OSCP Practice Lab: Active Directory Attack Path #1

[@DocGMoney]

Future Offsec teacher right here man! This is the second video of yours I've watched and 2/2 your killing it man. Pure GOLD!!!! Your helping at least one person out beyond measure! Have my sub :)

[@zacaryhalasz527]

Recently passed my OSCP. I owe at least part of that to these videos. You have such a great cadence and way of speaking/teaching. Thank you

[@derronc]

Congratulations! 🎉 and thank you very much, I'm so glad to hear these helped you in your journey

[@itsop6760]

How was it hard or easy ?

[@ianp6742]

This is a fantastic walk through. Very detailed and you did a good job of explaining your methodology and thought process. I am retaking the OSCP in December, this video will help me succeed and I would love to see more attack paths from you.

[@derronc]

thanks so much, I'm glad it helps. Best of luck on your retake!! I'll try and post another attack path soon.

[@Gelimarr]

Do you have the eJPT cert? also did u pass the OSCP?

[@rabinbeka]

I am preparing for the OSCP exam and this video taught me a lot about AD where I have difficulties. Awesome lab ..... Thank you

[@justarandomcat7]

29:06 we've got a shell ! Emmmmm ... hmmmmfffff Smell that , nice fresh shell 😂😂😂 I just subscribed! Your voice is so relaxing, unlike other cybersecurity channel owners who tend to scream. Your explanations are clear, and you simplify everything perfectly for beginners.

[@mikedunn330]

Without a doubt the most helpful thing I've seen! Taking your time and explaining "why" you're running commands was awesome. Thank you so much. I will be watching more of your content.

[@michael5743]

Derron, you've got to do more of these!! You're an amazing teacher man. Thank you!

[@briangrier3287]

Actual GOAT, watched video start to finish! Seeing your step by step process and methodology completing these 3 boxes was super inspiring! W video, please keep this content coming!

[@derronc]

Thank you so much, I appreciate the compliment!! I'll try and post some more content soon

[@ministeredelacybersecurite7074]

@@derronc Please make more awesome!

[@aaryanbhagat4852]

These playthroughs are worth it, very nicely explained, even the thought process!

[@dasskanal2343]

Agree passed my OSCP 3 weeks ago watched your AD content 2-3 times and just want to say thanks bro

[@derronc]

Congrats!!! That's awesome and I love to hear the content helped you on your journey ❤️

[@claymoody]

this was great. excellent setup, explanation, and note taking. thanks for taking the time to put this together and share

[@gwalchmei]

I don't often comment on videos but I simply have to say that your material is absolutely phenomenal. Am preparing to take the OSCP and wanted to really get practice in and you came through in such a big way (in the way that there's no way I can go forward in cybersecurity without acknowledging how important your guides have been). I adapted your setup to run on proxmox and I wanted to say thank you very much :)

[@Ibr8kThingz]

Outstanding content and well explained! I'm all for fresh content! Thanks so much for sharing. It's greatly helpful for a fellow student like myself prepping for the OSCP.

[@MotivationbyDesign]

great video. I think the way you go through it is both entertaining and very informational.

[@derekr4132]

Bro. Your methodology and flow is much appreciated. Do you have a OSCP cheatsheet that you care to share?

[@timecop1983Two]

Thanks man now I have an idea! Just having an idea what tools will be used and you should think, and how you should write notes is awesome! Now I have a full clear understanding and idea keep up the work!!!

[@CyberSecAfterDark]

Gotta say, more than being good informative and easy on the ears, the video is just entertaining to watch which is more than you can say for any other video like this, keep it up and we will keep watching!!

[@derronc]

Thank you! I try to make content with some personality and I'm glad to hear it helps

[@bramha7]

Hey man! I just watch your oscp AD and I got impressed with your explaination. Its' 10 out of 10. Hope to see more of you in upcoming days💌🥰

[@longtran7196]

How wonderful knowledge ! Love this every minute

[@mr.simple5528]

Nice walkthrough, clean notekeeping, really amazing video, congrats bro!

