System Hacking Phases and Attack Techniques · Topic 2 of 6
System Hacking, Gaining Access and Password Cracking
Learn the CEH system hacking goals and the password attack classes: online, offline and non-electronic, hashes, rainbow tables, common tools and defenses.
- 5 min
- Goals in order: gain access, escalate privileges, maintain access, clear logs.
- Attack classes: non-electronic, active online, passive online and offline.
- Salting defeats rainbow tables.
What it is
System hacking is the stage where information from footprinting, scanning and enumeration is used to gain control of a system. EC-Council describes it as a set of goals pursued in order.
Gaining access is the first goal, and the most common route is a password. Password cracking is the set of techniques used to recover or bypass a password.
How it works
System hacking goals
| Goal | Purpose |
|---|---|
| Gaining access | Get past authentication to a system |
| Escalating privileges | Move from a normal account to administrator or root |
| Maintaining access | Keep the access for later use |
| Clearing logs | Remove evidence of the activity |
The CEH methodology also describes the stages with more detail: executing applications, hiding files, establishing persistence and covering tracks, which later pages cover.
Password attack classes
| Class | Description | Examples |
|---|---|---|
| Non-electronic | No technical tool is needed | Shoulder surfing, social engineering, dumpster diving |
| Active online | Interacts with the target authentication | Dictionary, brute force, password guessing, password spraying |
| Passive online | Captures credentials as they travel | Sniffing, man in the middle, replay |
| Offline | Works on a stolen password hash or database | Dictionary, brute force, rainbow table |
Dictionary attacks try words from a list. Brute force tries every combination of characters, which is guaranteed to succeed in time but is slow. Hybrid attacks add numbers and symbols to dictionary words. Password spraying tries one or a few common passwords against many accounts, which often avoids lockout. Credential stuffing reuses user name and password pairs leaked from other sites.
Rainbow table attacks use precomputed tables of hash values to look up a password from its hash. Salting, which adds a random value to each password before hashing, defeats ready-made tables.
LLMNR and NBT-NS poisoning answers name resolution requests on a local network to trick a host into sending a hash. Pass-the-hash uses a captured hash directly, without needing the password. The Kerberos tickets can be abused in a similar way.
Where passwords are stored
| System | Storage |
|---|---|
| Windows local accounts | The Security Account Manager (SAM) database |
| Windows domains | The Active Directory database (NTDS.dit) on domain controllers |
| Linux | /etc/passwd for accounts and /etc/shadow for hashes |
| Applications | Databases, configuration files and browser stores |
Windows uses LM and NTLM hashes. LM is an old weak design that splits a password into two seven character halves and ignores case, so it is quick to crack. NTLMv2 is the stronger challenge and response form, and Kerberos (port 88) is the default domain authentication. Modern systems should disable LM.
Password cracking tools
| Tool | Purpose |
|---|---|
| John the Ripper | Offline cracker for many hash formats |
| Hashcat | Fast cracker that uses graphics processors |
| Hydra and Medusa | Online login guessing against network services |
| Ophcrack | Uses rainbow tables for Windows hashes |
| L0phtCrack and Cain and Abel | Older Windows password tools |
| Responder | Captures hashes through name resolution poisoning |
Offline attacks are the more dangerous kind because there is no lockout and no log on the target. Online attacks are limited by lockout policies and rate limiting, and they are more noisy.
Defenses
- Use long passwords or passphrases and block known breached passwords.
- Require multi-factor authentication.
- Lock accounts or add delays after repeated failures, and watch for spraying across many accounts.
- Store passwords with a salt and a slow, purpose-built hashing algorithm.
- Disable LM hashes, restrict NTLM, and prefer Kerberos.
- Protect hash stores and restrict who can read SAM, NTDS.dit and shadow files.
- Do not reuse passwords, and use a password manager.
- Train staff about shoulder surfing and phishing, and use screen privacy.
A worked example
A security analyst sees one failed login each for 500 different accounts, all with the same password, spread over an hour. This is password spraying. The account lockout threshold never triggers because each account fails only once. The best fixes are multi-factor authentication, blocking the weak password and alerting on one source failing against many accounts.
How the exam asks about this
- "Attacker tries one common password against thousands of accounts. What is it?" -> Password spraying.
- "Which attack uses precomputed hash tables?" -> A rainbow table attack, defeated by salting.
- "Which tool performs fast offline hash cracking using GPUs?" -> Hashcat.
What to remember for the exam
- Goals in order: gain access, escalate privileges, maintain access, clear logs.
- Attack classes: non-electronic, active online, passive online and offline.
- Salting defeats rainbow tables.
- Linux stores hashes in /etc/shadow, and Windows in the SAM or NTDS.dit.
- Hydra and Medusa guess logins online, while John the Ripper and Hashcat crack hashes offline.
Brute force is not the same as a dictionary attack. A dictionary uses a list of likely words, while brute force tries all combinations.
Common mistakes
Calling pass-the-hash a cracking attack. It does not recover the password, it reuses the hash.
Thinking lockout stops all password attacks. It does nothing against offline attacks and weakly protects against spraying.
Treating longer as always safer. Length helps only if the password is not predictable or reused.
Check yourself
What is the first goal of system hacking?
Gaining access to the system.
Why does salting help?
It makes each hash unique, so precomputed rainbow tables no longer match.
Which class of attack is not slowed by account lockout?
Offline attacks on stolen hashes.
Topic 2 of 6 in System Hacking Phases and Attack Techniques
Test yourself on System Hacking Phases and Attack Techniques
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.