OSCP Reference

6.5.3 Read and classify command output

AD cheatsheet | §6 — AD Notes | §6.5.1 — Failure diagnosis

6.5.3.1 Before running a command

Write one question it should answer. Record source host, local identity, network identity, target object/service and the access required. Know whether it reads data, requests a ticket, collects secrets, creates a session or modifies state.

6.5.3.2 Read in this order

  1. Did the command run? Import/runtime failures are local failures.
  2. Did it reach the right endpoint? Names, route, listener and protocol precede account conclusions.
  3. Did authentication succeed? Distinguish it from the later authorization check.
  4. Which object/operation succeeded? Share listing is not file reading; file writing is not execution.
  5. Which exact field changes the next decision? Trustee, GUID, group, SPN, account scope, ticket validity or host right.
  6. What is still missing? State the next discriminating check rather than assuming a complete attack.

6.5.3.3 Worked example: share access

Synthetic observations:

Authentication: succeeded as EXAMPLE\analyst
Share listing: Deploy visible
Directory listing: config.ini visible
File read: ACCESS_DENIED
Remote execution: not tested

Observed: authentication and listing succeeded; the selected file read was denied. Unsupported: knowing the file contents, finding credentials or having remote execution. Next: inspect another relevant permitted object or investigate the effective file permission if its contents are necessary. Retest this denied file after a genuinely relevant identity/rights change.

6.5.3.4 Empty output is a question, not an answer

Check scope/base DN, filters, pagination, permissions, collection method and freshness. For example, zero Session edges after DCOnly collection does not establish zero active sessions: the relevant host collection was not performed.

6.5.3.5 Save a useful observation

Observation: exact output and context
Interpretation: only what that output supports
Candidate: useful capability it might enable
Missing condition: exact prerequisite not yet established
Next check: what would discriminate the hypothesis
Decision: enabled after validation / ruled out here / inconclusive

Keep actual outputs and secrets in private lab records. Use recognition practice for unanswered paper cases after studying the annotated examples.

Top of document · Reference home