Step 312. ★ Sitting the OSCP Practical Exam — 24 Hours of Doing Only What You Practiced

Level 4 — OSCP Preparation & Sitting the Exam | Difficulty ★★★★★ | Estimated time: 3 days (the day before’s preparation + 24-hour exam + 24-hour report)

Prerequisites: the two mock exams from Steps 309–311 and the strategy final document; the full OSCP preparation training of Steps 305–308.

• What you need: a confirmed exam schedule, your Kali environment (updated and VPN-tested), an ID card, a webcam (for proctoring), the strategy final document, the when-stuck checklist, and the report template. Every exam and score scene in this chapter is an example.
• ⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Only the exam environment’s machines are in scope, and you do not use tools or actions prohibited by the exam rules.
• ⚠️ Exam rules, scoring, and duration can change. Every figure in this chapter (23 hours 45 minutes, 70 points, the scoring composition, restricted tools) is general guidance as of this writing; before sitting the exam, always confirm the latest rules through OffSec’s official documents and the exam information email. Where official guidance and this chapter differ, the official guidance is the answer.

Finally, the real thing. The exam proceeds in an environment where a supervisor (proctor) monitors your screen and webcam, and you must submit the report within 24 hours after the end. Everything trained so far — the enumeration checklist, time allocation, evidence collection habits, the report template — was accumulated for this one day.

So today’s strategy contains not one new thing. What matters is doing it exactly as you did in practice — that alone. This chapter is not new technique but a final briefing that spreads out the day’s procedure and mental operations in advance.

---

1. Learning Objectives

By the end of this chapter, you will be able to:

• Execute the day-before preparation checklist (equipment, rules, condition)
• Understand the proctoring procedure (ID verification, environment inspection, screen sharing) and pass it without fluster
• Confirm the restricted-tool rules and check that your toolbox complies
• Compute the score-summation structure to grasp "how many points I have now and what remains" during the exam
• Manage the opening scoreless stretch’s panic with a planned protocol, finish the 24 hours, and submit the report

---

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

2-1. Proctoring — Surveillance Is a Procedure, Not Pressure

The exam proceeds under remote supervision. The general flow is as follows (check official guidance for details).

Pre-start procedure (example):
1. Connect to the proctoring platform before the reserved start time
2. ID verification — show your ID to the webcam to confirm your identity
3. Environment inspection — show the whole room 360 degrees on webcam (desk, around the monitors)
4. Screen sharing begins + webcam stays on
5. After proctor approval, the VPN pack is delivered → exam begins

Why know this in advance: a procedure you’ve never experienced raises your heart rate by itself. Known as "the normal procedure," surveillance becomes background; experienced unknown, it becomes foreground and burns the first 30 minutes. Bathroom breaks and meals are allowed during the exam but may involve procedures like webcam return confirmation, so read the rules in advance and design meals to fit them.

2-2. Restricted-Tool Rules — What You Should Have Kept Since the Mock Exams

The exam has tool categories whose use is restricted or prohibited. Typical examples (⚠️ always confirm the latest rules through official guidance):

Examples of restricted/prohibited categories (general guidance as of this writing):
- Commercial automated exploitation tools (e.g., rules restricting Metasploit use)
- Automated exploitation tools in general (sqlmap and the like may be restricted)
- AI assistants / outside help — third-party solving support prohibited, human or tool
- Attacks outside the exam environment (infrastructure, other candidates) — prohibited, of course

The core is this — confirming the rules is work for mock-exam composition time, not the day before the exam. This is why Step 309 said "fix the prohibited-tool list to the real standard." Only if the workflow you used in the mock exams is legal as-is will your hands not tangle changing tools on the day.

2-3. Score Strategy — The Math of 70 Points

Save the script below as score_calc.py (Python 3, standard library only).

