I'm using NMAP to scan for hosts. Then, I use Hydra to find the password to the Administrator account. I then use telnet to gain access to the system.
I don't know why I raise my eyebrows when I'm reaching deep in my mind to try to figure out what to say lol.