Step 309. ★ The First 24-Hour Mock Exam — A Day of Learning to Fight the Clock

Level 4 — OSCP Preparation & Sitting the Exam | Difficulty ★★★★★ | Estimated time: 3 days (1 day for set composition & planning + 24-hour mock exam + 1 day for grading & report)

Prerequisites: the OSCP preparation training of Steps 305–308 (enumeration checklist, AD set takedown) complete; the time-attack methodology of Steps 276–278.

What you need: a mock exam set built from machines you’ve never seen (1 AD set + 3–4 standalone machines), a 24-hour timer, a screenshot tool, the report template, and Python 3. Every machine-takedown and score scene in this chapter is a screen example, and since the exam composition and scoring can change, confirm OffSec’s official guidance before sitting the exam.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Mock exam machines must come only from platforms officially opened by their operators for attack practice, such as OffSec labs, Hack The Box, and Proving Grounds.
This chapter is a simulation — a rehearsal where you live one real 24 hours and measure whether your body reaches the passing bar (70 points in the example).

The OSCP practical exam runs for 23 hours and 45 minutes (subject to change by operating policy — check official guidance). In this exam, what splits scores apart as much as technical skill is operational strategy. "Don’t get tied to one machine beyond a set number of hours," "the order of the AD set versus standalone machines," "when to sleep and when to eat," "how far to take report memos in real time" — a candidate who hasn’t decided these four things in advance must make those decisions mid-exam with a fatigued brain.

Today you verify those decisions under real conditions for the first time. The goal is not passing but finishing and measuring. Falling apart in the first mock exam is normal, and if the coordinates of the collapse are recorded, they become exactly the material for remediation.

1. Learning Objectives

By the end of this chapter, you will be able to:

Compose a 24-hour mock exam set under the real rules (prohibited tools, evidence collection, no external solutions)
Write a time-blocked operational plan (including sleep, meals, mid-exam reviews) and keep it during the exam
Mechanize switching decisions by fixing machine priority (AD set vs standalone machines) and per-machine time caps
Track elapsed time and per-machine accumulated time in real time with a lap timer tool
After the end, analyze scoring and time usage, recording the causes of "wasted time" as coordinates

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	Mock exam machine set (OffSec labs/HTB, etc.), Python 3 (timer & log), report template
Today’s commands	`python lap_timer.py plan/start/lap/status/report` — the attack commands themselves are all review
Concepts needed	24-hour operational design, per-machine time caps, mid-exam reviews, sleep reservations, real-time evidence collection
Today’s deliverable	1 operational plan + 1 lap log + a time-usage analysis + a report first draft

2-1. Why a Mock Exam — Practice and the Exam Are Different Sports

Time attacks so far were 4 hours, 8 at most. Twenty-four hours is three times that, but the difficulty isn’t three times. Past the 12-hour mark, the resource called judgment starts running dry — the same blockage feels twice as hard at 3 a.m., and the "do I hold this route" decision made then differs in quality from a daytime decision.

So the mock exam is not a skill test but an operations test. Many of the reasons you fail solvable machines lie not in technique but in operations — time allocation, stamina, evidence collection — and the first mock exam will show you that. Showing you that is this chapter’s reason to exist.

2-2. Machine Priority — Allocating Between the AD Set and Standalone Machines

The exam composition (on the example basis) is a summed-points game of the AD set and standalone machines. The AD set carries big points but is a chained structure, so if the initial compromise stalls, everything stalls; standalone machines are independent, so one machine’s failure doesn’t affect the next.

Strategy	Strength	Risk
AD set first	Secure the big points early; the remaining time relaxes	If the initial compromise stalls, the first 3 hours evaporate scoreless
Standalone machines first	Quick points build confidence; recon the AD in parallel	The time left for AD may run short
Parallel recon + fluid allocation	Scan every machine in the first 30 minutes, "easiest first"	Without judgment criteria, it degrades into flailing

For the first mock exam, fix one of the three before starting and keep it to the end. Changing strategy mid-way is allowed, but only at a planned mid-exam review point. You don’t yet know which strategy fits you — today is the day you find out.

