Pearson's OSCP Notebook

Attack Path Graph

Properties1
tagsreference, attack-path, methodology, initial-foothold, privesc, active-directory, oscp, decision-tree

7 min read

Attack Path Graph — OSCP Decision Trees

Visual “where do I go next?” maps for the exam. Pair with Credential Graph (“I found X artifact — what can I do?”) and UseCases for ports (port-specific commands).

How to use: Start at Exam Mental Model on a new box → drill into the service branch → follow links to tool notes.

📌 OSCP Exam Mental Model

Port Scan
│
├── Lab VM — IP unknown?
│   └── netdiscover -i eth0        → [[netdiscover]]
│
├── SSH closed but "knock" hinted?
│   └── knock SEQ then ssh         → [[Port Knocking - knock]]
│
├── Web?
│   └── Exploit → Shell          → [[Exploitation]] · [[Initial foothold]]
│
├── SMB?
│   └── Enumerate → Creds        → [[SMB]] · [[enum4linux]] · [[CrackMapExec - nxc]]
│
├── LDAP?
│   └── Users → Kerberos Attacks → [[ldapsearch]] · [[Kerberos]] · [[Kerbrute]]
│
├── MSSQL?
│   └── xp_cmdshell → Shell      → [[MSSQL]] · [[mssqlclient]] · domain cred → `-windows-auth`
│
├── SSH?
│   └── Creds → Shell            → [[SSH]] · [[Hydra]]
│
└── WinRM?
    └── Creds → Shell            → [[evil-winrm]] · [[CrackMapExec - nxc]]
 
Shell
│
├── Local listeners / pivot      → [[netstat]] · [[Port Forwarding]] · [[Chisel]]
│
├── PrivEsc                      → [[Linux]] · [[Windows PrivEsc]]
│
├── Loot Creds                   → [[Credential Discovery]]
│
├── Reuse Creds                  → [[Credential Graph]] · [[Hydra]]
│
├── Lateral Movement             → [[LatMovement]]
│
└── Domain Escalation            → [[AD]] · [[Active Directory]]

Workflow: Methodology → Initial foothold → this note → tool docs.

📌 Initial Foothold — By Service

Network Access
│
├── Web
│   ├── SQL Injection            → [[SQL Injection]] · [[SQLMap]]
│   ├── Command Injection
│   ├── File Upload              → [[File Upload Bypass]]
│   ├── LFI                      → [[Local File Inclusion (LFI)]]
│   ├── RFI                      → [[Remote File Inclusion (RFI)]]
│   ├── SSRF
│   ├── XXE
│   ├── Deserialization
│   ├── Default Credentials      → [[Hydra]]
│   └── Vulnerable CMS           → [[CMSeeK - cmseek]] · [[WPScan]] · [[searchsploit]]
│
├── SMB
│   ├── Anonymous Shares         → [[smbclient]] · [[smbmap]] · [[enum4linux]]
│   ├── Writable Shares
│   ├── Password Spray           → [[CrackMapExec - nxc]] · [[Kerbrute]]
│   ├── Credentials in Files
│   └── Vulnerable Services      → [[searchsploit]]
│
├── LDAP
│   ├── Anonymous Bind           → [[ldapsearch]]
│   ├── User Enumeration
│   ├── Group Enumeration
│   ├── Description Fields       → passwords in LDAP attrs
│   └── Password Leaks
│
├── MSSQL
│   ├── Weak Credentials         → [[MSSQL]] · [[Hydra]]
│   ├── xp_cmdshell
│   ├── Linked Servers
│   └── Credential Discovery
│
├── FTP
│   ├── Anonymous Login          → [[FTP]]
│   ├── Weak Creds (-e nsr)      → [[Hydra#FTP]] · null / same / reverse before rockyou
│   ├── Password Reuse
│   └── Sensitive Files
│
├── SSH
│   ├── Password Reuse           → [[SSH]] · [[Hydra]]
│   ├── Private Key Discovery    → [[SSH]] · [[John]]
│   └── Weak Credentials
│
├── WinRM
│   ├── Reused Credentials       → [[evil-winrm]]
│   └── Credential Spray         → [[CrackMapExec - nxc]]
│
└── Other Services
    ├── SNMP                     → [[snmpwalk]]
    ├── NFS                      → [[UseCases for ports#Port 2049 — NFS]]
    ├── RDP                      → [[xfreerdp]] · [[rdesktop]]
    ├── Jenkins                  → [[UseCases for ports]]
    ├── Tomcat
    ├── Redis                    → [[Redis]]
    └── Docker                   → [[UseCases for ports]]

See full port workflows: UseCases for ports · Initial foothold

📌 Credential Discovery Paths

After any shell — hunt artifacts before moving on.

