> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/ethical-hacking/topic-8-system-hacking-and-privilege-escalation-concepts.md).

# Topic 8: System Hacking and Privilege Escalation Concepts

### Simple Explanation

Once an attacker has found an open door (scanning) and knows what's inside (enumeration), **system hacking** is the actual process of getting in and then trying to gain more control than they started with (privilege escalation) — going from a "guest" to becoming the "admin" of the house.

*(This topic is explained conceptually and from a defensive standpoint — understanding these categories helps you configure systems correctly and recognize attack patterns, which is exactly how it's meant to be studied for this exam.)*

*for practical level* [*https://github.com/alhamrizvi-cloud/Linux-PrivEsc*](https://github.com/alhamrizvi-cloud/Linux-PrivEsc)

***

### 1. The System Hacking Goal Sequence (CEH's classic model)

1. **Gaining Access** — getting an initial foothold (via password cracking, exploiting a vulnerability, phishing, etc.)
2. **Escalating Privileges** — moving from a low-privilege account to admin/root/SYSTEM level.
3. **Maintaining Access** — ensuring the attacker can return later (backdoors, rootkits).
4. **Clearing Tracks** — hiding evidence of the intrusion.

### 2. Password Cracking — Concepts and Categories

Passwords remain the most common authentication method, so cracking them is a central part of "gaining access."

#### Types of Password Attacks

| Attack Type                               | Description                                                                                                                                   |
| ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------- |
| **Dictionary Attack**                     | Trying every word from a pre-built wordlist (common passwords, leaked password lists)                                                         |
| **Brute Force Attack**                    | Trying every possible character combination systematically — guaranteed to work eventually but can take a very long time for strong passwords |
| **Hybrid Attack**                         | Combines dictionary words with variations (e.g., appending numbers/symbols: `password123!`)                                                   |
| **Rainbow Table Attack**                  | Uses precomputed tables of hash values mapped to plaintext passwords, to reverse a hash quickly without brute-forcing — defeated by "salting" |
| **Rule-Based Attack**                     | Applies known human password patterns (capitalize first letter, replace 'a' with '@', etc.) to a base wordlist                                |
| **Credential Stuffing**                   | Using username/password pairs leaked from *one* breach to try logging into *other, unrelated* services (works because people reuse passwords) |
| **Password Spraying**                     | Trying one or a few common passwords against *many* different usernames, to avoid triggering account lockout thresholds                       |
| **Keystroke Logging**                     | Capturing keystrokes as a user types their password (covered in Malware topic)                                                                |
| **Shoulder Surfing / Social Engineering** | Non-technical methods of obtaining passwords directly (covered in Social Engineering topic)                                                   |

#### Passive vs Active Online Attacks vs Offline Attacks

| Category           | Description                                                                                                                                                      |
| ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Passive Online** | Sniffing credentials from network traffic without directly interacting with the target (e.g., capturing unencrypted login traffic)                               |
| **Active Online**  | Directly attempting logins against a live system (brute force/dictionary against a login form) — noisy, can trigger lockouts/alerts                              |
| **Offline Attack** | Attacker has already obtained the password hash file and cracks it on their own hardware without touching the target system again — much faster, no lockout risk |
| **Non-Electronic** | Shoulder surfing, social engineering, dumpster diving                                                                                                            |

### 3. Authentication and Password Storage Concepts

* Systems typically don't store plaintext passwords; they store a **hash** of the password.
* **Salting** — adding a unique random value to each password before hashing, so identical passwords produce different hashes, defeating rainbow tables.
* Windows historically used **LM hash** (very weak, case-insensitive, easily cracked) and later **NTLM hash** (stronger, but still crackable offline if obtained).
* Linux/Unix stores password hashes in `/etc/shadow` (readable only by root), using algorithms like SHA-512 with salting.

### 4. Privilege Escalation

The process of exploiting a bug, design flaw, or misconfiguration to gain elevated access to resources normally restricted from the current user.

