The Four Stages of System Hacking
Before hacking a system, an attacker uses footprinting, scanning, and enumeration to detect the target area and the vulnerabilities that act as doorways in. Once the attacker has the information needed, the actual "system hacking" begins - and it follows a consistent methodology, whether it's a criminal or an ethical hacker running the same playbook to test defenses.
Mnemonic - The 4 Stages: "Grandma Escalates Maintenance Coverage"
Grandma Escalates Maintenance Coverage = Gain access → Escalate privileges → Maintain access → Cover tracks. Once you're "in," you always want more power, then you want to stay, then you want to disappear.
Before You Can Crack It, Know How It's Stored
System hacking on Windows starts with understanding how the OS stores and verifies credentials. Three mechanisms matter here.
SAM Database
Windows uses the Security Accounts Manager (SAM) database (or Active Directory) to manage accounts and passwords, storing them as one-way hashes - never in plaintext. It's implemented as a registry file, and the Windows kernel keeps an exclusive filesystem lock on it while running.
NTLM Authentication
The default challenge/response authentication scheme. Consists of two protocols - the NTLM authentication protocol and the older LAN Manager (LM) protocol - which use different hashing methods to store passwords in the SAM database.
Kerberos Authentication
A network authentication protocol offering strong, mutual authentication via secret-key cryptography - both client and server verify each other. Protects against replay attacks and eavesdropping. Microsoft moved to Kerberos as its default because it's stronger than NTLM.
The SAM file is stored at %SystemRoot%/system32/config/SAM and Windows mounts it in the registry under HKLM/SAM. It stores LM or NTLM hashed passwords. Because the OS locks this file with an exclusive filesystem lock, you can't simply copy it while Windows is running - the lock only releases on a blue screen or shutdown. Attackers get around this using specialized dumping techniques to grab the hashes for offline cracking.
Why Hashing Matters Here
Storing a one-way hash means the system never needs to store the actual password - it just compares hash-to-hash at login. But once an attacker gets the hash file offline, they can brute-force or rainbow-table attack it without Windows' lock getting in the way.
Mnemonic - Windows Auth Trio: "SNK" (Sam, NTLM, Kerberos)
S-N-K: SAM stores the hashes → NTLM is the older challenge/response way of checking them → Kerberos is the newer, stronger, mutual-auth replacement. Progression from "storage" to "old auth" to "new auth."
Password Cracking Techniques
Password cracking is the classic way to gain privileges on a system - continually trying guesses until one works. The slides give five categories of password cracking technique.
1. Non-Electronic Attacks
Also called non-technical attacks - no technical skill required. Three types: shoulder surfing, social engineering, and dumpster diving.
2. Active Online Attacks
Attacker directly communicates with the victim machine while cracking. Includes: 2.1 Dictionary & Brute-Force, 2.2 Trojan/Spyware/Keyloggers, 2.3 Hash Injection and Phishing.
3. Passive Online Attacks
Attacker cracks passwords without directly communicating with the authorizing party. Includes: Wire Sniffing, Man-in-the-Middle, and Replay attacks.
4. Offline Attacks (Rainbow Attacks)
The attacker already has the stored password data (e.g. a hash dump) and checks it offline. Time-consuming but a high success rate since hashes can be reversed thanks to their small keyspace/short length.
5. Default Password Attacks
Manufacturers ship devices (switches, hubs, routers) with default passwords meant to be changed at setup. Admins often forget to change them. Attackers find the default password from manufacturer sites or online lookup tools, then fold it into their dictionary/guessing attacks. Example sites named in the slides: open-sez.me, fortypoundhead.com, cirt.net, defaultpassword.us, routerpasswords.com, default-password.info, 192-168-1-1ip.mobi.
Mnemonic - 5 Password Cracking Types: "No Actor Plays Offline Defaults"
No Actor Plays Offline Defaults = Non-electronic → Active online → Passive online → Offline → Default password. Same order the slides present them in.
