SYSTEM HACKING

Understand the following
Remote password guessing
Eavesdropping
Denial of Service
Buffer overflows
Privilege escalation
Password cracking
keystroke loggers
sniffers
Remote control and backdoors
Port re direction
Covering tracks
Hiding files
Assuming that NetBIOS TCP139 port is open, the most effective method of breaking into NT/2000 is password guessing.
Attempting to connect to an enumerated share (IPC$, or C$) and trying username/password.
Default Admin$, C$, %Systemdrive% shares are good starting point.
Performing automated password guessing is easy-simple loop using the NT/2000 shell for command based on the standard NET USE syntax.
1. Create a simple username and password file.
2. Pipe this file into FOR command
C:\> FOR /F "token=1, 2*" %i in (credentials.txt)
do net use \\target\IPC$ %i /u: %j