Extra tools to obtain

This lookup describes the standard Kali default toolset and base system, not every optional Kali package or every possible image. Package availability and actual installation are separate checks. Install only the missing package you need.

Optional Kali client profile for an evidenced SMB1/NT1-only endpoint. It is not needed for the normal SMB procedure and does not modify /etc/samba/smb.conf. Samba client configuration.

sudo apt install smbclient samba-common-bin
mkdir -p "$HOME/oscp/tools/config"
( set -o noclobber
cat > "$HOME/oscp/tools/config/smb-legacy.conf" <<'EOF'
[global]
client min protocol = NT1
client max protocol = SMB3
EOF
)
testparm -s "$HOME/oscp/tools/config/smb-legacy.conf"

Keep normal defaults for modern endpoints. Pass this file with smbclient -s only for the selected compatibility check; protocol negotiation and authentication are separate issues. The profile does not enable NTLMv1 or prove that credentials work. Keep an existing reviewed file rather than overwriting it.

Use Legacy Samba client profile · Setup source

Optional Kali endpoint for the existing SCP and Plink reverse-forward procedures. Use your ordinary Kali account; neither root login nor a global trust change is required. OpenSSH server configuration.

sudo apt install openssh-server
sudo sshd -t
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

The syntax check must succeed. Record/compare the server key fingerprint when connecting; the fingerprint is host-specific and stays private. Start the service only when that workflow needs it:

sudo systemctl start ssh.service
systemctl is-active ssh.service
ss -ltn '( sport = :22 )'

The intended host must be able to reach the endpoint. An active service/listener does not prove remote reachability or successful authentication. If forwarding is denied by policy, review the specific SSH restriction rather than enabling root login. Stop it only if you started it solely for the finished task:

sudo systemctl stop ssh.service

Use Kali SSH endpoint · Setup source

PowerUp, PowerView, Mimikatz and Windows Netcat are used in the existing tracks. Prepare only the files selected for a procedure; match architecture and access requirements. These commands copy files on Kali without executing them. Kali PowerSploit, Mimikatz and Windows binaries.

sudo apt install windows-binaries powersploit mimikatz
mkdir -p "$HOME/oscp/tools/artifacts/windows/"{powersploit,mimikatz}
cp /usr/share/windows-resources/binaries/nc.exe "$HOME/oscp/tools/artifacts/windows/x86/nc.exe"
cp /usr/share/windows-resources/powersploit/Privesc/PowerUp.ps1 "$HOME/oscp/tools/artifacts/windows/powersploit/"
cp /usr/share/windows-resources/powersploit/Recon/PowerView.ps1 "$HOME/oscp/tools/artifacts/windows/powersploit/"
cp -a /usr/share/windows-resources/mimikatz/Win32 /usr/share/windows-resources/mimikatz/x64 "$HOME/oscp/tools/artifacts/windows/mimikatz/"
file "$HOME/oscp/tools/artifacts/windows/x86/nc.exe" "$HOME/oscp/tools/artifacts/windows/mimikatz/"{Win32,x64}/mimikatz.exe
test -s "$HOME/oscp/tools/artifacts/windows/powersploit/PowerUp.ps1"
test -s "$HOME/oscp/tools/artifacts/windows/powersploit/PowerView.ps1"

Keep the matching complete Mimikatz directory together. Return to PowerUp, PowerView, or credential-access prerequisites for actual use. Use target staging before transfer. File checks do not establish Windows execution.

Use Packaged Windows support files · Setup source

Optional Kali HTTP receiver for the existing .NET UploadFile method. Prepare the PHP endpoint once; select a separate receiving directory and listen address for each use. This uses a foreground PHP server, not a change to the global Apache webroot. PHP upload handling.

sudo apt install php-cli
mkdir -p "$HOME/oscp/tools/receivers/http"
( set -o noclobber
cat > "$HOME/oscp/tools/receivers/http/upload.php" <<'PHP'
<?php
$directory = getenv('OSCP_UPLOAD_DIR');
if (!$directory || !is_dir($directory) || !isset($_FILES['file']) || $_FILES['file']['error'] !== UPLOAD_ERR_OK) {
    http_response_code(400);
    exit('Invalid upload');
}
$name = basename($_FILES['file']['name']);
$destination = $directory . DIRECTORY_SEPARATOR . $name;
if ($name === '' || file_exists($destination)) {
    http_response_code(409);
    exit('Choose a new filename');
}
if (!move_uploaded_file($_FILES['file']['tmp_name'], $destination)) {
    http_response_code(500);
    exit('Upload failed');
}
echo 'Saved';
PHP
)
php -l "$HOME/oscp/tools/receivers/http/upload.php"

