OSEP Track
Prep for OSEP (PEN-300) — the exam where getting a shell isn't enough, you have to get it past the defences. Restricted-shell breakouts, filter & defense evasion, lateral movement and pivoting, advanced Active Directory, and insecure deserialization. This is where OSCP ends and the red team begins.
What OSEP demands
The exam is 48 hours of chaining and evasion. Drill the mindset here.
Evade, don't just exploit
Blocklists, hardened tools, restricted shells — the payload that works is the one that gets through. Obfuscate, encode, substitute.
Chain everything
One foothold is a starting line. Loot creds, move laterally, pivot into networks you can't reach, and escalate on every host.
Own the domain
Advanced Active Directory is the heart of OSEP — GPP secrets, Kerberoasting, and lateral movement all the way to Domain Admin.
Read the code
Deserialization and logic bugs reward candidates who understand how the app actually handles data, not just where to point a scanner.
The Modules
Work them in order — each one leans on the last.
Restricted Environment Breakouts
OSEP throws you into locked-down shells, kiosks, and jump hosts. Learn to recognise a restricted shell (rbash), map what you're actually allowed to run, and break out of it into a full shell.
PEN-300 — Operating System & Programming Theory / Bypassing restrictions- Recognising and enumerating a restricted shell (rbash)
- Escaping via allowed interpreters (awk/vi/ed system() escapes)
- PATH and environment abuse from a locked-down shell
- Chaining a breakout straight into a sudo GTFOBins privesc
Filter & Defense Evasion
The whole point of OSEP is getting your payload past defences. Here a 'hardened' root tool blocks the obvious injection — you get in anyway with obfuscation: no spaces, no keywords, encoded and substituted payloads.
PEN-300 — Antivirus Evasion / Application Whitelisting concepts- Reading a blocklist and finding what it forgot
- Space-less command injection (${IFS}, brace/paren tricks)
- Command substitution and encoding to dodge keyword filters
- Turning a filtered diagnostic tool into root RCE
Lateral Movement & Pivoting
One foothold is never the goal. Loot credentials, move to the next account and host, and tunnel into networks you can't reach directly.
PEN-300 — Lateral Movement / Linux post-exploitation- Credential looting from configs, env files, and history
- Lateral movement across service accounts
- SSH tunnelling / port-forwarding to internal-only services
- Privilege escalation on the pivoted host
Advanced Active Directory
Multi-domain Windows attacks — GPP/SYSVOL secrets, Kerberoasting, and lateral movement to Domain Admin across three environments.
PEN-300 — Active Directory Exploitation- GPP passwords in SYSVOL (MS14-025)
- Kerberoasting & AS-REP roasting
- Pass-the-Hash / Pass-the-Ticket lateral movement
- DCSync to full domain compromise
Insecure Deserialization
A recurring OSEP path to code execution — abuse an application that deserialises attacker-controlled data into a gadget chain and a shell.
PEN-300 — Attacking .NET / deserialization- Spotting deserialization sinks and type handling
- Building / delivering a gadget chain payload
- Escalating from the service account to root