My OSCP Journey: OSCP Certified At First Attempt (90 Points)

It all began in August 2022 when I achieved a significant milestone in my cybersecurity journey by passing the Red Hat Certified System Administrator (RHCSA) exam. This achievement not only provided me with a strong foundation in Linux but also fueled my passion for diving deeper into the world of cybersecurity.

Around the same time, I found myself holding a voucher for the CompTIA Cybersecurity Analyst (CySA+) exam, which I knew was another crucial step in my career progression. I was determined to continue building my expertise in cybersecurity.

However, my true adventure towards the Offensive Security Certified Professional (OSCP) certification didn't officially kick off until November 23, 2023. That's when I made the decision to invest in the OSCP Learn One subscription package, which granted me one year of access to the OSCP labs and two exam attempts. It was an exciting but challenging journey that awaited me.

Balancing my OSCP preparation with my university commitments proved to be quite demanding. While I couldn't dedicate all my time to OSCP, I remained determined and occasionally honed my skills by tackling Capture The Flag (CTF) challenges on platforms like Hack The Box. Nevertheless, there was a persistent feeling that I hadn't truly started my OSCP preparation yet, despite having the resources at my disposal.

In May 2023, I decided to prioritize the CompTIA CySA+ certification since my voucher was set to expire in September 2023. With dedication and hard work, I successfully passed the CySA+ exam in June 2023. This accomplishment was a reminder of my commitment to continuous learning and my ability to tackle challenging cybersecurity exams.

It wasn't until June 5th that a pivotal moment occurred in my OSCP journey. I stumbled upon Ansh Bhawnani's video detailing his own OSCP journey. The video not only provided valuable insights into the exam but also filled me with the confidence I needed to embark on my own OSCP preparation journey.

 

Part 2: Preparation - Building Confidence and Skills

With my CompTIA CySA+ certification under my belt, I was determined to shift my focus to the highly coveted Offensive Security Certified Professional (OSCP) certification. While I had dabbled in Capture The Flag (CTF) challenges on platforms like Hack The Box (HTB), my experience was predominantly limited to Linux machines.

To prepare for the OSCP, I knew I needed to expand my skill set to encompass Windows environments, Active Directory (AD), and pivoting techniques. This journey led me to the HTB Academy, where I embarked on the Penetration Tester Path, which included mastering the complexities of Active Directory.

Within two weeks, I had completed the AD module in the HTB Academy, giving me a solid foundation in AD and the confidence to proceed. The time had come to practice and hone my skills.

I began by solving Windows AD machines listed by TJ Null. I tackled approximately 19 machines, each presenting its unique set of challenges. This phase not only bolstered my technical skills but also increased my familiarity with Windows environments.

Next, I delved into the Offensive Security's PWK (Penetration Testing with Kali Linux) course material, focusing on Active Directory. I started working on the PWK lab machines, completing an impressive 30 of them within a span of just 2 to 3 weeks. Throughout this phase, I was never hesitant to seek hints when I encountered challenging scenarios. The OffSec Discord channel proved to be a valuable resource, offering guidance and hints from experienced professionals when I found myself stuck.

As I approached the final stretch of my preparation, I made the bold decision to withdraw from a university unit, freeing up an entire month to dedicate to my OSCP practice. I set my sights on TJ Null's list of Proving Ground (PG) machines, which included a total of around 45 machines, both Linux and Windows. I tackled each one methodically, determined to expand my expertise further.

Somewhere along this intense journey, I had scheduled my OSCP exam for September 27, 2023, a Wednesday, giving myself ample time to prepare.However, with just five days to go, my dad, ever the believer in my capabilities, encouraged me to reschedule my exam for an earlier date—September 20, 2023. I took his advice to heart, making the change.

On Monday, September 18th, I tackled the newly added CTF challenges in the PG practice—eight in total, completing them all in a single day. They ranged from easy to intermediate difficulty and served as a valuable final practice run.

The day before the exam, on Tuesday, September 19th, I decided to follow a vital piece of advice: I refrained from reviewing my notes or accessing the PWK portal. Instead, I rested, mentally preparing for the challenge that awaited me.

Now, with Part 2 of my OSCP journey complete, Part 3 awaits—the Exam Day.

Part 3: Exam Day - A Rollercoaster of Challenges

September 20, 2023: Exam Day

I began my OSCP exam day with a sense of purpose and a touch of nervous excitement. I knew that the next 24 hours would test not only my technical skills but also my mental endurance.

The day started at 6 am, as I followed my usual routine. I took time to relax and prepare myself both mentally and physically. A trip to Coles with my dad for breakfast helped ease my nerves, and a brief call with my brother provided much-needed encouragement. By 9:45 am, I was ready to begin the exam.

