I currently have access to a server and I am the "hacker" (not really just a demo for class). I have ssh'ed into her machine. What is the first thing I should care about when she logs in? Apparently she is going to log in soon and as an "hacker" what should I look out for?
It really depends what the goal is or what you're wanting to achieve.
In short, you probably want to gather as much information as possible.
Collecting password hashes to escalate your privileges would be a good bet.
I would probably try to identify and analyze any additional vulnerabilities.
You might also want to set up some means of maintaining persistent access.
For the purpose of the exercise I would try and create an audit trail of what she is doing and report on it. Clues on what she is doing will be found in the logs, so that is the first place I would look.
If it is a Linux box you will find the logs in /var/logs. In particular, have a look at secure.log if it is a redhat based machine, or auth.log if it is a debian based machine, these will let you see when she uses the sudo command. Additionally issue the command
last,to see who has logged in and when.
If it is a windows box then have a look at the event viewer, and you will find the Windows logs there.
Hope this helps, and good luck.
EDIT: I misread the question, (I was a passenger in a badly driven car at the time) and typed out the following answer, which is not relevant to the question but you may find it useful so I will leave it.
The first thing a real life attacker should do is scope the attack. Including documenting pre-defined goals, that are agreed on by all parties involved. During this phase you should work out what kind of test it is and what kind of hat you will be wearing.
The next stage is non-intrusive information gathering, this involves finding as much information as possible about the target that can later be used and leveraged during the attack.
Then you will want to enumerate the target, staying aligned to the scope you defined at the beginning. Generally this involves, vulnerability scanning, port scanning, banner grabbing etc.
All this information will help with the exploitation phase (if there is one in the scope).
Have look at the The Penetration Testing Execution Standard, for a good explanation of each phase.
If there is a goal to be accomplished in the demo, you should achieve that as fast as possible, in case they find out you're logged in. Also, if you can log in through ssh, you should be able to login via SFTP with the same credentials in order to obtain and edit files in there system. Really there isn't much you can do if she finds out you're in, so act fast!