Foothold
│
├── Config Files                 → web roots, .env, appsettings.json
├── Backup Files                 → .bak, .zip, SQL dumps
├── Database Dumps               → [[SQLite]] · [[MySQL]] · [[Database]]
├── Environment Variables        → env, set, proc
├── Browser Passwords              → LaZagne, manual
├── SSH Keys                     → [[SSH]] · id_rsa → [[John]]
├── SAM Database                 → [[Registry Hives and Linux Equivalents]] · [[secretsdump]] · [[Mimikatz]]
├── Registry                     → [[Windows PrivEsc]]
├── Scheduled Tasks              → scripts with creds
├── Scripts                      → .ps1, .bat, .sh
├── Application Secrets          → API keys, connection strings
└── Password Reuse               → [[Hydra]] · [[CrackMapExec - nxc]] every service

Deep dive: Credential Graph · Credential Discovery

📌 Active Directory — Attack Tree

LDAP Access
│
├── Enumerate Users              → [[ldapsearch]] · [[CrackMapExec - nxc]] ldap
├── Enumerate Groups
├── Enumerate Computers
├── Enumerate SPNs               → [[Kerberoast]]
└── Enumerate Trusts             → [[PowerView]] · [[Bloodhound + Sharphound]]

Kerberos branch

Valid Domain User
│
├── Kerberoasting                → [[Kerberoast]] · [[Kerberos Scripts]] · [[Rubeus]]
│   ├── Request TGS
│   ├── Crack Offline            → [[Hashcat]] mode 13100
│   └── Recover Service Account Password
│
├── AS-REP Roasting              → [[Kerberos Scripts]] GetNPUsers · [[Kerbrute]]
├── Password Spraying            → [[Kerbrute]] · [[CrackMapExec - nxc]]
├── Password must change         → [[Change password AD - NT_STATUS_PASSWORD_MUST_CHANGE]] · [[krb5-user]] · port **464** (not **646**)
├── Silver Ticket                → [[Rubeus]] · [[Kerberos Scripts]] ticketer
├── Golden Ticket                → KRBTGT hash → [[Rubeus]] · [[Mimikatz]]
└── Delegation Abuse
    ├── Constrained
    ├── Unconstrained
    └── Resource-Based (RBCD)    → [[bloodyAD]] · [[Impacket]] getST

Sync time first: Time Sync-Clock Skew · Concepts: Kerberos

NTLM branch

Credentials
│
├── Password                     → [[Credential Graph]]
├── NTLM Hash
│   ├── Pass-the-Hash            → [[Impacket]] · [[CrackMapExec - nxc]] · [[evil-winrm]]
│   ├── SMB · WinRM · WMI · PsExec → [[Remote Execution]]
│   └── Scheduled Tasks
├── NTLM Relay                     → [[ntlmrelayx]] · [[Responder]]
└── Crack Hash                   → [[Hashcat]] · [[John]]

SMB branch

SMB Access
│
├── Enumerate Shares             → [[smbmap]] · [[CrackMapExec - nxc]] · [[enum4linux]]
├── Read Share → creds/scripts/backups/keys
├── Writable Share → service binary / logon script / DLL hijack
└── Authentication → password · hash · relay

Domain Admin paths

Low Priv User
│
├── Kerberoast
├── AS-REP Roast
├── Password Spray
├── Local Admin                  → [[Bloodhound + Sharphound]] sessions
├── Credential Dump              → [[secretsdump]] · [[Mimikatz]]
├── Reuse Found Password
├── DCSync                       → [[bloodyAD]] · [[secretsdump]]
├── Delegation Abuse
├── ADCS Abuse                   → [[Certipy & Certify]]
└── Domain Admin

Full AD hub: AD · Active Directory · ACL edges: Credential Graph > BloodHound ACL edges

📌 Local Windows Privilege Escalation

User Shell
│
├── SeImpersonatePrivilege       → [[Potato Attacks]] (GodPotato · [[PrintSpoofer]] · JuicyPotato · RoguePotato)
├── SeManageVolumePrivilege      → [[SeManageVolumePrivilege]] · [[SeManageVolumeExploit]] · [[DLL Injection]]
├── Services → weak perms / unquoted paths / writable binary
├── Scheduled Tasks
├── Registry
├── DLL Hijacking                → [[DLL Hijacking]] · [[DLL Injection]]
├── Stored Credentials
├── AlwaysInstallElevated
├── UAC Bypass
└── Vulnerable Drivers

→ Windows PrivEsc · Privesc Tools (WinPEAS)

📌 Linux Privilege Escalation

User Shell
│
├── SUID                         → [[Linux]] · GTFOBins
├── Capabilities                 → getcap -r /
├── Cron Jobs
├── Writable Scripts
├── PATH Hijacking
├── NFS
├── Docker                     → [[Linux#📌 13) Docker / LXC / LXD Escape]]
├── LXD / lxc                  → [[lxc - LXD Privilege Escalation - EDB 46978]]
├── Kernel Exploit               → [[linux-exploit-suggester]] · [[Dirty COW - CVE-2016-5195]] · [[Dirty Pipe - CVE-2022-0847]] · [[Baron Samedit - CVE-2021-3156]] · [[pkexec - CVE-2021-4034 PwnKit]] · [[OverlayFS - Privilege Escalation]]
├── SSH Keys
├── Password Reuse
└── Credentials in Configs

→ Linux · Privesc Tools (LinPEAS)

📌 BloodHound — ACL Logic (summary)

When BloodHound shows an edge, see Credential Graph > BloodHound ACL edges for “what do I do?”

Domain User
│
├── GenericAll · GenericWrite · WriteDACL
├── ForceChangePassword · AddMember
├── AddKeyCredentialLink (Shadow Creds)
├── RBCD · DCSync · Local Admin Rights
└── → [[bloodyAD]] · [[Bloodhound + Sharphound]]

Graph View

Backlinks