Module 06 - System Hacking ( EC Mode Part 02 ) Flashcards

Question

Which of the following countermeasures allows security experts to defend against rootkits? A. Surf the Internet while logged into an administrator account. B. Use configuration management and vulnerability-scanning tools to verify the effective deployment of updates. C. Disable write protection on the motherboard to prevent BIOS from being infected by a rootkit. D. Skip reading the instructions in the end-user license agreement (EULA) before installing software.

Answer 1

Answer: B. Use configuration management and vulnerability-scanning tools to verify the effective deployment of updates. Explanation: A few techniques adopted to defend against rootkits are as follows: Use configuration management and vulnerability-scanning tools to verify the effective deployment of updates. Employ traffic filtering software to detect and block malicious traffic entering the network. Use next-generation antivirus programs having machine learning–based anomaly detection and behavioral heuristics capabilities. Thoroughly read the instructions in the end-user license agreement (EULA) before installing any software. Avoid surfing the Internet while logged into an administrator account. Enforce write protection on the motherboard to prevent BIOS from being infected by a rootkit.

Answer 2

Answer: B. Abusing boot or logon autostart executions Explanation: Abusing Data Protection API (DPAPI): DPAPI is a unified location in Windows environments where all the cryptographically secured files, passwords of browsers, and other critical data are stored. Windows domain controllers (DCs) contain a master key to decrypt DPAPI-protected files. Attackers often attempt to obtain this master key from the DC. Abusing AdminSDHolder: AdminSDHolder is an object of AD that protects user accounts and groups having high privileges against accidental modifications of security permissions. Abusing Boot or Logon Autostart Executions: Attackers can conduct persistence attacks or privilege escalation if they identify a service with all the necessary permissions that is connected with the registry key. When any authorized user attempts to log in, the service link associated with the registry runs automatically. Abusing accessibility features: Attackers create persistence and escalate privileges by embedding and running malicious code within Windows accessibility features.

Answer 3

Answer: C. PowerLurk Explanation: Hashcat: Hashcat is a cracker compatible with multiple OSs and platforms and can perform multihash (MD4, 5; SHA – 224, 256, 384, 512; RIPEMD-160; etc.), multi-device password cracking. PowerLurk: PowerLurk is a PowerShell toolset for building malicious WMI event subscriptions. The goal of PowerLurk is to make WMI events easier to trigger during a penetration test or red-team engagement. Attackers use PowerLurk to create malicious WMI event subscriptions and execute arbitrary payloads on every Windows logon. Immunity’s CANVAS: Immunity’s CANVAS provides penetration testers and security professionals with hundreds of exploits, an automated exploitation system, and a comprehensive, reliable exploit development framework. GFI LanGuard: The GFI LanGuard patch management software scans the user’s network automatically as well as installs and manages security and non-security patches.

Answer 4

Answer: A. find / -perm -3000 -ls 2> /dev/null Explanation: File-system commands are frequently used by attackers to discover sensitive files, directories, and permissions that can be exploited to gain unauthorized access. Below are some commonly used file-system commands: find / -perm -3000 -ls 2> /dev/null: This command discovers SUID-executable binaries that have the setuid bit set, which can allow attackers to execute commands with elevated privileges. find / -path /sys -prune -o -path /proc -prune -o -type f -perm -o=w -ls 2> /dev/null: This command discovers world-writable files that can be exploited to write malicious code or steal sensitive information. chmod o-w file: This command disables write access to a file, which can help prevent attackers from modifying or deleting sensitive information. find / -path /sys -prune -o -path /proc -prune -o -type d -perm -o=w -ls 2> /dev/null: This command discovers world-writable directories that can be exploited to store malicious files or gain access to sensitive data. find / -name "*.txt" -ls 2> /dev/null: This command discovers .txt files on the system, which can provide attackers with sensitive information. sudo -l: This command displays the list of permitted and forbidden commands for the current user, which can help attackers identify which commands they can run with elevated privileges. openssl s_client -connect : -showcerts: This command displays all certificates' details for a given hostname and port, which can help attackers identify vulnerable certificates and exploit them. keytool -list -v -keystore keystore.jks: This command displays the contents of keystore files and alias names, which can provide attackers with sensitive information and potentially allow them to gain unauthorized access. It's essential to monitor system logs and implement security measures to protect against these types of file-system commands. Limiting access to sensitive information, implementing strong passwords, and using intrusion detection systems can also help prevent attackers from using these commands to gain unauthorized access.