2-3. Time-Blocked Operational Design — Sleep and Meals Are Also the Plan

There is one core principle of 24-hour operations — every consumption is reserved before the start. "I’ll sleep when I’m tired" is not a plan. A tired brain can’t even judge that it’s tired.

The 4 fixed blocks of operational design:
1. Sleep 4–5 hours — reserved around the 14-hour mark, 2 alarms
2. 2 meals + a 20-minute walk — time fully away from the screen
3. 2 mid-exam reviews — at 12 hours and 4 hours before the end: score tally + priority readjustment
4. Closing block — from 2 hours before the end, stop new attacks; harvest partial points + report

The strategy of enduring on caffeine collapses around the 16-hour mark. This point holds up in practice — a 5-minute walk, a cold-water face wash, and planned sleep beat caffeine. It’s common for 30 minutes after a 4-hour dawn sleep to produce more points than 3 hours of all-night flailing.

2-4. Real-Time Evidence Collection — The More Tired, the More Screenshot First

The exam requires submitting a report within 24 hours after the end (policy subject to change — confirm officially), and points without evidence are not credited. But a machine cracked at dawn is easy to pass over with "I’ll capture it later" — and then the session drops and the machine resets.

The rule is simple — the moment you get a shell, take the evidence first, then celebrate. whoami, ip (or ipconfig), the flag, and the key command output of the attack path. Only when these four kinds are captured are that machine’s points yours. The more tired you are, the more you keep this order — a fatigued brain’s "I’ll remember it" is an unreliable storage device.

3. Follow Along

3-1. Composing the Mock Exam Set — "Never Seen Before" Is the Condition

To be a rehearsal of the exam, every machine must be unsolved. A machine you’ve solved before is solved by memory, so operations can’t be measured.

Set composition checks:
[ ] 1 AD set (or a bundle of 3 AD-style linked machines) — if an OffSec mock set exists, use it
[ ] 3–4 standalone machines — ones whose solutions/walkthroughs you've never seen
[ ] Fix the prohibited-tool list to the real standard (official guidance check required)
[ ] Mark the start and end times as a box on the calendar
[ ] Share the 24-hour schedule with family/housemates — pre-block interruptions

Why: set composition is half the exam. A set that’s too hard measures skill instead of operations, and a set with known machines mixed in measures neither. Match the difficulty to "the grades you were passing in your usual time attacks."

3-2. Printing the Operational Plan — Preparing the Timer Tool

Print the plan with the chapter’s timer tool lap_timer.py and stick it on your desk. This is the measured result.

python lap_timer.py plan

=== 24-hour mock exam time allocation plan ===
  00:00  Start — parallel recon: nmap on all machines, grasp the AD set composition
  00:30  Begin the AD set (initial compromise → enumerate domain paths)
  03:00  AD set cap — if tied up, switch to standalone machine A
  06:00  Standalone machine B / mid-point check of score status
  09:00  Meal + 20-minute walk — fully away from the screen
  12:00  Mid-exam review: score tally, readjust remaining machine priorities
  14:00  Reserved sleep block of 4–5 hours (2 alarms)
  19:00  Re-attack unsolved machines — starting from the checklist at the blocked points
  22:00  Partial-point harvest: low-priv shells, flags, organize path evidence
  23:00  Report first draft — cross-check screenshots/commands/IPs
  24:00  End — back up logs, save the report

Rule: 3-hour cap per machine / final 2 hours are partial points + report

How to read it: this table is an example, and what matters is that each line is written in elapsed time, not clock time. If the exam starts at 9 a.m., the 14-hour mark is 11 p.m. — sleep must be reserved at that clock time. Convert to real clock times matching your own start time and write them down.

3-3. Running the Exam — Making Operations Visible with Lap Records

Start the timer the moment you begin, and take a lap whenever you move machines or a state changes.

python lap_timer.py start
python lap_timer.py lap "standalone-A" "in progress" "nmap done, ports 80/443"
python lap_timer.py status

The role of the status output is mechanizing switching decisions — when a machine’s accumulated time passes the cap (3 hours), a warning appears, and the decision at that moment is not "should I keep going" but "switch per the cap rule." Making the rule decide in your place is the only way to survive the fatigued hours.

