OSEP Tester PEN-300 Course Review
Overview
Offensive Security has released several new courses recently, including Evasion Techniques and Breaching Defenses (PEN-300), which primarily focuses on “penetration tests against mature organizations with an established security function.” After reading that overview on the website, I was excited to take on the challenge and expand my knowledge base in preparation for obtaining the OSEP certification.
PEN-300 students are given videos and a massive, 700+ page PDF of training material. The course also features individual lab modules for each chapter, as well as six lab challenges. While a big portion of the content does spotlight evading Anti-Virus (AV) and/or Endpoint Detection and Response (EDR) tools, the training is less focused on evading an active Blue Team. The challenge labs and exam offer several paths to exploitation—for example, a lab may contain an initial access point through web vulnerability but also provide an e-mail address to target for a phishing attempt through a malicious Word document or link. Given this, the environment provides plenty of opportunity to learn cutting edge techniques and apply them in a lab environment.
After exploiting all six lab challenges and passing the exam, I can say that this course will challenge a seasoned penetration tester that is already comfortable with Windows environments. I would recommend the Offensive Security Certified Professional (OSCP) certification as a prerequisite, though it is not required. I also highly recommend PEN-300 itself, as I believe that my attack arsenal has grown as a penetration tester now that I have completed the materials.
Tips & Tricks
When I began the PEN-300 course, I started by watching the videos and following along through the provided PDF—the entire program took about two weeks using my process. Now having gone through it, I suggest to others interested in the course that you write your own code as you go along instead of trying to copy and paste—this will help in fully understanding the concepts. Then, when you have code that works, save it, and include an inline comment containing the shellcode command, which will make life easier should you run into a scenario where you need that code. Each section also includes “Extra Mile” activities, and I would recommend completing those before moving on to the labs, as they are designed to re-enforce the concepts presented.
When it comes to the lab challenges, they are meant to test specific techniques taught through the course, and each of the six contains a small environment of isolated servers. There is often more than one path to compromise all boxes within the environment, so you will be forced to think critically on how to move laterally and eventually escalate privileges—again, as you write code that compiles and works, save it. Don’t be afraid to repeat anything that may have taken a longer time to solve for added clarity and confidence, and before you attempt the exam, double check that your code works as expected.
Helpful Tools
There are also several tools available that can help with PEN-300 and only require a foundational understanding. Though knowledge of these tools is not required, I can attest that I did find them useful—here are a few that helped me move through the course while building on the training provided:
| Tool / Concept | Description |
|---|---|
| Bloodhound | An Active Directory tool that helps visualize and identify attack paths. Given that each lab environment is relatively small, this tool was extremely useful. |
| Impacket | A collection of Python tools that allows interactaction with network protocols such as SMB and MSRPC. There are many tools in this collection that can aid in lateral movement, depending on the services that are available to you. |
| Chisel | A Go-based tool that helps proxy through compromised hosts. I found that Chisel worked better than Metasploit’s SOCKS proxy in certain situations. |
| LOLBAS | LOLBAS is short for “Living Off the Land Binaries and Scripts.” Several of these built-in Windows executables allow bypassing certain controls that may be in place on a server. Though the course will go over commonly used ones throughout the provided PDF, the linked resource here will give options for other binaries that can be leveraged on Windows hosts. |
| Rubeus | A C# toolset for Kerberos attacks. This is a very common tool in offensive security these days, and it is used in the course several times for different Kerberos attacks. |
Closing Thoughts
In my experience, the PEN-300 course is perfect for anyone looking to expand their internal network penetration testing knowledge, as it teaches techniques for escalation and lateral movement on the Linux and Windows side. Previous knowledge of basic Active Directory, C#, and debugging will help immensely. This course will bring you deep into the weeds to make sure you understand what you are doing and how to leverage it to complete your objective and own the environment.
About Wes Dorman
Wes is a Senior Penetration Tester with Schellman. Wes specializes in performing technical offensive security assessments such as red teaming, external assessments, web application assessments, and social engineering. With five years of experience in the offensive security field, Wes brings a strong technical background with experience across multiple industries.