Just checked my notes. It's possible to pwn that box and my notes also had a star by them that says, "Try Harder"

Agreed with the "Try Harder " approach ..there is no fun in spoon fed solution 

I have been trying various approaches and wanted to confirm whether it is pwnable via remote exploit or not..

Cheers..

SO much more rewarding to do it that way then have it given to you.

Come on guys, I've been studying this training for the last 2 /12 weeks and I am still beginning the smtp (My record show me 19 hours)

How fast do you move with the material? I am trying to assimilate all the info and do all the labs and extra miles but I am not sure if 90 days will be enough.

Here is something I will give a tip on concerning the OCSP and others like it: If you're machine is doing only one thing, and your focused on one thing... You're doing it wrong.

You're capable of opening up the amount of terminals allowed by the amount of memory on your machine to perform functions. If you're doing the exam or others like it using a Unix based system, I suggest creating desktops for specific tasks, e.g:

Desktop 1 - Scanning and Enumeration
Desktop 2 - brute forcing / password cracking
Desktop 3 - Web applications
etc
etc

This allows you to go back and forth and perform multiple tasks without getting lost. Scripting helps, e.g.:

nmap -sS -sV -O this.block/24 -oX this.block-scan.xml ; printf "\n\nDone"|wall

You don't necessarily have to wait for nmap to finish to perform another task. You can move on and do what you need to do. Let's better this example:


This is fine, but a waste of time. My goal is to find whether or not this host was running a webserver. Simply because I needed to enumerate it after the fact. Maybe with dirbuster or Nikto. I know that I need to do something AFTER the fact, and I don't want to sit around waiting for this to finish to get to the next stage.


Now that this solves one problem, I can create a script that does something like:

if [ this server runs http ]

then

run nikto using this directory list I created

fi

Let's see it in action:


I killed it as it was only an example. In exams like this where time is a factor, don't get bogged down with waiting on anything. There is nothing stopping you from automating a lot of tasks to narrow down the information you will need. This applies in the REAL world of penetration testing. Most times, I have automated scripts ready to roll the minute I pop a sessions. The reason for this is to allow me to get in and out and get as much data as quickly and silently as possible. When I say silent, if you've read any of my posts before, I use a LOT of decoys I also tend to use alternative means for extracting data. E.g., I will use DNS, ICMP UDP, SSL tunnels at a rate limited speed. I will throw data into comments on a webpage, then view the webpage and parse out the comments. Think outside the box. For some of these exams, its not always about an 0day either. There is escalation and so forth. Config files, sniffing the wire from one machine to another. I would add: "Try DIFFERENTLY" to their Try Harder motto

When I did my exam, I created literally a script to do the entire thing and at the last minute, many of my machines were firewalled, bastille linux'd, etc., so I have to modify it and parse out sections on the fly. I submitted the script to them as well and explained what it was I did and why. Unsure if that gave me brownie points heh....

So an approach would be something like:

if [ this scan shows http ]

then

run these http based tools against those

else

if [ this scan show snmp ]

then

run these snmp based tools

else

if [ this scan shows http login forms ]

then

run hydra using this wordlist and dictionary list

fi
fi
fi

I would throw in wall's after each command so you'll know step X was finished

Client sides. I am a stickler for spelling things out from the jump. When we meet with clients, I often take the time to explain to them the differences in attacks and attackers. I always explain to them the realities and costs associated with an attack because there is a cost for an attacker, and there are different types of attackers.

Once a client understands the differences (an INTENT attacker - someone who wants in no matter what the cost) they almost always allow me to try anything and everything. So most of the times I perform 4 types of tests. I've documented those different tests in the document I wrote for the RWSP (outside attacker, outside attacker w/creds, insider, insider w/creds). By insider, it does not solely mean: "Joe who works for the IT department" it extends to the social engineerer who'll find a way onto the environment and work blindly as well as that same social engineerer who managed to get credentials.

It all boils down to your SOW and your presentation way beforehand to get your client to agree to full blown testing