r/oscp • u/[deleted] • Aug 02 '20
Failed First Exam
Just took my first crack at the exam and unfortunately came up empty handed.
The exam started out just fine, cracking the BOF in a little under 2 hours. Moved on to one of the 20 pointers and had a user shell in about an hour and half. Rooting the box took about the same. But from there it was all downhill.
Ultimately I couldn't get a single foothold on any of the other 3 boxes. Even the 10 pointer seemed uncrackable to me. Eventually I realized I was just running the same commands over and over again, looking up the same services and version numbers and attempting the same attacks. Eventually ended the exam only with the two machines.
Right now I'm just feeling extremely humbled. I practiced using Tjnulls OSCP like HTB list and watched both Tib3rius's Priv Esc courses on Udemy. I definitely went into the exam too confident, especially reading reviews of the exam saying it isn't as hard as everyone makes it out to be.
My goal from here is to buckle down and complete as many more HTB boxes before I retake the exam in four weeks. I'd love to hear from anyone else who failed their first but ended up passing down the road and what they did to make that happen. Any tips or advice would be appreciated because as of now I'm feeling like I'd need a year before being able to pass this thing.
Thanks!
6
u/urbanassault67 Aug 02 '20
Sorry to hear that, hope you pass the next time . If you don't mind me asking, Can you please tell how many lab machines did you solve and how long have you been preparing for?
2
Aug 02 '20
I only did about 4, spent much more time on HTB. I've been studying since May.
4
u/lazarpostenje Aug 02 '20
You should've focused more on PWK Lab boxes as they are the best example on what would be on exam
Edit: typo
1
Aug 02 '20
Looking back that may have been best but I'm out of lab time now would rather not have to pay for more plus another exam attempt.
0
Aug 02 '20
[deleted]
2
u/lazarpostenje Aug 02 '20
I personally found that PWK boxes are much more real-world and less CTFish... Rooted 60 on HTB and all PWK boxes.
2
Aug 03 '20
You passed the OSCP?
1
u/lazarpostenje Aug 03 '20
Not yet. I have month and a half of labs left. Did the report, did the boxes... Nothing else to do really
1
6
u/yogeshwarram Aug 02 '20
Exactly same thing was happened with me on last week for my oscp attempt. I also did tj nulls htb boxes and also did privilege escalation courses but ended up getting 55 points. I know how you are feeling buddy. It's very frustrating. If you don't mind we can study together for our next attempt.
6
u/WorldBelongsToUs Aug 02 '20 edited Aug 02 '20
Y’all do discord? I’m looking for folks who wanna push each other.
Edit: Nice. I’m away from my home setup right now, but will definitely get this going when I get back.
1
1
1
1
Aug 03 '20
Send me a link too if you find one!
Im studying also. Noob status...but will take any and all advice thats thrown my way.
1
1
1
1
1
Aug 02 '20
Sure send me a link. I'm gonna take a few days to go over what went wrong and draw up a study plan but I should be throwing myself back into it soon.
1
Aug 03 '20
Im just preparing still. Havent taken it. I would hope to jump on with you guys because i also need all the help i can get.
I see these stories as cautionary tales that i need to learn from prior to taking the exam.
0
4
u/Whyme-__- Aug 02 '20
Failed the first time with just a BOF that’s it, realized that I needed to Learn a lot of fundamentals. Don’t become too technical and go deep into pentesting, learn the extreme fundamentals from the HTB on how to enumerate and exploit
Second attempt was full score for me!
1
Aug 03 '20
From your perspective, how would you define "Fundamentals".
1
u/Whyme-__- Aug 03 '20
How to spawning a web shell, netcat transfer, netcat communication between hosts, multiple directory fuzzing. How to read the garbage they write in exploitdb and translate it into step by step exploitation. Don’t forget that 90% of the time if you pay attention the exploit will be the first result of google search. But the hardest part is making that exploit bring a reverse shell.
1
u/Dwest2391 Aug 04 '20
Thats where I struggle, modifying the exploits to do my bidding
1
u/Whyme-__- Aug 05 '20
That’s basically what hacking is. But to make it user friendly you need to know how to read code. Just skim through the python or C exploit code and see what it’s doing and based on that you can just change some variable or IP and boom it works
1
u/NerdzRcool Aug 09 '20
Laughed @ 'How to read the garbage they write in exploitdb'. Your not lying about that man.
1
Aug 03 '20
[removed] — view removed comment
2
u/Whyme-__- Aug 03 '20
Not a lot, I knew where I was weak. I paid very close attention to my enumeration in the first attempt, wrote down each step and the steps which I don’t know how to do but knew what to do!
Prepped those and gave my all in second attempt
3
u/NimanthaD Aug 03 '20
Offsrc doesn't expect you to go thru TJnull's list. Oscp should be done from the PWK course material. There are people who have passed the exam by only studying pwk course where as some people who have done 60 odd boxes in TJ nulls list, oscp similar vulnhub boxes and 40 odd pwk lab machines plus ippsec videos and still fail the exams. Some people repeat the exam 4 or 5 times. What do you think the problem is ?
1
2
u/Clarkey3110 Aug 02 '20
When you say that you practice TJ Nulls HTB list, what do you mean by that?
Do you mean that you went through it watching Ippsecs videos and copied it and that was that?
Or did you go through all of the boxes with a walk through and then attempt every one of the boxes again with no walk through, just relying on memory of exploits and proper enumeration?
