Method 1.

you first use Port scanner to scan for available Net-Bios ports (137,138,139) and just enter into the shared docs of that pc(which has those ports open) and leave a backdoor there and let the target activate that backdoor,then you will be having full access to his pc!

(or)

You can just login using the username as 'ADMINISTRATOR' and blank password.This is successful most of the times as most of them dont disable default ADMINISTRATOR account!

(or)

Resolve the username of the target system and bruteforce the password!(but..Be careful,the firewall stores all info.You may be booked by the victim if he traces you!)

Method 2.

Maintain a http service on your IP using Apache and put up an exploit shell on your server,and wait for the victim to log on to your http page(If the target also know about these port scanners,then he will definitely log on to your http page!Or else make him do it by any possible means!) Thats it! If the target pc user logs onto your IP,then YOU will be landing DIRECTLY into his command shell!

This method appears easy than it actually is,but is a perfect h4ck!!

Now..if you think of trying his method ,then regarding method of putting up the exploit on your server,reply!