How to Pass Technical Screening Interviews for Offensive Security Certified Professional (OSCP)
A complete step-by-step masterclass on passing OSCP 24-hour penetration testing lab challenges, privilege escalation, and ethical hacking technical screens.
Summary: Master practical penetration testing methodologies, Active Directory Kerberoasting/Pass-the-Hash attacks, Linux/Windows privilege escalation, and OSCP report writing strategy.
1. OSCP 24-Hour Practical Exam & Methodology
Offensive Security Certified Professional (OSCP) evaluates 100% hands-on penetration testing in a simulated network. 1. **Active Directory Set (40 Points):** 1 Domain Controller + 2 Client Machines. Must compromise all 3 machines in chain. 2. **Standalone Machines (3 x 20 Points = 60 Points):** Initial access (10 points) + Local Privilege Escalation (10 points). 3. **Passing Score:** 70 points out of 100 required within 23 hours and 45 minutes, followed by a professional 24-hour report.
2. Initial Reconnaissance & Enumeration Strategy
**Interview Scenario:** *"Walk me through your systematic methodology when given an unknown IP address in an OSCP lab environment."* * **Port Scanning:** Run initial fast Nmap scan followed by full TCP scan: `nmap -p- --min-rate 10000 10.10.X.X -oN initial_ports.txt` * **Service Enumeration:** Run targeted scripts on open ports (`nmap -sC -sV -p 80,445,8080 10.10.X.X`). * **Web Fuzzing:** Execute `ffuf` or `gobuster` for hidden files and administrative endpoints: `gobuster dir -u http://10.10.X.X/ -w /usr/share/wordlists/dirb/common.txt -x php,txt,html` * **SMB & RPC Enumeration:** Check null sessions on Port 445 using `smbclient -L //10.10.X.X` and `enum4linux-ng`.
3. Windows & Linux Privilege Escalation Vectors
**Interview Scenario:** *"You obtained a low-privilege shell (`www-data` or `localuser`). What are your key privilege escalation vectors on Linux and Windows?"* * **Linux Escalation Vectors:** 1. **SUID Binaries:** Run `find / -perm -4000 2>/dev/null` and cross-reference with GTFOBins. 2. **Sudo Permissions:** Check `sudo -l` for misconfigured commands or NOPASSWD rules. 3. **Automated Scripts:** Run LinPEAS script for kernel exploits and vulnerable cron jobs. * **Windows Escalation Vectors:** 1. **Unquoted Service Paths:** Check services running from unquoted spaces in paths. 2. **Token Impersonation:** Use `PrintSpoofer` or `JuicyPotato` if `SeImpersonatePrivilege` is enabled. 3. **AlwaysInstallElevated:** Check registry hives for elevated MSI installations.
4. Active Directory Exploitation (Kerberoasting & AD Pivoting)
**Interview Scenario:** *"How do you attack an Active Directory domain after compromising a domain-joined workstation?"* 1. **Domain Enumeration:** Execute PowerView or `bloodhound-python` to graph Domain Admins and Delegation paths. 2. **Kerberoasting:** Request TGS tickets for accounts with Service Principal Names (SPN) using `GetUserSPNs.py` and crack ticket hashes offline using Hashcat (`hashcat -m 13100 hashes.txt rockyou.txt`). 3. **Pass-the-Hash / Pass-the-Ticket:** Use Mimikatz to dump NTLM hashes from memory or execute lateral movement via `evil-winrm` or `psexec.py`.
5. OSCP 24-Hour Exam Report Writing & Passing Thresholds
**Interview Scenario:** *"Why do candidates fail the OSCP even after obtaining 70+ points in the lab environment?"* * **Missing Proof Flags:** Forgetting to capture `ipconfig / ifconfig` alongside `local.txt` and `proof.txt` hashes. * **Incomplete PoC Steps:** Failing to document exact commands, exploit code modifications, and screenshots allowing an auditor to reproduce the root shell. * **Lack of Remediation Advice:** An OSCP report requires professional executive summaries and technical remediation steps for every identified vulnerability.