Keep an existing reviewed script, or choose a different endpoint directory. When needed, replace TARGET with the private host label and LHOST with Kali's reachable interface address. Start in the foreground:

mkdir -p "$HOME/oscp/work/TARGET/received"
export OSCP_UPLOAD_DIR="$HOME/oscp/work/TARGET/received"
php -S LHOST:8000 -t "$HOME/oscp/tools/receivers/http"

Use /upload.php in the existing client command. Inspect the received filename/content and compare its hash; a Saved response alone does not establish byte-for-byte integrity. PHP's configured request/upload size limits still apply. Stop this receiver with Ctrl+C when finished; do not serve the evidence directory itself.

Use HTTP file receiver · Setup source

Conditional fallback when a Windows TFTP client is already available and UDP connectivity permits the transfer. Prepare the server package on Kali. APT may start a packaged service under the local service policy; check systemctl status atftpd and sudo ss -lunp before starting the foreground receiver. Do not start a second listener on an occupied port. Kali atftp/atftpd documentation.

sudo apt install atftpd
atftpd --help

For one selected transfer, replace TARGET, FILE and LHOST. Precreate the receiving file and run the server in the foreground under your ordinary Kali identity after binding the UDP port:

mkdir -p "$HOME/oscp/work/TARGET/received"
touch "$HOME/oscp/work/TARGET/received/FILE"
sudo atftpd --daemon --no-fork --user "$(id -un)" --group "$(id -gn)" --bind-address LHOST --port 69 --pidfile "$HOME/oscp/work/TARGET/atftpd.pid" "$HOME/oscp/work/TARGET/received"

Use that exact FILE destination in the target's put command. This unauthenticated protocol is an on-demand transfer fallback, not a permanently running baseline service. Check the resulting file/hash, and stop the foreground receiver with Ctrl+C when finished. If a target lacks TFTP or the path is blocked, use the existing HTTP/SCP/SMB choices rather than enabling target features by default.

Use TFTP file receiver · Setup source

Prepare one explicit ProxyChains profile on Kali; it works with either the existing Chisel reverse SOCKS transport or SSH dynamic forwarding. It does not create a tunnel. ProxyChains upstream.

mkdir -p "$HOME/oscp/tools/config"
( set -o noclobber
cat > "$HOME/oscp/tools/config/proxychains-oscp.conf" <<'EOF'
strict_chain
proxy_dns
[ProxyList]
socks5 127.0.0.1 1080
EOF
)

Keep an existing reviewed profile, or use a new name. If the actual SOCKS listener uses another port, create a separate profile with that port and pass its path explicitly. Check the local parser without contacting a target:

proxychains4 -f "$HOME/oscp/tools/config/proxychains-oscp.conf" /bin/true

The configuration should load. This does not establish a working listener or route; the owning pivot procedure checks those when the tunnel is running.

Use SOCKS client profile · Setup source

Retained alternative, not an additional mandatory pass after AutoRecon. Upstream modes have different dependencies; inspect the selected mode before use. Upstream.

git clone --depth 1 https://github.com/21y4d/nmapAutomator.git "$HOME/oscp/tools/repos/nmapAutomator"

Check on Kali:

bash -n "$HOME/oscp/tools/repos/nmapAutomator/nmapAutomator.sh"

Use nmapAutomator · Setup source

Optional Kali alternative for recursive content discovery. Upstream.

sudo apt install feroxbuster

Check on Kali:

feroxbuster --version

Use Feroxbuster · Setup source

Optional Kali alternative for path discovery. Upstream.

sudo apt install dirsearch

Check on Kali:

dirsearch --help

Use dirsearch · Setup source

Optional Rust-based web discovery tool. The config and technology wordlists are required even when the binary builds successfully. The three filename corrections below align the upstream profile with its case-sensitive wordlist checkout. Preserve an existing ~/.config/chameleon installation and review its paths instead of overwriting it. Compilation requires a compatible Rust toolchain; do not use its installer as an opaque substitute for reviewing dependencies. Upstream.

