Appendix B. System & Network Hacking — A Complete Guide to Major Attack Techniques
- Target reader: Anyone who has completed Level 3 or higher (with hands-on pwnable and privilege escalation practice)
- Purpose: Exam prep summary, interview review, revision map
⚠️ All techniques in this appendix are for your own lab and legal platforms only. Applying them to unauthorized systems or networks is a crime.
This appendix covers what happens after you break through the web layer and set foot on a server — plus attacks on the network itself. It follows the actual timeline of an intrusion: system hacking → privilege escalation → internal spread → network attacks.
B-0. The System & Network Attack Map at a Glance
| # | Technique | Phase | One-line essence |
|---|---|---|---|
| 1 | Buffer Overflow | Initial foothold | Overwriting memory that lacks bounds checking |
| 2 | ROP | Exploit refinement | Chaining legitimate code fragments for malicious ends |
| 3 | Format String | Initial foothold | printf reads and writes memory |
| 4 | Linux Privilege Escalation | Privilege escalation | Gaps in SUID, sudo, and the kernel |
| 5 | Windows Privilege Escalation | Privilege escalation | Tokens, services, and configuration mistakes |
| 6 | Credential Dumping | Spread preparation | Digging passwords out of memory and files |
| 7 | Lateral Movement | Internal spread | Sideways to the next server with stolen credentials |
| 8 | Sniffing & Spoofing | Network | Eavesdropping on and hijacking conversations on the wire |
| 9 | MITM | Network | Slipping between two parties to relay traffic |
| 10 | DoS/DDoS | Availability destruction | Flooding a system past what it can handle |
| 11 | Wireless (Wi-Fi) Attacks | Physical proximity | Radio waves go through walls |
B-1. Buffer Overflow
Definition: When data is written to a fixed-size buffer without bounds checking, the overflow overwrites adjacent memory (including the return address).
Principle: If an unsafe function like strcpy doesn’t check input length, it overwrites right up to the saved return address on the stack. If the attacker writes the address they want there (shellcode, a gadget), they hijack the program’s execution flow.
Modern mitigations and bypasses: ASLR (address randomization), NX (non-executable stack), and canaries (stack guard values) ship by default, so a real-world exploit clears each mitigation one at a time: leak the canary → calculate addresses → build a ROP chain. You practiced this entire process hands-on in the Level 3 pwnable part.
Defense: Use safe functions (snprintf instead of strncpy, etc.), compiler protection options (-fstack-protector, PIE), and adopt memory-safe languages (like Rust).
B-2. ROP (Return-Oriented Programming)
Definition: When NX means shellcode planted on the stack won’t execute, this technique chains together code fragments (gadgets — instruction sequences ending in ret) that already exist inside the program to produce the behavior you want.
Intuition: Since you can’t write a new sentence, it’s like cutting letters out of a book and gluing them together into a ransom note. You collect gadgets from the binary with ROPgadget and assemble the chain with the ROP object in pwntools.
Defense: Stronger NX and ASLR, CFI (Control Flow Integrity), and modern compiler protection options.
B-3. Format String
Definition: A vulnerability that arises when the user controls the format string, as in printf(user_input). With %x you can read stack memory (information leak → grab the canary and addresses), and with %n you can even write to arbitrary addresses.
Defense: Always fix the format string (printf("%s", input)). Promote the compiler warning (-Wformat-security) to an error.
B-4. Linux Privilege Escalation
Once you have a shell as a regular user, there are three roads toward root.
| Path | Checkpoint | Representative command |
|---|---|---|
| SUID binaries | Abusing files that run with root privileges (find / -perm -4000) |
Cross-reference GTFOBins |
| sudo configuration | sudo -l — commands runnable without a password |
sudo -l |
| Configuration mistakes | Writable cron scripts, world-writable files, PATH injection | ls -la /etc/cron* |
| Kernel vulnerabilities | Known exploits for outdated kernels (Dirty COW, etc.) | uname -a |
Defense: Minimize SUID binaries, keep the sudo allowlist minimal, audit cron and PATH permissions, and manage kernel patch cycles.