[@cy_wareye7395]

i learn lot new stuff about Windows enumeration from this video

[@infosecrisk5393]

Really nice and helpful. Thanks a lot for your awesome content.

[@etcissue8965]

Awesome video!!! One of the best i have ever seen!! keep going for next videos!!!

[@monsterkush11]

Thank you . Learned about some new tools and more about windows . Great content

[@romilthakkar404]

Keep making these man! Loved it… I failed OsCP on first attempt because of AD section. I pawned the first one, created tunnel as well.. and forgot about routing! If I would have done routing, I would have passed! I knew all the things but didnt know about tunnel and routing properly. Thanks a lot 👍

[@elilanz]

When did you took your exam? Seems I can join some dots in your statement

[@romilthakkar404]

@@elilanz End of July 2023.

[@elilanz]

@@romilthakkar404 aah okay okay

[@colinrogers9927]

This is a great walkthrough. I watched your previous video about setup and I ran in to a lot of perm issues when getting foothold on this video

[@derronc]

oh no! can you elaborate on the permission issues? I will do my best to help

[@colinrogers9927]

@@derronc essentially everything is caught by the av even if tamper is turned off.

[@zribianas4010]

Truly excellent and beneficial. I greatly appreciate your fantastic content.

[@sp3ct3r71]

woow bro keep doing this offsec cert serires..crystal clear guidance

[@nicksmith5400]

I have my OSCP retempt comming up tomorrow and I have been using your videos the last few weeks to study with. Really great stuff, the way offsec explains AD seems overly complicated. I just needed DA then I think I had it my last attempt, so fingers crossed we get it this time :) Thanks for the videos, please make more!

[@derronc]

much thanks for those kind words and best of luck tomorrow!!! you got this

[@daddyyankeee4477]

Were you able to make it brother?

[@lloydchan9606]

Subscribed within the first minute, i can't believe this stuff is free. Thank you!

[@derronc]

Thanks for the sub! I'm so glad you appreciate the content

[@AnkitKumar-px6dr]

Thank you for such great insight into the scenario loved every bit of it

[@martinlastname8548]

I have been watching this for two days writing up an attack plan and tool list on Obsidian

[@jasond580]

Thank you for this. Very helpful!

[@gnuPirate]

Really awesome topic really well covered. Instant sub. Looking forward to working through this.

[@akshaykumar-wd8jc]

wow! such a quality content. Thank you so much for this. People really need an instructor like you. Will complete the other 2 Attacks paths as well. Would like to know whether you are planning to create any new content ?

[@gabrydanto778]

Very fantastic walktrough🎉 Superman 😮

[@ferasalfarsi897]

Please, continue!

[@arashgudarzi2623]

really liked the video, hoping for more, learned alot from it

[@bendum-zb4km]

Watched it all, Insane video Man !! Much appreciated.

[@sweno9007]

thank you very much for the video very clear loved every minute

[@derronc]

You're very welcome and thanks for the feedback!

[@JimmyNeutronAdHdCuzzin]

Thank you for sharing ‼️

[@internexus1]

Your. Ideas are so valuable for helping to develop and fine tune methodologies, I appreciate this greatly and look forward to more from you! Also a small recommendation, consider picking up a mic as your keyboard comes through rather heavy 😉

[@mpotisambo2465]

man man man thanks for the content once again

[@derronc]

I'm so glad it was helpful!

[@podavu7044]

I love the methodology ! Thank you for this amazing content

[@derronc]

my pleasure! I'm glad you enjoy it

[@shockinho]

Amazing video! Thanks!

[@0xolv069]

This walk through is amazing thank you a lot

[@truth_4lif399]

That was just awesome 👌 👏 👍🏾 🔥 🔥

[@vlad7269]

Better than my teachers at university...

[@ellerionsnow3340]

Reviewing your videos prior to OSCP, also saw your hare scramble videos. Thought I was the only hacker that rode dirtbikes lmao

[@derronc]

it definitely feels like it's rare; so glad to meet a fellow adrenaline junky 🤘

[@ellerionsnow3340]

@@derronc Thanks man, I passed the OSCP on Monday as well a lot goes to reviewing your channel right before!

