System Hacking

System hacking is the phase in ethical hacking where you move from the network perimeter to the target computer itself. It is what happens after you have already discovered a target (reconnaissance) and identified a weakness (scanning and enumeration). Now you are actively trying to break in.

The first major technique is password cracking. A password is a string of characters used to verify a user's identity. Attackers do not need to guess the password from nothing—they often use lists of common passwords or leaked databases. Password cracking tools, like John the Ripper or Hashcat, work by taking a list of candidate passwords, turning each one into a hash (a fixed-length string output from a mathematical function), and comparing that hash to the stolen hash from the target system. If they match, you have found the password. This is called an offline attack because you are not trying to log in repeatedly; you are just comparing hashes on your own machine. The most common types are dictionary attacks (using a wordlist) and brute-force attacks (trying every possible combination). Salting is a defence where a unique random value is added to each password before hashing, which makes pre-computed hash lists (rainbow tables) useless.

The second technique is privilege escalation. Once you have a normal user account (like a standard employee login), you need to gain higher privileges—typically Administrator or SYSTEM level on Windows, or root on Linux. This is because many critical files and system settings are only accessible to high-privilege accounts. There are two types: vertical escalation (moving from user to admin) and horizontal escalation (accessing another user's account at the same privilege level). Attackers do this by exploiting bugs in the operating system or installed software—for example, a buffer overflow vulnerability that lets them run code with elevated rights. Another common method is token impersonation, where an attacker steals an access token (a temporary pass) from a higher-privilege process. On Windows, tools like Mimikatz can extract plaintext passwords or hash values from memory, and if the system has weak service permissions, you can use that to run commands as SYSTEM.

The third technique is executing applications. After you have gained access and escalated privileges, you need to do something useful—like install a backdoor, a keylogger, or a remote access tool (RAT). A backdoor is a piece of software that gives you a secret way back into the system, bypassing normal authentication. A keylogger records every keystroke the user types, capturing passwords and sensitive data. A RAT lets you control the computer remotely. Attackers often use a technique called DLL injection to hide malicious code inside a legitimate running process, making it harder for antivirus software to detect. Another method is to modify the Windows registry to run your malicious program every time the system starts, which is called maintaining persistence.

The entire system hacking process follows a methodology: gaining access, escalating privileges, maintaining access, and clearing logs. Clearing logs is the final step—attackers delete or alter event logs to cover their tracks. For the CEH exam, you must know the tools for each phase: password cracking (John the Ripper, Hashcat, Cain & Abel), privilege escalation (Mimikatz, Windows Exploit Suggester), and executing applications (Netcat, Metasploit, RATs). You also need to understand how defences work: strong password policies, account lockout mechanisms, least privilege principle, and application whitelisting.

An IT security professional, let us call her Priya, works for a mid-sized financial services company. One morning, she receives an alert from the company's intrusion detection system (IDS) about unusual outbound traffic from an employee's workstation. That employee works in finance and handles sensitive client data. Priya's job is to investigate whether this is a real attack or a false alarm.

First, Priya isolates the workstation from the network to prevent any further data exfiltration. She then takes a forensic image of the hard drive so she can analyse it without altering evidence. Using a tool like FTK Imager, she creates a bit-for-bit copy. Next, she runs a password-cracking analysis. She finds a suspicious process running in memory. She uses Mimikatz to dump the hashes of all local accounts. One hash matches the administrator account, even though the employee does not have admin rights. This suggests the attacker already performed privilege escalation. She then checks the Windows Event Logs for logon events and finds hundreds of failed logon attempts followed by a successful one—this looks like a dictionary attack against the employee's password.

Priya now reconstructs the attack timeline. She uses John the Ripper to crack the employee's password from the captured hash, and it turns out to be 'Spring2024!'—a common password based on a seasonal pattern. The attacker used that low-privilege account, then exploited a known vulnerability in an outdated version of a PDF reader installed on the workstation. That exploit gave the attacker SYSTEM-level privileges. Once SYSTEM, the attacker used a RAT to exfiltrate client contact lists in small chunks over several days to avoid detection. Priya finds the RAT's executable hidden inside a legitimate Windows system folder under a misleading name like 'svchost.exe.backup'.

Priya's response includes: resetting the compromised password, applying the latest security patches to all workstations, disabling the old PDF reader version company-wide, implementing account lockout after 5 failed attempts, and deploying endpoint detection and response (EDR) software to catch similar RAT installations in real time. She also writes a report for management detailing the attack path and recommends mandatory security awareness training to discourage weak passwords like 'Spring2024!'.