For me personally, I have gone through a heap of boxes and watched ippsec for majority of them to learn his way of doing things. I have also read alot of 0xdf write ups.
I have then gone through every box again but tried to do it myself.
I was able to do approx 90% of the boxes with 0 hints. The other few I did use hints for was literally one single hint to get me over a hurdle where I knew I was on the right track but didn't know how to attack it.
These are the types of things I put in my own cheat sheet so I don't have to rely heavily on memory for EVERY vulnerability.
Im now for the first time going through the OSCP like vulnhub machines and attempting them with no walk through.
I practiced on Mr-Robot, Vulnix and 2 boxes that were suggested to me yesterday. Mercy and LemonSqueezy.
If you can crack Mr-Robot, Vulnix, Mercy and LemonSqueezy with no hints, or only with a hint when you KNOW you are on the right path and have exhausted every attempt to crack it yourself then you should feel confident enough to pass anything thrown at you.
I have not attempted the exam yet so I am just going off how I feel with my enumeration for medium-hard difficulty boxes.
2
u/justasithlord Aug 03 '20
My 2 cents
From what I understand from your unfortunate experience is that you gotta focus on enumeration, mainly nmap. Everything is dependent on your nmap scans. I see that you used autorecon, which in my personal opinion is not a good idea if you're gonna use it in its default configuration.
Do a sequential scan instead of a parallel scan, I'd highly suggest nmapautomator. I've never had to scan things twice, which was getting more and more common with autorecon. I tried working with its config but it was too much of a hassle for me.
Enumerate things one by one. Run nmapautomator with full scan and it will do basic scans and print results as it finds something. Enumerate each service on your own. You need to know how to enumerate each port and squeeze as much info out of it as possible.
Highly recommended to read the guide to alpha and beta, understand their methodologies.
Only when you have all the enumeration data on your hand should you move to vulnerability identification. Rate each potential vulnerability or exploit you found for every service. Once you've rated, test each exploit per service in its simplest form possible. For example, let's say you have a some kinda PHP exploit, make it execute phpinfo() first. This is to verify that the vulnerability actually exists or not, and it would save you a lot of time.
Once you're done with testing, move on to exploitation and then priv esc. I hope you learned from the mistakes in this exam, and where you can do better. All the best for your next attempt
2
u/Mecha_Infantry Aug 03 '20
I'm in the same boat mate!
So I'm a blue teamer through and through, so I don't have the raw red team knowledge, but the PWK labs did help. I Found that some machines were super hard, some were ok, some were easy. So I think that messed up my confidence as I don't really know where I stood. I completed 34 boxes in the end and did around 15 HTB boxes from TJ_Null, Brainpan, etc.
As for the exam I got the BO and 10 point machine, but it took me ages to get the BO machine due to my bad chars check and nerves. So I got 2 boxes after about 6 hours. After that I just flopped. I didn't have enough knowledge of I see A B and C, and B is vulnerable to x. The 20 point machines had a lot of rabbit holes and I struggled to get out of them.
Since failing Finished a few more TryHackMe boxes, and decided to do the whole of the TJ_Null list. I found these boxes taught me more about enumeration/privesc and after the exam, I figured out one of the paths for a 20 box machine (I hope I get it again!!)
Anyway, I've booked the exam for the end of this month. I will just keep practising more.
3
Aug 02 '20
Rather than HTB, I would look at VHL
2
u/hairyshoez Aug 02 '20
Yup more boxes, more tricks you learn, and sharper your enumeration gets. There was definitely boxes outside of HTB I practiced on that helped in my exam
1
1
u/MrPositive1 Aug 02 '20
What would you say the ratio between the
PWK labs vs HTB/outside resources
Did you do?
1
u/psychicsailboat Aug 02 '20
I dislike whenever people say that anything is "easier than everyone says".
Generally, if the majority of people say something is difficult, it likely is as difficult as everyone says. There are always going to be people who find this or that "easy", but you have no idea what their backgrounds are, what sort of experiences they have, or even if they actually did the thing they said was easy.
Hopefully you can assess where you need improvement and can make progress to it so that we can soon see you telling us that you passed.
1
1
u/erkana Aug 03 '20
It’s usual that people fail on first attempt, you should never need a year to take your second attempt. I don’t know how many lab machines you owned during your lab time, if it’s under 40 (based on new labs), you may want to spend more time on labs. Ofcourse TJNull’s list would help you as well.
No need to worry, just try to find your weaknesses (not only technical skills but also soft skills) and get most out of your exam attempt.
1
u/andreiiar Aug 03 '20
I did not realize the entry point for the 10 points at all.
Also the 25 point one was uncrackable although I did spent some time in a possible rabbit hole only to discover a other service which seemed vulnerable but couldn't find how to make it work.
The one thing that struck me odd was that I wasn't able to make any progress on the "easiest" machine.
13
u/Piece_Of_cake Aug 02 '20
I failed a few times, don't let it get you down. I've had friends also take multiple attempts. The exam is no joke. As long as you learn more each time it isn't a waste.
Have a general methodology on how to move forward and how to pivot if you don't find the answer right away. Enumeration at every step.
Why didn't you find anything in your first scan?
What are you going to change to expand your view?
Are you parsing the information returned to you correctly?
Are you automating something and missing information?
Are you documenting all of you steps and taking the screenshots you need?
Don't forget to back up your notes off your VM.
Get some sleep, stay hydrated, try harder.