OSEP DeHospital Walkthrough Part 4: Domain Admin and Exam Reporting

You have bypassed the EDR, escalated through Active Directory, and pivoted across the SQL databases. The final stage of the DeHospital environment is capturing Domain Admin and extracting the ultimate PEN-300 flags. However, your technical execution is only half the battle.

The Final Domain Push

Securing Domain Admin in the DeHospital network often relies on abusing advanced delegation or executing a DCSync attack from a highly privileged pivot point. Once you have the NTDS.dit hashes, your technical engagement concludes, but the critical reporting phase begins.

• Mandatory Screenshots: You must prove your attack chain. Ensure you have clear screenshots of your custom code bypassing the initial AV, the exact SQL queries used to pivot, and the ipconfig output for every compromised host.
• Code Documentation: The OSEP requires you to explain how your custom C# tools bypassed the simulated defenses. You cannot simply paste code; you must document the API hashing and injection techniques.