# OSCP Enterprise Homelab

> A fully documented, enterprise-inspired cybersecurity lab built on Proxmox for practicing penetration testing, Active Directory exploitation, privilege escalation, pivoting, web application attacks, and professional reporting.

---

## Overview

This repository documents the design, deployment, and operation of a reusable cybersecurity lab that closely resembles a small enterprise network.

The primary goal is to create a repeatable environment where attacks can be practiced safely and reset to a known-good state using Proxmox snapshots.

Unlike many "vulnerable VM" collections, this lab emphasizes realistic infrastructure and attack paths. Machines exist for a reason, users belong to departments, and services are deployed similarly to what an internal penetration tester would encounter.

---

## Objectives

* Learn enterprise networking
* Build an Active Directory environment
* Practice OSCP-style methodology
* Learn Windows and Linux privilege escalation
* Practice web application testing
* Practice buffer overflow exploitation
* Learn lateral movement and pivoting
* Build professional documentation habits
* Maintain a reusable cyber range

---

## Lab Architecture

```text
                     Internet
                         |
                    Home Router
                         |
                      Proxmox
                         |
                    vmbr0 (WAN)
                         |
                      pfSense
             +-----------+-----------+
             |                       |
      vmbr1 (Attack)          vmbr2 (Corporate)
             |                       |
          Kali Linux           Active Directory
                               Windows Clients
                               SQL Server
                               File Server
                               Linux Targets
                               Buffer Overflow VM

                     vmbr3 (DMZ)
                         |
                 Public Web Targets
```

---

## Repository Layout

```text
homelab/
├── README.md
├── diagrams/
├── docs/
├── playbooks/
└── assets/
```

### Documentation

| File                       | Purpose                                 |
| -------------------------- | --------------------------------------- |
| 01-proxmox.md              | Proxmox installation and virtualization |
| 02-pfsense.md              | Firewall and routing                    |
| 03-networking.md           | Network design and IP addressing        |
| 04-active-directory.md     | Domain deployment                       |
| 05-kali.md                 | Attacker workstation                    |
| 06-vulnerable-machines.md  | Windows/Linux targets                   |
| 07-pivoting.md             | Internal routing and tunneling          |
| 08-buffer-overflow.md      | Dedicated BOF machine                   |
| 09-web-attacks.md          | Web application testing                 |
| 10-privilege-escalation.md | Windows/Linux PrivEsc                   |
| 11-attack-methodology.md   | Full penetration testing workflow       |
| 12-resetting-the-lab.md    | Snapshots and restoration               |
| troubleshooting.md         | Common issues                           |

---

## IP Addressing

| Network        | Purpose                |
| -------------- | ---------------------- |
| 192.168.1.0/24 | Home LAN               |
| 10.10.10.0/24  | Attacker Network       |
| 10.10.20.0/24  | Internal Corporate LAN |
| 10.10.30.0/24  | DMZ                    |

---

## Virtual Machines

| Machine    | Purpose                    |
| ---------- | -------------------------- |
| pfSense    | Firewall and routing       |
| Kali Linux | Attacker workstation       |
| DC01       | Active Directory           |
| WIN10-01   | Domain workstation         |
| WIN10-02   | Domain workstation         |
| FILE01     | SMB enumeration            |
| SQL01      | MSSQL attacks              |
| WEB01      | Web exploitation           |
| LINUX01    | Linux privilege escalation |
| BOF-WIN7   | Buffer overflow practice   |
| PIVOT01    | Pivoting and tunneling     |

---

## Learning Workflow

Each exercise should follow the same methodology:

1. Reconnaissance
2. Enumeration
3. Vulnerability Identification
4. Initial Access
5. Privilege Escalation
6. Credential Harvesting
7. Pivoting
8. Lateral Movement
9. Domain Compromise
10. Documentation
11. Restore Snapshot

---

## Snapshot Philosophy

Every virtual machine should maintain at least one baseline snapshot.

Recommended naming convention:

```
BASE_INSTALL
DOMAIN_JOINED
VULNERABLE
READY_FOR_ATTACK
```

Rollback should always return the machine to a known state within seconds.

---

## Documentation Standards

Every completed attack should include:

* Objective
* Enumeration
* Exploitation
* Privilege Escalation
* Screenshots
* Commands Used
* Lessons Learned
* Detection Opportunities
* Mitigations

---

## Long-Term Goals

Future improvements include:

* SIEM integration
* Wazuh
* Sysmon
* BloodHound
* Elastic Stack
* Terraform
* Ansible
* Automated lab deployment
* Continuous lab documentation through Wiki.js