2.1 Dictionary and Brute-Force Attack (Deep Dive)
A dictionary file is loaded into a cracking application and run against user accounts - the program tries every word in the dictionary. Attacker dictionaries also mix in numbers/symbols (e.g. "3December!962") and common keyboard patterns (e.g. "qwer0987"). Dictionary attacks are more efficient than raw brute-force, but don't work against long passphrases.
Two use cases the slides call out: (1) in cryptanalysis, to find the decryption key from a ciphertext; (2) in computer security, to bypass authentication by guessing passwords.
Use multiple dictionaries (technical/foreign languages) to widen coverage, and apply string manipulation on dictionary words - e.g. turning "system" into an anagram like "metsys" - to catch passwords that are dictionary words in disguise.
Requires direct communication with the victim machine. Faster, but noisier and easier to detect/lock out.
No direct communication with the authorizing party - e.g. sniffing traffic. Quieter and stealthier, but slower to gather enough data.
Password Cracking Targets
From "In" to "In Charge"
Escalating privileges is the second stage of system hacking. The attacker uses the password obtained in stage 1 to get into the target system, then tries to attain higher-level privileges. Privilege escalation attacks take advantage of design flaws, programming errors, bugs, and configuration oversights in the OS/applications. These elevated privileges let attackers view sensitive info, delete files, or install malware (viruses, Trojans, worms).
Gaining higher privileges than the attacker currently has - e.g. going from a normal user account to Administrator/root.
An unauthorized user accesses resources/functions/privileges belonging to another user at the same privilege level. Example from the slides: online banking user A accessing user B's account.
Mnemonic - Vertical vs Horizontal
Vertical = "climb UP the ladder" (more privilege than before). Horizontal = "sneak SIDEWAYS into your neighbor's house" (same privilege level, different person's stuff).
Privilege Escalation Tools
Staying In the House
After gaining access and escalating privileges, attackers work to maintain that access for further exploitation - or to turn the compromised system into a launchpad for attacking other systems on the network. They remotely execute malicious applications such as keyloggers and spyware to hold onto access and steal usernames/passwords, hiding their tools using rootkits, steganography, and NTFS data streams.
Executing Applications ("Owning" the System)
Once attackers have higher privileges, they may execute a malicious application by exploiting a vulnerability to run arbitrary code. This lets them steal information, gain unauthorized resource access, crack passwords, capture screenshots, and install a backdoor. This whole act of executing malicious applications on an owned system is called "owning" the system.
Backdoors
Programs designed to deny/disrupt operations, gather information leading to exploitation/privacy loss, or grant unauthorized access to system resources.
Crackers
Software components designed specifically for cracking codes or passwords.
Keyloggers
Hardware or software that records every keystroke made on the keyboard.
Spyware
Captures screenshots and sends them to a location the attacker defines; often used alongside backdoors for future easy access.
Mnemonic - Malicious Programs at This Stage: "BCKS"
B-C-K-S = Backdoors (deny/disrupt/access), Crackers (crack codes/passwords), Keyloggers (record keystrokes), Spyware (capture screenshots). "Backs" as in - these are the tools that keep the attacker's access "backed up."
Erasing the Footprints
Covering tracks is the attacker's attempt to hide and avoid being detected or "traced out" by removing all logs/traces generated while accessing the target system. Erasing evidence starts with wiping contaminated logs and error messages, and can involve tricking the admin into believing no intrusion has occurred by manipulating event logs.
Techniques Used for Covering Tracks
Mnemonic - Covering Tracks: "DDC" (Disable, Data-hide, Clear)
D-D-C = Disable auditing (turn off the camera), Data hide (hide the evidence), Clear logs (burn the paper trail). Three ways to make it look like nobody was ever there.
Defending Against Covering Tracks
Activate Logging Everywhere
Turn on logging functionality on all critical systems, and audit periodically to confirm logging matches the security policy.
Protect Log Storage
Ensure new events don't overwrite old entries when storage limits are hit; configure minimal necessary permissions to read/write log files.
Centralize Logs
Maintain a separate logging server in the DMZ so critical servers (DNS, mail, web) forward and store logs there, away from the attacker's reach.