Answer 5

Answer: B. psexec -i \ ipconfig /all Explanation: Sysinternals is a suite of tools developed by Microsoft for Windows systems administration and troubleshooting. Below are some commonly used Sysinternals commands: psexec -i \\ cmd: This command establishes an interactive Command Prompt (CMD) with a remote system. This can be useful for remote administration and troubleshooting. psexec -i \\ -c file.exe: This command copies the file.exe from the local machine to a remote computer. This can be useful for deploying software or executing programs on remote systems. psexec -i -d -s c:\windows\regedit.exe: This command retrieves the contents of security keys and SAM on the local system. This can be useful for troubleshooting and analyzing system security. psexec -i \\ ipconfig /all: This command displays a remote system's network information, including IP addresses, subnet masks, and DNS servers. Sysinternals commands can provide valuable information for system administrators, but they can also be used by attackers for reconnaissance and exploitation purposes. It's important to limit access to Sysinternals tools and monitor their usage for any suspicious activity. Regular system updates, antivirus software, and intrusion detection systems can also help protect against malicious Sysinternals commands.

Answer 6

Answer: D. sc queryex type=service state=all | find /i "Name of the service: myService" Explanation: Service commands are used to manage the services running on a Windows system. Below are some commonly used service commands: sc queryex type=service state=all: This command lists all the available services on the Windows system. The output includes details like the display name, service name, current status, and process ID. sc queryex type=service state=all | find /i "Name of the service: myService": This command lists details about the specified service on the Windows system, including the service name, display name, and current status. net start or stop: This command starts or stops a network service on the Windows system, depending on the specified service name. netsh firewall show state: This command displays the current state of the Windows firewall. netsh firewall show config: This command displays the settings for the Windows firewall, including the enabled state, allowed programs, and port exceptions. netsh advfirewall set currentprofile state off: This command turns off the firewall service for the current profile on the Windows system. netsh advfirewall set allprofiles state off: This command turns off the firewall service for all profiles on the Windows system. Service commands can provide valuable information for system administrators, but they can also be used by attackers for reconnaissance and exploitation purposes. It's important to monitor service usage and implement security measures to protect against malicious service commands. Regular system updates, antivirus software, and intrusion detection systems can also help protect against attacks that use service commands.

Answer 7

Answer: A. Always use the administrative mode Explanation: Some of the defensive techniques against Spyware are as follows: Try to avoid using any computer system that is not entirely under your control Adjust the browser security settings to medium or higher for the Internet zone Be cautious about suspicious emails and sites Enable the firewall to enhance the security level of the computer Regularly update the software and use a firewall with outbound protection Regularly check the task manager report and MS configuration manager report Regularly update virus definition files and scan the system for spyware Install and use anti-spyware software Perform web surfing safely and download cautiously Do not use administrative mode unless it is necessary Keep your operating system up to date Do not download free music files, screensavers, or smiley faces from the Internet Beware of pop-up windows or web pages. Never click anywhere on these windows Carefully read all disclosures, including the license agreement and privacy statement before installing any application Do not use administrative mode unless it is necessary

Answer 8

Answer: B. NetVizor Explanation: NetVizor: NetVizor comes with an unparalleled task recording feature-set that in secret records everything employees do on the network. Chats, keystrokes and emails, site and on-line search activity, application usage, file usage, uploads and downloads, computer software setups, and web traffic represent simply a sampling of the NetVizor activity recording capabilities. Stream Armor: Stream Armor is a tool used to discover hidden ADSs and clean them completely from your system. Its advanced auto analysis, coupled with an online threat verification mechanism, helps you eradicate any ADSs that may be present GFI LanGuard: GFI LanGuard scans for, detects, assesses, and rectifies security vulnerabilities in a network and its connected devices. This is done with minimal administrative effort. It scans the operating systems, virtual environments, and installed applications through vulnerability check databases CCleaner: CCleaner is a system optimization, privacy, and cleaning tool. It allows attackers to remove unused files and cleans traces of Internet browsing details from the target PC. With this tool, an attacker can very easily erase his/her tracks