As the clock struck 10 am, I initiated the examination and started setting up the proctoring tool. For the next two hours, my focus was on enumerating the Active Directory (AD) network, gathering crucial information that would pave the way for my success.

At the two-hour mark, I achieved a foothold on the AD network, marking a significant milestone. I proceeded to make steady progress and, by noon, I had completed my work with the AD portion of the exam.

Throughout the exam, I followed a schedule that included taking short 10-minute breaks roughly every 40 minutes. These breaks allowed me to recharge mentally and maintain my concentration.

Between 12:40 pm and 4:30 pm, I rooted the first standalone machine, and at that point, I was ecstatic. I had secured 40 points from the AD and an additional 20 points for the first standalone machine, along with 10 bonus points for meeting the 70-point threshold. I had reached a total of 70 points in exactly 6 and a half hours.

The momentum continued, and by 7:30 pm, I had obtained a foothold on the second standalone machine. However, my privilege escalation attempts proved unsuccessful, leaving me with 80 points.

At this juncture, fatigue was setting in, but I pressed on. From 8:40 pm to 9:50 pm, I achieved a foothold on the third standalone machine, bringing my total score to 90 points.

Around 10 pm, I took my first substantial break for dinner, but the unexpected occurred. What was anticipated to be a brief intermission turned into a much longer break. After dinner, I found myself deeply entrenched in capturing screenshots, a task that consumed a surprising amount of time, extending into the early hours of the morning.

Frustration and exhaustion loomed as I attempted to get some much-needed rest between 1 am and 3 am. Unfortunately, sleep proved elusive, and by 3 am, I was back at the keyboard.

From 3 am to 5 am, I dedicated myself to privilege escalation attempts on the remaining two standalone machines. Despite my best efforts, success remained elusive.

By 5 am, I was exhausted both mentally and physically. I made the difficult decision to conclude the exam, ending it at around 9 am.

 

Part 4: Post Exam Report - A Mix of Relief and Celebration

September 21, 2023: The Day After the Exam

After completing the OSCP exam marathon, I knew it was time to take a well-deserved break. I allowed myself some relaxation before diving into the crucial task of crafting the exam report.

Around 11:30 am, I began working on my report, meticulously detailing every step of my exam journey, the vulnerabilities I exploited, and the privilege escalation techniques I attempted. This comprehensive report is an essential component of the OSCP certification process and is used to validate your skills.

I worked diligently, making sure to present my findings clearly and thoroughly. The hours flew by, but I remained focused on the task at hand. By 7:30 pm, I had completed and submitted my report.

Throughout the report-writing process, I took random short breaks whenever needed. These moments allowed me to refresh my mind and regain perspective on my work.

With the report submitted, I felt a unique mix of emotions—relief that the most challenging part was behind me, but also a lingering tension as I awaited the results.

September 22, 2023: The Confirmation

The next morning, I awoke with a sense of anticipation and checked my email. However, there were no updates, and I knew it was likely too early for any news.

As the hours passed, I couldn't help but keep checking my email periodically. Then, at around 9 am, I decided to log into the OSCP exam portal. To my astonishment, there it was—the exam schedule section had been updated, indicating that I had passed the OSCP exam. The relief and joy that washed over me at that moment were indescribable.

However, I still had not received an official email confirmation. The wait continued, filled with a mix of excitement and impatience. It wasn't until 9 pm that evening that the email finally arrived, officially confirming that I had passed the OSCP certification.

And with that, the journey from RHCSA to OSCP certified was complete. I had achieved a milestone that had demanded dedication, perseverance, and a whole lot of effort. The sense of accomplishment was unparalleled, and I knew it marked the beginning of an exciting new chapter in my cybersecurity career.

 

As a PEN-200 student, I embarked on my OSCP journey fueled by an insatiable thirst for knowledge and a desire to excel. Along the way, I devoured every OSCP-related blog and post I could find on the vast expanse of the internet.

Yet, within this sea of information and guidance, I discovered a yearning for more. More experiences, more insights, and more stories from fellow OSCP aspirants who've traversed this challenging path. It was this desire for a deeper understanding that led me to craft this blog post.

In sharing my own OSCP journey, I hope to provide upcoming students with a unique perspective—a glimpse into the highs and lows, the moments of doubt, and the exhilaration of success. I understand firsthand how impactful reading these blogs can be; they're more than just words on a screen. They're beacons of motivation, sources of solace during challenging times, and reminders that the OSCP certification is attainable, no matter where you start. So, ALL THE BEST!, YOU CAN DO IT!!!....

----

Ram Charan Ponnam