System Hacking
The four stages
System hacking follows gaining access → escalating privileges → maintaining access → covering tracks. Gaining access uses password attacks, exploit delivery, or credential reuse. Privilege escalation is vertical (low user to administrator/root) or horizontal (same level, different user); common vectors are kernel exploits, missing patches, SUID/SGID binaries on Linux, unquoted service paths and weak service permissions on Windows, DLL hijacking, and stored credentials. Maintaining access means backdoors, reverse shells, scheduled tasks, and rootkits. Covering tracks means log clearing (wevtutil cl, auditpol, clearing /var/log), timestomping, and disabling auditing.
Password attacks
Know the families: dictionary, rule-based/mangling, brute force, mask, hybrid, rainbow table, and credential stuffing. Distinguish LM (disabled-by-default legacy, split into 7-character halves) from NTLM hashes; note that /etc/shadow on Linux stores salted hashes (yescrypt/SHA-512), so rainbow tables fail on salted hashes. Pass-the-hash reuses an NTLM hash without cracking it. Kerberos attacks include Kerberoasting (request service tickets and crack them offline) and AS-REP roasting (accounts without pre-authentication).
Shells and persistence
A bind shell listens on the target and the attacker connects in; a reverse shell has the target connect back out, which traverses NAT and egress firewalls - usually preferred. Tools: Metasploit/Meterpreter (with migrate to move into a stable process), Netcat, John the Ripper, Hashcat, Mimikatz, keyloggers, and steganography for data hiding.
Worked example
You dump NTLM hashes from a compromised host and need domain admin. Rather than cracking an expensive 14-character password, try pass-the-hash with a tool like Impacket or Mimikatz - the hash itself authenticates under NTLM. Rule of thumb: hashes are bearer tokens, so protecting them equals protecting the password.