System Exploitation, Windows Security, and Password Cracking

Week 4 · Week 4: System Exploitation, Windows Security, and Password Cracking · Download .docx

Objectives

Explain NTLM and Kerberos authentication and identify the specific weakness exploited by pass-the-hash
Describe Linux privilege escalation via SUID binaries and weak sudo configurations
Classify password attack types and identify the specific defensive control that defeats each
Explain how salting defeats rainbow table attacks
Describe what post-exploitation demonstrates in the context of an authorized penetration test

Key terms

NTLM: NT LAN Manager — Windows challenge-response authentication that accepts the password hash directly, enabling pass-the-hash attacks.
Kerberos: Network authentication using a Key Distribution Center and tickets — the primary Windows domain authentication mechanism.
Pass-the-hash: Authenticating using a captured NTLM password hash instead of plaintext — exploits NTLM's challenge-response design.
SAM database: Security Accounts Manager — Windows database storing local credential hashes; locked during system operation to prevent runtime access.
SUID: Set User ID — a Linux permission bit causing a file to execute with the file owner's privileges, regardless of who runs it.
UAC: User Account Control — Windows security feature prompting for elevation when a process requests administrative privileges.
Rainbow table: A precomputed hash-to-plaintext lookup table — defeated by adding a unique random salt before hashing.
Salt: A random value added to a password before hashing — prevents rainbow tables from working by making identical passwords produce different hashes.
Dictionary attack: Password cracking using a predefined wordlist — effective against common or reused passwords.
Brute force attack: Systematically testing every possible password combination — computationally expensive for long passphrases.
MFA: Multi-Factor Authentication — combining at least two of: something you know, something you have, something you are.
FAR / FRR: False Acceptance Rate / False Rejection Rate — the complementary accuracy trade-offs in biometric authentication systems.

The concept

Once a penetration tester has identified and enumerated vulnerabilities, the exploitation phase demonstrates that those vulnerabilities are actually exploitable — not just theoretically present. In an authorized context, exploitation proves real risk and motivates remediation investment.

Windows authentication is a high-value target. NTLM uses a challenge-response mechanism: the server sends a challenge, the client responds with the result of hashing their password against that challenge. NTLM's critical weakness is that the response can be generated directly from the password hash — meaning a captured hash is as useful as the password itself for authentication without cracking. This technique is called pass-the-hash and is a foundational post-exploitation technique in Windows environments. Kerberos is more secure: it uses a Key Distribution Center that issues time-limited tickets, and the plaintext password never travels the network. However, Kerberos is subject to its own attacks — golden ticket and silver ticket attacks exploit the KDC's ticket-issuing trust relationship.

On Linux systems, privilege escalation paths include SUID binaries (executables that run as root regardless of who invokes them), writable cron jobs running as root, sudo misconfigurations (users allowed to run certain commands as root without a password), and unpatched kernel vulnerabilities. During authorized security assessments, these are systematically checked to demonstrate what an attacker with initial low-privilege access could achieve.

Password attacks take three main forms. Dictionary attacks iterate a wordlist — effective because most users choose common words and phrases. Brute force attacks systematically enumerate all possible character combinations — computationally expensive but guaranteed given enough time. Rainbow table attacks use precomputed hash-to-plaintext chains — extremely fast but defeated completely by adding a unique random salt to each password before hashing. The salt makes the hash of 'password123' unique for every user who uses it, rendering a rainbow table useless.

NIST SP 800-63B provides the authoritative guidance on modern credential management: avoid periodic forced rotation (it creates predictable patterns), screen all passwords against known breach lists, allow phrases up to 64 characters, and deploy MFA for all high-value accounts. MFA requires at least two factors — something you know (password), something you have (hardware token, authenticator app), something you are (biometric). Even if a password is cracked, MFA denies access to the attacker without the second factor.

Post-exploitation demonstrates cascading impact: after initial access, the tester attempts lateral movement (reaching other systems), privilege escalation (gaining higher access), and persistence (establishing access that survives reboots) — all within scope — to show the full business impact of the compromise to the client.

Standards: Maryland Blueprint Pillar 3 · EC-Council CEH v12 Domain 6 (System Hacking) + Domain 7 (Password Cracking) · PGCC INT-2681 Outcomes 3, 4, 6.

Worked examples

Example 1: [object Object]

Example 2: [object Object]

Common mistakes

Believing that salting a password eliminates all cracking risk. Salting defeats rainbow tables but does not prevent brute-force or dictionary attacks — just forces the attacker to crack each hash individually.
Assuming Kerberos is completely secure. Kerberos has its own attack surface — golden tickets, silver tickets, and AS-REP roasting — that penetration testers examine in Windows domain environments.
Confusing FAR and FRR direction. Lowering the acceptance threshold reduces FAR (fewer impostors accepted) but raises FRR (more legitimate users rejected) — the security-usability trade-off.
Treating post-exploitation as a separate test from exploitation. Post-exploitation is a continuation of the same authorized engagement — it demonstrates scope of impact, not unauthorized expansion.

Self-check

Try each one before you look. A miss here costs nothing and tells you exactly what to reread.

1. Pass-the-hash attacks specifically exploit which authentication protocol?

2. Rainbow table attacks are completely defeated by which password storage practice?

3. MFA improves security over a password alone because:

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top