OSEP Review – The Experienced Penetration Tester

What I’ll Cover

What is the OSEP Course?

If I had to summarize the OSEP course, I would start by comparing it to the OSCP. The OSCP is all about learning how to attack vulnerable machines. If OSCP is how to attack vulnerable machines, then OSEP is how you attack non-vulnerable machines. OSEP focuses on attacking up-to-date systems running proper security tooling like AV, AppLocker, and Powershell CLM.

It focuses on gaining initial access to a machine, overcoming AV to get execution on the machine, and utilizing common misconfigurations as an attack path instead of relying on old vulnerable versions and exploit code.

Although the OSEP is still considered a Penetration Testing certification, it has definitely been beneficial to Red Teaming activities, if you care to split those hairs.

The OSEP is a natural extension to the OSCP. There are times where it feels like you’re picking up right where you left off in OSCP. The expectation coming into the OSEP is that you’ll be able to compromise basic vulnerable code. For example, a web server in a DMZ might have a SQL injection flaw, can you leverage it to gain shell access to the machine? You’ll be expected to do that without hand-holding, since that’s not the focus of this course.

If you’ve done other Offensive Security certs, then you’ll know what to expect with this one. Standard expectation has become: materials, videos, and a training lab. Unlike the OSCP however, there is no need to report on the lab environment (other than good practice).

The Course Review

Who I am and Who I’m Not

I feel compelled to clarify that I’m not the security guy that knocks out a cert like this in a week. I’m not the guy who reads the PDF in week one, then ignores the course for 2 months, and then passes the 48 hour exam in 5 hours.

I mention this, because this isn’t an industry reserved to techy savants that have a knack for it. I’m an average person with interests and hobbies outside of InfoSec, so I’ll never be the guy that can knock out Offsec Certs without a heavy lift.

The Course Layout

To start the course, you’ll get the PDF, videos, and a VPN connection to the labs. I had already done the OSWP and OSCP, so this was pretty standard.

My recommendation is to start by going through the PDF and / or videos, and once you’ve completed those, start reviewing the Challenge Labs.

I read through each section in the PDF, and then followed it up by watching the videos. Despite them being the same, I still found it helpful to hear the review, and then I could follow along with any code or tools that the section focuses on.

Most sections end with exercises to test your knowledge. In addition to those exercises, there are some sections with “Extra Miles” exercises. The Extra Miles aren’t testable knowledge, but are great areas where you can expand on the knowledge they’ve taught.

Although the Extra Miles can technically be skipped, DO NOT skip any of the standard exercises. Even if they seem ridiculous or obvious, do not skip them. In every case where I thought it might be worth skipping, I ended up learning some quirk, or specific use-case, that I wouldn’t have found otherwise.

The course materials are wrapped up with a sort of walkthrough. “Combining the Pieces” puts together everything and shows how you would use the techniques in an engagement. This is a perfect way to end the course, because after this you move into the Challenge Labs where you are on your own to do the same thing.

Putting it all together

Between the walkthrough of “Combining the Pieces” and the various Challenge Labs, you’ll be executing each stage of the MITRE kill chain. From initial access and execution, discovery, credential access, lateral movement, privilege escalation… and a lot of it will be using custom tooling that you’ll develop throughout the course.

To start, you might find a vulnerable asset on the “public” network, and access to it would give you access to the internal network. You’ll have to craft an exploit that successfully evades AV and gain access to the asset. Alternatively, you might find you can trick users into clicking your links, or downloading / executing your malicious files. Again, you’ll have to craft your client side execution in a way that bypasses AV. Some examples include hta files, js or vbs files, and various maldocs / macro enabled Excel and Word documents. You’ll also be up against protections for standard user logins, like applocker, and constrained language mode.

With access to the first machines, you’ll notice you can now discover machines within the Challenge Lab’s internal network. You’ll work through abusing Active Directory permissions and identifying lateral movement.

In order to access additional items on the internal network, you may occasionally need to proxy through your internal access sessions or beacons. In addition, you create custom tools to move laterally, and abuse SQL Server misconfigurations to access servers beyond basic xp_cmdshell executions.

Tooling

One of the great things about this course is that it’s taught using meterpreter sessions in Metasploit. I think this is great, because comparable courses seem to push custom C2 frameworks or use tooling that not everybody is familiar with. Using Metasploit makes the entire course super accessible, and quite honestly, if you can successfully implement the HIGHLY fingerprinted meterpreter reverse shells, you’ll be able to adapt to any other C2 framework of your choice.

The course does show some meterpreter specific sections, but they’re all things that can be executed via other tooling. For example, mimikatz is integrated with meterpreter, or token manipulation with incognito. In both cases, you could find other ways to dump creds to steal tokens.

My Exam Recommendations

To succeed in the exam, you need to be able to complete all of the Challenge Labs. To succeed in the labs, you need to take great notes during the course.

Just like a PenTest report, if you take good notes up front, then you’ll have everything you need when you’re writing the report. If you take good notes during the course, you’ll have everything you need during the exam.

Even still, having everything I needed, I took most of the 48 hours to complete the exam. Unlike my experience with the OSCP, where I stayed up all night and worked nearly non-stop, my OSEP was much more properly spaced out. I worked normal 8 hours workdays, with a lunch halfway through. I took a few hours to myself after “work” to relax and have dinner. I went back to the exam for a few hours, before going to bed at night at my usual time, and waking up the next day for another “day at work”.

Other Cool Notes and Technical Details

Based on what I’ve learned in the course, I’ve successfully implemented custom tooling within my engagements and written new payloads for execution. The payloads are all Fully Undetected by standard defensive tooling.

The techniques have successfully transferred to custom tooling in other frameworks, like Cobalt Strike customizations and BOFs.

I’d like to share some of the knowledge that the course builds, without sharing details directly from the coursework. Prior to the course, I had minor basic exposure to C#. This has changed very quickly, and as a direct result of this course, I’ve shifted to building most of my tooling in C# now,. I currently prefer C2 frameworks that provide an easy way for me to integrate these tools. At worst, you can use your powershell windows to reflectively load the .NET assemblies.

By the end of the course, I was significantly more comfortable with C#, js, vba macros, hta’s, and even powershell which is something I was already very comfortable with. I also found value in the SQL Services techniques that I haven’t seen elsewhere, the best practices for C2 setup for network IDS / IPS, and found a lot of value in the Challenge labs, which really gave me an opportunity to test out the tools and techniques within a well replicated “internal network” environment. At one point, I even had 60-70 beacons going out to my C2 server with various access, so I could test tools we had written and lateral movement techniques.

Overall, I thought OSEP was a great course, and laid out in a super achievable and logical way. If you have any penetration testing experience, OSEP is a great certification to up your skills.