sudo apt install cargo build-essential perl pkg-config
git clone --depth 1 https://github.com/iustin24/chameleon.git "$HOME/oscp/tools/repos/chameleon"
cargo build --release --manifest-path "$HOME/oscp/tools/repos/chameleon/Cargo.toml"
mkdir -p "$HOME/.config/chameleon"
git clone --depth 1 https://github.com/iustin24/chameleon-wordlists.git "$HOME/.config/chameleon/wordlists"
( set -o noclobber; sed -e 's@/GO.txt@/Golang.txt@g' -e 's@/umbraco.txt@/Umbraco.txt@g' -e 's@/Joommla.txt@/Joomla.txt@g' "$HOME/oscp/tools/repos/chameleon/config.toml" > "$HOME/.config/chameleon/config.toml" )

Check on Kali:

"$HOME/oscp/tools/repos/chameleon/target/release/chameleon" --help
python3 - <<'PY'
import pathlib, tomllib
config = pathlib.Path.home() / ".config/chameleon/config.toml"
data = tomllib.loads(config.read_text())
def check(value):
    if isinstance(value, dict):
        for child in value.values():
            check(child)
    elif isinstance(value, str) and value.startswith("~/"):
        path = pathlib.Path(value).expanduser()
        assert path.is_file(), f"Missing configured file: {path}"
check(data)
PY

Use Chameleon · Setup source

Optional general-lab web proxy/scanner. This does not approve active scanner/automation features for the exam; follow the feature-specific restrictions in the owning section. Upstream.

sudo apt install zaproxy

Check on Kali:

zaproxy -version

Use ZAP · Setup source

The existing examples use the legacy mongo client. This optional Kali package supplies that spelling; it may not support modern server/authentication requirements. Use the vendor-supported mongosh client when the actual server requires it; do not assume the two CLIs are identical. Upstream.

sudo apt install mongodb-clients

Check on Kali:

mongo --version

Use MongoDB shell · Setup source

Optional official Go sqlcmd for Kali amd64; this is not the separate ODBC mssql-tools package. The existing -S/-U connection form is supported; review encryption/authentication options in the installed help for the actual server. Upstream.

mkdir -p "$HOME/oscp/tools/repos/sqlcmd"
curl -fL https://github.com/microsoft/go-sqlcmd/releases/download/v1.10.0/sqlcmd-linux-amd64.tar.bz2 -o "$HOME/oscp/tools/downloads/sqlcmd.tar.bz2"
tar -xjf "$HOME/oscp/tools/downloads/sqlcmd.tar.bz2" -C "$HOME/oscp/tools/repos/sqlcmd"
ln -s "$HOME/oscp/tools/repos/sqlcmd/sqlcmd" "$HOME/oscp/tools/bin/sqlcmd"

Check on Kali:

"$HOME/oscp/tools/bin/sqlcmd" --version

Use sqlcmd · Setup source

Optional Kali wordlist profiler. It creates a local wordlist, not permission to spray accounts. Upstream.

sudo apt install cupp

Check on Kali:

cupp -h

Use CUPP · Setup source

Runs on Kali. Definition update needs Internet access; host analysis uses a separately collected systeminfo file. Upstream.

git clone --depth 1 https://github.com/bitsadmin/wesng.git "$HOME/oscp/tools/repos/wesng"
cd "$HOME/oscp/tools/repos/wesng"
python3 wes.py --update

Check on Kali:

python3 "$HOME/oscp/tools/repos/wesng/wes.py" --help

Use Windows Exploit Suggester Next Generation · Setup source

putty-tools supplies the Kali CLI; the existing Windows example uses the separately bundled windows-binaries artifact. Check its PE architecture/age before use; these are different platform binaries. Upstream.

sudo apt install putty-tools
cp /usr/share/windows-resources/binaries/plink.exe "$HOME/oscp/tools/artifacts/windows/x86/plink.exe"

Check on Kali:

plink -V
file "$HOME/oscp/tools/artifacts/windows/x86/plink.exe"

Use PuTTY / Plink · Setup source

Optional Kali-side alternative to Windows SharpHound; requires Python/pipx and a compatible BloodHound CE importer. Upstream CE branch. Skip installation if a suitable command already exists; do not replace a managed installation merely to obtain another collector.

pipx install bloodhound-ce
bloodhound-ce-python --help

Help must expose DCOnly, --disable-autogc and --zip. Legacy bloodhound-python uses a different output schema. A successful help screen does not verify domain connectivity or graph ingestion.

