I85PREP
⌘ K
OSEP study materials
OSEP study resources

OSEP: Client-Side Attacks and Initial Access

OSEP · Work through your exam, one topic at a time.

All guide sections

Client-Side Attacks and Initial Access

The chain, not the payload

Initial access questions test whether you can name each link of a delivery chain: pretext and delivery channel (phishing email, Teams/Slack message, USB, watering hole, exposed VPN or RDP), the container (document, archive, container image, shortcut, HTML page), the execution primitive (macro, HTA, scriptlet, DLL, installer, LNK target), and the post-execution callback. Candidates lose points by memorising payloads instead of chains.

Containers and the Mark-of-the-Web

Windows tags internet-originated files with Mark-of-the-Web (MOTW) via an alternate data stream, and Office blocks macros in MOTW files by default. That single fact explains the modern preference for ISO/IMG/VHD containers, LNK files, OneNote sections with embedded objects, and HTML smuggling, all of which either strip MOTW or push the decision to the user. Remember the direction of travel: MOTW was historically lost when mounting an ISO, so container files became the favourite macro-delivery wrapper; browsers now propagate MOTW to downloads more aggressively.

Traps to expect

  • Extension confusion: a .lnk is a container/launcher, not the payload; a .scf or .url file can execute via an icon path pointing at a UNC share.
  • HTA and .js/.vbs run under mshta.exe and Windows Script Host, not Office, so macro-blocking policy does nothing.
  • Phishing is not only attachments: device-code phishing, OAuth consent phishing, MFA fatigue, and password spraying against exposed identity portals are all "initial access" answers.
  • A drive-by compromise requires no user file interaction but still needs a vulnerable browser/plugin or a malicious ad chain.

Worked example

HTML smuggling: the attachment is an HTML file whose JavaScript Base64-decodes an embedded blob, builds it with Blob and URL.createObjectURL or msSaveBlob, then triggers a download. The malicious executable never crosses the wire as a recognisable file, so gateway content inspection sees only HTML; the file is assembled in the browser's memory and written to disk at click time. Rule of thumb: for any client-side technique, ask three questions, "what does the victim click, what process executes, and does MOTW survive?".