Week 4: System Exploitation, Windows Security, and Password Cracking
Week of Sun, Sep 13 · week closes Sat, Sep 19 · 200 points
This week's items
- Weekly Quiz 4points in Canvas
- Discussion Board 4points in Canvas
- Lab 4points in Canvas
- Midterm Examdue Sun, Sep 13 · 200 pts
Exact due times are in Canvas. Late assignments are NOT accepted. Complete all assignments before the due date.
Read this week
- TestOut Ethical Hacker Pro — Ch 10–12 — Commercial text; named here for reference.
- NIST SP 800-63B — Digital Identity Guidelines — Free — the authoritative NIST password and authenticator guidance.
Know these cold
- Linux privilege escalation paths include SUID binaries, writable cron jobs, weak sudo configurations, and unpatched kernel vulnerabilities — defenders audit these during hardening.
- Windows authentication: NTLM uses a challenge-response mechanism accepting password hashes; Kerberos uses a ticket-based system with a Key Distribution Center.
- The SAM database stores local Windows credential hashes and is locked during system operation; attackers access it offline through shadow copies or bootable media in authorized forensic tests.
- Password attack types: dictionary (wordlist + rules), brute force (systematic enumeration of all combinations), and rainbow table (precomputed hash-to-plaintext lookups).
- Countermeasures: salted hashes defeat rainbow tables; account lockout defeats brute force; long passphrases defeat dictionary attacks; MFA renders cracked passwords insufficient alone.
- Biometric authentication introduces FAR (false acceptance rate) and FRR (false rejection rate) as complementary accuracy trade-offs.
- Standards: Maryland Blueprint Pillar 3 · CEH v12 Domain 6 (System Hacking) + Domain 7 (Password Cracking) · PGCC Outcomes 3, 4, 6.
Meerk's quiz — open the Week 4 gate
10 questions, no time limit. 85% on your first attempt in a 24-hour window opens the gate. Retakes inside the window are practice — they help you learn, they don't count. Work alone; the point is to know it, not to have seen it.
Dinner Table Question
Ask at home: A penetration test finds all domain admin passwords cracked in under 10 minutes. Why is length and passphrases a better answer than complexity rules?
En español: Una prueba de penetración descifra todas las contraseñas de administrador en menos de 10 minutos. ¿Por qué las frases de contraseña son mejor respuesta que los requisitos de complejidad?