#!/usr/bin/env python3
# score_calc.py — the math of the 70-point bar (standard library only)
#
# Usage:
#   python score_calc.py                      print the passing-combination table
#   python score_calc.py 30 20 20 10          verdict on the points secured so far
#                                             (first number: AD set, rest: standalones)
#
# Example scoring basis: AD set 40 pts + 3 standalone machines x 20 pts = 100 pts,
# bar at 70. (⚠️ Always confirm the real scoring and bar with official guidance.)

import sys

PASS_LINE = 70

COMBOS = """=== Combinations reaching the 70-point bar (example scoring basis) ===

[Case: AD set finished (40)] — remaining points needed: 30
  2 standalones finished (20+20)            → 80 pts ✅ passing range
  1 standalone finished + 1 partial (20+10)  → 70 pts ✅ passing range

[Case: AD set not taken] — standalones alone max at 60
  All 3 standalones finished (20x3)          → 60 pts ❌ structurally impossible

[Case: AD set partial (30) + standalones] — remaining points needed: 40
  AD 30 + 2 standalones finished (20+20)     → 70 pts ✅ passing range
  AD 30 + 1 standalone finished + 2 partial  → 70 pts ✅ passing range
  AD 20 + 2 standalones finished + 1 partial → 70 pts ✅ passing range

Conclusion: there are effectively two paths to a pass — ① finish AD + 1.5 standalones,
            ② AD partial (30) + 2 standalones.
            The 'abandon AD' strategy does not hold mathematically."""


def main():
    args = sys.argv[1:]
    if len(args) == 4:
        ad = int(args[0])
        others = [int(a) for a in args[1:]]
        total = ad + sum(others)
        verdict = "✅" if total >= PASS_LINE else "❌"
        print("Input scores: AD=%d, standalones=%s → total %d pts" % (ad, others, total))
        print("Verdict: passing range against the %d-point bar %s" % (PASS_LINE, verdict))
        if total < PASS_LINE:
            print("%d pts to the bar — recompute the partial-point combinations of the remaining machines."
                  % (PASS_LINE - total))
    else:
        # no arguments, or a different count: combination-table mode
        print(COMBOS)


if __name__ == "__main__":
    main()

The exam is a summed-points game. An example scoring composition (⚠️ official confirmation required): AD set 40 points + 3 standalone machines × 20 points = 100 points, passing bar 70 points. Confirm with the calculator what this structure implies for strategy — this is the measured result.

python score_calc.py

=== Combinations reaching the 70-point bar (example scoring basis) ===

[Case: AD set finished (40)] — remaining points needed: 30
  2 standalones finished (20+20)            → 80 pts ✅ passing range
  1 standalone finished + 1 partial (20+10)  → 70 pts ✅ passing range

[Case: AD set not taken] — standalones alone max at 60
  All 3 standalones finished (20x3)          → 60 pts ❌ structurally impossible

[Case: AD set partial (30) + standalones] — remaining points needed: 40
  AD 30 + 2 standalones finished (20+20)     → 70 pts ✅ passing range
  AD 30 + 1 standalone finished + 2 partial  → 70 pts ✅ passing range
  AD 20 + 2 standalones finished + 1 partial → 70 pts ✅ passing range

Conclusion: there are effectively two paths to a pass — ① finish AD + 1.5 standalones,
            ② AD partial (30) + 2 standalones.
            The 'abandon AD' strategy does not hold mathematically.

How to read it: this math governs every judgment on the day. Because it’s a sum, not "if I miss this one machine it’s over," you can defer a blocked machine and compute the remaining combinations. To judge your current score mid-exam, feed the points you’ve secured, like python score_calc.py 30 20 20 10, and it shows the distance and slack to the bar.

2-4. Mental Management — Panic Is a Scheduled Stretch

This chapter’s central problem is one — if you solve nothing in the first 2–3 hours, panic comes. Design this panic into the plan not as "what if it comes" but as "a stretch that comes."