B-5. Windows Privilege Escalation
| Path | Checkpoint |
|---|---|
| Service paths | Unquoted Service Path, writable service binaries |
| Token abuse | Service accounts with SeImpersonatePrivilege → Potato-family techniques to SYSTEM |
| Configuration mistakes | AlwaysInstallElevated registry setting, stored credentials (cmdkey) |
| Missing patches | Check hotfixes with systeminfo, then match against known kernel exploits |
Defense: Least privilege, stripping privileges from service accounts, regular patching, and separating local admin passwords with LAPS.
B-6. Credential Dumping
Definition: The phase where you extract passwords, hashes, and tickets stored inside a system.
- Linux:
/etc/shadow(root required),~/.bash_history, hardcoded passwords in config files - Windows: LSASS process memory dumps (Mimikatz), the SAM database, browser-saved passwords
Why do it: Credentials from one machine usually work on others too (password reuse). They’re the fuel for the next phase: Lateral Movement.
Defense: LSASS protection (Credential Guard), prohibiting admin accounts from logging on to workstations, banning password reuse, and memory dump detection (EDR).
B-7. Lateral Movement
Definition: After taking over one machine, you spread to other systems inside the network.
- Pass-the-Hash: Authenticate with a stolen NTLM hash without knowing the password
- PsExec/WinRM/WMI: Remote execution with stolen admin credentials
- AD environments: Kerberos ticket theft (Pass-the-Ticket), analyzing shortest attack paths with BloodHound
Defense: A tiered administration model (Tier Model), individualized local admin passwords, monitoring lateral movement paths, and network segmentation.
B-8. Sniffing and Spoofing
- Sniffing: Eavesdropping on packets in the same network. Unencrypted protocols (HTTP, Telnet, FTP) show plaintext as-is. The tools are
tcpdump,tshark, and Wireshark. - ARP Spoofing: On a local network, you broadcast false ARP replies claiming "I’m the gateway" to redirect traffic through yourself.
- DNS Spoofing: Luring the victim to a forged site with fake DNS responses.
Defense: Encrypt everything end to end (TLS, SSH), ARP inspection (Dynamic ARP Inspection), and DNSSEC.
B-9. MITM (Man-in-the-Middle)
Definition: An attack where you slip between the two ends of a communication, relaying traffic while watching and tampering with it. After positioning yourself with ARP spoofing, you try to neutralize encryption with techniques like SSL stripping (forcing an HTTPS→HTTP downgrade).
Defense: HSTS (enforcing HTTPS), certificate pinning, and using a VPN on public Wi-Fi. For users, the first shield is never ignoring the padlock in the address bar and certificate warnings.
B-10. DoS / DDoS
Definition: An attack that stops a service by flooding it with more requests than the system can handle. The classics are SYN floods (sending connection requests and never completing them) and UDP amplification attacks (making small requests produce large responses aimed at the victim).
Defense: CDN and Anycast distribution, rate limiting, SYN cookies, and cloud DDoS mitigation services. Note that at scale, this attack can affect carrier networks even from a lab, so this book covers only the concepts and defenses.
B-11. Wireless (Wi-Fi) Attacks
- Handshake Capture: Eavesdrop on WPA2’s 4-way handshake, then run an offline dictionary attack on the password
- PMKID Attack: A technique that gets hash material directly from the AP without any client connection
- Evil Twin: Standing up a fake AP with the same name to lure connections and harvest passwords with a portal page
Defense: WPA3 or a strong pre-shared key (long and random), 802.1X authentication in enterprise environments, and wariness of suspicious same-named APs on public Wi-Fi.
Summary
Let’s lay out the timeline of system hacking once more.
Initial foothold (memory vulnerabilities) → Privilege escalation (gaps in configuration) → Credential Dumping (stored secrets) → Lateral Movement (reused trust)
From the defender’s side, there’s a link to cut at every phase. Block the foothold with bounds checking and patching, block escalation with least privilege, block dumping with credential protection, and block the spread with segmentation. The attacker has to succeed at every step to reach the goal — but the defender only has to break one link. That asymmetry is the hope of defense.
Hands-on practice for each technique is covered in the pwnable, privilege escalation, and AD parts of Level 3 (Steps 176~303) and the OSCP part of Level 4 (Steps 304~348).