OSCP Preparation: My Runbooks for Effective Enumeration Strategies
Written on
My OSCP journey has taught me that mastering enumeration is crucial for success. Many past candidates echoed the sentiment "enumerate harder," and I can confirm its validity. In this article, I will outline my runbooks for enumeration, categorized into external machine enumeration, Linux enumeration, and Windows enumeration. The focus here will be on external enumeration, while subsequent articles will cover Linux and Windows in detail.
The rationale behind this organization is that I always initiate my enumeration process with the runbook presented here, and then proceed to the specific runbook based on the target machine's operating system.
What Exactly is a Runbook?
A fundamental element that aided my OSCP preparation is the runbook, which serves as a checklist for actions to take in various scenarios. This approach alleviates stress and helps maintain focus. By adhering to a predefined runbook, you can navigate the exam without constantly questioning your next steps; simply refer to the runbook for guidance.
The specific tasks within your runbook may differ significantly based on the types of CTFs you participate in and your personal preferences for task order. I created my runbooks through practice with OSCP challenge machines and by examining the NetSecFocus machine list. Consequently, these runbooks align well with the OSCP standard.
A Note of Caution
While I'm sharing my examination strategy to motivate future candidates, it's essential to recognize that everyone has unique learning styles. Your runbook may differ vastly from mine or may not even be necessary for your approach.
If my method resonates with you, consider crafting your own runbook for practice machines. You’re welcome to draw inspiration from mine, but if a structured checklist feels awkward, feel free to set it aside and adopt a different approach.
My Runbook for Initial Machine Enumeration
Below is my runbook for conducting external enumeration of machines. The assumption is that we only know the machine's IP address, making this enumeration broad to ensure we capture as much information as possible. While it may not uncover everything, it should assist in covering the majority of OSCP-level machines.
Start with Autorecon
Initiate Autorecon using the command: sudo env PATH=$PATH autorecon $TARGET_IP Autorecon streamlines the enumeration process, allowing you to gather information about the entire machine without running individual tools like nmap, smbmap, and gobuster manually. This tool is permissible for the OSCP exam as it operates within the allowed parameters; it merely accelerates the process. I primarily use it for a comprehensive overview of the target. Any open ports identified during the Autorecon scan should be examined further through manual enumeration. Additionally, Autorecon provides insights into the target's operating system and version, aiding in determining subsequent steps.
The First Deep Dives
Interestingly, I often focus on services like SMB (typically ports 139, 135) and FTP (typically port 21) while Autorecon runs. These services can easily be dismissed as unimportant, yet they are worth checking. If an FTP server is accessible, always verify if it allows the credentials anonymous:anonymous. If access is restricted, the FTP server might become significant later if you discover credentials, or it could just lead you down a rabbit hole. The same logic applies to SMB servers; always check for access via the Guest account.
By addressing these quick checks upfront, I ensure that I have reviewed them before they become critical. Often, information from SMB or FTP leads to credentials for other systems, making early collection beneficial.
Review Autorecon Results
Once the initial checks are completed, Autorecon will have gathered data from most ports. Some machines may run services on atypical ports. For instance, I've encountered HTTP servers operating on ports like 8082 or 4443. Just because a service appears on an unexpected port doesn't guarantee access; however, if there's an HTTP server on port 8082 alongside another on port 80, it might be a red herring meant to divert attention.
Investigate Databases
If there’s an open port for MySQL, PostgreSQL, or MSSQL, check for default credentials. Some misconfigured databases might grant immediate RCE, while others provide system information.
Examine HTTP Servers
To keep this article concise, I can't cover everything regarding HTTP servers. They often provide the initial access point if they host a poorly configured CMS or vulnerable software. However, I have frequently spent excessive time enumerating HTTP directories, probing login forms for SQLi, only to realize the entry point lay elsewhere.
Here’s a brief summary of how I approach HTTP servers: - If it's merely an HTML template from a standard tool, it’s likely not worth extensive investigation. Only consider further directory enumeration if Autorecon suggests it. - Identify the software and its version. Sometimes a simple Google search can reveal the relevance of what you're dealing with. - For PHP-based servers, look for a phpinfo endpoint. This endpoint, intended for developer debugging, should not be publicly accessible and may leak valuable information. - Always test common credentials on login forms, like admin:admin or jenkins:jenkins. - If the server is a Git repository, use a tool like git-dumper to see if sensitive information is exposed in its history. - Utilize Burp Suite to test for vulnerabilities like SQLi, create a user if possible, and explore the site for anything unusual.
Even after following these steps, I recognize that I might overlook something. I often deviate from the established process, but the runbook ensures there’s always a subsequent action to take.
Final Thoughts
Ultimately, your enumeration process will be unique to you. However, I believe that finding your rhythm in tackling challenges is key to succeeding in the OSCP, and a runbook can assist in achieving that. Having a reference to return to after exploring complex paths was invaluable during my practice. Moving forward, I anticipate refining my runbook as I enhance my skills.
A couple of important points to remember: a runbook is a supplementary tool to your pentesting or CTF skills. No single list will elevate you from novice to expert. Similarly, using Autorecon doesn’t exempt you from needing to understand the fundamental operations of the underlying tools. You'll still need to know how to enumerate with tools like nmap, smbmap, and gobuster. I frequently delve into specific enumeration commands with these tools for aspects not captured by Autorecon. So while Autorecon can handle the heavy lifting, ensure you grasp the mechanics at play.
If you're interested in my somewhat disorganized notes from the OSCP and other red teaming experiences, feel free to check out my GitHub Repository here.
Is there anything glaring that I might have missed? Share your thoughts in the comments!