[@quesoexistential]

Your vids are a gold mine. Earned a sub!

[@alirezazebka6847]

This is So ispiring man. Keep Going

[@Heisenberg696]

keep it up bro keep making this kind of videos

[@Ravindunethsara]

Great content. Correction @1.42 .zip file cracked with JTR

[@moustafaahmed8294]

Very fantastic and helpful. Thank you so much ✨

[@strongshiv8]

Very detailed Explained , I Enjoyed every bit of it !

[@Lucas-n3l7n]

THIS IS PURE GOLD! THANK YOU MASTER! 🙏

[@ashleyscott7762]

Really good run through; I am currently running through some courses with TCM to get up to a proficient standard to do my oscp. Any advice you would pass on and also how long did it take you to feel confident and what would you do differently now you are at this point? Thanks

[@drewalleman]

Helpful thanks!

[@daviddeschamps444]

A perfect video really ! Very inspiring and useful thank you so much :)

[@0xarun]

Great shot!

[@ravensfpv]

Is the first box you have compromised using unquoted service path an actual OSCP exam box? Are these the OSCP A,B,C boxes? It felt easy to exploit the first machine, I am trying to gauge the exam difficulty which I will take it in couple of months. Thanks for the video! Super helpful.

[@derronc]

No, if I were to replicate an actual OSCP box I had in the exam that would be a privacy violation. I designed these labs based on the content they teach in the PEN-200 course and to be as close to the OSCP exam as I could replicate. You may end up with some of the same vulnerabilities I demonstrate, but you could also end up with different ones, but the difficulty should be about the same. It all depends on what lab set you get when you take the exam.

[@ravensfpv]

@@derronc as long as the difficulty is about the same, thats good to hear! Thanks man

[@ashishratnawat2711]

thank you

[@TienNguyenXuan-so6vl]

Love your mindset!

[@PirateKage]

dude.. i am wayyy far from even understanding OSCP. but no issues, ill get there one day (way more to learn), i can understand what he is saying and doing but, how the heck he is getting what to do next. no wonder this field requires experience.

[@snarfallymunchacen85]

This was a great lesson for me..

[@infosecabdul]

Well explained and demonstrated. Followed through till the end. Thank you

[@AlexSec]

Love it! Good job.

[@dgoncalo]

Great content! Just one question, why no minimatz?

[@derronc]

that's a great question! I do use mimikatz for many of my scenarios, but this one in particular I wanted to try and do a lot of things remotely from the kali machine. so I opted for impacket-secretsdump instead. I just think of it as remote mimikatz 😂 I appreciate the question, I think I'll make a future video with different tactics: including mimikatz

[@sandiproy9810]

@@derronc kerberoasting and asreproasting part would a lot clear if u use bloodhound as for ms02 machine u have smb access. and that would be better when someone sees the gui and that kind of stuffs.

[@1a4s4l7]

This is fantastic!

[@kevinhoy6838]

Hell yeah!! Thank you!!

[@Foobar1835]

great video. did you create the vulnerable machines or were they premade?

[@derronc]

thank you! I built all these machines from scratch and include the how-to guide in my video series. that way you can build them too :)

[@oliviermenager9702]

Top content. Congratulations.

[@NostalgiaModding]

Your videos are super helpful. Will you make any more?

[@derronc]

I have been wanting to create some more content, but life has been quite the rollercoaster this year! Hopefully you'll see some content in the near future 🤞

[@NostalgiaModding]

@@derronc Awesome to hear brother!

[@jackkelly6890]

Excellent tutorial. Maybe the most useful AD tutorial for OSCP on youtube! Hopefully plan to give back once I pass. Thankyou for the effort you've put in here. Did you build the labs yourself?

[@derronc]

so glad it has been helpful! I did build these myself, as a result of not finding much practice material out there.

[@AMINE_47]

Really nice content , please where can i find a similiar environnement

[@derronc]

Aside from my video on how to build the lab, I had a hard time finding this type of material as well. I was only able to find bits and pieces, but nothing that would take me through the entire process. I may share another scenario in the future.