Screen example (one page of a mid-exam lap log):

[+00:30] full-recon — done — nmap on all machines, AD set's 3 machines confirmed
[+03:30] AD-set — blocked — 30 min past cap, switching to standalone-A
[+05:40] standalone-A — done — user+root 20 pts, 4 kinds of evidence collected
[+14:00] sleep — start — 2 alarms set

3-4. Right After the End — Practicing Reading the Report with the Demo Log

Before a real session, first learn to read the report by generating a virtual 24-hour session with the tool’s demo command. This is the measured result.

python lap_timer.py demo

Elapsed 24:00 / remaining 00:00
  AD-set           06:00  ⚠ over cap — consider switching
  standalone-B     05:30  ⚠ over cap — consider switching
  sleep            04:40  ⚠ over cap — consider switching
  standalone-C     02:30
  standalone-A     02:10
  report           02:00
  meals/rest       00:40
  full-recon       00:30

=== Closing report: time usage analysis ===
  AD-set            06:00 (25.0%)  final: in progress
  standalone-B      05:30 (22.9%)  final: done
  sleep             04:40 (19.4%)  final: done
  standalone-C      02:30 (10.4%)  final: done
  standalone-A      02:10 ( 9.0%)  final: done
  report            02:00 ( 8.3%)  final: done
  meals/rest        00:40 ( 2.8%)  final: done
  full-recon        00:30 ( 2.1%)  final: done

Sleep 04:40 / meals·rest 00:40
Strategy check: machines over the cap (180 min) = ['AD-set', 'standalone-B']

How to read it: this example session’s diagnosis is clear — 6 hours (25%) went to the AD set, yet its final state is "in progress," meaning the most time was burned on an unfinished machine. Standalone-B also took 5 hours 30 minutes, nearly double the cap. Meanwhile, the finished standalone-A and C took about 2 hours each. "Had the cap rule been kept, the AD set’s 3 hours would have become other machines’ points" — that sentence is the one line you must extract from the closing report.

The 4 hours 40 minutes of sleep is as planned. The over-cap warning appearing on "sleep" too is because the tool tallies sleep like a machine; ignore it — the report’s last line (strategy check) computes excluding sleep and meals.

3-5. The Report First Draft — This Far Within the 24 Hours

The real exam requires submitting the report within 24 hours after the end (policy subject to change — confirm officially). In the mock exam, try completing even the first draft inside the exam time. The block 1 hour before the end is that time.

Report first-draft checks (per machine):
[ ] Machine name and IP
[ ] Attack path summary (3–5 sentences)
[ ] Key commands and output (reproducibly)
[ ] 4 kinds of evidence screenshots — whoami / IP / flag / key path output
[ ] Privilege escalation path (if any)

Why: if you push the report past the end, it becomes memory-dependent, and memory dependence leads to missing evidence. With the lap log and screenshots accumulated during the exam, the first draft is "organizing," not "authoring" — and that difference removes the pressure of the 24 hours after the end.

4. Missions & Exercises

Mission — Finish the First 24-Hour Mock Exam

Compose a set of unsolved machines — 1 AD set (or an AD-style bundle) + 3–4 standalone machines.
Referring to the structure of python lap_timer.py plan, write a real-clock operational plan based on your start time — including sleep, meals, 2 mid-exam reviews, and the closing block.
Fix one machine-priority strategy (AD first / standalone first / parallel recon) before starting, and record it.
Finish the 24 hours with the timer — lap records, real-time collection of the 4 kinds of evidence, the 3-hour per-machine cap applied.
Right after the end, pull the time-usage analysis with report and record in one line "the time I could have saved had I kept the cap."
Complete the report first draft inside the exam time and fill the grading sheet (score / passing bar assumed at 70 points).