Answer 9

Answer: B. Install malicious programs Explanation: Executing Applications: Once attackers have administrator privileges, they attempt to install malicious programs such as Trojans, Backdoors, Rootkits, and Keyloggers, which grant them remote system access, thereby enabling them to execute malicious codes remotely. Installing Rootkits allows them to gain access at the operating system level to perform malicious activities. To maintain access for use at a later date, they may install Backdoors. Hiding Files: Attackers use Rootkits and steganography techniques to attempt to hide the malicious files they install on the system, and thus their activities. Covering Tracks: To remain undetected, it is important for attackers to erase all evidence of security compromise from the system. To achieve this, they might modify or delete logs in the system using certain log-wiping utilities, thus removing all evidence of their presence. Gaining Access: In system hacking, the attacker first tries to gain access to a target system using information obtained and loopholes found in the system’s access control mechanism. Once attackers succeed in gaining access to the system, they are free to perform malicious activities such as stealing sensitive data, implementing a sniffer to capture network traffic, and infecting the system with malware. At this stage, attackers use techniques such as password cracking and social engineering tactics to gain access to the target system.

Answer 10

Answer: A. Hypervisor level rootkit Explanation: Hypervisor Level Rootkit: Attackers create Hypervisor level rootkits by exploiting hardware features such as Intel VT and AMD-V. These rootkits runs in Ring-1 and host the operating system of the target machine as a virtual machine and intercept all hardware calls made by the target operating system. This kind of rootkit works by modifying the system’s boot sequence and gets loaded instead of the original virtual machine monitor. Hardware/Firmware Rootkit: Hardware/firmware rootkits use devices or platform firmware to create a persistent malware image in hardware, such as a hard drive, system BIOS, or network card. The rootkit hides in firmware as the users do not inspect it for code integrity. A firmware rootkit implies the use of creating a permanent delusion of rootkit malware. Kernel Level Rootkit: The kernel is the core of the operating system. Kernel level rootkit runs in Ring-0 with highest operating system privileges. These cover backdoors on the computer and are created by writing additional code or by substituting portions of kernel code with modified code via device drivers in Windows or loadable kernel modules in Linux. Boot Loader Level Rootkit: Boot loader level (bootkit) rootkits function either by replacing or modifying the legitimate bootloader with another one. The boot loader level (bootkit) can activate even before the operating system starts. So, the boot-loader level (bootkit) rootkits are serious threats to security because they can help in hacking encryption keys and passwords.

Answer 11

Answer: D. Works higher up in the OS and usually patches, hooks, or supplants system calls with backdoor versions

Answer 12

Answer: C. Steganography. Explanation: Scanning: Scanning is the process of gathering additional detailed information about the target by using highly complex and aggressive reconnaissance techniques. Network scanning refers to a set of procedures used for identifying hosts, ports, and services in a network. It is one of the most important phases of intelligence gathering for an attacker which enables him/her to create a profile of the target organization. Steganography: Steganography refers to the art of hiding data “behind” other data without the target’s knowledge. Thus, Steganography hides the existence of the message. It replaces bits of unused data into the usual files such as graphic, sound, text, audio, video, etc. with some other surreptitious bits. The hidden data can be plaintext or ciphertext, or it can be an image. Enumeration: Enumeration is the process of extracting user names, machine names, network resources,shares, and services from a system or network. In the enumeration phase, attacker creates active connections with system and performs directed queries to gain more information about the target. The attackers use the information collected by means of enumeration to identify the vulnerabilities or weak points in the system security, which helps them exploit the target system. Footprinting: Footprinting, the first step in ethical hacking, refers to the process of collecting information about a target network and its environment. Using footprinting, you can find a number of opportunities to penetrate and assess the target organization’s network.