Panic management protocol (the last line of the strategy final document, re-quoted):
1. Recognize: "This is the scheduled scoreless stretch. Exams 1 and 2 had it too."
2. Action: check the timetable → defer the blocked machine's slot → open the checklist
3. Prohibited: strategy changes, trying new tools, repeatedly calculating remaining time
4. Basis: the exam is a marathon — 0 points at hour 3 is not 0 points at hour 24

And sleep — you actually take the planned sleep (4–5 hours). Not sleeping because "it’s a waste" is scrapping on the day a rule verified in Step 311. That a clear dawn head makes more points than all-night flailing is something your two rounds of data already proved.

---

3. Follow Along

3-1. The Day Before — Inspection Day for Equipment and Condition

The day before’s work is inspection, not study. Attempts to learn new techniques only grow the day-before anxiety.

Day-before checklist:
[ ] Kali VM updated, snapshot saved
[ ] Exam VPN connection test (connect, disconnect, reconnect)
[ ] Proctoring requirements confirmed: webcam works, ID ready, room tidy (around the monitors)
[ ] Screenshot tool hotkeys confirmed — a tool problem mid-exam leads straight to missing evidence
[ ] File locations fixed for the checklist / report template / strategy final document
[ ] Latest exam rules re-confirmed — the info email and official documents (scoring, restricted tools, duration)
[ ] Meals prepared (things edible without cooking), water, 2 sleep alarms
[ ] Earlier than usual the night before — shift your sleep phase to the exam start time

Why the last item exists: the exam start time is by reservation. A habitual night owl taking a 9 a.m. exam burns the first 3 hours in poor condition. From a few days before, align your wake time with the exam schedule.

3-2. Exam-Day Start — Procedure Slowly, Timer Precisely

Start sequence (example):
1. 30 minutes before start: connect to proctoring, pass ID & environment inspection
2. Connect the VPN, confirm the scope document — the IP list of targets you're allowed to attack
3. Start the timer: python lap_timer.py start
4. Execute the first block per the strategy document — parallel recon (scan all machines)
5. After 30 minutes: the first judgment — start the first machine per the final document's order rule

The 30 minutes right after the start decide the day. Impatience tempts you to begin with "just dig one deep," but as long as the final document exists, that temptation is not the exam but noise.

3-3. Mid-Exam Operations — Executing the Final Document

Mid-exam, you are not a strategist but an executor. The judging ended in Step 311; today only execution remains.

Execution rules (in the form excerpted from the strategy final document):
- Machine caps: standalone 3h / AD 4h — at cap, defer the slot (not give up)
- 30 min stuck: force the checklist open
- Score verdicts: at each mid-exam review, python score_calc.py <AD> <standalone1> <standalone2> <standalone3>
- Evidence: the 4 kinds immediately on shell (whoami / IP / flag / key path output)
- Sleep: go to bed at the planned time — 2 alarms
- Closing: from 2h before the end, stop new attacks; partial points + report first draft

Screen example (a score verdict at a mid-exam review — measured):

python score_calc.py 30 20 20 10

Input scores: AD=30, standalones=[20, 20, 10] → total 80 pts
Verdict: passing range against the 70-point bar ✅

The moment this output appears, strategy changes — from "making points" to "keeping points." Rather than attacking new machines, you spend time on the evidence completeness of secured machines and report organizing.

3-4. Writing and Submitting the Report — The Exam’s Second 24 Hours

Submit the report within 24 hours after the end (⚠️ confirm deadline and format in official guidance). If a first draft accumulated during the exam, this time is review, not authoring.

Pre-submission review checks (per machine):
[ ] Machine name & IP match the exam scope document
[ ] Attack path reproducible with commands+output — no vague sentences like "exploited the vulnerability"
[ ] The 4 kinds of evidence screenshots exist; IP and time identifiable
[ ] Command context of the required evidence files (local.txt / proof.txt, etc.) included — confirm the official format
[ ] After PDF conversion, review every page by eye
[ ] Submission confirmation (receipt email, etc.) kept

Why reproducibility: the report must let a grader follow your path. Not "written that it works" but "works when followed" is the report’s passing bar. The template you used across the two mock exams is used as-is here — which is why you’ve been told to use the template since Step 309.

