OSCP: A Journey of a lifetime

Introduction

If you have landed here, then you might have seen, heard about or even took the OSCP. The thing with OSCP is, it is easy and hard at the same time. Some Modules come naturally to a learner. Whereas, some modules you have to work hard for it. I am going to tell you some tips about OSCP. The thing about OSCP in a nutshell, is OSCP is an examination worth of 100 points with a time-limit of 24 hours, and a report writing timeline of 24 hours. The exam is not difficult, In this blog, I will be sharing both technical and non-technical aspects and tips of the exam.

What should you know?

There is no actual pre-requisite for OSCP, but my recommendations still stand as they should. You should know a little bit of networking and the basic stuff. I believe this will help you for the OSCP and it will help you for the exam. The tools are a part of OSCP but more than the tool you should understand what the tool does. As one of brightest minds I know (haxormad), once told me, dont depend on tools! If the tools fails you dont know any alternative to it, since you only know that that specific tool is used for lets say credential extraction. But if that tools fails, you fail. To avoid this you might want to learn how a tool works, what resources makes the tool work, what is the core vulnerability the tools is exploiting ? For example, you come across a low level user account that has seimpersonate privilege enabled. Being the 1337 hacker you are you push through with nc.exe and godpotato to gain a reverse shell, but even through multiple tries, you could not get a reverse shell on you listener. In this scenario, if you understand that there are multiple ways to exploit SEimpersonate privilege, you can gain an administrator account. For that you have to understand that, SEimpersonate privlege is a security privilege that allows a process to umpersonate the security context of a client after authentication, so basically if your user account ahs seimpersonate privilege enabled, you could run programs at an administrative level. So instead of running netcat, you could possibly, add another administrator account. When you understand these ideas and concepts you can turn things around. Below are some tools you should know.

Mindset of an attacker

If you're taking the certification just for the sake of it, dont. During the preparation for the exam you should attack think on the attacking side of things. If you think like an attacker, then you can perform like one. Mindset is one of the things that I cant put enough emphasis on. You main aim should be to learn and understand vulnerabilities while exploiting them. In the example, since there is no pre-defined scope that doesnt allow you to break systems, go crazy! If you think that a kernel exploit might be the solution, go for it. This is the phase where you try things out! dont be afraid to attack. Attack and find out why this exploit is working, what could the pre-requisite of this certain attack be and which scenario could you use this attack. It's never the tools that break you into systems, it the thought process. Always find multiple ways to exploit the vulnerability. and Lastly, you attack. But Berfore attacking there is a lot of things you should know, here is where it comes in, RECON.

Recon

Recon is the only way to get in and the first of things you should do on a system. Even seasoned pentesters spend a lot of time on recon, and I believe recon will always show you what is vulnerable and what is not. Dueing my exam, I performed the same recon multiple times, as in pivot, nmap tends to fail or not show accurate results. I also spent most of my exam time on recon over exploitation. For network recon, Nmap is always my first priority, but I have heard a few times that masscan is great as well. I believe you should always try out multiple tools. Lets say if you found a wordpress site, then you should always try to use the web application and scour the web application for some possible usernames, or anything like that. Always perform both active and passive recon on your target. After if you ahve a set of usernames you could test, I would probably see the tech stack the web application is usin, maybe through something like wappalyzer. After that I could possibly got for wp-scan since, its a wordpress site. So, Recon is never linear, its a constant back and forth where you keep visiting your scan results, so Always keep you scan results, Always double scan. Also, check for udp ports, not all vulnerabilities live in tcp ports.

Exploits

After Recon, you propbaly have a mapped iformation about system and you think some of the vulnerabilies are in specific versions of systems. You can always check searchsploit for it. But see sometimes, searchsploit might not have what you are looking for. You can always look at github pages, where old vulnerabilities are shown and broken down so you can use either github or exploitdb as a source to scan exploits for services. You would not need to write your own exploit. If you can that's great. If you cant, that's alright as well.

Unsaid Tips

There are a lot of things that people dont say, since oscp is a rigiouros exam, its not just technical, I mean it is completely technical, but you have to remember, you are human! There will be mental fatigue and so much more. So drink plenty of water. Take breaks, and dont be nervous. You can listen to music and all in the exam. so Don't worry about it. Also, when you are waiting for a reverse shell to hit your system, use default ports, don't use non default ports as it creates an issue with reverse shell. Use Ligolo-ng for pivoting rather than proxychains, learn both internal pivoting and external pivoting. Finally, encode you shell's in base6-4 encoding before you ever decide to execute them because AV can flag them if non base-64 encoded.

And Lastly

Best of Luck for your exams!