Passed OSCP 90/100, here is what I wish I knew earlier
Hey everyone, wanted to make a thank you post for this OSCP subreddit, I had a lot of doubts before my exam and naturally as do some of you. So I wanted to make a post of things I wish I knew before I started.
How to prepare ?
- I started with HTB CPTS path, I covered these following modules as they were the most relevant. Nmap, Footprinting, Password Attacks, File transfer, Shells & Payloads, Attacking Common Applications (Only tomcat,joomla, wordpress, drupal, jenkins), Attacking Common Services, SQLi, Command Injection, File inclusion, Ffuf, File upload attacks, Linux priv esc, windows priv esc, AD attack and enum. I highly recommend HTB over offsec course materials.
- If you feel your priv esc content is abit shaky, I reccomend ti3brius udemy course.
- If your AD content is abit shaky, feel free to watch hackerblueprint on youtube, his content is very good.
How to study ?
- Study within your means, i.e if you can study 3 hours a day, then do so, dont try and cramp some crazy "How i got 100 points in 3 months" ahh routine
- I did CPTS path then I did boxes before leaving challenge labs ABC to the last
Best part, which boxes do i do ?
As someone who did (almost) everything, heres what I reccomend
- Proving grounds -> you MUST do them, theyre made by offsec, so theyre the most similar to what youll see in the exams, though AD is abit older, the priv esc portions are still applicable. I did both Lains and TJNull list. Feel free to use hints and walkthrough. I did like maybe 60% (?) with hints/walkthrough.
My exam boxes difficulty was around medium,
AD -> Medium
Standalone #1 foothold medium, priv esc medium
Standalone #2 foothold easy, priv esc hard
Standalone #3 foothold medium, priv esc easy
- Hackerblueprint -> the GOAT i dare say for AD (Im not sponsored) i bought AD labs from 1-9 and did all of them. They are in my opinion well made, and really reinforced my methodology for AD. I love this place, do check it out. He also give free access to the labs when they first come out so keep your eyes peeled on his discord/reddit/twitter (I was always slow so I did not get any lol). He also replies your DMs to help, what a chad.
- Hacksmarter -> Pretty well made, shoutout to them for making the subscription so cheap though love yall. Community is also very friendly and the king tyler will reply whenever he can <3. However their AD machines only have the DC meaning you wont get to experience much pivoting but they make up for it by making you practice lateral movement. CORRECTION: a user pointed out there are some machines that have 2-3 machines, but ive not tried those.
- Virtual Hacking labs -> It is alright I guess, its not THE best but not THE worst either. You could honestly live without it. Mainly used it for standalone practice. Its pretty pricey too, so thats a downside.
- HTB -> I did like maybe 5 machines or so ? Pretty hard hahahaha more CTF-ish in my opinion. Could just watch ippsec and take notes. S1ren for OSCP walkthrough is also very good, she explains stuff pretty well and intuitive.
- Challenge labs -> I did 1 a day to test if I was ready, if I passed them, I knew I was ready. No stress if you cant do them though, I struggled on OSCP A. But if youre interested, I passed all of them without hints or walkthrough.
Exam Tips
- Follow the methodology you built
- Keep it simple, I read somewhere here that the path to a foothold/priv esc is always 3-5 commands away, and its pretty true, less AD
- Use sysreptor for making your exam report
- Take frequent breaks, I was stuck for a good 10 hours and then I showered, contemplated life, then suddenly hit my flow state and reached 90 points.
Methodology I used
Well this can be very long and detailed
AD -> use nxc to find shares, winrm, rdp rights. Get a foothold and set up ligolo. Run bloodhound, check for any outgoing rights, kerberoast, asrep roast, look for sus files that may contain credentials. If nothing, try windows priv esc, if nothing look at other services, maybe a FTP, MSSQL, MySQL or something and see if theres any low hanging fruits. Rinse and repeat till youre DC.
Standalone -> Foothold is usually easy to find, enumerate the services very hard. Once in throw everything including the kitchen sink, winpeas, linpeas, pspy, PrivescCheck
Tools in my GOAT list
- Ligolo-ng for pivoting and port forwarding, super good
- nxc >>> crackmapexec. The wiki is super good, I reckon you could do 90% of boxes if you use nxc well.
- PrivescCheck -> More concise than winpeas, no choice then run winpeas and slowly look for clues
- bloodhound -> so useful for AD, cant do anything without it
Do feel free to DM me or drop a qn here if possible so everyone can see the answer to it. (And no dont ask me for the exam qns, ill ask for your OSID and report you to offsec)