---

4. Missions & Exercises

Mission — Sit the Practical Exam and Submit the Report

1. Execute the whole day-before checklist (3-1), and re-confirm the latest exam rules (scoring, restricted tools, duration, report deadline) through official guidance.
2. Pass the proctoring procedure and begin the exam — keep the timer and lap records the same way as the mock exams.
3. Execute the strategy final document to the end — caps kept, sleep taken, the 4 kinds of evidence collected in real time.
4. At each mid-exam review, judge the current score with score_calc.py, and switch to "keeping" mode after reaching the bar.
5. Within 24 hours after the end, submit the report with the review checks (3-4), and keep the submission confirmation.

Exercises

Exercise 1. In the score-summation structure (example basis), explain with math why "the strategy of abandoning the AD set and concentrating on standalone machines" doesn’t hold.

Exercise 2. Why must the restricted-tool rules be confirmed at "mock-exam composition time" rather than "the day before the exam"?

Exercise 3. In the panic management protocol for the opening scoreless stretch, why is "repeatedly calculating remaining time" a prohibited item?

Exercise 4. After reaching the bar, you’re told to switch to "keeping points" mode. What is time spent on in keeping mode, and why does attacking new machines fall to lower priority?

---

Answers & completion criteria · expand/collapse

5. Model Answers & Completion Criteria

Mission Model Answer

Verify against these criteria.

1. Rules currency: is there a trace of confirming scoring, duration, restricted tools, and the report deadline through official guidance — sitting the exam believing this chapter’s figures as-is is a violation of this chapter’s own instruction.
2. Day-before completeness: were equipment, VPN, webcam, and the screenshot tool all inspected the day before — an equipment problem on the morning of is panic’s most absurd route.
3. Execution consistency: does mid-exam behavior match the strategy final document — a strategy newly made on the day has never been verified.
4. Sleep executed: did you actually take the planned sleep — if not, it’s the #1 record item for the retrospective (Step 313).
5. Evidence and report: does every scored machine have evidence, and was the report submitted and confirmed within the deadline? However excellent the solving, an insufficient report means the points aren’t credited.

Exercise Answers

Answer 1. In the example scoring, standalone machines total 60 points (3 × 20) while the bar is 70 — even a perfect standalone sweep is structurally 10 points short. So you must take at least 10 points (in practice 20–30) from the AD set, and this is why "AD first" or "AD parallel recon" is a common element of every strategy. Math sets strategy’s floor — which is why you must not change strategy by emotion on the day.

Answer 2. Because a tool workflow is muscle memory. If a solving habit dependent on a prohibited tool settles into your body during mock exams, then on the day, facing the same problem without that tool, your hands stop — you enter a state of "can but can’t." Practicing under the real rules from the mock exams makes the legal workflow the default and removes one exam-day variable. Rule compliance is a training-design problem before it is an ethics problem.

Answer 3. Because calculating remaining time is not action but the reproduction of anxiety. The computation "14 hours left and 30 more points needed" can’t change the only conclusion available at that moment — "do the next action per the timetable" — yet it raises the heart rate. Repeatedly checking information that changes no decision is panic’s fuel. Time checks happen only at the planned mid-exam review points — because there, computation leads to action (priority readjustment).

Answer 4. Keeping mode’s time goes to the completeness of secured points — re-confirming the 4 kinds of evidence, extra harvesting on partially scored machines, organizing the report first draft. New-machine attacks fall behind because of expected value — new points from an unsolved machine are uncertain, but missing evidence on an already-cracked machine is a certain loss of certain points. Since "solved but no evidence" at the report stage is an irreversible accident, documenting the secured always comes before new exploration.

