My Fast-paced Freemium OSCP Journey!
Hey there, welcome to my post! I hope you’ll have a good read on how I took the 30 days labs for the new PWK 2020 course, owned 53 machines, and aced the OSCP (for free!). If you are just looking for my advice on the exam please have a read at this post!
I’m a 19 years old fellow from Bangladesh. I’ve been a big fan of the OSCP and their “Try Harder” philosophy ever since I heard this song two years ago! people have somewhat mixed feelings about the concept of trying harder but for me, this has been a great motivational force as I learned and grew over the last two years! This year it feels like the universe wanted me to have the OSCP as one after another opportunity knocked on my door! This was my first ever certification, prior to this I didn’t take any other course or certifications. I taught myself to code since I was 15 and my interest in infosec and hacking kept growing over the years. Before the OSCP journey, I taught myself to code in all the common web-based languages and a handful of machine-based programming languages. I was familiar with common web attack vectors and a Linux lover since childhood!
Winning the Pwk 2020 OSCP course voucher!
I have been practicing some HackTheBox machines from last year or so kind of irregularly to improve my skills now and then, never really got around to take it seriously until something amazing happened! There I was doing assignments for my university when I got a knock from my dear old friend Ziaur Rashid who suggested I should participate and play in the DefconSafeMode Redteamvillage CTF. I went to their prize pool page and remember slightly smirking as I saw the “OSCP Course Voucher” prize listed there and the condition to win that prize was “Follow the white rabbit”. I still don’t understand what it means but I thought to myself, yeah like I would win something like that! I decided to put my skills to the test and “Try” as hard as I can and see where I end up! 24 hours in, I’m sitting at the 112th place solo in the leaderboard among 690 teams comprised of 1428 players! If only I had time I could’ve gotten quite a few more challenges as I did them later and climbed up to 43rd place! I was happy this has been a blast and considering my first ever participation I did well! One of the CTF organizers reached out to me and awarded me the OSCP Course Voucher! It made my whole month!
PS: RedTeamVillage hosts CTFs from time to time so you should keep an eye on their Twitter and Discord for the next one, who knows you may win something similar like this and I’ll get to read your story!
Racing against The 30 days lab time
If you kept an eye on the OSCP course you would know they bumped their course and added much more content in their course! they have added active directory enumeration basics, client-side attack vectors and you can use that knowledge to do lateral movements, own domain controllers in the labs! There are internal networks to pivot to, client-simulated actions for you to perform client-side attacks, and many more! it also means now it’s harder to take in everything of the course in 30 days of lab time. Their Coursebook went from 300+ pages to 850+ pages! Plus there are 60+ lab machines to hack and if you choose to do the course exercise report it would be very difficult to complete all the machines in the lab unless you have a lot of experience! With that being said I wanted to grasp everything this course has to offer, I wanted to pass in my first attempt, and I wanted to keep my course free! To increase my chances I went for the “5” points that can be achieved if you complete the course exercise and submit a lab report. I did all the course exercises and wrote the report in the first 13 days of lab time, comprised of more than 300 pages and 459 screenshots! Alright, half of the work is done so I took a break for one day and went back to the lab network to hunt as many machines I can in the next 15 days. I was able to own 53 machines in the 15 days that I had left. I tracked my hours during these 30 days and this is how it looks like:
I was lucky enough to get this many machines in such a short time so I would suggest the 60 days or 90 days lab time if you want to practice and own all the boxes in the lab and do the course exercises!
I scheduled my exam two days after the expiration of my lab time, I wanted to face the exam as soon as possible because I knew I would grow impatient and do nothing else after lab time.
The Exam Day
At 9 am my exam began and I went through the first box quite easily. Took a short break, came back, and owned another one. Kept taking breaks whenever I felt frustrated and never attempted to spend more than 3 hours straight. In 15 hours I owned all five of the boxes! I got to sleep an hour at the noon in between! We are not allowed to talk about anything specific about the exam, all I can say is that it will test your skills on how well you can differentiate between what is normal and what isn’t normal, how certain things which seems perfectly fine in one condition can become exploitable in other condition, your ability to understand how an exploit work and adapting it according to your target.
I ended my exam after 15 hours, went to sleep, and submitted both my lab report and exam report the next day. After three days, I received good news from Offsec! In the end, I didn’t need the five points that I worked so hard for the first thirteen days to collect but I still recommend anyone doing it because you are not just paying for the labs but the course material as well! Plus there are valuable basics in there that you should know as an OSCP!
There are very few numbers of OSCP holders in my country and I am probably the youngest one so far! I would love to see this number grow and hope my journey would inspire more people to take on this challenge!
In the end, I enjoyed the journey more than I enjoyed my win! To keep this amazing feeling alive I plan to take on the OSWE certification next, so wish me luck!
My OSCP experience ends here, Thank you for reading my journey! Find me on Twitter, Linkedin, and check out my blog! I hope I can share more achievements like this in the future as I learn and grow!
I wrote a blog post answering some of the difficulties people may face during the exam and also some learning tips here in my blog!
Update (April 13, 2021): I passed my OSWE exam a few days ago! If you feel like it, you can read about my experience on that here in my blog.