Patch and Harden
Regularly update/patch OSes, applications, and firmware; close all unused open ports and services.
Protect the Logs Themselves
Encrypt log files so they can't be altered without the decryption key; set logs to "append only" mode; periodically back up logs to unalterable media; use restricted ACLs to secure log files.
Exam Tips & Tricks
Remember the 4 Stages in Order
Gain Access → Escalate Privileges → Maintain Access → Cover Tracks. Every question about "system hacking phases" maps to this order.
SAM File Location
%SystemRoot%/system32/config/SAM, mounted at HKLM/SAM in the registry.
SAM Lock Only Releases On Crash/Shutdown
You can't copy the SAM file live - the exclusive lock only releases on a blue screen or OS shutdown.
Kerberos > NTLM
Kerberos offers mutual authentication and protects against replay/eavesdropping - it's the stronger, newer default over NTLM.
5 Password Cracking Types
Non-electronic, Active online, Passive online, Offline, Default password. "No Actor Plays Offline Defaults."
Vertical vs Horizontal Escalation
Vertical = more privileges than before. Horizontal = same-level access to someone else's resources.
"Owning" the System
The term for executing malicious applications after gaining administrative privileges.
3 Ways to Cover Tracks
Disable auditing, hide data, clear logs - each defeated by a matching countermeasure (enable logging, protect files, secure/centralize logs).
Quick Reference - Everything at a Glance
| Topic | Key Point |
|---|---|
| SAM Database | Stores Windows passwords as one-way hashes; located at %SystemRoot%/system32/config/SAM, mounted at HKLM/SAM |
| SAM File Lock | Windows kernel keeps an exclusive filesystem lock; releases only on blue screen or shutdown |
| NTLM Authentication | Default challenge/response scheme; includes NTLM protocol + older LM protocol |
| Kerberos Authentication | Mutual auth via secret-key cryptography; protects against replay/eavesdropping; Microsoft's stronger default |
| 4 Stages of System Hacking | Gain Access → Escalate Privileges → Maintain Access → Cover Tracks |
| Password Cracking | Continually guessing password combinations until correct; classic access technique |
| Non-Electronic Attack | No technical skill: shoulder surfing, social engineering, dumpster diving |
| Active Online Attack | Direct communication with victim: dictionary/brute-force, Trojans/keyloggers, hash injection/phishing |
| Passive Online Attack | No direct communication: wire sniffing, MITM, replay attacks |
| Offline Attack (Rainbow) | Cracks stored hashes offline; slow but high success rate |
| Default Password Attack | Uses unchanged manufacturer defaults found online or via lookup tools |
| Dictionary Attack | Tries every word in a wordlist, often with symbols/numbers/anagrams added |
| Password Targets | Administrator account, lower-level accounts, guest account |
| Privilege Escalation | 2nd stage; exploits design flaws/bugs/misconfig to gain higher access |
| Vertical Escalation | Gaining higher privileges than currently held |
| Horizontal Escalation | Accessing another same-level user's resources (e.g. user A → user B's bank account) |
| Privilege Escalation Tools | Active@ Password Changer, Trinity Rescue Kit, ERD Commander, Recovery Console |
| Maintaining Access | 3rd stage; keeps foothold via keyloggers/spyware; hides tools with rootkits/steganography/ADS |
| "Owning" the System | Term for executing malicious applications after gaining admin privileges |
| Backdoors | Deny/disrupt operations or grant unauthorized resource access |
| Crackers | Software designed to crack codes/passwords |
| Keyloggers | Hardware/software recording every keystroke |
| Spyware | Captures screenshots, sends to attacker-defined location |
| Covering Tracks | 4th stage; hides/erases evidence of the attacker's activity |
| Disabling Auditing | Removes system owner's ability to detect what happened |
| Data Hiding | Hides files via attributes or Alternate Data Streams (ADS) |
| Clearing Logs | Deletes log entries tied to the attacker's activity |
| Defending Against Track-Covering | Enable logging everywhere, protect/centralize logs, patch systems, encrypt/backup logs, restrict ACLs |