Use BloodHound.py CE · Setup source

Optional Kali LDAP rights query tool. Upstream. Use an isolated Python environment; keep a suitable existing installation.

pipx install bloodyAD
bloodyAD get writable -h

Help must include --detail and --partition. Select get writable for the inventory above; add, remove and set are separate state-changing operations. Setup/help checks do not authorize target activity.

Use bloodyAD · Setup source

FreeRDP 3 client used in the RDP/drive-transfer variants. A minimal/custom image may not have it even if older notes assume xfreerdp. The /version check requires no target. Upstream.

sudo apt install freerdp3-x11

Check on Kali:

xfreerdp3 /version

Use FreeRDP · Setup source

Optional graphical RDP client on Kali; requires a desktop session when used. Prefer one chosen RDP client, not repeated attempts through every GUI. Upstream.

sudo apt install remmina

Check on Kali:

remmina --version

Use Remmina · Setup source

MacroRaptor runs locally on Kali to inspect a selected Office document. It does not execute the document or prove that a target will run its macros. Upstream.

sudo apt install oletools

Check on Kali:

mraptor -h

Use oletools: MacroRaptor · Setup source

Kali amd64 binary. Choose another upstream asset for ARM/i386; this does not authorize or perform authentication attempts. Upstream.

curl -fL https://github.com/ropnop/kerbrute/releases/download/v1.0.3/kerbrute_linux_amd64 -o "$HOME/oscp/tools/bin/kerbrute"
chmod u+x "$HOME/oscp/tools/bin/kerbrute"

Check on Kali:

"$HOME/oscp/tools/bin/kerbrute" version

Use Kerbrute · Setup source

Legacy transfer encoder, not an installed Kali package in the current repository. Invoke the reviewed Python 3 source explicitly. Encoding does not establish execution, transfer integrity or endpoint compatibility. Upstream.

git clone --depth 1 https://github.com/g0tmi1k/exe2hex.git "$HOME/oscp/tools/repos/exe2hex"

Check on Kali:

python3 "$HOME/oscp/tools/repos/exe2hex/exe2hex.py" -h

Use exe2hex · Setup source

Alternative Linux shell collector; retain its script rather than running a second full inventory by habit. Upstream.

git clone --depth 1 https://github.com/diego-treitos/linux-smart-enumeration.git "$HOME/oscp/tools/repos/linux-smart-enumeration"
cp "$HOME/oscp/tools/repos/linux-smart-enumeration/lse.sh" "$HOME/oscp/tools/artifacts/linux/lse.sh"

Check on Kali:

bash -n "$HOME/oscp/tools/artifacts/linux/lse.sh"

Use Linux Smart Enumeration · Setup source

Optional Perl suggester: run on Kali with the observed target kernel release, or transfer it for target-side use when Perl is available. Matching a kernel string does not account for every distribution backport. Upstream.

git clone --depth 1 https://github.com/jondonas/linux-exploit-suggester-2.git "$HOME/oscp/tools/repos/linux-exploit-suggester-2"
cp "$HOME/oscp/tools/repos/linux-exploit-suggester-2/linux-exploit-suggester-2.pl" "$HOME/oscp/tools/artifacts/linux/linux-exploit-suggester-2.pl"

Check on Kali:

perl -c "$HOME/oscp/tools/artifacts/linux/linux-exploit-suggester-2.pl"

Use Linux Exploit Suggester 2 · Setup source

Windows PowerShell 5.1. The repository requires authorized GitHub access; authenticate on Kali when prompted. If you already have a local checkout, use it instead of cloning again. Preserve native/scripts/ad-map and the module; transfer the directory, not only the entry script. Upstream.

sudo apt install gh
gh auth login
gh auth setup-git
git clone --depth 1 https://github.com/ArmaanLeg3nd/OSCP-Exploitation-Reference.git "$HOME/oscp/tools/repos/OSCP-Exploitation-Reference"
mkdir -p "$HOME/oscp/tools/artifacts/windows/native/scripts"
cp -a "$HOME/oscp/tools/repos/OSCP-Exploitation-Reference/scripts/ad-map" "$HOME/oscp/tools/artifacts/windows/native/scripts/"

Check on Kali:

test -s "$HOME/oscp/tools/artifacts/windows/native/scripts/ad-map/ADMap.psm1"
test -s "$HOME/oscp/tools/artifacts/windows/native/scripts/ad-map/Invoke-ADMap.ps1"
test -s "$HOME/oscp/tools/artifacts/windows/native/scripts/ad-map/Get-HostSurface.ps1"

