My itinerary to OSCP
By: Mounish Periasamy
Tags: Hacking, Oscp, Information Security, Penetration Testing, Oscp Certification

//Please don’t mind typo and grammatical mistakes :P

Who really I’m

An Electronics and communication Graduate, who was totally into the world of electronics where I used to play with controllers, sensors, hardware, eventually breaking and burning them to grab my first job as an Embedded Developer before I got introduced to the world of security.

Where it all started

Back in 2017, I and my other friends were interested in enrolling for the OSCP and we created one WhatsApp group. Well, we all know for how long the group will be active :P.

Since I’m from a hardware background I’ve no idea about the network and web app security, to be precise I didn’t even know how to use Metasploit. so I made up my mind and started watching a CEH course (youtube of course) where I have learned a lot about different tools and methodologies. Later in 2019, I was able to secure funding from my current organization to pay for a 90 days lab for OSCP.

The Journey

My journey started back in Nov 2019. A month before my lab started, I asked my colleague where to and how to begin with and the reply I got was

OSCP is a journey where you learn and evolve yourself, so all you need to do is search, read, explore, and try

Still, whenever I’m stuck during my lab, instead of giving me direct hints they ask me questions that really make me think and find a way around by myself. Thanks to Nalla Muthu, Prasath and Sriram.

So I started with OSCP-like-machine, the main goal here is not about solving them, it’s all about what we are learning by solving them. I haven’t solved the 1st machine by myself because I had no idea how to and where to start with. I read the walkthrough and solved them while reading the walkthrough I understood that enumeration is the key to exploit a machine.

So after that, I started solving machines by myself, where I made up my mind that I need to solve one machine a day. After solving I read multiple walkthroughs for the same machine because it helps you to understand different methodologies and approaches to the same machine. So in 10–12 days I had solved nearly 7–8 machines. So for the next 15 days, I spent time writing automation scripts, learning and practicing buffer overflow, preparing my kali machine, reading the walkthrough and making a note of them.

Read multiple walkthroughs for a single machine

practice buffer overflow with two different executables

prepare your kali machine for the lab, it’s not stable so it crashes sometimes. so I personally recommend using a shared folder if you are running in VM/Virtualbox

Select the tools which you are going to use, whether it’s SPARTA, Nikto, dirb,dirbuster,gobuster, etc.,

If possible write an automation code for enumeration or use any of the existing

Get familiar with msfvenom commands, supported payloads, and the output format

Enumeration

The most important when it comes to OSCP, without proper enumeration you won’t be moving ahead in any of the machines. so if you are good with Nmap commands, Nikto and dirb command it’s better to automate by writing your own script ( i wrote one for myself) else there are two wonderful which really helped me during my exam and these are nmapautomator and AutoRecon.

Lab

During lab it’s highly recommended to take notes of each and everything you do/read and organize them properly, I personally used one note for taking notes. These notes are gonna help us in the exam and for preparing the Lab Report as well. My notes have the links which I clearly understood, Nmap commands, reverse shell commands, steps involved in solving a machine and so on.

Don’t push yourself much, solve one machine per day and take time to understand what actually you did and read about all the ports/services and check if there is an exploit available for those service/ports. it won’t be helpful right now in the lab, but it’s gonna help you somewhere(bug bounty, interview.etc), or maybe in the exam as well.

You can’t connect the dot looking forward; you can only connect them looking backward. -Steve Jobs

My lab expired on the 1st of Feb, and I have pwned nearly 35 machines, I was confident that I can clear the exam after learning and pwning 35 machines. I was so confident in Linux privilege escalation while compared to windows privilege escalations, Still, I booked for my exam like a dumbass.

Don’t go for SMB exploit in the lab, because by doing that we are solving machine, but we are not learning something new in that machine. If the enumeration shows the system is vulnerable to SMB it’s good to skip and try another way to exploit the machine.

DOs

Always Revert the machine before you start.

The IRC Bot is really useful, it helps you with hints for some target.

If you are using your own commands for enumeration, make sure to save the output to a file and the commands to your notes section.

Wait for 5–10 min after reverting a machine, because some service will take time to start.

Every machine will have proof.txt located in the administrator desktop (Windows) or root directory (Linux).

Join Infosec prep discord, there you’ll get some hints and guidelines.

Read the PDF and Documentation shared by offsec, because it provides you with many basic things that are really helpful.