[@IAmWrk_]

2).Hey man don’t be discouraged, it comes from practicing and familiarity of common human habits. I happen to work in a Windows IT environment, Most people save important documents right in their desktop or in documents folder (Linux users do too). This would spark my interest in checking those folders first if i get user access to a box 1)Working in windows you notice exe files and ps files often work without needing to install an outside source “bash” for example you need the pc to have bash to run bash scripts, if you don’t have admin priv it’s harder to install bash is my understanding I still suck though so i still feel the same as you lol doubt ima pass lol

[@orca2162]

Great video, thank u ❤

[@achillesmyrmidon4424]

Hi @derronc, halfway in your vid and it is super nice so far. Do you have any tips for terminal logger? Or it is not that important with logger?

[@LightAura]

Great walkthrough, but there is one thing I don't understand. @23:15 you modified the exploit to run certutil.exe with some arguments. How does this work when the string you are typing is not run in CMD or PowerShell? As far as I understood, you are typing in the start menu, so it's a search bar.

[@mohamed_azizfadhel8624]

I don't know if this matters, but the exploit is essentially opening win+r then cmd.exe and then typing the payload char by char (that is why there is a keyboard map as a dictionary) and finally executing it

[@arashgudarzi2623]

it just is in my mind, why didn't you send a Meterpreter shell, or get the reverse shell with the metasploit so that you can elevate it to meterpreter and do the fun stuff with it ? is there something that im missing ?

[@derronc]

you're only allowed to use metasploit/meterpreter against one target on the actual exam. ideally you should be able to accomplish all your exploits without it, however it is there as a nice fallback if you get stuck

[@obipixel]

Great work dude. Do you perhaps have the virtual machines as a setup I can use to practice with?

[@obipixel]

I ask because I have my own labs I use to teach students. I’m missing a good one for Active Directory.

[@adrianosela]

This is awesome. Is there a repo for your environment? e.g. docker-compose, terraform, anything so I can reproduce it?

[@lamjerry9977]

Thank you!

[@extraordinay]

Thank you sir, can you do some cryphotgraphy ctf too?

[@derronc]

ooo I hadn't really thought about that. I can't say I'm great at it, but I'll keep this in mind for the future. thanks for the suggestion!

[@cvport8155]

Please make more vd for advanced techniques red team and ad attack good work bro ❤

[@derronc]

thank you! I'm currently working on posting another attack path soon 😊

[@sandiproy9810]

hey please make other attack path video as soon as possible

[@matteosteksy7656]

hi Derron, great work!! I have a doubt, in MS01 Priv Esc, you renamed the malicious payload to "Wise.exe" and put it in the "C:/apps/Wise/" folder...at this point why, after rebooting, the system executed the "Wise.exe" file?

[@derronc]

great question! so this is abusing "unquoted service paths". basically the service for the Wise application is referenced without quotes, but there is a space in the folder structure. this allows us to place Wise.exe where the space break is and when the service is started it attempts to find an executable called "Wise.exe" as part of the way windows processes/enumerates an unquoted service path. rebooting the host forces the service to restart and kick off this vulnerability we have exploited. for more info the PEN-200 course is here: portal.offsec.com/courses/pen-200/books-and-videos/modal/modules/windows-privilege-escalation/leveraging-windows-services/unquoted-service-paths otherwise a public post is here: medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae

[@matteosteksy7656]

​@@derroncthank you so much, another question, as written in a previous comment, everyone will now move to the cloud environment, how will all this impact cyber security and hacking in general?

[@derronc]

@@matteosteksy7656 great question but also a loaded one :) the short answer is it is expanding the attack surface and is an addition to Active Directory on-premise. attackers and defenders are learning/exploring cloud identity (Azure AD/Entra), cloud infrastructure (IaaS), and SaaS/PaaS services. what this means for us is more lateral movement options (from on-premise to cloud, and vice-versa), and more attack surface (for example: password spraying against cloud services, in addition to on-premise services).

