CYS405 · Chapter 6 · Annotated SlidesSystem Hacking
Original
Overview

System Hacking

Windows authentication (SAM, NTLM, Kerberos), the CEH system-hacking goals, password cracking (non-electronic, active online, passive online, offline rainbow-table attacks, defaults), defenses, privilege escalation, executing applications and keyloggers, and covering tracks.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 42 slides
  1. 1 Slide 1
  2. 2 Information at Hand Before System Hacking Stage
  3. 3 Gaining Access
  4. 4 § It is not possible to copy the SAM file to another location in the case of online
  5. 5 v NTLM Authentication
  6. 6 v Kerberos Authentication
  7. 7 How Hash Passwords Are Stored in Windows SAM?
  8. 8 Slide 8
  9. 9 System Hacking: Goals
  10. 10 Gaining Access : CEH Hacking Methodology (CHM)
  11. 11 Slide 11
  12. 12 Password Cracking
  13. 13 Password Complexity
  14. 14 Password Cracking Techniques
  15. 15 Types of Password Cracking
  16. 16 1- Non-Electronic attack
  17. 17 2- Active Online Attacks
  18. 18 2.1 Active Online Attack: Dictionary and Brute Forcing Attack
  19. 19 Slide 19
  20. 20 Methods to improve the success of a dictionary attack:
  21. 21 2.2 Active Online Attack: Trojan/Spyware/Keylogger
  22. 22 2.3 Active Online Attack: Hash Injection Attack
  23. 23 3- Passive Online Attacks
  24. 24 3.1 Passive Online Attack: Wire Sniffing
  25. 25 3.2 Passive Online Attack: Man-in-the -Middle and Replay Attack
  26. 26 4- Offline Attack: Rainbow Attacks
  27. 27 4- Offline Attack: Rainbow Attacks
  28. 28 5- Default Password
  29. 29 The following are some of the online tools to search default passwords:
  30. 30 Using Password Cracking: Targets
  31. 31 How to Defend against Password Cracking
  32. 32 Privilege Escalation
  33. 33 Types of Privilege Escalation :
  34. 34 Privilege Escalation Tools
  35. 35 Maintaining Access
  36. 36 Executing Applications
  37. 37 The malicious programs attackers execute on target systems can be:
  38. 38 Slide 38
  39. 39 Covering Tracks
  40. 40 Some techniques used for Covering Tracks:
  41. 41 Defending against Covering Tracks
  42. 42 ▪ Regularly update and patch OSes, applications, and firmware.
Slide 1 / 42

Slide 1

Slide 1: Slide 1
Slide 2 / 42

Information at Hand Before System Hacking Stage

Slide 2: Information at Hand Before System Hacking Stage
Slide 3 / 42

Gaining Access

Slide 3: Gaining Access
Slide 4 / 42

§ It is not possible to copy the SAM file to another location in the case of online

Slide 4: § It is not possible to copy the SAM file to another location in the case of online
Slide 5 / 42

v NTLM Authentication

Slide 5: v NTLM Authentication

Notes

  1. NTLM: challenge–response with the password hash. Kerberos (default in domains): tickets from a KDC.

Slide 6 / 42

v Kerberos Authentication

Slide 6: v Kerberos Authentication
Slide 7 / 42

How Hash Passwords Are Stored in Windows SAM?

Slide 7: How Hash Passwords Are Stored in Windows SAM?

Notes

  1. Windows stores password hashes (LM/NTLM) in the SAM file (C:\Windows\System32\config\SAM), locked while Windows runs.

Slide 8 / 42

Slide 8

Slide 8: Slide 8
Slide 9 / 42

System Hacking: Goals

Slide 9: System Hacking: Goals

Notes

  1. Goals: gain access, escalate privileges, execute applications, hide files, cover tracks.

Slide 10 / 42

Gaining Access : CEH Hacking Methodology (CHM)

Slide 10: Gaining Access : CEH Hacking Methodology (CHM)
Slide 11 / 42

Slide 11

Slide 11: Slide 11
Slide 12 / 42

Password Cracking

Slide 12: Password Cracking
Slide 13 / 42

Password Complexity

Slide 13: Password Complexity
Slide 14 / 42

Password Cracking Techniques

Slide 14: Password Cracking Techniques
Slide 15 / 42

Types of Password Cracking

Slide 15: Types of Password Cracking

Notes

  1. Password attacks: non-electronic (shoulder surfing, social engineering, dumpster diving), active online, passive online, offline.

