tar xzf nmap_nse_vulscan-2.0.tar.gz

c4ri0c4

OSCP Handy Commands

Nmap Full Web Vulnerable Scan:

mkdir /usr/share/nmap/scripts/vulscan

cd /usr/share/nmap/scrripts/vulscan

wget http://www.computec.ch/projekte/vulscan/download/nmap_nse_vulscan-2.0.tar.gz && tar xzf nmap_nse_vulscan-2.0.tar.gz

c4ri0c4

#!/bin/bash
###################################################
#              Recon Script
#
# Version: v2_08102016
# Created By: Seclyn
# Description: For initial recon of network/hosts.
# Mod by: r00t.pgp
#
###################################################

c4ri0c4

#!/usr/bin/expect -f

cd "lab-connection"

spawn openvpn OS-213**-OSCP.ovpn
expect "Enter Auth Username:" {
send "OS-213**\n"
}
expect "Enter Auth Password:" {
    send "mypass\n"

c4ri0c4

#!/usr/bin/env python
import sys
import msfrpc
import time

if __name__ == '__main__':
    # Create a new instance of the Msfrpc client with the default options
    client = msfrpc.Msfrpc({})

    # Login to the msf server using the password "abc123"

c4ri0c4

"""
Extract Rapid 2.0 ransomware config from encrypter or decrypter
Author: @demonslay335
"""

import os, sys, string, re, binascii, base64, argparse

# https://stackoverflow.com/a/17197027/1301139
def strings(filename, min=4, max=10000):
    with open(filename, "rb") as f:           # Python 2.x

c4ri0c4

#!/usr/bin/env python

## Decodes NTLM "Authenticate" HTTP-Header blobs.
## Reads the raw blob from stdin; prints out the contained metadata.
## Supports (auto-detects) Type 1, Type 2, and Type 3 messages.
## Based on the excellent protocol description from:
##  <http://davenport.sourceforge.net/ntlm.html>
## with additional detail subsequently added from the official protocol spec:
##  <http://msdn.microsoft.com/en-us/library/cc236621.aspx>
##