Answer 13

Answer: C. Document steganography. Explanation: Image Steganography: Image steganography allows you to conceal your secret message within an image. You can take advantage of the redundant bit of the image to conceal your message within it. These redundant bits are those bits of the image that have very little effect on the image, if altered. Detection of this alteration is not easy. You can conceal your information within images of different formats (e.g., .PNG, .JPG, .BMP). Document Steganography: As with image steganography, document steganography is the technique of hiding secret messages transferred in the form of documents. It includes addition of white spaces and tabs at the end of the lines. Stego-document is a cover document comprising of the hidden message. Steganography algorithms, referred to as the “stego system, are employed for hiding the secret messages in the cover medium at the sender end. The same algorithm is used for extracting the hidden message from the stego-document by the recipient. Folder Steganography: Folder steganography refers to hiding secret information in folders. Files are hidden and encrypted within a folder and are not seen by the normal Windows applications, including Windows Explorer. Video Steganography: Video steganography refers to hiding secret information into a carrier video file. The information is hidden in video files of different formats such as .AVI, .MPG4, .WMV, etc. Discrete Cosine Transform (DCT) manipulation is used to add secret data at the time of the transformation process of the video.

Answer 14

Answer: C. Domain dominance. Explanation: Steganography: Steganography refers to the art of hiding data “behind” other data without the knowledge of the victim. Kernel Exploits: Kernel exploits refer to programs that can exploit vulnerabilities present in the kernel to execute arbitrary commands or code with higher privileges. Steganalysis: Steganalysis is the process of discovering the existence of hidden information in a medium. It is the reverse process of steganography. Domain Dominance: Domain dominance is a process of taking control over critical assets such as domain controllers (DCs) on a target system and gaining access to other networked resources.

Answer 15

Answer: A. Skeleton key. Explanation: NTFS Data Stream: NTFS is a filesystem that stores a file with the help of two data streams, called NTFS data streams, along with the file attributes. Keylogger: Keyloggers are software programs or hardware devices that record the keys struck on the computer keyboard (also called keystroke logging) of an individual computer user or a network of computers. Spyware: Spyware is stealthy computer monitoring software that allows you to secretly record all the user activities on a target computer. It automatically delivers logs to the remote attacker using the Internet (via email, FTP, command and control through encrypted traffic, HTTP, DNS, etc.). Skeleton Key Attack: A skeleton key is a form of malware that attackers use to inject false credentials into domain controllers (DCs) to create a backdoor password. It is a memory-resident virus that enables an attacker to obtain a master password to validate themselves as a legitimate user in the domain.

Answer 16

Answer: A. Skeleton key attack. Explanation: Overpass-the-Hash Attack: The overpass-the-hash (OPtH) attack is an extension of pass-the-ticket and pass-the-hash attacks. It is a type of credential theft-and-reuse attack using which attackers perform malicious activities on compromised devices or environments. Dumpster Diving: “Dumpster diving” is a key attack method that employs significant failures in computer security in the target system. STP Attack: In a Spanning Tree Protocol (STP) attack, attackers connect a rogue switch into the network to change the operation of the STP protocol and sniff all the network traffic. STP is used in LAN-switched networks with the primary function of removing potential loops within the network. Skeleton Key Attack: A skeleton key is a form of malware that attackers use to inject false credentials into domain controllers (DCs) to create a backdoor password. It is a memory-resident virus that enables an attacker to obtain a master password to validate themselves as a legitimate user in the domain.

Answer 17

Answer: C. Never restrict credential overlap within systems to maximize lateral movement. Explanation: Discussed below are some of the countermeasures to defend against persistence attacks: Conduct security awareness campaigns/training on phishing attacks, password creation policies, and other methods. Deploy a minimum privileges access model, which assists in restricting user access and domain admin account access. Regularly change KRBTGT’s password and reset the service twice. Restrict the credential overlap within systems to limit lateral movement through privileged account management. Use admin credentials only if the data need to be shared among the devices.

Answer 18

Answer: B. Restrict domain users within a local administrator group across multiple systems. Explanation: The best practices to defend against persistence attacks are listed as follows: Deploy the Kerberos validation tool for verifying the legitimacy of individual tickets provided by a valid KDC. Restrict the credential overlap within systems to limit lateral movement through privileged account management. Restrict domain users within a local administrator group across multiple systems. Limit the inbound traffic through Windows Firewall. Ensure that Kerberos follows the signing of the Privilege Attribute Certificate (PAC) and TGS with the key “krbtgt” by the key distribution center (KDC).