[@vedanttare9425]

Awesome walkthrough! Really interesting and engaging. Wanted to know, What is the configuration of your kali OS? How much RAM have you given it as well as memory? Also, how much RAM does your actual system have? Because my Kali lags so much when there is firefox, burp and other tools running simultaneously. Just curious as its really frustrating to work with a slow kali sometimes.

[@derronc]

Thanks for the feedback! when it comes to the VMs... I've been deploying the .ova from kali.org/get-kali and 4cpu / 4GB memory. I've run into issues with vmware workstation and my macbook a few times and had to reinstall macOS just to get rid of glitchy behavior 😭

[@IntroMakerNET]

Two strange things on this lab: 1) You find a .exe file and you're immediately suspecting that .exe is running on the server, I mean why? 2) Why would someone look for a .txt file specifically in one users folder? I mean, I could take it if you do it from c:\users, but in a specific user's folder? That was too specific. This kind of things makes me think if I'm in the right path. I don't think I would pass this test. Anyway, thank you for the video, it's great.

[@LakeE.]

How does he immediately suspect the binary is running on the server? He takes the information received from the nmap scan which showed a port sending information that matches with the exploit code which gives reason to believe that the software is running on the server.

[@mattlai443]

this is wt makes oscp worthless, all presumed and weird setup never happen in real life

[@gunnar-ai]

Cut my man a break 🤣

[@charlesnathansmith]

​@LakeE. Anytime you encounter weird ports you should be trying to figure out what's listening on them. Anytime you encounter hints that something unusual could be installed you should try to determine if it vulnerable and if it's running (it's port listening is a pretty big sign)

[@lemarou]

Great video! Your content is awesome and really informative. However, I'm currently stuck with the OpenVPN configuration. Any additional tips would be greatly appreciated. Thanks!

[@ickoxii]

nice video! what terminal emulator do you use?

[@derronc]

thanks! I like iterm2 but the terminal I used in the video is just the default kali terminal

[@vidazsolt9685]

It was very interesting, thank you! I didn't catch how you knew that lord_business was logged in on ms02. Could you please clarify it? If I understand well, you couldn't get his plain text password if he would be logged off. Is that right?

[@TaelurAlexis]

The way I perform password spraying across a network of hosts in a lab is by specifying the CIDR range like crackmapexec smb 192.0.0.0/24 -u users -p passwords! :)

[@derronc]

yep, that is a great way to cover an entire subnet :) Thankfully when it comes to the OSCP you will know what the IP addresses are (based on the flag submission menu) so you can immediately narrow down your scope

[@kad-g2y]

At DC machine, let pass the hash with 0:NT_hash . I think it works because you lost LM_hash in form of ntlm in set of exec tool

[@derronc]

great catch! Yes, you can split the hash and only need to use the NT piece for pass-the-hash. LM is around for backwards compatibility and can't be passed but can be easily cracked (with the right wordlist/rules)

[@0xn4if]

May I ask you we set a service principal name for svc_iis and we catch wyldstyle using kerberoasting attack how these users related together ?

[@0xn4if]

Okay I understand now

[@I_Unintentionally_Morph]

wow thank you

[@snarfallymunchacen85]

Have you used netexec in place of crackmap? thoughts?

[@abhishekajit1611]

Can someone tell me is installing and using tools prebuild by someone allowed during the OSCP? Like can we install the tools after the exam started?

[@derronc]

yes, you absolutely can. Just be aware of the exam rules as they outline you cannot use auto exploitation tools like sqlmap

[@ihuang694]

you are the best!

[@TamponiMapei]

so is evilwinrm considered a stable shell? for getting the point on oscp a winrm shell is enought or we should rev shell it via pivoting?

[@derronc]

that's a great question, thank you for asking! I can tell you that I used evil-winrm in my OSCP exam and was given credit. That said, if you have the time and want to go the extra credit you could totally use evil-winrm to upload a reverse shell payload and then execute it to call back home. BUT if you do that you'll need to port forward through MS01 to get back to your kali machine. I might try that out in a future video just to show how to do it.

[@TamponiMapei]

thanks for the answer, during my last attempt I spent 40minutes trying to rev shell via pivoting haha, this time I will go by evilwinrm, thanks@@derronc