Slide 16 / 42

1- Non-Electronic attack

Slide 16: 1- Non-Electronic attack
Slide 17 / 42

2- Active Online Attacks

Slide 17: 2- Active Online Attacks
Slide 18 / 42

2.1 Active Online Attack: Dictionary and Brute Forcing Attack

Slide 18: 2.1 Active Online Attack: Dictionary and Brute Forcing Attack

Notes

  1. Dictionary attack: try words from a list. Brute force: every combination. Hybrid: words + numbers/symbols.

Exam angle

PredictionQ1

Trying every possible combination of characters is a:

Slide 19 / 42

Slide 19

Slide 19: Slide 19
Slide 20 / 42

Methods to improve the success of a dictionary attack:

Slide 20: Methods to improve the success of a dictionary attack:
Slide 21 / 42

2.2 Active Online Attack: Trojan/Spyware/Keylogger

Slide 21: 2.2 Active Online Attack: Trojan/Spyware/Keylogger
Slide 22 / 42

2.3 Active Online Attack: Hash Injection Attack

Slide 22: 2.3 Active Online Attack: Hash Injection Attack
Slide 23 / 42

3- Passive Online Attacks

Slide 23: 3- Passive Online Attacks
Slide 24 / 42

3.1 Passive Online Attack: Wire Sniffing

Slide 24: 3.1 Passive Online Attack: Wire Sniffing
Slide 25 / 42

3.2 Passive Online Attack: Man-in-the -Middle and Replay Attack

Slide 25: 3.2 Passive Online Attack: Man-in-the -Middle and Replay Attack
Slide 26 / 42

4- Offline Attack: Rainbow Attacks

Slide 26: 4- Offline Attack: Rainbow Attacks

Notes

  1. Rainbow tables: precomputed hash → password tables; fast lookups. Defeated by salting.

  2. Memory trick Salt = a random value added before hashing, so the same password hashes differently and precomputed tables fail.

Exam angle

PredictionQ1

The best defense against rainbow-table attacks is:

Slide 27 / 42

4- Offline Attack: Rainbow Attacks

Slide 27: 4- Offline Attack: Rainbow Attacks
Slide 28 / 42

5- Default Password

Slide 28: 5- Default Password
Slide 29 / 42

The following are some of the online tools to search default passwords:

Slide 29: The following are some of the online tools to search default passwords:
Slide 30 / 42

Using Password Cracking: Targets

Slide 30: Using Password Cracking: Targets
Slide 31 / 42

How to Defend against Password Cracking

Slide 31: How to Defend against Password Cracking

Notes

  1. Defenses: long complex passwords, lockout policies, MFA, salted hashes, no defaults, monitoring.

Slide 32 / 42

Privilege Escalation

Slide 32: Privilege Escalation

Notes

  1. Privilege escalation: vertical (user → admin) or horizontal (access another user’s resources at the same level).

Exam angle

PredictionQ1

A normal user gaining administrator rights is:

Slide 33 / 42

Types of Privilege Escalation :

Slide 33: Types of Privilege Escalation :
Slide 34 / 42

Privilege Escalation Tools

Slide 34: Privilege Escalation Tools
Slide 35 / 42

Maintaining Access

Slide 35: Maintaining Access
Slide 36 / 42

Executing Applications

Slide 36: Executing Applications
Slide 37 / 42

The malicious programs attackers execute on target systems can be:

Slide 37: The malicious programs attackers execute on target systems can be:

Notes

  1. Keyloggers (hardware or software) record keystrokes; spyware hides and reports activity.

Slide 38 / 42

Slide 38

Slide 38: Slide 38
Slide 39 / 42

Covering Tracks

Slide 39: Covering Tracks

Notes

  1. Covering tracks: clear or edit logs (auditpol, clearing event logs), hide files (ADS, steganography), rootkits.

Slide 40 / 42

Some techniques used for Covering Tracks:

Slide 40: Some techniques used for Covering Tracks:
Slide 41 / 42

Defending against Covering Tracks

Slide 41: Defending against Covering Tracks
Slide 42 / 42

▪ Regularly update and patch OSes, applications, and firmware.

Slide 42: ▪ Regularly update and patch OSes, applications, and firmware.