Targeting Oscp A Journey Into The Void

Posted on

Journey and review of accomplishing the Offensive Security Certified Professional Exam (OSCP). Documenting the ups and downs creating an attack plan and colminating in achievement.

Overview

The Offensive Security Certified Professional (OSCP) is more than just targeting boxes and popping shells. What you sign up for is a journey; one filled with fear, anguish, self-doubt, and frustration but rewarded with the resolve to overcome obstacles. Understandably, this path is not one for someone who is a dabbler. You WILL require a fire within and a drive to succeed that you might not know is inside of you.

At the destination of this journey, you will be a different person. You are required to be one who has a mindset to look for solutions and preserver through adversity.

Impossible, no. Difficult, yes.

You are going to need to have an honest conversation with yourself. “Is this something I truly want?” and only you can honestly answer.

First Attempt

I had initially signed up for a 90 Day - Penetration with Kali (PWK) Lab and crossed the borders of all networks tackling box after box on the proverbial “struggle bus”. Leading me to accomplish a majority of the boxes but lacking that methodology needed.

Key Takeaway: I failed to realize the purpose of the labs and was focused on an arbitrary number of boxes. I didn’t take into account that this is where you would practice targeting services and honing your skills. I treated the whole event as a Capture the Flag (CTF). This was a mistake.

Jumping into the first exam attempt I choked. My mistakes from the labs became glaring. My Buffer Overflow (BOF) took close to 8hrs to accomplish. Scrambling notes trying to understand why things would not align. I just didn’t have the experience to truly understand what exactly was going on in a stack overflow. From one blunder to another to a complete loss of confidence. I felt the failure as a complete blow to my ego and my efforts as fruitless. I didn’t touch a box for 3 months.

“Everyone has a plan 'till they get punched in the mouth” - Mike Tyson

enters depression and imposture syndrome… This is real and you should be very aware of these feelings. You must have the “why” dialed in to call upon in these times.

Time to Rise Above

Key Takeaway: Have a plan for failure and understand it’s all part of the process. Remember F.A.I.L is simply the “first attempt in learning”.

After taking some time to reflect and really dial in my personal “why” and we got back into the zone analyzing my weakness of stack overflows and developed a concrete methodology. I knew what I needed was more experience and so into the fire I went:

Full Course Immersion:

Buffer Overflow Training:

I needed to sharpen up my skills and buckled in for the ride.

Second Attempt

Leading up to scheduling the exam, I created a plan to review privilege escalation and to do that I would use Tib3rius courses:

I put the exam three weeks into the future. First weekend leading to exam completing a course, second weekend accomplish second course. Third weekend, compile my lab notes and exercises completely formatted and ready for submission along with setup exam lab template (based off lab template).

Key Takeaway: Step back and create your plan of success. Understand your weaknesses and attack them head on. Do yourself a favor and complete the lab exercises and document them in your lab report.

It felt different right from the start. I had the methodology that I was missing I had the experience I so needed and all pulled together I aligned myself on the runway and SENT IT!

Exam Setup

Exam and Lab Reports

There is more to this than meets the eye. Make sure you thoroughly read all the instructions given to you by Offensive security (then read them again). My recommendation is to do as I did and use the standard template offered. (Offensive Security Lab and Exam - Template)

Could you use something else, sure. In the end you should be focused on NOT complicating your life not looking for ways to make it harder.

Key Takeaway: You have the ability to receive up to 5pts extra for completing the lab exercises. Imagine how you would feel if all you needed was those 5pts to pass? My flight instructor would drill into our heads “It’s better to be on the ground wishing you were in the air, than in the air wishing you were on the ground”.

System Shakedown

The days leading up to your exam you should perform a shake down of your system. Understand you will be taxing it with your VM, host system and the monitoring software used by Offensive Security.

Take a snapshot of your VM you plan to use during the exam and make sure you have a plan for disaster.

Make sure your webcam is in working order and all drivers are preinstalled on system.

You will need Chrome browser and a few extensions that Offensive Security will give instructions on the setup. I personally use Brave Browser (and so should you) and had to make adjustments.

“If you fail to plan, you are planning to fail!” - Benjamin Franklin

Post-Flight Briefing

Final Thoughts

What you are tasked to do is not impossible. There are solutions to all problems and it’s up to you to use the resources and knowledge and find those solutions. You will become frustrated, you will have doubts, it will feel emotions rush through your veins as you inch closer and closer. I can’t give details about the exam but I can say believe in yourself and understand you have everything you need right in front of you.

As you embark on this journey everything will not be given. You will need to search and develop those methods. Gather your notes in an orderly fashion and as chaotic as a seems to stay organized understand that too is part of this process.

whoami I’m ExecuteAtWill and I’m an Offensive Security Certified Professional.