OSEP Review

OSEP (OffSec Experienced Pentester) is an OffSec (previously known as Offensive Security) certification launched in late 2020.

It was one of the three certifications (along with OSWE and OSED) that appeared to conquer OSCE(3) as a replacement for the mythical OSCE. OSCE was way more advanced and difficult than OSCP, but its contents, although mostly relevant up to its final, dated back to 2012.

As it was designed to be a replacement for an honestly weak evasion section of the OSCE course (Cracking The Perimeter), OSEP can be ranked as a hard certification. The course that prepares you to take the certification is called PEN-300. Let's take a look at the summary.

The next two chapters are focused on client-side attacks. Starting with HTML smuggling and VBA basics, the third chapter rapidly escalates on difficulty with PowerShell download cradles, PowerShell .NET object calling and Reflection. The fourth chapter describes abuses of the Windows Script Host tool that can run arbitrary code on VBScript and JScript. As there's no known way to directly call Win32 APIs from JScript, the fourth chapter introduces tools like DotNetToJscript and SharpShooter that are used to accomplish this task via deserialization.

The next chapter is about Process Injection, where different techniques are described to inject code into another process, including the use of Win32 APIs, DLL Injection, and Process Hollowing. Those techniques can be used together with the client-side attacks described in the previous chapters, and this is where the fun of PEN-300 starts.

The following chapter was my favorite, and it's related to AppLocker bypasses. Several techniques are described thoroughly, including the use of custom PowerShell runspaces and the use of client-side attacks for bypassing AppLocker rules.

There are two no consecutive chapters (Bypassing Network Filters and Kiosk Breakups) which are highly theoretical and too specific. IMO, that kind of content is more relevant in a blog post than in a chapter of a certification book. If they were removed from the course materials, nothing relevant to OSEP would be lost.

The chapter Linux Post Exploitation is somewhat weak too. A couple of abuses using VIM backdoors are described. The only fun part was the implementation of DLL Injection, but in the Linux realm, using shared libraries.

The chapter Linux Lateral Movement also describes abuses using the SSH protocol and tools that can be found in modern Linux servers that are part of an on-prem DevOps infrastructure, like Ansible and JFrog. Also, it mentions abuses on how Kerberos and things relevant to an Active Directory deployment are relevant on a Linux-joined machine.

The next two chapters are the largest. Microsoft SQL Attacks and Active Directory Exploitation cover misconfigurations that can be leveraged to escalate privileges on an AD Domain. Although the longest, the depth of content is nothing like that of courses such as CRTP, CRTE, CRTO and eCPTX. If you are expecting to master AD attacks using only the PEN-300 content, you may be disappointed.

Finally, the last chapter, Combining the Pieces, was my second favorite. It is a very helpful chapter describing a sample scenario where most of the techniques described throughout the course are employed, which gives a glimpse of what the challenges and exam would be like.

Along the way of the course contents, there are labs on which you can practice everything that's presented. Each lab may contain one or more machines with different configurations and learning objectives. You will need to use an OpenVPN client to access the environment. On most of the course contents, there are exercises to practice in the lab. You may end up with several custom tools for specific attacks. I heavily recommend organizing it properly because many of those tools will be used during the challenges and even the exam with minimal changes. This is how I arranged the resulting artifacts during the course:

Aside from the labs, there are six challenges included in the PEN-300 course. Those challenges provide an environment where you must gather flags on different machines to complete them. The first four challenges are focused on specific topics of the course. The fifth and sixth are broader in scope and simulate very well what the exam environment would look like.

Therefore, it is absolutely recommended to finish all the challenges before attempting to take the exam. You can thank me later.

The course content is slightly out of date. The last update was in 2021, which is a very long time for the highly dynamic world of Active Directory attacks. Things that are not present include ADCS abuses, advanced coercing attacks (MS-RPRN, MS-FSRVP, MS-EFSR aka. PetitPotam, etc.), vulnerabilities like KrbRelayUp and ZeroLogon, modern technologies bypass (EDRs, ETW, ASR, WDAC, Kernel Callbacks), GPO abuses (!), WMI/COM, persistence mechanisms.

Also, the exam is proctored. The proctoring plugin makes the computer really slow. I used a 4k screen that made my laptop run very hot. I had to change the resolution to 2k to mitigate the resource consumption.

PEN-300/OSEP covers several things, from evasion to Linux and Windows advanced attacks. If you want to get comfortable with Active Directory attacks, doing CRTP or CRTO first will give you a confidence boost.

CCRTA can give you experience attacking Linux machines that belong to an Active Directory.

CRTL is currently more up-to-date than OSEP in terms of bypassing techniques. Doing it will also help you with OSEP.

Finally, the closest certification to OSEP would be eCPTXv2. The main difference is that OSEP includes Linux attacks, and eCPTXv2 goes very deep on Active Directory abuses.

PEN-300 is a high-quality course. Aside from a couple of chapters, every module had very rich, relevant and deep technical information. The course needs an update. Major abuses and attacks have been discovered since the last update, and many others presented on the course are no longer working with today's default defenses. In the end, the OSEP certification will boost your Pentesting skills to a whole new level.