OSCP case studies

OSCP · Put your knowledge to work in context.

The OffSec Certified Professional (OSCP) is a hands-on penetration testing credential awarded by OffSec and associated with the PEN-200 course, "Penetration Testing with Kali Linux." OffSec publicly describes itself as the creator of Kali Linux and describes OSCP as "the gold standard in penetration testing certifications" - a marketing claim made by the vendor, not an independent ranking. Unlike multiple-choice certifications, the OSCP assessment is practical: candidates attack machines in a live lab environment and must submit a professional report documenting their findings, so both technical execution and written communication are evaluated. The OSCP case studies are 5 cases and about 3,148 words.

Four Services, One Scope Entry: Deciding What Deserves the Minutes

You have a single in-scope host, 10.10.10.45, no credentials, and a hard stop in six hours. A full TCP scan returns 22/tcp OpenSSH 8.2p1 (Ubuntu), 80/tcp Apache 2.4.41 serving the stock "It works" page, 8080/tcp Apache Tomcat 9.0.31 returning 401 on /manager/html, and 8443/tcp presenting a self-signed certificate with CN=internal.corp and a Tomcat-style error page.

712 words, about 4 min 2

Local File Inclusion With the Obvious Paths Closed

On app.target.local (Ubuntu 20.04, PHP 7.4, Apache) you find GET /download.php?file=report.pdf, which renders the file inline. Traversal works: ../../../../etc/passwd returns the file.

580 words, about 3 min 3

One Captured Hash, Two Very Different Decisions

On an internal engagement you poison an SMB share and capture an NTLMv2 response for CORP , a helpdesk user. From a separate misconfigured backup share you recover the local SAM database from a workstation and extract the NTLM hash of the local Administrator account on that one machine.

556 words, about 3 min 4

SeImpersonate Blocked by AV: Choosing the Second-Best Privilege Path

You land on WS01 as CORP backup through a scheduled task that stored its password in a readable XML file. The host is Windows Server 2019 build 17763, domain-joined, Defender real-time protection on, and it has no outbound internet.

555 words, about 3 min 5

One Low-Privilege Domain Account and a Network You Cannot Route To

You have SSH to www01, an Ubuntu box dual-homed at 10.10.10.50 (reachable from your Kali) and 172.16.10.50. Your Kali has no route to 172.16.10.0/24.

745 words, about 4 min