Failed OSCP

Got right into the AD set which was a little different than the lab sets, which I wasn’t expecting. Still the same basic three machines without giving anything away. I believe people were calling this lab set very hard.

Was able to get a domain user, but with no admin access. Use CME to get all users and tried every way to get passwords or hashes for any users. No unique SMB shares, no kerberoastable users, no repeat credentials, no local auth. Could not RDP , could not use winrm or the likes due to no local admin and maybe not being in remote users group. Dead in the water for 16 hours.

Got a foothold on one standalone but couldn’t escalate,and had an idea of what to do on the others, but the exploits were not working as I expected.

Overall it wss hard but I haven’t exactly been studying like crazy. I took my time with the course and lazily did some PG. I still have a second attempt and I definitely will be more efficient now that I’m familiar. And maybe I’ll get a luckier draw.

Tips

Autorecon and starting a web server in its root directory made my enumeration so much better.

Download libreoffice to your vm so you can view docs you grab from shares

Try wordlists specific to what you are doing along with a generic one (common, raft). API? Use an API wordlist

Look up AD MINDMAPS. These methodologies saved me. No user? Do this. User no creds? Do this.

Keep your lucky rabbits foot close

Best of luck everyone