Exam Review — Trends & Attack Patterns

Cross-cutting patterns observed across all exams (Exams A–F). Use this as a pre-exam mental checklist.

Port Enumeration Priorities

Where Credentials Hide

This is the most consistent pattern across all exams. Every machine had credentials somewhere — the question is where.

Linux

• .env files — DB username and password in plaintext. Found via rsync shares or linpeas. Always present on web app boxes
• seed_db.py / migration scripts — Hardcoded credentials used to seed the database. Found in rsync shares
• .mysql_history — MySQL root password in ALTER USER statements. linpeas flags this
• Application DB tables — developers, users, internal_auth.users — bcrypt hashes and sometimes plaintext

Windows

• Web.config — MSSQL connection strings with plaintext credentials. Found in SMB shares (WebDev, legacy/)
• DVRParams.ini — Encrypted Argus Surveillance DVR admin password. Found via anonymous FTP. Crack with CVE-2022-25012
• db_config.ini — Plaintext MySQL or domain credentials inside backup archives on SMB shares
• JWT payloads — Decoded from /backend/api/v2/users/dev endpoint. One token consistently contains a plaintext password
• Notezilla Notes9.db — AppData\Roaming\Conceptworld\Notezilla. Master password stored as Base64 SHA256 — reveals OS admin password when cracked

Active Directory

• Local MSSQL "passwords" DB — SELECT * FROM creds returns plaintext domain accounts. Try assumed breach creds against local port 1433
• SMB backup archives — .zip files in readable shares on Internal. Contain db_config.ini or SAM/SYSTEM hives with domain credentials
• LSASS — Dump with Mimikatz (SeDebugPrivilege) or lsassy (post-psexec). Domain Admin creds frequently cached here

Initial Foothold Patterns

Pattern 1: Unauthenticated Service → Config File → Credential Reuse → SSH/WinRM

The most common chain. Applies to: rsync, FTP, SMB guest.

rsync/FTP/SMB (no auth) → download everything → find .env / Web.config / DVRParams.ini
    → extract credentials → spray against SSH or WinRM → shell

Seen in: Exam A (.110), Exam D (.110), Exam F (.110) — rsync; Exam D (.111), Exam F (.111) — FTP; Exam A (.111), Exam B (.111) — SMB

Pattern 2: Web App Self-Registration → Sensitive Content Exposure

No authentication bypass needed — the app allows open registration and exposes sensitive files post-login.

Web portal (nginx/IIS) → register account → browse team directory / file areas
    → SSH private key or sensitive attachment → SSH

Seen in: Exam B (.112), Exam C (.112)

Pattern 3: Dir-Busting Web App → Hidden Endpoint → Credential/JWT Leak

IIS or ASP.NET app returning 403 at root. Recursive dir-bust required.

IIS port 80 (403) → feroxbuster (recurse into /backend/api) → /v1/dev (plaintext creds)
    → /v2/users/dev (JWT list) → decode JWTs → extract username:password
    → SMB/RDP spray → shell

Seen in: Exam F (.112)

Pattern 4: WHOIS Username Harvest → POP3 Brute Force → SSH Creds in Email

Specific to boxes with port 43 open. Self-referential credential chain.

Port 43 (WHOIS) → query oscp.exam → extract nic-hdl / e-mail contacts
    → build users.txt → Hydra POP3 spray → login as sysadmin:sysadmin
    → RETR emails → plaintext SSH credentials for another user → SSH

Seen in: Exam C (.110), Exam E (.110)

Pattern 5: vhost Fuzzing → Web App Attack Surface Expansion

Root domain is a decoy or a static site. Helpdesk / support portals live on a hidden vhost.

ffuf vhost fuzz → discover support.domain → register account
    → file upload feature → Burp Content-Type bypass → .aspx RCE

Seen in: Exam A (.112)

Privilege Escalation Patterns

Linux

Linpeas always first. Manual enumeration rarely caught what linpeas found.

Windows (Standalone)

Argus DVR PrivEsc: If you got in via DVR credentials, Sandra's account has (F) on C:\Program Files\Argus Surveillance DVR. Replace DVRWatchdog.exe with a msfvenom shell, then shutdown /r /t 0 to trigger service restart as SYSTEM.

Active Directory

Things to Do on Every Machine

On First Nmap Hit

• Check all ports against the table above for immediate priority
• If port 43 is open → WHOIS enum immediately
• If port 873 is open → rsync $IP:: before anything else
• If port 21 is open → ftp $IP anonymous login immediately
• If port 80/443 is open → whatweb fingerprint + feroxbuster (recurse to depth 3+)
• If port 8080 is open → check for Argus DVR

After Initial Foothold (Linux)

1. id — check groups, especially dev, developers, docker
2. find / -group <groupname> 2>/dev/null — follow the group
3. ss -tnlp — internal services not visible externally (MySQL on 3306, APIs on 8005)
4. cat ~/.bash_history, cat ~/.mysql_history — credential leaks
5. Run linpeas before spending time on manual enum
6. sudo -l — always, even if you expect nothing
7. find / -perm -u=s -type f 2>/dev/null + getcap -r / 2>/dev/null

After Initial Foothold (Windows)

1. whoami /priv — SeDebugPrivilege / SeBackupPrivilege / SeManageVolumePrivilege
2. whoami /groups — check for local admin groups
3. icacls "C:\Program Files\*" — writable service directories
4. Check C:\Users\<user>\AppData\Roaming for application databases (Notezilla, etc.)
5. Check desktop for obvious clues (locked apps, unusual shortcuts)
6. Look for local services not exposed externally (netstat -ano)

After Initial Foothold (AD — WS26)

1. whoami /priv — immediately. If nothing useful, move straight to step 2
2. gobuster dir -u http://$IP — port 80 may be running XAMPP with phpMyAdmin; don't skip it
3. Connect to local MSSQL: impacket-mssqlclient oscp.exam/$USER:$PASS@$IP -windows-auth
4. Check all DBs: SELECT name FROM master.dbo.sysdatabases — look for "passwords", "creds"
5. Run nxc smb <all_IPs> -u $USER -p $PASS --shares with every credential found
6. Set up Ligolo to reach internal segment (172.16.x.x)
7. Run BloodHound (SharpHound.exe -c All) as soon as any domain account is confirmed — don't skip this, GenericAll edges were present and were the only lateral path

Credential Spraying Checklist

Every time a new credential is found, spray it immediately across all known services.

nxc smb $ALL_IPS -u users.txt -p passwords.txt --continue-on-success -t 1
nxc winrm $ALL_IPS -u users.txt -p passwords.txt --continue-on-success
nxc ssh $ALL_IPS -u users.txt -p passwords.txt --continue-on-success
nxc mssql $ALL_IPS -u users.txt -p passwords.txt --continue-on-success

Use -t 1 on SMB sprays to avoid lockouts. Add --local-auth separately — local admin credentials sometimes don't work without it.

Observed Failure Modes

Patterns from across all reports where attempts stalled — useful as a "don't waste time here" reference.

Linked Notes

• Standalones/Summary
• Standalones/Initial Foothold Vectors
• Standalones/PrivEsc Vectors
• AD/Summary
• AD/Initial Foothold Vectors
• AD/PrivEsc Vectors