PWK(OSCP) [PEN-200] Review 2021

This short blog post covers how I approached Offensive Security’s PEN-200 coursework along with the examination.

Pre-PWK Preparation

I started my preparation from Proving Grounds Practice (19$/month). It is absolutely worth spending money on, as it provides non-CTF style boxes curated by Offsec itself. I was able to solve 32 boxes (did TJ Null’s PG practice list) in a month, spending 4–5 hours, 5 days/week. After my subscription expired, I revised buffer overflow and curated Linux/Windows privesc cheatsheets for a week.

PEN-200 Coursework

I registered for a 30 days voucher + 1 exam attempt.
Starting with the coursework pdf, it took me 3 days to go over all the modules. Next, I began pwning the machines on the PWK network. I was able to root 70 machines in 25 days including 2–3 break days. On average I was solving 4–5 machines daily and it felt like I was giving the exam every day XD

I preferred spending the last week revising my notes, building a better methodology, and therefore, left the remaining 5 boxes. I completed a few lab exercises but did not document them for the extra 5 points as it was time-consuming for 30 days of access. I spent most of my time on the PWK network.

Note: During lab time, I used to spend 90–100 hours a week and was not working on anything else.

The OSCP exam

My lab access expired on 6th July 2021 and I scheduled my exam for the same day itself.

My Exam Methodology

I came up with the following strategy:

• complete buffer overflow in the first hour while enumerating the 10 pointer
• hit the 10 pointer machine for the next 1 hour, while enumerating the 20 pointers
• if the 10 pointer box is solved, move on to the 20 point box with a lower number of ports (because in that case, I’ll have to focus on less)
• at last, enumerate the 25 pointer box

I planned to take 10 min breaks every time I solved a box or after being stuck for 2 hours straight.

1 Day before the exam
I did the Try Hack Me rooms for buffer overflow, Linux and Windows privesc in the first part of the day (for the second time). Next, I spent my time watching movies and tv shows.

The final Exam day
On 6th July, I woke up at 7 a.m and went to exercise for 30 minutes. My exam was scheduled for 8:30 a.m. As required, I connected to the proctoring tool 15 minutes before the exam. Finally, the exam began and it went in the following order:

• Buffer overflow (25 points) [20 minutes]
• 10 point box [40 minutes]
• First 20 point box [1 hour 20 minutes]
• 25 point box (unintended root) [3 hours]
• Second 20 point box (1 hour)
• 25 point box (intended privesc) [10 minutes]

In the first 3 hours, I had 55 points with 3 boxes solved. Next, I tried the other 20 point box and I failed to find a foothold. I took a 1-hour long break and started with the 25 point box. It took me 2 hours to get a foothold and then I was stuck on the privesc for an hour. I finally managed to root it using an unintended method. In 7 hours, I had 80 points which were more than enough to pass the exam. After a short break, I started with the second 20 point box. It took me 45 minutes to get a rev-shell and 15 minutes to perform the privesc.

Technically, I was done with the exam, but I still wanted to find the intended root on the 25 point box. I manually performed the enumeration for privesc and found a potential vector. It took me another 10 minutes to get the root. Finally, I was done with the exam in 11 hours 30 minutes!

In short, it took me 7 hours to reach passing marks, 10 hours to root all the machines and 11 hours 30 minutes to solve everything in an intended way.

I took a 3-hour long break and then started with the report writing. Around 5 am in morning, I was done with a 45-page long report. I told my proctor to end the session and I finally went to sleep. The next morning, I proofread my report and uploaded it on the portal.

On 8th July, around 3 p.m, I received the e-mail!