Things to Remember for OSCP

 

All links for OSCP  Windows Enum  Linux - Enum   

Windows Priv Esc Cheatsheet   Windows Priv Esc Guif.re   

CVE-Exploits                

1) Start Screen Recording using OBS Screen Recorder

2) Check the Machine IP's 
         -   Start Timer (Dont Stay on a Single Machine for too Long) 
         -   Cracked a Machine - Restart the Timer 

3) Start Buffer overflow on the test machine 
         -  Start NmapAutomator on all 4 machines before starting BOF on test

4) Take Screenshots of everything 

5) Start with 10 Points Box after BOF(25 Points); If this is taking too long,
   switch to a new box. Come back to this later. Document Everything.

6) HTTP is Vulnerable Most of the times - start with HTTP 
        - Start nikto, dirb,dirsearch, dirbuster - extensions 
        - robots.txt, config.php, license.txt 
        - Try Default Creds - if the creds doesnt work - try searching for creds for sometime 
        - Try Cewl --> use it for brute forcing 
        - Check for the running application version 
        - Google the application for finding version & exploits 
        - Dont just rely on Searchsploit, search on google as well. 
        - Check Github Exploits as well, read the exploit properly
        - Run wpscan,droopscan if they are found - search for vuln plugins,version 
        - Search for LFI / RFI - got a doubt - Check PDF/ Videos MORE LFI
        - Check for SQL Injections 
        - Check this out for web vulns
        - Check for Tomcat, web.config, cgi-bin exploits
        - 

7) Checks all ports - do a full nmap scan, if u think something is missing 

8) Always check for nmap vulns 

9) Check SMB port 

If linux machine has smb - check version and exploit it 

use smbclient without password and null login as well
Smb SCF file exploit - Using Responder, might not be for exam

10) Privilege Escalation: 

Linux: Few methods available here 

uname -a
sudo -l
sudo su 
find / -perm -4000 2>/dev/null | xargs ls -la     //Files with root privs
ls -la /etc/passwd 
cd /var/www/
cd /var/backups/
search for config files
ps aux | grep root 
netstat -ano
netstat -tulpn
search for writable files
path exploit 
cron jobs  - pspy 
check ./bash_hisroty
mysql running as root ?
cat /etc/fstab
cat /dev/sdb  

pspy -f             /check for running file system tasks


check file permissions -> you are folder owner & file inside is running as roo
Check for unknown binaries 

file binary
strings binary 
cat binary
ls -la binary
Check the file to see if its executing any commands. 
Check for the file paths; 
If the command is cat instead of /bin/cat --> path injection might be possible 
decrease the size of terminal and check for changes
less binary
./binary | less   //Try Getting an Interactive shell with less

Then !Command to execute the command, 
it might only work with a definite screen size

./binary anycommand && /bin/bash 


Windows: 







Metasploit Priv Esc



Compiled Kernel Exploit  Compiled Windows Exploits 

Download the Exam Report & Lab Report Template Here