Fair enough, so lets say its a person new to hacking. Would that be possible?
No, because new people do not know any attacks, nor would they know how they work until experiencing one on their own (hopefully in a legal manner). Attack vectors are not only limited to what ports are open. To really be able to determine what type of attack is best, one would have to completely understand the inner-workings of an organization...for example: how the network is setup (this is a very very very broad term for what it all entails), security policies, any financial issues, legal history, what kind of physical security they have, telephone numbers, e-mail addresses, what kind of hobbies bob likes, etc, etc, ETC!!!! Setting up an effective knowledge base to attack with can take days, weeks, months (depending on the circumstances, i.e. stuxnet, the advanced persistent threat, etc).
In short, pay attention to the little things. A sticky note saying what time john's dinner date with his wife is can be turned into an attack vector.
EDIT: More simply, think of an attack like putting together a jigsaw puzzle. It will take forever to find the pieces, but once you put them all in the right place, you see exactly what the entire picture is about.
