Penetration-testing reference for the 2026 OSCP+ exam: 3 standalone machines (20 pts each = 60) + one Active Directory set of 3 machines (40 pts) — 70 to pass. No buffer-overflow machine, no bonus points.
How to use it. Each file below is a self-contained phase of the attack — open the one you need and Ctrl+F the keyword (a port like 445, a technique like kerberoast, a tool like chisel). During the exam, clone this repo locally first (git clone) and/or keep an offline copy so you're never depending on the network staying up for 24h. Remember: AI assistants are not permitted during the exam or report phase — this is offline notes.
| Phase | File |
|---|---|
| Recon & enumeration (nmap, per-port, web) | 01-recon.md |
| Foothold — shells, file transfer, web exploitation, public exploits | 02-foothold.md |
| Linux privilege escalation | 03-linux-privesc.md |
| Windows privilege escalation | 04-windows-privesc.md |
| Active Directory (the 40-point set) | 05-active-directory.md |
| Pivoting & tunneling | 06-pivoting.md |
| Password attacks & cracking | 07-password-attacks.md |
The strategy, exam rules, report guidance, and a quick-reference appendix live below on this page.
- No AI / LLM chatbots during the exam OR the report phase. This file is prep — you reference it offline. KAI included. Don't even have a chatbot tab open.
- Metasploit: ONE target only. Full MSF (exploit/auxiliary/post + one meterpreter) on a single machine of your choice. Not usable for pivoting (that would touch >1 target).
msfvenom,searchsploit,pattern_create,nasm_shellare NOT counted as "using Metasploit." - Responder poisoning/spoofing is BANNED on the exam. LLMNR/NBT-NS poisoning won't be the path. (Responder is "allowed" only in analyze mode; don't run
-w/poisoning.) - Automatic exploitation tools are BANNED: SQLMap, SQLNinja, db_autopwn, browser_autopwn, and anything that auto-discovers-and-exploits. Mass scanners (Nessus, OpenVAS, Nexpose) are banned too. Do SQLi and all exploitation manually. (Single-target tools like Nikto, dirb, nmap NSE are fine.)
- PowerShell Core / PSSession counts as a valid interactive shell.
- Everything happens on the proctored host. Don't discuss the exam anywhere (Discord, forums) — instant policy violation.
BloodHound (Legacy + CE), SharpHound, PowerShell Empire, Covenant, PowerView, Rubeus, evil-winrm, Responder (analyze only), CrackMapExec / NetExec, Mimikatz, Impacket, PrintSpoofer. Standard non-MSF exploits are fine.
You need 70. Realistic winning lines:
- AD (40) + 3 local.txt (30) = 70 ← most common pass
- AD (40) + 2 local + 1 proof = 70
- AD (20, partial) + all 3 standalones fully = 70
- AD (10) + 3 standalones fully = 70
Takeaway: the AD set is the single biggest decider. Land AD first or early. Partial credit exists (foothold = 10, root = 10 on standalones; 10/10/20 on AD).
- First 20–30 min: kick off nmap on every target, screenshot as scans run.
- Triage: note quick wins (obvious CVE, anon SMB, default creds).
- AD set early — it's 40 pts and chained; sinking those points first de-risks the day.
- Standalones: grab every foothold (10 pts each) before grinding any single privesc. Partial points stack.
- Rotate. Hard rule: if stuck 1.5–2h with zero progress, switch boxes. Come back fresh.
- Stop hacking ~2h before the window ends. Verify every flag, re-take any missing screenshot, confirm proof.txt contents.
- Screenshot
local.txt/proof.txtwithwhoami/id/ipconfig/hostnamein the SAME frame. - Screenshot the IP of the target in the shell.
- Log everything:
scriptor just keep a per-box markdown with every command + output. - Take MORE screenshots than you think you need. You cannot re-enter after the window closes.
## <IP> - <hostname>
Ports:
Foothold: <how> | cred: <user:pass> | local.txt: <hash>
Privesc: <how> | proof.txt: <hash>
Screenshots: [ ] foothold+id [ ] root+id [ ] local.txt [ ] proof.txt
- Use the official OffSec OSCP/OSCP+ report template (.docx). Download and fill it offline.
- One section per machine: ports/services → foothold (exact request/exploit + URL/CVE) →
local.txtproof → privesc steps →proof.txtproof. - Every claim needs a screenshot showing the command, its output, and
whoami/id/ipconfig+ the target IP in frame. - Write commands verbatim so a grader can reproduce each step. Note any exploit you modified.
