186 lines
5.1 KiB
Markdown
186 lines
5.1 KiB
Markdown
# OSCP Enterprise Homelab
|
|
|
|
> A fully documented, enterprise-inspired cybersecurity lab built on Proxmox for practicing penetration testing, Active Directory exploitation, privilege escalation, pivoting, web application attacks, and professional reporting.
|
|
|
|
---
|
|
|
|
## Overview
|
|
|
|
This repository documents the design, deployment, and operation of a reusable cybersecurity lab that closely resembles a small enterprise network.
|
|
|
|
The primary goal is to create a repeatable environment where attacks can be practiced safely and reset to a known-good state using Proxmox snapshots.
|
|
|
|
Unlike many "vulnerable VM" collections, this lab emphasizes realistic infrastructure and attack paths. Machines exist for a reason, users belong to departments, and services are deployed similarly to what an internal penetration tester would encounter.
|
|
|
|
---
|
|
|
|
## Objectives
|
|
|
|
* Learn enterprise networking
|
|
* Build an Active Directory environment
|
|
* Practice OSCP-style methodology
|
|
* Learn Windows and Linux privilege escalation
|
|
* Practice web application testing
|
|
* Practice buffer overflow exploitation
|
|
* Learn lateral movement and pivoting
|
|
* Build professional documentation habits
|
|
* Maintain a reusable cyber range
|
|
|
|
---
|
|
|
|
## Lab Architecture
|
|
|
|
```text
|
|
Internet
|
|
|
|
|
Home Router
|
|
|
|
|
Proxmox
|
|
|
|
|
vmbr0 (WAN)
|
|
|
|
|
pfSense
|
|
+-----------+-----------+
|
|
| |
|
|
vmbr1 (Attack) vmbr2 (Corporate)
|
|
| |
|
|
Kali Linux Active Directory
|
|
Windows Clients
|
|
SQL Server
|
|
File Server
|
|
Linux Targets
|
|
Buffer Overflow VM
|
|
|
|
vmbr3 (DMZ)
|
|
|
|
|
Public Web Targets
|
|
```
|
|
|
|
---
|
|
|
|
## Repository Layout
|
|
|
|
```text
|
|
homelab/
|
|
├── README.md
|
|
├── diagrams/
|
|
├── docs/
|
|
├── playbooks/
|
|
└── assets/
|
|
```
|
|
|
|
### Documentation
|
|
|
|
| File | Purpose |
|
|
| -------------------------- | --------------------------------------- |
|
|
| 01-proxmox.md | Proxmox installation and virtualization |
|
|
| 02-pfsense.md | Firewall and routing |
|
|
| 03-networking.md | Network design and IP addressing |
|
|
| 04-active-directory.md | Domain deployment |
|
|
| 05-kali.md | Attacker workstation |
|
|
| 06-vulnerable-machines.md | Windows/Linux targets |
|
|
| 07-pivoting.md | Internal routing and tunneling |
|
|
| 08-buffer-overflow.md | Dedicated BOF machine |
|
|
| 09-web-attacks.md | Web application testing |
|
|
| 10-privilege-escalation.md | Windows/Linux PrivEsc |
|
|
| 11-attack-methodology.md | Full penetration testing workflow |
|
|
| 12-resetting-the-lab.md | Snapshots and restoration |
|
|
| troubleshooting.md | Common issues |
|
|
|
|
---
|
|
|
|
## IP Addressing
|
|
|
|
| Network | Purpose |
|
|
| -------------- | ---------------------- |
|
|
| 192.168.1.0/24 | Home LAN |
|
|
| 10.10.10.0/24 | Attacker Network |
|
|
| 10.10.20.0/24 | Internal Corporate LAN |
|
|
| 10.10.30.0/24 | DMZ |
|
|
|
|
---
|
|
|
|
## Virtual Machines
|
|
|
|
| Machine | Purpose |
|
|
| ---------- | -------------------------- |
|
|
| pfSense | Firewall and routing |
|
|
| Kali Linux | Attacker workstation |
|
|
| DC01 | Active Directory |
|
|
| WIN10-01 | Domain workstation |
|
|
| WIN10-02 | Domain workstation |
|
|
| FILE01 | SMB enumeration |
|
|
| SQL01 | MSSQL attacks |
|
|
| WEB01 | Web exploitation |
|
|
| LINUX01 | Linux privilege escalation |
|
|
| BOF-WIN7 | Buffer overflow practice |
|
|
| PIVOT01 | Pivoting and tunneling |
|
|
|
|
---
|
|
|
|
## Learning Workflow
|
|
|
|
Each exercise should follow the same methodology:
|
|
|
|
1. Reconnaissance
|
|
2. Enumeration
|
|
3. Vulnerability Identification
|
|
4. Initial Access
|
|
5. Privilege Escalation
|
|
6. Credential Harvesting
|
|
7. Pivoting
|
|
8. Lateral Movement
|
|
9. Domain Compromise
|
|
10. Documentation
|
|
11. Restore Snapshot
|
|
|
|
---
|
|
|
|
## Snapshot Philosophy
|
|
|
|
Every virtual machine should maintain at least one baseline snapshot.
|
|
|
|
Recommended naming convention:
|
|
|
|
```
|
|
BASE_INSTALL
|
|
DOMAIN_JOINED
|
|
VULNERABLE
|
|
READY_FOR_ATTACK
|
|
```
|
|
|
|
Rollback should always return the machine to a known state within seconds.
|
|
|
|
---
|
|
|
|
## Documentation Standards
|
|
|
|
Every completed attack should include:
|
|
|
|
* Objective
|
|
* Enumeration
|
|
* Exploitation
|
|
* Privilege Escalation
|
|
* Screenshots
|
|
* Commands Used
|
|
* Lessons Learned
|
|
* Detection Opportunities
|
|
* Mitigations
|
|
|
|
---
|
|
|
|
## Long-Term Goals
|
|
|
|
Future improvements include:
|
|
|
|
* SIEM integration
|
|
* Wazuh
|
|
* Sysmon
|
|
* BloodHound
|
|
* Elastic Stack
|
|
* Terraform
|
|
* Ansible
|
|
* Automated lab deployment
|
|
* Continuous lab documentation through Wiki.js
|
|
|