System Hacking and Privilege Escalation
This domain covers gaining and expanding control of a host: credential attacks, local privilege escalation, and the discipline needed to prove impact without damaging the system. The exam focuses on misconfigurations and careful validation more than on one-click exploits.
Core rules and concepts
- Credential attacks include password spraying, credential stuffing, hash cracking, and relaying. Spraying avoids lockouts by trying a few common passwords across many accounts; stuffing reuses breached pairs.
- On Windows, check service permissions, unquoted service paths, scheduled tasks, token privileges, AlwaysInstallElevated, and missing patches. Local admin is not SYSTEM.
- On Linux, check SUID/SGID binaries, sudo rights, cron jobs, writable service files, capabilities, and kernel version. Confirm the exploit path before running a kernel exploit.
- Privilege escalation should be minimal and reversible. Record commands, collect only necessary proof, and avoid changing production data.
Worked example
A low-privileged shell finds a SUID binary. You check GTFOBins-style behavior and see it can read arbitrary files. Rather than exploiting a kernel bug, you use the binary to read /etc/shadow only far enough to confirm access, then stop. The reasoning: a stable misconfiguration gives credible proof with less risk. You document the binary path, permissions, command, and output hash, then recommend removing the SUID bit.
Traps
Blindly running public exploits can crash hosts or leave unstable artifacts. Password spraying can lock accounts if thresholds are ignored. Do not confuse a local administrator with domain administrator or SYSTEM. Avoid cleaning up by deleting logs; that destroys evidence and may violate the engagement.