Here is Part 1: Gaining Access and Escalating Privileges.
We will cover how to break
in (Passwords & Exploits) and how to become the boss (Privilege Escalation).
--------------------------------------------------------------------------------
1. The Goal: What is System Hacking?
Explain it Like I’m Five: You have already scoped out the house (Footprinting) and
checked the locks (Scanning). Now, System Hacking is the moment you actually kick
the door open, go inside, steal the cookies, and clean up your muddy footprints so no
one knows you were there.
Formal Explanation: System hacking is the activity where the attacker acquires
information through footprinting, scanning, and enumeration to hack the target system.
It involves gaining access, escalating privileges, executing applications, hiding files,
and covering tracks.
--------------------------------------------------------------------------------
2. Cracking Passwords (The Keys to the Castle)
To get in, you usually need a password. Windows systems are tricky because they don't
store your password as plain text (like "1234"). They store it as a Hash.
Explain it Like I’m Five: Imagine you have a document shredder. You write "1234" on a
paper and put it through the shredder. It comes out as a pile of confetti. Windows
stores the confetti (the Hash), not the paper. When you log in, you type "1234",
Windows shreds it, and compares the new confetti to the old confetti. If they match,
you get in. Hackers try to steal the confetti and reconstruct the paper.
Formal Explanation: Windows stores user passwords in the Security Accounts
Manager (SAM) database or Active Directory. Passwords are never stored in clear text;
they are hashed (using LM or NTLM algorithms).
Types of Password Attacks
1. Non-Electronic Attacks:
◦ ELI5: You don't use a computer. You look through their trash (Dumpster Diving) or
look over their shoulder while they type (Shoulder Surfing).
◦ Formal: Attacks that do not require technical knowledge, relying instead on social
engineering, shoulder surfing, or dumpster diving.
2. Active Online Attacks:
◦ ELI5: You are at the door trying keys.
▪ Dictionary Attack: You try every word in a dictionary.
▪ Brute-Force: You try "aaaa", "aaab", "aaac"... until it opens.
▪ Password Spraying: Instead of trying 1,000 passwords on one person (which
locks the account), you try one common password (like "Password123") on 1,000
different people.
◦ Formal: The attacker communicates directly with the victim's machine. Techniques
include password guessing, dictionary attacks, brute-forcing, and password spraying
(targeting multiple accounts with a few passwords to avoid lockout).
3. Passive Online Attacks:
◦ ELI5: You hide in the bushes and listen to people shouting their passwords. This
includes Wire Sniffing (listening to the network) or Man-in-the-Middle attacks.
◦ Formal: The attacker passively monitors or records data passing over the
communication channel (sniffing) without modifying the system, using the captured
data to break in.
4. Offline Attacks (Rainbow Tables):
◦ ELI5: You steal the "confetti" (hashes) and take it home. You use a giant cheat sheet
called a Rainbow Table. This table lists millions of passwords and what their "confetti"
looks like. You just look for a match.
◦ Formal: Attackers copy the target's password file and try to crack it on their own
system. They often use Rainbow Tables, which are precomputed tables containing
word lists and their corresponding hash values to recover passwords quickly.
--------------------------------------------------------------------------------
3. Vulnerability Exploitation: Buffer Overflows
If you can't guess the password, you break the software itself.
Explain it Like I’m Five: Imagine a glass that can hold exactly 10 ounces of water. This
glass is the "Buffer." The computer expects you to pour 10 ounces. A Buffer Overflow is
when the hacker pours 20 ounces into the glass. The water spills over the sides and
ruins the papers sitting on the table. In a computer, that "spilled water" overwrites the
computer's instructions. The hacker can make the "spill" contain new instructions that
say, "Make me the Administrator."
Formal Explanation: A buffer is a memory area allocated to handle data. A buffer
overflow occurs when an application writes more data to the buffer than it is allocated
to hold, overwriting neighboring memory locations. Attackers exploit this to inject
malicious code, damage files, or escalate privileges.
--------------------------------------------------------------------------------
4. Privilege Escalation (Getting a Promotion)
You broke in! But you are logged in as "Guest." You can't do anything fun. You need to
become "Admin."
Vertical vs. Horizontal Escalation
• Horizontal: You break into your coworker's account. You have the same level of
power, just different data.
• Vertical: You are a regular user, and you hack your way up to become the
Administrator.
Technique: DLL Hijacking
Explain it Like I’m Five: When a program starts, it yells, "I need my helper library (DLL)!"
It looks in the hallway (current folder) first, then the library (system folder). The hacker
puts a fake helper in the hallway with the same name. The program grabs the fake
helper and says, "Do this work." The fake helper executes the hacker's evil commands.
Formal Explanation: Most Windows applications search the directory from which they
loaded before searching system directories. If an attacker places a malicious DLL in the
application directory, it will be executed in place of the real DLL, allowing the attacker
to gain remote access or escalate privileges.
Technique: Spectre and Meltdown
Explain it Like I’m Five: These are flaws in the actual computer chip (CPU). Modern
chips try to guess what you will do next to be faster (like a waiter bringing you water
before you ask). Spectre/Meltdown tricks the waiter into bringing secrets (like
passwords) that you weren't supposed to see, simply because the waiter was trying to
be too helpful and fast.
Formal Explanation: Spectre and Meltdown are vulnerabilities in modern processor
chips (AMD, ARM, Intel) caused by performance optimizations like speculative
execution. Attackers exploit these to read adjacent memory locations (kernel memory)
and steal credentials or secret keys.
--------------------------------------------------------------------------------
5. Critical Tools (The Hacker's Toolkit)
Here are the specific "brand names" of tools mentioned in Module 06 that you must
memorize:
• Mimikatz: The ultimate tool for stealing credentials. It can pull passwords right out of
the computer's memory while it's running.
• CrackMapExec: A "Swiss army knife" for hacking networks. It automates password
spraying.
• Responder: A tool that pretends to be a helpful server on the network to steal
passwords from people trying to find files.
• L0phtCrack / Ophcrack: Tools used to crack Windows passwords using Rainbow
tables.
--------------------------------------------------------------------------------