- AD set: document the full chain host-by-host — how you got each credential and each hop to the DC.
- Workflow: keep per-box markdown notes during the exam → paste into the template afterward. (No AI for writing the report either.)
- Export to a single PDF, submit to the OffSec portal within 24h of the window closing.
- Unproven flags / missing screenshots = lost points. When unsure, screenshot it.
21 FTP | 22 SSH | 23 Telnet | 25 SMTP | 53 DNS | 80/443 HTTP(S) | 88 Kerberos(DC)
110 POP3 | 111 RPC/NFS | 135/139/445 SMB-RPC | 143 IMAP | 161 SNMP(UDP) | 389/636 LDAP
1433 MSSQL | 3306 MySQL | 3389 RDP | 5432 Postgres | 5985/5986 WinRM | 6379 Redis
Seeing 88 + 389 + 445 + 5985 together = Domain Controller. 53+88 too.
nmap -> /etc/hosts -> per-port enum -> web dirbust -> identify version/CVE/default creds
-> FOOTHOLD (web exploit / public exploit / creds) -> stabilize shell -> screenshot local.txt
-> linpeas/winpeas + manual -> sudo -l / whoami /priv FIRST
-> PRIVESC -> screenshot proof.txt -> document + move on
AD: given creds -> bloodhound -> roast/ACL/spray -> lateral (PtH) -> secretsdump -> DCSync -> DA
- Re-read ALL nmap output + every script line. Did you scan UDP? all 65535 TCP?
- Did you check every SMB share / web vhost / user
description? - Did you try found creds everywhere (SSH, SMB, RDP, WinRM, web, su)?
sudo -l/whoami /privdone? GTFOBins/LOLBAS the binary?- Any internal-only port in
ss -tlnp/netstat -anoyou haven't forwarded out? - Backup/config/history files read?
.git? source via php filter? - For AD: re-collect BloodHound as the NEW user after each cred — paths change.
- Version too obscure for searchsploit? Search the exact
name + version + "exploit"(cached refs).
python3 -c 'import pty;pty.spawn("/bin/bash")' ; Ctrl+Z ; stty raw -echo; fg ; export TERM=xterm
impacket-secretsdump 'dom/user:pass@IP' # dump
impacket-wmiexec dom/user@IP -hashes :NThash # use the hash
evil-winrm -i IP -u user -H NThash
HackTricks (book.hacktricks.xyz), GTFOBins, LOLBAS, PayloadsAllTheThings, revshells.com cheats, hashcat mode table, Impacket/nxc help dumps, your own per-box notes. Keep binaries staged: linpeas, winPEASany, pspy64, chisel (lin+win), ligolo (proxy+agent), PrintSpoofer64, GodPotato, JuicyPotatoNG, PowerView, SharpHound, mimikatz, PwnKit, bloodyAD (sealed LDAP / ACL abuse), certipy-ad (ADCS ESC1/ESC8), RunasCs (run-as with creds), Invoke-ConPtyShell (interactive Win TTY), impacket owneredit/dacledit (WriteOwner/WriteDACL abuse).
Personal prep notes. Coverage cross-checked against public OSCP checklists (crtvrffnrt, BlessedRebuS, fatalxs), HackTricks, GTFOBins and PayloadsAllTheThings, plus the official OSCP+ 2026 exam rules.
This cheatsheet is original notes, but its coverage was cross-checked against these community references — all worth reading directly:
- crtvrffnrt/OSCP-Checklist-Cheatsheet2024 — phase-by-phase checklists
- 0xsyr0/OSCP — large command/tool/payload index
- BlessedRebuS/OSCP-Pentesting-Cheatsheet — methodology + payloads
- HackTricks · The Hacker Recipes — deep technique references
- PayloadsAllTheThings — payloads for every web vuln
- GTFOBins · LOLBAS — living-off-the-land binaries (Linux / Windows)
- WADComs — interactive Windows/AD command picker
- Orange Cyberdefense AD mindmap — the AD attack flow on one page
- revshells.com — reverse-shell generator (cache it offline)
- Official: OSCP+ Exam Guide · OSCP+ Exam FAQ
Always confirm the current exam rules on the official guide before sitting — restricted-tool lists change.