Use Our native AD / host helpers · Setup source

Windows .NET build required. A source checkout is not a runnable Seatbelt.exe. Use a Windows Developer Command Prompt with MSBuild and the project's .NET Framework targeting pack; build Release, then transfer its output and dependencies to Kali. Upstream.

git clone --depth 1 https://github.com/GhostPack/Seatbelt.git "$HOME/oscp/tools/repos/Seatbelt"

Check on Kali:

test -s "$HOME/oscp/tools/repos/Seatbelt/Seatbelt.sln"

On the Windows build machine, clone the same upstream project and run from its directory:

MSBuild.exe Seatbelt.sln /p:Configuration=Release

Inspect the build output directory for the executable and required DLL/config files. Copy that complete output into ~/oscp/tools/artifacts/windows/Seatbelt/ on Kali using the existing transfer procedure. A modern dotnet build on Kali is not assumed to support these legacy .NET Framework projects.

Use Seatbelt · Setup source

Windows .NET build required. A source checkout is not a runnable SharpUp.exe. Use a Windows Developer Command Prompt with MSBuild and the project's .NET Framework targeting pack; build Release, then transfer its output and dependencies to Kali. Upstream.

git clone --depth 1 https://github.com/GhostPack/SharpUp.git "$HOME/oscp/tools/repos/SharpUp"

Check on Kali:

test -s "$HOME/oscp/tools/repos/SharpUp/SharpUp.sln"

On the Windows build machine, clone the same upstream project and run from its directory:

MSBuild.exe SharpUp.sln /p:Configuration=Release

Inspect the build output directory for the executable and required DLL/config files. Copy that complete output into ~/oscp/tools/artifacts/windows/SharpUp/ on Kali using the existing transfer procedure. A modern dotnet build on Kali is not assumed to support these legacy .NET Framework projects.

Use SharpUp · Setup source

Windows .NET build required. A source checkout is not a runnable Watson.exe. Use a Windows Developer Command Prompt with MSBuild and the project's .NET Framework targeting pack; build Release, then transfer its output and dependencies to Kali. Watson additionally supports only its documented legacy OS builds. Upstream.

git clone --depth 1 https://github.com/rasta-mouse/Watson.git "$HOME/oscp/tools/repos/Watson"

Check on Kali:

test -s "$HOME/oscp/tools/repos/Watson/Watson.sln"

On the Windows build machine, clone the same upstream project and run from its directory:

MSBuild.exe Watson.sln /p:Configuration=Release

Inspect the build output directory for the executable and required DLL/config files. Copy that complete output into ~/oscp/tools/artifacts/windows/Watson/ on Kali using the existing transfer procedure. A modern dotnet build on Kali is not assumed to support these legacy .NET Framework projects.

Use Watson · Setup source

Conditional legacy Windows path. Select PrintSpoofer32.exe for x86; obtaining the binary does not establish compatible OS, spooler state or token rights. Upstream.

curl -fL https://github.com/itm4n/PrintSpoofer/releases/download/v1.0/PrintSpoofer64.exe -o "$HOME/oscp/tools/artifacts/windows/x64/PrintSpoofer.exe"

Check on Kali:

file "$HOME/oscp/tools/artifacts/windows/x64/PrintSpoofer.exe"

Use PrintSpoofer · Setup source

Conditional legacy Windows path. Verify the PE architecture and compatible CLSID/OS before target delivery; do not treat it as a universal escalation utility. Upstream.

curl -fL https://github.com/ohpe/juicy-potato/releases/download/v0.1/JuicyPotato.exe -o "$HOME/oscp/tools/artifacts/windows/x64/JuicyPotato.exe"
curl -fL https://raw.githubusercontent.com/ohpe/juicy-potato/master/CLSID/GetCLSID.ps1 -o "$HOME/oscp/tools/artifacts/windows/GetCLSID.ps1"

Check on Kali:

file "$HOME/oscp/tools/artifacts/windows/x64/JuicyPotato.exe"
test -s "$HOME/oscp/tools/artifacts/windows/GetCLSID.ps1"

Use JuicyPotato · Setup source

Windows native utility. Keep the official distribution/EULA and select the matching architecture; use requires the permissions in the owning procedure. Upstream.

curl -fL https://download.sysinternals.com/files/PSTools.zip -o "$HOME/oscp/tools/downloads/PSTools.zip"
unzip -o "$HOME/oscp/tools/downloads/PSTools.zip" -d "$HOME/oscp/tools/artifacts/windows/pstools"