Exercises

Exercise 1. In 24-hour operations, why are sleep and meals designed as "blocks reserved before the start" rather than "measures taken when condition worsens"?

Exercise 2. Explain the risks of the AD-first strategy and the standalone-first strategy respectively, and state why "keeping the strategy to the end" matters more than the choice of strategy in the first mock exam.

Exercise 3. Explain why the rule "the more tired, the more screenshot first" holds — from the perspective of evidence collection and from the perspective of the fatigued brain’s characteristics.

Exercise 4. In the closing report, the "most time-consuming machine" came out as an unfinished machine. What strategic problem does this one fact suggest, and what’s the fix direction for the next mock exam?

5. Model Answers & Completion Criteria

Mission Model Answer

Verify against these criteria.

Set freshness: are all machines unsolved — if you’ve seen the solution of even one, discard that machine’s time data.
Real-clock plan: is it written in actual clock times — "what you do at what time" — rather than elapsed times, especially the sleep start time?
Strategy fixed in advance: is the priority strategy recorded before the start — a strategy decided mid-exam is not a strategy but a reaction.
Lap log continuity: are machine switches and state changes captured without gaps — a 6-hour blank makes that stretch’s operations unmeasurable.
The 4 kinds of evidence: does every finished/partially scored machine have whoami/IP/flag/path output — with no omissions in the fatigued dawn stretch?
The one line of analysis: is a sentence recorded like "time I could have saved had I kept the cap: X hours Y minutes — it would have been standalone-B’s points"?
Report first draft: is there a first draft with the 5 per-machine checks filled, completed inside the exam time?

Exercise Answers

Answer 1. Because a fatigued brain can’t judge its own fatigue. The plan "I’ll sleep when it gets bad" delegates that judgment to the fatigued brain, so in practice it ends in an all-nighter. A reserved block eliminates judgment — when the time comes you sleep; you don’t decide then whether to sleep. The essence of operational design is forcing a decision made in advance onto your future self.

Answer 2. AD-first carries the risk that if the initial compromise stalls, the first few hours evaporate scoreless; standalone-first carries the risk that the big-point AD set runs short of time. The reason keeping the strategy matters more than choosing it in the first mock exam is measurement — a strategy changed mid-way leaves data for neither side, so the design basis for the next exam disappears. Since the first mock exam’s goal is not passing but securing data on "which strategy fits me," a failure that kept one strategy to the end is worth more than a success that swung between two.

Answer 3. From the evidence perspective, a shell is guaranteed only at the moment it’s obtained — session drops and machine resets come without warning, so "capture later" carries a probability of never being captured. From the fatigue perspective, the dawn brain can’t be trusted even with memories of what it just did, to the point of "believing I captured it." So the order is reversed — right after the shell, not celebration but evidence first. Only after the evidence is captured are those points secured.

Answer 4. That the most time went to an unfinished machine means the time-cap rule didn’t exist or wasn’t kept — the most resources were tied up on a machine where invested time doesn’t convert to points. The fix direction is ① state the cap as a clock time ("switch at 03:00," not "3 hours"), ② rely on an external device (like the status warning) for the switch at cap, ③ redefine a blocked machine not as "abandoned" but as "deferred to a later slot," lowering the psychological resistance.

Completion Criteria Checklist

[ ] I composed a set of an AD set + 3–4 standalones from unsolved machines
[ ] I wrote a real-clock operational plan (including sleep, meals, mid-exam reviews, closing block)
[ ] I fixed and recorded the machine-priority strategy before starting
[ ] I finished the 24 hours and the lap log remains continuous
[ ] I collected the 4 kinds of evidence in real time for every scored machine
[ ] I analyzed per-machine time and cap overruns with the closing report
[ ] I completed the report first draft inside the exam time
[ ] I recorded the gap between my score and the passing bar (70 assumed)

6. Common Pitfalls & Fixes

Wall 1. I took a lap and got "run python lap_timer.py start first"

Symptom: you forgot to start the exam and recorded a lap first.

Cause: running lap without lap_log.json existing is rejected by the tool — by design, working as intended.

