Starting OSCP - 31/1/16

Hi guys, been lurking on this forum for a couple of weeks now. Got loads of help from some of the OSCP threads on here so thought I'd make my own.

So my previous experience is mainly self-taught, I've done Sec+ and net+ courses, but not the exams due to other factors. My self taught skills lie in a broad spectrum, I enjoy RE and binary exploitation, pentesting, and a bit of forensics. I'd say my biggest weakness is web app hacking (going to spend the next few weeks getting up to scratch on this).

Programming languages I'm confident with are C, python (use mainly for CTF's), java (for uni), and I can write pretty basic assembly from scratch (mainly for custom shellcode exploits).

A few questions from people who've been there and done it:
Did you guys take notes as you went through the course material (not the labs), I'm a heavy note taker, I tend to write notes by hand, then type them up at the end of the week. Reckon that'll be doable?

How prevelant in the labs was web based hacking? It's (through my own fault) not my best area, obviously I look to improve on this.

So thats pretty much me. I'm doing this mainly to learn, if I get a cert out of it at the end then its just a bonus. Cheers for reading, I'll update this as and when I feel I should.

Find more posts tagged with

Free for TechExams community: Cybersecurity salary guide

Compare cert salaries and plan your next career move

Button

Comments

diggitle

c colon I net pub dub dub dub root

invictus_123

diggitle wrote: »

c colon I net pub dub dub dub root

????? What are you on about

invictus_123

Almost 24 hours on the dot from when I sent my report and I received the dreaded email. Certain I had failed but unsure as to whether I was ready for the news, it took me ten minutes and a cigarette break to calm my nerves. I finally got the courage to open it, as soon as I saw "We are happy to inform you...." I let out a massive YES!!!! I re-read the email three times to double check, but I have successfully passed the exam!

I have to say that was the best feeling I have had in ages, this course has taught me a hell of a lot. I will get round to doing a full writeup of the labs and exam once I've got some spare time - I have a lot of actual work to catch up on!

Jebjeb

Nice job, Congrats!

JasminLandry

Awesome, congrats! Starting my journey April 9th, can't wait!

invictus_123

JasminLandry wrote: »

Awesome, congrats! Starting my journey April 9th, can't wait!

Good luck youre going to love/hate it!

My best advice for you is to thoroughly document your lab time. Once you gain root on a system, revert it, and go again, redoing your notes in such a way that you can come back to it in a months time and do it from just those notes (take lots of screen shots as well). This was my biggest downfall and I wasted a lot of time re-exploiting hosts.

invictus_123

JasminLandry wrote: »

Awesome, congrats! Starting my journey April 9th, can't wait!

JoJoCal19

Congrats on the pass!

Sheiko37

Congratulations.

Sch1sm

Congratulations. Can you go into some detail about what your lab report had? How detailed was it? I wasn't planning on submitting one but your post made me reconsider.

Congrats!

Congratulations!

Congrats.

Sch1sm wrote: »

Congratulations. Can you go into some detail about what your lab report had? How detailed was it? I wasn't planning on submitting one but your post made me reconsider.

I highly recommend doing your lab report before the exam. I didn't, and so had to report on 41 hosts after a 24 hour exam where I hadn't slept.

So in my report I had to go of my pretty rubbish notes. I basically just put down how I rooted the system. So, if it was a rfi and then kernel priv esc.

Remote file inclusion and kernel exploit
Vulnerable host: 1.1.1.1
Vulnerability explained: the web app running on this system was vulnerable to a remote file inclusion due to poorly sanitised user input. A malicious user could use this vulnerability to execute arbitrary server side code. For example 1.1.1.1/index.php?path=1.1.1.2/shell.txt

And then do the same thing after that for the kernel exploit.

Something i did which I think I helped is in the exam report, I reported on the machine that I didn't get in to. I described what I thought was vulnerable and how someone (better than me) might use that to get it

Jebjeb

Interesting, sounds like you got the last 5 points due to the lab report. First real story I've heard confirming that. Should motivate more of hte slackers (like myself ) to do the report.

invictus_123

Jebjeb wrote: »

Interesting, sounds like you got the last 5 points due to the lab report. First real story I've heard confirming that. Should motivate more of hte slackers (like myself ) to do the report.

The thing is you just don't know what's going to happen in the exam. I was quite confident that I would do well, and so didn't do a lab report. How wrong I was!

I think it just can't hurt to have your lab report ready just in case. I suffered a lot trying to write one straight after the exam

tceu

Congrats - and thank you for your helpful explanations!

renacido

Congrats!!

djctwo

invictus_123 wrote: »

Been a few days since I've posted here and thought I'd give an update.

So I took the exam on sunday and it was the hardest thing I've done in a long time. The systems were much more up to date than the lab machines and there didnt seem to be available exploits for many of the services. All in all I'm unsure as to whether I've passed, if they count a low privilege shell on a 20 point system as being worth 10 points, then I achieved 65 points in total. It is then up to the offsec staff to decide whether my poorly written lab report covering the 41 rooted systems is enough to bump me up to 70 points - something tells me it wont be enough.

I learnt a lot from the exam and once I get the email telling me I've failed, I'll re-book it for a week or so's time. If anyone has general exam questions let me know.

Now that you've taken the exam and the exam machines are different/harder do you think the overall course prepared you for the exam though?

invictus_123

djctwo wrote: »

Now that you've taken the exam and the exam machines are different/harder do you think the overall course prepared you for the exam though?

Absolutely. Bear in mind I had zero pentesting experience, so I learnt an absolute ton going through the labs.

And whilst I couldn't directly apply knowledge of exploiting a certain lab host to an exam machine, it's the way you go about exploiting hosts that you learn which is important.

Sheiko37

invictus_123 wrote: »

I'm unsure as to whether I've passed, if they count a low privilege shell on a 20 point system as being worth 10 points, then I achieved 65 points in total.

It's interesting going back and reading this. I emailed them for feedback after failing the exam and they said "partial points are awarded for systems where full root access is not achieved but you can safely assume that non-root access earns less than half the points for that particular target."