Check on Kali:

file "$HOME/oscp/tools/artifacts/windows/pstools/PsExec64.exe"

Use PsExec (Sysinternals) · Setup source

Optional Windows GUI diagnostic tool requiring the appropriate administrator/driver access. The current release supports Windows 11 / Server 2019 and newer; do not assume it runs on the legacy Windows 7 example. Select a vendor-supported compatible build or use the existing manual checks. Upstream.

curl -fL https://download.sysinternals.com/files/ProcessMonitor.zip -o "$HOME/oscp/tools/downloads/ProcessMonitor.zip"
unzip -o "$HOME/oscp/tools/downloads/ProcessMonitor.zip" -d "$HOME/oscp/tools/artifacts/windows/procmon"

Check on Kali:

file "$HOME/oscp/tools/artifacts/windows/procmon/Procmon64.exe"

Use Process Monitor · Setup source

Retained legacy PowerShell SPN-enumeration alternative. The actual script referenced here is GetUserSPNs.ps1; this does not install obsolete cracking scripts. Prefer the existing Impacket/Rubeus owner for ticket requests; these mechanisms have distinct prerequisites. Upstream.

mkdir -p "$HOME/oscp/tools/artifacts/windows/legacy-ad"
curl -fL https://raw.githubusercontent.com/nidem/kerberoast/master/GetUserSPNs.ps1 -o "$HOME/oscp/tools/artifacts/windows/legacy-ad/GetUserSPNs.ps1"

Check on Kali:

test -s "$HOME/oscp/tools/artifacts/windows/legacy-ad/GetUserSPNs.ps1"

Use Kerberoast scripts and tgsrepcrack · Setup source

Retained standalone PowerShell SPN lookup; inspect the script and available directory context before use. Obtaining a script is separate from having authenticated directory access. Upstream.

mkdir -p "$HOME/oscp/tools/artifacts/windows/legacy-ad"
curl -fL https://raw.githubusercontent.com/compwiz32/PowerShell/master/Get-SPN.ps1 -o "$HOME/oscp/tools/artifacts/windows/legacy-ad/Get-SPN.ps1"

Check on Kali:

test -s "$HOME/oscp/tools/artifacts/windows/legacy-ad/Get-SPN.ps1"

Use Get-SPN.ps1 · Setup source

Windows .NET tool. Kali currently packages an older release; compare its supported options with the command you intend to use. Build the matching upstream version on a Windows .NET build environment when newer functionality is required. Upstream.

sudo apt install rubeus
cp -a /usr/share/windows-resources/rubeus "$HOME/oscp/tools/artifacts/windows/"

Check on Kali:

dpkg-query -W rubeus
file "$HOME/oscp/tools/artifacts/windows/rubeus/Rubeus.exe"

Use Rubeus · Setup source

Runs on an owned Windows 10/11 Pro or Enterprise management host, not Kali. Install from elevated PowerShell only when you administer that host; a low-privilege domain shell does not imply this feature is available. This feature is required for the Get-AD* examples, not for PowerView or the native LDAP helper. Upstream.

Get-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools*
Add-WindowsCapability -Online -Name Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0

Check on the Windows management host:

Get-Module -ListAvailable ActiveDirectory
Import-Module ActiveDirectory
Get-Command Get-ADUser

On Windows Server, use elevated PowerShell instead:

Install-WindowsFeature RSAT-AD-PowerShell
Import-Module ActiveDirectory
Get-Command Get-ADUser

If you cannot install RSAT, use the existing LDAP/PowerView methods rather than assuming Get-ADUser is a built-in cmdlet.

Use RSAT Active Directory PowerShell · Setup source

Optional local AD graph service using the upstream CE quickstart, not the old Electron startup sequence. Requires Docker/Compose, at least 8 GB RAM and about 10 GB free storage. CLI installation is interactive and starts local containers; record its generated credentials privately and change them on first login. If port 8080 is occupied, use the CLI configuration rather than stopping unrelated services. Upstream.

sudo apt install docker.io docker-compose-v2
sudo systemctl start docker
mkdir -p "$HOME/oscp/tools/repos/bloodhound-ce"
cd "$HOME/oscp/tools/repos/bloodhound-ce"
curl -fL https://github.com/SpecterOps/bloodhound-cli/releases/download/v0.2.1/bloodhound-cli-linux-amd64.tar.gz -o "$HOME/oscp/tools/downloads/bloodhound-cli.tar.gz"
tar -xzf "$HOME/oscp/tools/downloads/bloodhound-cli.tar.gz"
sudo ./bloodhound-cli install

Check on Kali:

sudo "$HOME/oscp/tools/repos/bloodhound-ce/bloodhound-cli" running
curl -I http://127.0.0.1:8080

Keep using the same sudo context for CLI management so its configuration/data directory stays consistent. Installation is a first-time operation: resume an existing installation with sudo "$HOME/oscp/tools/repos/bloodhound-ce/bloodhound-cli" up, and stop its containers with the same path followed by down; do not use uninstall as a stop command because it deletes stored data.