DON’Ts

Don’t use MSFconsole in the lab, try to solve everything without Metasploit.

Don’t use a mobile hotspot during your enumeration, it won’t be efficient and most of the time you’ll be getting an error.

Don’t give up, if you start with a machine try to focus and push yourself to finish it.

Don’t skip a machine, until or unless it is a duplicate machine.

Big Day — Big Failure #attempt 1

I booked my exam on Feb 19 around 16:30, I was so nervous around 4 PM like a man who’s waiting outside an operation theatre :P.

To be OSCP certified you need to get 70 points. First 24 hours to pwn the machine and another 24 hours to deliver a professional pentest report detailing each and every step with screenshots.

The exam consists of 5 machines, where a student will be provided with points and the objective for each machine.

Since I was so confident in buffer overflow, I thought of solving it on the 1st. It’s an easy 25 mark which will obviously boost us to go ahead in the exam with positive energy.

In the first attempt, I took more than 10 hours, still I didn’t solve my buffer overflow which I thought “it’s a piece of cake”, I lost my confidence, I was fully shattered and exhausted. so I took a nap for 4 hours and then worked and started freshly and I solved the machine in an hour. While starting buffer overflow I triggered my automation script for all the given IP. Then I solved the 10 mark machine and tried other machines. As time went on I lost myself totally and I have only solved 2 machines.

So from my 1st attempt, I learned a few things, which really helped me clear my exam in the next attempt.

Take away

Manage time wisely

If you are stuck, it’s ok just move on to another machine.

Take frequent breaks to clear your head, whereas I was thinking about the same machine for 10–12 hours.

Don’t consume too much time for a single machine.

Don’t lose your temper, be patient enough to go through the enumeration outputs.

Don’t lose hope and think “I can’t even solve buffer overflow and how I’m gonna solve all this”, it brings you down.

Before taking my second attempt I prepared myself, I worked on the area which I really lagged. I focused more on the enumeration part, I found tools like nmapAutomator and Autorecon which I tried against the HTB machine to check how it’s working and watched videos from IppSec.

He has solved many machines and categorized them according to the level of hardness. Instead of solving the machine, I watched nearly 10–12 videos and learned many things from the video which really helped me in the exam for my enumeration and to approach the target machine.

Another Big Day — Hard work never fails.

I started my exam around 1:30, this time I was calm and relaxed. Whatever I learned from my last attempt and a month gap between attempts gave me confidence that I can do better than my previous.

In the second attempt, I ran Autorecon and nmapAutomator for all the machines before starting buffer overflow. I finished my buffer overflow machine in 35 min, unlike last time.

By that time most of the scans were done, so started with the 10 point machine, then moved to a 20 point Linux machine (I’m good with Linux privilege), then followed by other 20 point machines with a lot of breaks. After 6 hours of exam, I almost had 65 points in my hand. Now all I have left is a one 25 point machine, it’s one hell of a ride I would say !! The exploit which is available was not working, so tried rewriting the code, tried another way around to reproduce the exploit but nothing helped other than msfconsole. I really don’t want to use it, but I got no other options and was a little exhausted trying out multiple ways.

I had a good sleep for 7 hours, then I started with the privilege escalation for the windows machine. Few things need to be done before finishing the exam.

check your notes for steps, it’s gonna give hand during your report.

Make sure you have a screenshot for all the steps you did to pop a shell in a machine.

Make sure local.txt and proof.txt are copied to your notes, please do cross verify whether the value is the same in your screenshot as well the exam notes. There is a hell lot of chance for human errors and there is a possibility one can fail because of this small mistake.

Make sure the limited shell and privileged shell screenshots meet the offsec requirement or according to what they have mentioned in the game guide.

I took an hour to verify and make sure everything is good and I haven’t missed any screenshots. When you are confident enough with your screenshot and the steps it’s good to finish the exam.

Exam & Lab writeup

When my lab was about to be over, I took two days to write my lab report. so now I don’t need to worry about this since it has been done a couple of months back.

For the Exam report, I have spent nearly 6 hours. Once I finished writing I verified it thrice taking time to make sure each and every step is detailed with the appropriate screenshots and the modified code. I used the offsec template for writing both the exam as well as the lab report.

After 3 days of my report submission, guess what I got? The most awaited mail from offsec saying that I’ve cleared the OSCP Exam !!!