Completion Criteria Checklist

• [ ] I confirmed the latest exam rules (scoring, duration, restricted tools, report deadline) through official guidance
• [ ] I executed the whole day-before checklist (equipment, VPN, proctoring, condition)
• [ ] I passed the proctoring procedure (ID, environment inspection, screen sharing)
• [ ] I executed the 24 hours per the strategy final document (caps, sleep, checklist included)
• [ ] I collected the 4 kinds of evidence in real time for every scored machine
• [ ] I judged scores at mid-exam reviews and switched to keeping mode after reaching the bar
• [ ] I submitted the report within 24 hours after the end and kept the receipt confirmation

---

6. Common Pitfalls & Fixes

Wall 1. Before the exam starts, the proctoring app won’t detect the webcam

Symptom: the camera isn’t recognized on the supervision screen. The start time approaches.

Cause: in most cases another app (video conference, a browser tab) is holding the webcam.

Fix: in the day-before inspection, test the combination of the proctoring app and the webcam together — a camera-only test can pass while the combination fails. On the day, close every app that uses the webcam and reconnect; if it still fails, share the situation immediately via the proctor chat. Procedural delay gets recorded, but silence is worse.

Wall 2. The VPN dropped mid-exam

Symptom: scans stall and shell sessions die.

Cause: connection drops in long sessions are common incidents — you likely experienced them in the mock exams too.

Fix: don’t panic; run the reconnection procedure — the day-before "connect, disconnect, reconnect" test was for this moment. Record the drop time in a lap, and resume the attack in progress from the log’s last point. A machine whose session fully died may need re-compromise — which is why evidence was "capture the moment you get it." If it’s a persistent failure, report it to the proctor.

Wall 3. It’s hour 3 with 0 points and my hands are shaking

Symptom: nothing seems to work, and you keep looking at the clock.

Cause: the scheduled panic stretch — remember the same spot in the mock exams. The logs of exams 1 and 2 had opening scoreless stretches, and points came after them.

Fix: run the protocol — ① recognize it as "the scheduled stretch," ② check the timetable and defer the blocked machine’s slot, ③ open the checklist and go mechanically from the first item. And take 5 minutes away from the screen for a cold-water face wash. The exam is a marathon — 0 points at hour 3 is like being last at the 5 km mark. Grading happens only at the finish line.

Wall 4. I solved machines but the score_calc.py input format confuses me

Symptom:

$ python score_calc.py 40 20
... (prints in combination mode — my score verdict doesn't run)

Cause: the score-verdict mode runs only with exactly 4 arguments (AD + 3 standalones). With a different count, it runs in combination-explanation mode.

Fix: fill standalones you haven’t touched yet with 0 to make 4 — python score_calc.py 40 20 0 0. Enter in the same format at every mid-exam review and the score trend stays in the lap log as retrospective material.

Wall 5. Writing the report, I find one evidence screenshot is missing

Symptom: in the post-end review, a particular machine’s proof capture is absent. The exam environment is already closed.

Cause: one firing of 2-4’s "capture later" — the most painful accident, but there’s a response.

Fix: immediately check the procedure in the proctor/operations guidance — whether environment reconnection is allowed, and what the post-end access rules are, is answered by official guidance. If reconnection is impossible, document as faithfully as possible with the attack path’s logs and output records, lower the score expectation for that machine, and concentrate on the remaining machines’ completeness. And record it in the retrospective — the cost of this one image permanently builds the "evidence first" habit for the next exam (or retake).

---

7. Summary

Today’s Concepts

Today’s Commands & Documents

The Core Instinct

There should have been nothing new today. The proctoring, the length of 24 hours, the dawn fatigue, the despair of blockage — every one is a road you already passed once in the mock exams. What the exam graded was not technique alone. It graded the completeness of the whole process — make a plan, keep it, analyze after collapsing, and stand again.

After you press the submit button, a few days of waiting for the result remain. Those days also have their work — regardless of the outcome, the work of leaving this one day as a record and turning it into an asset.

---

Once every box is checked, Step 312 is complete.