#### Types of Privilege Escalation

| Type                                | Description                                                                                                                               |
| ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
| **Vertical Privilege Escalation**   | Moving from a lower privilege level to a higher one (e.g., regular user → administrator/root)                                             |
| **Horizontal Privilege Escalation** | Gaining access to resources/accounts of another user at the *same* privilege level (e.g., accessing another regular user's files/account) |

#### Common Categories of Privilege Escalation Techniques (conceptual, defensive framing)

| Category                                   | Description                                                                                                                                                | Defensive Fix                                             |
| ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |
| **Misconfigured File/Service Permissions** | A file, service, or scheduled task that runs with high privileges but can be modified by a low-privilege user                                              | Apply least-privilege permissions; regularly audit ACLs   |
| **Unpatched Software Vulnerabilities**     | Known OS/kernel bugs that allow privilege escalation (kernel exploits)                                                                                     | Keep systems patched with latest security updates         |
| **Weak Service Configurations**            | Services running as SYSTEM/root unnecessarily                                                                                                              | Run services with the minimum privilege they need         |
| **DLL Hijacking (Windows)**                | Placing a malicious DLL where a privileged application will load it instead of the legitimate one                                                          | Use full/trusted DLL search paths, code signing           |
| **SUID/SGID Misconfiguration (Linux)**     | Executable files with the SUID bit set run with the file owner's privileges (often root) — if such a binary can be manipulated, it can lead to root access | Minimize SUID binaries, audit regularly                   |
| **Token Impersonation (Windows)**          | Abusing access tokens to impersonate a higher-privileged user/process                                                                                      | Restrict token-related privileges, monitor for abuse      |
| **Credential Harvesting from Memory**      | Extracting cached credentials/hashes from system memory of a running session                                                                               | Enable credential protection features, limit admin logons |

### 5. Maintaining Access

Once elevated privileges are gained, attackers (in a real malicious scenario) may try to ensure continued access:

* **Backdoors** — hidden entry points bypassing normal authentication.
* **Rootkits** — tools designed to hide the presence of malware/unauthorized access from the OS and monitoring tools (covered more in the Malware topic).
* **Trojans** — malware disguised as legitimate software that provides remote access (covered in Malware topic).
* **Scheduled Tasks/Services** — creating a persistent task that re-establishes access even after reboot.

*(In an authorized penetration test, this phase is only performed with explicit client permission, is fully documented, and everything created is removed at the end of the engagement.)*

### 6. Clearing Tracks

Techniques attackers use to avoid detection (studied here so defenders know what to look for in an incident investigation):

* Deleting or modifying system/application/security **event logs**.
* Disabling auditing/logging temporarily during the attack.
* Using **steganography** to hide data within images/files.
* Clearing command history, temp files, browser cache.
* Modifying file timestamps ("timestomping") to blend malicious files in with legitimate ones.

**Defensive counter:** centralized/remote logging (SIEM systems) so logs aren't only stored on the compromised machine, and file integrity monitoring to detect tampering.

### 7. Rootkits — Types (Conceptual Overview)

| Type              | Description                                                            |
| ----------------- | ---------------------------------------------------------------------- |
| Application-level | Replaces/modifies application binaries                                 |
| Kernel-level      | Modifies the OS kernel itself — very hard to detect, highest privilege |
| Bootkit           | Infects the boot process (MBR/UEFI), loads before the OS itself        |
| Library-level     | Hooks system library calls to hide activity                            |
| Firmware-level    | Hides in device firmware — extremely persistent, survives OS reinstall |

### 8. Countermeasures (System Hacking Defense — very important section for exams)

* Enforce strong password policies (length, complexity, expiration, no reuse) and consider passphrases.
* Implement **account lockout policies** to slow brute-force/spraying attacks.
* Use **Multi-Factor Authentication (MFA)** everywhere possible.
* Apply the **Principle of Least Privilege** — users/services get only the access they truly need.
* Keep systems **patched** — most privilege escalation relies on known, unpatched vulnerabilities.
* Use **salting + strong hashing algorithms** (bcrypt, Argon2, PBKDF2) for password storage.
* Enable centralized logging/SIEM so attackers can't simply clear local logs to hide.
* Use **file integrity monitoring** and **endpoint detection & response (EDR)** tools to catch rootkits/backdoors.
* Regularly audit user privileges, SUID binaries, and service account permissions.
* Disable unused accounts and services.

***

### Exam Points (Quick Revision)

* System hacking sequence: Gain Access → Escalate Privileges → Maintain Access → Clear Tracks.
* Password attacks: Dictionary, Brute Force, Hybrid, Rainbow Table, Password Spraying, Credential Stuffing.
* Offline attacks (crack hash locally) are faster & stealthier than online/active attacks.
* Salting defeats rainbow tables.
* Vertical Privilege Escalation (low → high) vs Horizontal (same level, different user).
* Rootkit types: Application, Kernel, Bootkit, Library, Firmware level.
* Best defenses: MFA, least privilege, patching, strong hashing (bcrypt/Argon2), centralized logging.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/ethical-hacking/topic-8-system-hacking-and-privilege-escalation-concepts.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.