Use the official CE quickstart for installation prompts, version matching, start/stop and recovery. Confirm the web login before collecting domain data; docker ps alone does not prove the application is ready.

Use BloodHound · Setup source

Optional data collection, not an executable installation. Inspect sizes and choose one relevant dictionary; do not concatenate every list or treat it as a required download. Upstream.

git clone --depth 1 https://github.com/berzerk0/Probable-Wordlists.git "$HOME/oscp/tools/repos/probable-wordlists"

Check on Kali:

git -C "$HOME/oscp/tools/repos/probable-wordlists" rev-parse --short HEAD

Use Probable Wordlists · Setup source

Optional data collection, not an executable installation. Inspect sizes and choose one relevant dictionary; do not concatenate every list or treat it as a required download. Upstream.

git clone --depth 1 https://github.com/Dormidera/WordList-Compendium.git "$HOME/oscp/tools/repos/wordlist-compendium"

Check on Kali:

git -C "$HOME/oscp/tools/repos/wordlist-compendium" rev-parse --short HEAD

Use WordList Compendium · Setup source

Optional data collection, not an executable installation. Inspect sizes and choose one relevant dictionary; do not concatenate every list or treat it as a required download. Upstream.

git clone --depth 1 https://github.com/google/fuzzing.git "$HOME/oscp/tools/repos/google-fuzzing"

Check on Kali:

git -C "$HOME/oscp/tools/repos/google-fuzzing" rev-parse --short HEAD

Use Google fuzzing dictionaries · Setup source

Optional web-path dictionary. Inspect the list and select a sensible scope/rate; its presence is not a reason to repeat complete discovery. Upstream.

mkdir -p "$HOME/oscp/tools/artifacts/wordlists"
curl -fL https://gist.githubusercontent.com/jhaddix/b80ea67d85c13206125806f0828f4d10/raw/content_discovery_all.txt -o "$HOME/oscp/tools/artifacts/wordlists/content_discovery_all.txt"

Check on Kali:

wc -l "$HOME/oscp/tools/artifacts/wordlists/content_discovery_all.txt"

Use Jhaddix content-discovery list · Setup source

Optional human-password subset, roughly 247 MiB compressed / 684 MiB expanded. Select only if useful and allow disk space for both files. Expected archive SHA256: 201f8815c71a47d39775304aa422a505fc4cca18493cfaf5a76e608a72920267. The full list is about 15 GiB expanded and is not part of this setup. Upstream.

mkdir -p "$HOME/oscp/tools/artifacts/wordlists"
curl -fL https://crackstation.net/files/crackstation-human-only.txt.gz -o "$HOME/oscp/tools/downloads/crackstation-human-only.txt.gz"
gzip -dk "$HOME/oscp/tools/downloads/crackstation-human-only.txt.gz"
mv "$HOME/oscp/tools/downloads/crackstation-human-only.txt" "$HOME/oscp/tools/artifacts/wordlists/"

Check on Kali:

sha256sum "$HOME/oscp/tools/downloads/crackstation-human-only.txt.gz"
wc -l "$HOME/oscp/tools/artifacts/wordlists/crackstation-human-only.txt"

Use CrackStation dictionary · Setup source

Source/reference collection, not a general tool installation. Obtain only when the owning technique is applicable. Read the selected PoC requirements and build/runtime instructions; no exploit is executed by this checkout. Upstream.

git clone --depth 1 https://github.com/SecWiki/windows-kernel-exploits.git "$HOME/oscp/tools/repos/windows-kernel-exploits"

Check on Kali:

git -C "$HOME/oscp/tools/repos/windows-kernel-exploits" rev-parse --short HEAD

Use Windows kernel exploit collection · Setup source

Source/reference collection, not a general tool installation. Obtain only when the owning technique is applicable. Read the selected PoC requirements and build/runtime instructions; no exploit is executed by this checkout. Upstream.

