Die OSCP+ (Penetration Testing with Kali Linux) Zertifizierung wurde aktualisiert, um moderne Bedrohungsszenarien, insbesondere im Bereich Active Directory (AD), stärker zu gewichten. Die Prüfung ist ein 24-stündiges Hands-on-Assessment, gefolgt von weiteren 24 Stunden für die Berichterstellung.

OSCP+ Exam Tips

Read the Exam Control Panel

1. Read the instructions for each machine before you start.
   • It will give you an idea of the structure of the AD set.
2. Plan based on the objectives outlined in your Control Panel.
   • Identify whether you will start with an AD set or stand-alone machines.
   • Format your report template in line with the requirements of each machine.

Enumeration Tips

Initial Enumeration

• Perform light scans on your targets.
  • E.g., scan for ten common ports on your exam machines.
  • Manually interact with services found while waiting for thorough and longer scans.

Enumerate carefully

• Avoid heavy scans on multiple targets.
• Revert machines after running unsafe scans.
• Re-run scans to ensure all information are correct. Scans can be inaccurate.
  • Use various tools to verify scan outputs.

Enumeration is a cyclical approach

• After gaining new access, enumerate again in the context of your new privileges.
  • If you gain login access to a webpage, enumerate the webapp as that user
  • If you gain domain user access to a machine, enumerate the domain as that user.
• This concept is often overlooked.
  • Learners tend to stop enumerating after getting a shell/root access.

Exploitation Tips

Make sure to read exploits prior to using them.

• Do you need to set up files or permissions prior to running the exploit?
• Do you need to modify the exploit to match your target?

Check multiple exploits for the same vulnerability.

• Exploits may use different methods to exploit vulnerabilities.
• Some exploits might be compatible/incompatible with your target.

Active Directory Tips

AD Enumeration

• Identify the machine's role (DC/client) and the services present.
• Identify the initial target in the domain (the low-hanging fruit).

AD Exploitation

• Have a cheatsheet of AD commands.
  • Be thorough for enumeration, exploitation, and post-exploitation.
• Do not ignore standard enumeration; check applications and non-AD-related services.
• Try using the information you obtained on multiple domain machines.

https://help.offsec.com/hc/en-us/articles/4547917816468-OffSec-OSCP-Exam-with-AD-Preparation#h_01FX54D2W34TP81WBH46KM6EVZ

VPN TOR Investigation

This lab simulates a real incident where an employee used the Tor network through the corporate VPN. The primary objective is to develop fundamental digital forensic investigation skills through correlation of logs from different sources.

https://portal.offsec.com/machine/vpn-tor-investigation-218100/overview

Lab

CVE-2026-24061

This lab delves into CVE-2026-24061, a newly disclosed vulnerability in the telnet daemon of GNU Inetutils, where attackers can bypass authentication by manipulating environment variables. Learners will perform a full port scan to uncover exposed services, focusing on telnet—a legacy protocol often overlooked in modern security postures. By analyzing telnet's behavior and its insecure environment variable handling, users will exploit the flaw to escalate privileges directly to root. This exercise reinforces the real-world dangers posed by outdated services and misconfigured daemons, offering critical insight into exploitation techniques and defense strategies.

Ideal for penetration testers, red teamers, and system administrators, this lab builds practical skills in network enumeration, vulnerability analysis, privilege escalation, and hardening legacy services. It also strengthens understanding of how environment variables can be abused if not securely handled—an often underestimated risk in system security.

Lab

CVE-2025-51482

 This lab immerses learners in a realistic offensive security scenario centered on abusing an exposed AI-driven API within a modern application stack. Participants are tasked with identifying externally accessible services, profiling a vulnerable Letta AI deployment, and exploiting unsafe functionality to achieve remote command execution and an initial foothold on the target system. From there, the challenge shifts into post-exploitation, requiring careful local enumeration to uncover mismanaged configuration data containing an encrypted Juniper Type-9 password. By reversing this credential and reusing it to escalate privileges, learners progress from a low-privileged shell to full root access, mirroring real-world attack chains that combine application-layer flaws with weak credential handling.

Lab

CVE-2024-3673

Explore a WordPress-based web application vulnerable to an unauthenticated Local File Inclusion via the Web Directory Free plugin (CVE-2024-3673). Gain insights into internal server configuration, uncover sensitive backend code, and exploit a Python deserialization flaw to obtain remote shell access. Further escalate privileges by leveraging a command injection vulnerability in an internal admin panel exposed through insecure session management. This lab tests your ability to enumerate web services, exploit file inclusion vulnerabilities, analyze Python source code, perform unsafe deserialization attacks, and escalate privileges through command injection and insecure role-based access controls.

The session explored the following topics:

● NTLM vs Kerberos Authentication ● Authentication Attacks: No credentials ○ Password Spraying ○ AS-REP Roasting ● Authentication Attacks: Assumed breach ○ Kerberoasting ○ Cached credentials ○ Credential Guard

CVE-2025-1716_Attack

A Python Flask application exposes a vulnerable model upload endpoint that insecurely deserializes user-supplied data using the pickle module. This flaw, identified as CVE-2025-1716, enables remote code execution by uploading a malicious pickle file. Exploiting this weakness provides shell access as root on the target system.

Hacktrack: AD Intro and Enum

The session explored the following topics:

• Prior to engagement
  • Customizing Terminal Prompt
  • Creating Logs automatically
• During the engagement
  • Ongoing documentation
  • Obsidian, Flameshot, Joplin and etc
• Post-engagement
  • CVE and CVSS
  • SysReptor

Cloud Automation & Security Foundations Assessment

The Cloud Automation & Security Foundations Assessment is a hands-on evaluation consisting of 5 practical questions, designed to be completed in approximately 120 minutes.

This assessment focuses on foundational cloud automation and security competencies essential for working with modern cloud environments. Learners will demonstrate their understanding of Infrastructure as Code principles, apply basic Terraform workflows, identify common IAM misconfigurations, follow secure practices for managing secrets, and use configuration management tools to perform ad-hoc operations. The assessment emphasizes real-world cloud administration and security scenarios, validating core skills required for secure cloud automation roles.

The session explored the following topics:

• What is a C2 framework?
• Staged vs Stageless payload
• Sliver – Server, Client, Multiplayer, Operators and Armory
• Sliver – Listeners: HTTP(s), DNS, WireGuard, mTLS
• Sliver – Implants (beacons/sessions)
• Sliver – Execute in memory (bonus SharpCollection)
• Sliver – Pivoting with Proxychains
• Sliver – Pivoting with Ligolo-NG (bonus)
• Sliver – staged binary creation (bonus)
• Sliver – staged Powershell creation (bonus)

Lab