I wanted to share my experience after finishing the PTP coursework and also having successfully passing the eCPPT exam. I’m obviously not going to divulge any specific details about the exam or spoilers, but speak very broadly about my experience.
By obtaining the eCPPT, your skills in the following areas will be assessed and certified:
- Penetration testing processes and methodologies, against Windows and Linux targets
- Vulnerability Assessment of Networks
- Vulnerability Assessment of Web Applications
- Advanced Exploitation with Metasploit
- Performing Attacks in Pivoting
- Web application Manual exploitation
- Information Gathering and Reconnaissance
- Scanning and Profiling the target
- Privilege escalation and Persistence
- Exploit Development
- Advanced Reporting skills and Remediation
The eCPPT is a certification for individuals with highly technical understanding of networks, systems and web applications attacks. Recommended Prerequisites:
- Understanding a letter of engagement and the basics related to a penetration testing engagement
- Deep understanding of networking concepts
- Manual exploitation of Windows and Linux targets
- Performing vulnerability assessment of networks
- Using Metasploit for complex and multi-step exploitation of different systems and OS’s
- Web application Manual exploitation
- Ability in performing post-exploitation techniques
- Exploit development skills on x86 environment
- Outstanding reporting skills
Overall, the exam wasn’t too incredibly hard. I think the course material properly prepared students for the engagement. And even though some of the techniques or tools were deprecated, the methodology and thoroughness of the course was solid. Except for the pivoting and buffer overflow sections, I didn’t need to rely on third party resources to get prepared. Students get seven whole days to work in the multi network test environment. It’s pass fail test. You must root every machine to get certified.
Prepping for the exam
It’s important to fully prep Kali and Windows based virtual machines in order to test the Buffer Overflow exploit.
To be safe I prepared both Windows 8.1 and 10 virtual machines using Virtual Box. I created snapshots after I was finished setting them up.
We’ll need to disable some security settings:
- Turn off DEP
- Turn off ASLR
- Disable Firewall
- Disable Windows Defender
Then install Immunity Debugger and Mona plugin. I didn’t install the bundled Python environment and instead manually installed Python 2.7.14.
I used one simple command cheat sheet in CherryTree and referenced my course notes in OneNote. I opened two Desktop instances of OneNote, so that I can take exam notes in a different section without having to constantly jump back and forth.
Day 1
I started the exam at 3pm so that on my last day, I’d still have a few hours left during daylight. After pressing the Start button, I Instantly received the pentest scope and instructions. I then connected to the exam environment and quickly focused on a target.
Early on I was stuck for a few hours but then found some promising things, but they didn’t lead to a shell. I tried to remember that this is a pentest and not just a boot to root, I wanted to try to be as thorough as possible and document any vulnerabilities that I discovered even if they didn’t lead to an exploit.
I methodically went through my enumeration steps and after a few hours, I found a way forward to get a limited shell. I upgraded the shell and poked around a bit. After this foothold, I decided to call it a night.
Day 2
I started the day exploring and enumerating the first compromised endpoint. I found what I thought would be the best privilege escalation technique, but struggled for a couple of hours getting it to work. I changed gears and quickly escalated privileges. My first root!
Next I found, what I believed to be, a pathway to the next network. I did some basic enumeration and was confident that this exploitation technique would work. It didn’t. Originally I decided not to use Metasploit for pivoting and mainly rely on Chisel, this ended up being a mistake. More on that later.
I battled trying to get the exploit working, even though I thought it should have been easy. I tried many different things. But still no luck. I called it a night, still only with one machine rooted.
Day 3
I didn’t make any progress
Day 4
I woke up a little nervous that I’ve only compromised one machine out of multiple machines. And I still hadn’t pivoted to any other networks. It was at this point, I realized that I should probably use Metasploit. Knowing that there were going to be double and triple pivots, I came to the determination that this framework is really going to help me. Since I’m planning on taking the OSCP after this exam, and you can only use Metasploit once during the exam, I wanted to become skilled with not relying on it much and trying to exploit everything manually.
After I changed my approach, I was able to root a few machines and pivot to the next network. This ended up being trivial to. I located the Buffer Overflow application, downloaded it and decided to sleep.
Day 5
My plan today was to conquer the infamous Buffer Overflow. I had practiced Windows 32 bit based BoF’s extensively and felt pretty confident about knocking it out in 30 minutes to an hour.
Overall it was pretty straight forward and similar to what I had been practicing. However there was some difficulty getting the payload to work. No matter what I tried, I just could not pop a shell. The payload required a lot of effort and I had to think outside of the box to get it to work. I worked on this custom exploit for the entire day. Once I got it to work locally, I prepared for deploying it to the exam environment. I also had to launch the exploit in a double pivoted network.
Day 6
I started the day feeling much more confident about passing the exam. But I still needed to pivot once more to get into the DMZ. I fired off my BoF custom exploit and to my relief it worked on the first try! Shell baby. Now I had access to a new network and started the enumeration process. I found and exploited the privilege escalation in a few hours. I then moved to own the DMZ, but I wasn’t able to make any significant progress and had to sleep.
Day 7
The last day of the exam was very stressful. I woke up at 4am so that I’d still have around eleven hours to get the last root in the DMZ.
I reset the exam environment for the first time, to make sure that all of my shells and pivots were as stable as possible. I got disconnect a few times and when that happens you have to re-exploit all the previous machines in the chain. I know I probably should have tried to setup some persistence method, but it seemed too overwhelming right at the end.
The good news is that re exploiting everything allowed me to record my session to video in case I missed any screenshots and take more screenshots for the report. I’d hate to fail the exam for missing a simple screenshot.
Unfortunately the privilege escalation on the very last machine (DMZ) was finicky. I hadn’t seen this specific escalation before and really had trouble finding out how to exploit it. Hours later I eventually found the way forward and got my final pwn a couple hours before the exam environment ended. Talk about close! I was thrilled that I finally hacked the entire network. I double checked that I had all of the necessary screenshots. And took rested for the rest of the day.
The Report
I read a few reviews that said the report was harder than the exam, and while i don’t personally agree with that sentiment, it was still very challenging and time consuming. Overall, I spend probably another 15 hours on the report. I had a hard time figuring out how to organize everything. I looked at many different templates including Offensive Security’s, Cyber Mentor and others. I reviewed sample reports from major pentesting firms. In the end, I just created my own report format and used examples for guidance.
It took a lot of time just to organize everything. I wrote a detailed yet broad Executive Summary that gave an overview of the entire test.
I classified each vulnerability that I found, even ones that didn’t lead to exploits, with the CVSS rating system. I organized each vulnerability near the beginning of the report. And here I specified remediation steps for each vulnerability. Then after this, I created sections for each IP address, and here showed the detailed steps and screenshots of the enumeration process, initial footholds and privilege escalation.
The report in total had 79 screenshots and was 62 pages. To make the report more professional and realistic, I created a fictitious pentesting company name, logo and made a custom cover page.
Waiting for the Results
I was near certain that I had passed the exam and that my report was sufficient. But the waiting game was rough. Maybe I had missed a screenshot? Did I find enough vulnerabilities and give proper remediation steps? It was a long few days waiting for the results. Then a week later, I checked my email in the middle of the night, I saw the subject “Congrats you are a eCPPT certified”!
The first thing on my mind was, let’s get started on the OSCP!
