This exam is primarily designed to test your ability to comprehend a network environment, which makes it somewhat challenging to prepare for. While the lab machines may be easy to compromise, the network itself is much more difficult to navigate.

To pass this exam, you'll need to be able to accurately identify web vulnerabilities and possess the necessary skills to easily complete an easy-rated box on HackTheBox. If you're confident in both of these areas, it's time to dive into the details of tunneling, routing, and pivoting. In my opinion, the best way to do this is by creating a home lab consisting of at least three machines, each on a different NAT network with different subnets. You can set this up using VirtualBox. At the bottom of this page, you'll find a video that demonstrates this process and guides you through compromising each network. The final skill you'll need is the ability to generate shellcode and understand simple stack-based buffer overflows.

Content

Overall, the exam felt a little dated, especially compared to the labs being released on HTB or THM recently. If you've been able to compromise the easy-medium machines on HTB you shouldn't have a problem with the labs here. The network itself was complicated for me to figure out because I didn't prepare enough, if you bought the course I'm pretty sure it's covered in there. If not set up a home lab. You will at least need a Windows lab with Immunity to get through the BoF.

Difficulty

There were a few curve balls. I certainly was unprepared for the network situation and think this is the most difficult part of the exam. If this was a 24 hour exam like the OSCP I would've failed, the additional time gave me a chance to do more researh and learn while in the environment. I'd recommend having a strong understanding of routing, the difference between bind and reverse shells, how to pivot and tunnel and how to use metasploit, it helped so much with routing and initial access.

Tips

• Brush up on pivoting and tunneling
• Confidently exploit stack overflows and practice with different payloads
• Be familiar with Linux and Windows privilege escalation.
• Take good notes, screenshot each step of each process
• Be comfortable with common vulnerabilities affecting webapps

Resources

• A video showing the exploitation of a home lab setup similar to an ecppt environment
• TCM Buffer Overflow playlist
• TryHackMe Wreath Network. You need at least a 7 day streak if unsubscribed
• An article that made pivoting stick