Assembling the Pieces — Exam Report & Capstone Chain

Two things in one place: the OSCP exam reporting requirements/checklist, and a condensed capstone attack chain (the PEN-200 "Assembling the Pieces" multi-machine engagement) as a reference for chaining techniques end to end.

Proof screenshots (required per machine)

Every machine needs two screenshots minimum, in the same shell window:

• whoami/id + hostname + ipconfig/ip a — proving user context and machine identity
• The proof file contents (type proof.txt / cat proof.txt)

$# Linux one-liner
$echo "---" && id && hostname && ip a | grep -E "inet " && echo "---" && cat /root/proof.txt
$ 
$# Windows one-liner
$whoami && hostname && ipconfig && type C:\Users\Administrator\Desktop\proof.txt

⚠️ Take the proof screenshot before you do anything else on the box. If you lose the shell you'll have to re-pwn it.

Per-machine documentation (capture during the exam, not after)

For each box, record as you go: IP, OS, open ports & services; the vuln/attack vector that gave the foothold (CVE or technique); the exact exploit commands (copy the working chain); the privilege-escalation vector + commands; any credentials found (to a central creds.txt); and the proof file content + screenshot path.

Exam report structure (OffSec template)

1. Cover page — name, OSID, date
2. High-level summary — what you compromised, in 1–2 paragraphs
3. Methodology — brief description of approach (recon, exploit, privesc, post-ex)
4. Machine findings — one section per machine: target info (IP/OS/hostname), embedded proof screenshot, vulnerability description, numbered steps to reproduce with commands, one-sentence remediation
5. Appendix — full command output and extra screenshots

Time management

First 15 minutes: revert all machines and start scans on every target simultaneously. Every 90 minutes: step back and reassess — switch targets if stuck more than 45 minutes, don't rabbit-hole. Screenshot every proof the moment you get it, never batch at the end. Last 2 hours: stop hacking and write the report.

Capstone chain reference (MAILSRV1 → … → DCSRV1)

A worked example of chaining the individual guides into a full engagement.

Enumerate the public network

$mkdir beyond && cd beyond && mkdir mailsrv1 websrv1 && touch creds.txt
$sudo nmap -sC -sV -oN mailsrv1/nmap 192.168.50.242      # IIS + hMailServer
$gobuster dir -u http://192.168.50.242 -w /usr/share/wordlists/dirb/common.txt -o mailsrv1/gobuster -x txt,pdf,config
$sudo nmap -sC -sV -oN websrv1/nmap 192.168.50.244
$whatweb http://192.168.50.244                            # WordPress 6.0.2
$wpscan --url http://192.168.50.244 --enumerate p --plugins-detection aggressive -o websrv1/wpscan
$searchsploit duplicator

Foothold + privesc on the public machine

Exploit a vulnerable WordPress plugin (Duplicator directory traversal, CVE-2020-11738) → read files → phishing/creds via hMailServer → foothold, then local privilege escalation.

$searchsploit -x 50420
$searchsploit -m <edb-id>      # copy the PoC into websrv1/

Pivot into the internal network

Use the compromised public host as a pivot. Set up a Chisel/Ligolo tunnel and proxychains so your Kali tooling reaches the internal subnet (see the Pivoting & Tunneling guides).

Enumerate internal (BloodHound + Chisel)

Run SharpHound/BloodHound over the tunnel to map the AD attack paths; enumerate shares and users from every credential you collect.

Attack an internal web app (Kerberoasting + relay)

Kerberoast service accounts, crack offline, and spray. Where SMB signing is disabled, coerce authentication and relay with ntlmrelayx (see the Active Directory guide).

Take the domain controller (Mimikatz + lateral movement)

With domain-admin-equivalent creds, move laterally (psexec/wmiexec/evil-winrm), dump secrets with Mimikatz/secretsdump, and DCSync for full domain compromise.

Cross-reference: Web Exploitation, Password Attacks, Pivoting & Tunneling, Active Directory, and Windows/Linux PrivEsc guides each cover a stage of this chain in depth.