git clone --depth 1 https://github.com/hatRiot/token-priv.git "$HOME/oscp/tools/repos/token-priv"

Check on Kali:

git -C "$HOME/oscp/tools/repos/token-priv" rev-parse --short HEAD

Use Token privilege research · Setup source

Source/reference collection, not a general tool installation. Obtain only when the owning technique is applicable. Read the selected PoC requirements and build/runtime instructions; no exploit is executed by this checkout. Upstream.

git clone --depth 1 https://github.com/CsEnox/EventViewer-UACBypass.git "$HOME/oscp/tools/repos/EventViewer-UACBypass"

Check on Kali:

git -C "$HOME/oscp/tools/repos/EventViewer-UACBypass" rev-parse --short HEAD

Use EventViewer-UACBypass · Setup source

Historical general-lab source only. This technique uses spoofing/relay and is outside the current exam baseline. This checkout does not build, stage or run potato.exe. Read the selected source/build requirements only for an independently authorized compatible lab. Upstream.

git clone --depth 1 https://github.com/foxglovesec/Potato.git "$HOME/oscp/tools/repos/Potato"

Check on Kali:

git -C "$HOME/oscp/tools/repos/Potato" rev-parse --short HEAD

Use Hot Potato · Setup source

Source/reference collection, not a general tool installation. Obtain only when the owning technique is applicable. Read the selected PoC requirements and build/runtime instructions; no exploit is executed by this checkout. Upstream.

git clone --depth 1 https://github.com/dirkjanm/CVE-2020-1472.git "$HOME/oscp/tools/repos/CVE-2020-1472"

Check on Kali:

git -C "$HOME/oscp/tools/repos/CVE-2020-1472" rev-parse --short HEAD

Use ZeroLogon PoC (source example) · Setup source

Optional payload source, not a Kali service to install or start. Select one reviewed file matching the application runtime, edit required parameters, and copy only that file into the target staging directory. Do not deploy the whole collection. Upstream.

git clone --depth 1 https://github.com/artyuum/Simple-PHP-Web-Shell.git "$HOME/oscp/tools/repos/simple-php-web-shell"

Check on Kali:

git -C "$HOME/oscp/tools/repos/simple-php-web-shell" rev-parse --short HEAD

Use Simple PHP Web Shell · Setup source

Optional payload source, not a Kali service to install or start. Select one reviewed file matching the application runtime, edit required parameters, and copy only that file into the target staging directory. Do not deploy the whole collection. Upstream.

git clone --depth 1 https://github.com/drag0s/php-webshell.git "$HOME/oscp/tools/repos/php-webshell-drag0s"

Check on Kali:

git -C "$HOME/oscp/tools/repos/php-webshell-drag0s" rev-parse --short HEAD

Use PHP web shell (drag0s) · Setup source

Optional payload source, not a Kali service to install or start. Select one reviewed file matching the application runtime, edit required parameters, and copy only that file into the target staging directory. Do not deploy the whole collection. Upstream.

git clone --depth 1 https://github.com/LaiKash/JSP-Reverse-and-Web-Shell.git "$HOME/oscp/tools/repos/jsp-shells-laikash"

Check on Kali:

git -C "$HOME/oscp/tools/repos/jsp-shells-laikash" rev-parse --short HEAD

Use JSP shells (LaiKash) · Setup source

Optional payload source, not a Kali service to install or start. Select one reviewed file matching the application runtime, edit required parameters, and copy only that file into the target staging directory. Do not deploy the whole collection. Upstream.

git clone --depth 1 https://github.com/threedr3am/JSP-Webshells.git "$HOME/oscp/tools/repos/jsp-webshells"

Check on Kali:

git -C "$HOME/oscp/tools/repos/jsp-webshells" rev-parse --short HEAD

Use JSP-Webshells (threedr3am) · Setup source

Optional payload source, not a Kali service to install or start. Select one reviewed file matching the application runtime, edit required parameters, and copy only that file into the target staging directory. Do not deploy the whole collection. Upstream.

git clone --depth 1 https://github.com/tennc/webshell.git "$HOME/oscp/tools/repos/webshell-tennc"

Check on Kali:

git -C "$HOME/oscp/tools/repos/webshell-tennc" rev-parse --short HEAD

Use Web shell collection (tennc) · Setup source

Network Scan

Services Exploitation

Web Application Attacks

Brute Forcing

Privilege Escalation

Active Directory

Transfer Files

Shells