appl3b0y

How I Passed the OSCP+ on My First Try (But With Plenty of Sweat)

Wed, 01 Jul 2026 00:00:00 +0000

My first blog post: the full story of how I passed the OSCP+ on the first try. The study path, the notes obsession, exam day, and the strategies that actually worked.

Escape

Tue, 09 Jun 2026 00:00:00 +0000

Introduction

Escape is a medium-difficulty Windows machine built around a realistic Active Directory attack path. There is no flashy web exploit here: the whole box is about chaining together small pieces of information leaked across an AD environment.

The chain looks like this: a document sitting on an anonymous SMB share hands us a low-privilege MSSQL account. From MSSQL we coerce the service account into authenticating back to us and capture its hash. That single credential, sprayed across the domain, gives us a shell. On the host we find a domain user’s password hiding in an SQL error log, and finally we abuse a misconfigured Active Directory Certificate Services (AD CS) template (ESC1) to mint a certificate for the Domain Administrator.

Bashed

Wed, 04 Feb 2026 00:00:00 +0000

Introduction

Welcome to this technical breakdown of Bashed, an introductory Linux machine. In this session, I will demonstrate how meticulous enumeration is the key to a successful compromise.

The core of this challenge is a common development error: leaving a publicly accessible web shell on the server. In real-world scenarios, these administrative tools are direct gateways for an attacker to gain control over an internal network.

Enumeration

I began by mapping the target IP to bashed.htb in my local /etc/hosts file. This is a standard step that makes it easier to interact with the target and helps in finding potential Virtual Hosts.