Fix: run python lap_timer.py start first. If you include "start the timer" in the plan’s first line (the 00:00 block), you won’t forget. If you’ve proceeded without starting, press start even now, and for the missed stretch, take laps marked "estimated" in the memo — an estimate beats nothing.

Wall 2. I took a lap on top of the demo log and got a TypeError

Symptom:

TypeError: unsupported operand type(s) for -: 'float' and 'str'

Cause: a log made by demo is based on virtual time (strings), so mixed with real-time lap entries, time computation breaks.

Fix: don’t mix practice (demo) and the real run in the same file. Before the real start, delete lap_log.json or rename it as a backup, then start fresh with start. Separating exam logs from practice logs helps as-is at the report-organizing stage too.

Wall 3. Around 12 hours my focus collapses and I can’t make any decision

Symptom: you’ve been staring at the same screen for 30 minutes. You want more caffeine.

Cause: a normal physiological phenomenon — judgment is a finite resource, and it’s dry at 12 hours.

Fix: run the plan instead of caffeine — a 5-minute walk, a cold-water face wash, and the reserved sleep block. And don’t make judgment-requiring decisions (strategy changes, machine switches) in this time zone. The actions allowed in the fatigued hours are only executing what’s written in the plan. This is why 2-3 said "every consumption is reserved."

Wall 4. I didn’t take screenshots of the machine I solved at dawn

Symptom: you definitely got a shell but there’s no evidence, and the machine has already been reset.

Cause: a fatigued brain’s "I’ll remember it" doesn’t get stored — exactly as covered in 2-4.

Fix: reverse the rule’s order — shell obtained → immediately capture whoami and IP → then celebrate. Add a "4 kinds of evidence confirmed" item to the lap log and check it on each machine’s final lap. For a machine already missed, if the session is alive, reconnect now and capture; if it’s dropped, leave the attack path memo in detail at least, preserving the possibility of partial credit.

Wall 5. I can’t leave a blocked machine — "just a bit more" became 3 hours

Symptom: you knew the cap and still passed it.

Cause: the sunk-cost illusion — the feeling of "after coming this far" inflates the invested value. Time already spent doesn’t come back.

Fix: place the cap warning in two places — the tool (status) and a physical timer; a warning inside the screen goes unseen when you’re absorbed in the screen. And call switching not "giving up" but "deferring the slot" — since the plan’s 19:00 block has "re-attack unsolved machines," deferring is part of the plan, not a defeat.

7. Summary

Today’s Concepts

Concept	One-line explanation
24-hour operational design	Reserving every consumption (sleep, meals, reviews, closing) before the start
Per-machine time cap	The device that moves switching decisions from emotion to rule — 3 hours in the example
Mid-exam review	At 12 hours / 4 hours before the end — the only points where strategy changes are allowed
Real-time evidence collection	The 4 kinds right after a shell — "capture later" is another name for "never captured"
Scoreless time	Time tied up on unfinished machines — the closing report’s #1 check item
Finish and measure	The first mock exam’s goal is not passing but securing operational data

Today’s Commands

Command	What it does
`python lap_timer.py plan`	Print the 24-hour operational plan
`python lap_timer.py start`	Start the timer — initialize the lap log
`python lap_timer.py lap "machine" "state" "memo"`	Record a lap at every switch/state change
`python lap_timer.py status`	Check elapsed time, per-machine accumulation, cap warnings
`python lap_timer.py report`	Post-end time-usage analysis
`python lap_timer.py demo`	Practice reading the report with a virtual session

The Core Instinct

The 24-hour exam’s enemy is not the machines but unplanned time. Even if you didn’t crack today’s set, if the plan was kept and the coordinates of the collapse remain in the lap log, the mock exam is a success — skill can be raised through failure analysis and remediation, but without operational data, you don’t even know what to remediate.

And one more thing — finishing the first 24 hours is itself training. Most people have never taken a 24-hour exam in their lives. You now know what those hours look like and what happens to your brain at the 14-hour mark. That knowledge will halve the panic on the real day.

Once every box is checked, Step 309 is complete.