u/King_000_7

I passed on 19 August with 90 points, first attempt, 1 month and 25 days after I started preparing. I had passed the HTB CPTS two weeks before that, which shaped a lot of this and is probably the most useful context for anyone here deciding between the two.

I wrote the whole thing up because when I was preparing, almost every review I found stopped at "the labs are great, the exam is hard, trust the process." I needed the order. Which machines, in what sequence, what to read in the course and what to skip, which challenge labs and why that order.

Short version of the path:

75 Proving Grounds machines in 24 days. LainKusanagi list first, then TJ Null to fill the gaps. Five a day as a ceiling, not a target, because the point of that phase is the note, not the flag.

I did all Linux first, then all Windows, then AD last. This is the contrarian bit. Doing one OS in a long block is what turns enumeration from a checklist you read into something your hands do. I put AD last only because CPTS had already made it my strongest area. If you are not coming from CPTS, flip that and give AD the biggest block you have.

The PEN-200 text in 5 days, skipping the videos entirely. That was only possible because I already had CPTS notes covering most of the syllabus. My course progress bar said 36.3 percent on exam day.

9 challenge labs in 10 days: Secura, Zeus, Poseidon, Laser, MedTech, Relia, then OSCP A, B and C. A, B and C are closest to the exam in shape but not in content, and skipping the first six to rush them is the most expensive shortcut available.

Two honest admissions. I did not take A, B or C blind and timed, because I was on a compressed schedule and chose speed. I think that is directly why I burned five hours on my first exam machine. And I wrote no challenge lab reports, which was only safe because I had just written a 189 page CPTS report.

Exam day, the part worth reading:

I went at the AD set first and hit a wall for five hours. Zero points. The cause was not a hard machine, it was me running CPTS brain, building theories and chaining ideas because I assumed the answer had to be sophisticated. I took a 15 minute break, came back, decided to stop being clever, and ran the simple enumeration I should have run at minute ten. The whole AD set fell in the next 35 minutes.

That is the single thing I would tell anyone coming from CPTS. The OSCP rewards the boring answer. Try the documented exploit for the version in your nmap output before you build anything.

After that I sorted the standalones by open port count and started with the fewest. Smaller attack surface usually means a more focused intended path. User and root on the first in an hour, then user only on the other two, then back around for one more root. 90 points at about 3:30 AM, then I slept, verified evidence in the morning, and stopped.

One more thing that nearly cost me everything. During the report window I left my VM running and stepped out, and a driver issue restarted my Windows host. Every terminal and tab gone. I lost nothing, because every flag went into Notion with its screenshots the instant I got it, not at the end of the machine. If you take one habit from this, take that one.

Tools that earned their place: Ligolo-ng for pivoting, NetExec for the AD set, BloodHound CE rather than the legacy build, and more than one privesc tool because WinPEAS misses things that SharpUp and PowerUp catch.

Report was 68 pages, written in SysReptor using their OSCP template.

Full writeup with the dates, the lab order, the exam hour by hour and the screenshots:
https://medium.com/@hydra007/how-i-passed-the-oscp-with-90-100-in-1-month-and-25-days-straight-after-cpts-fa2122edea76

And the CPTS one that came before it, if you are weighing that path:
https://medium.com/@hydra007/how-i-passed-the-htb-cpts-with-a-perfect-100-100-on-my-first-attempt-736226738cde

Happy to answer anything in the comments.

Passed in June, 14 of 14, first attempt. I had been meaning to write it up for months and finally did.

Rather than repeat the whole thing here, the four things that actually changed my outcome:

1. Treating it as an AD exam is the most common mistake I see.

Everyone drills Active Directory and skims Using Web Proxies, Ffuf, file inclusion, file upload, and command injection. Count how much of the Penetration Tester path is web. Your foothold is more likely to come from there than from Kerberos.

2. Finishing the Academy path makes you eligible, not ready.

The path teaches techniques against targets built to be receptive to the technique you just learned. The exam does not care what chapter you are on. The official CPTS machine track plus the IppSec list is where methodology actually gets built, and methodology is the thing that pulls you out of a rabbit hole on day four.

3. My worst stretch was entirely self inflicted.

One flag cost me two full days. When I finally got it, the answer had been sitting in the basic, obvious category the whole time and I had walked past it repeatedly because it looked too simple to be right. My order now when stuck: try the simple thing, take a break, enumerate again from scratch, then search anything the modules never covered.

4. Write the report as you go.

Flag, then report. The one exception is being mid chain, in which case finish the chain, then document the whole thing before starting anything new. That rhythm is why the hands on work and the report both finished inside 5.5 days instead of me facing an empty document on day eight.

Full write up if you want the dated nine month timeline, the day by day exam breakdown, my notes setup and the cheatsheet I built from it:

https://medium.com/@hydra007/how-i-passed-the-htb-cpts-with-a-perfect-100-100-on-my-first-attempt-736226738cde

https://divyeshs-organization-1.gitbook.io/cpts-cheatsheet

Ask me anything about prep, happy to go into detail.