Section 19.181 Execution and Escalation Attacks

Question 1

Arbitrary Code Execution

Answer 1

Vulnerability allows an attacker to run their code without restrictions and lets attackers execute their code on the target system (Physically be on the system)

Question 2

Remote Code Execution

Answer 2

Type of arbitrary code execution that occurs remotely, often over the internet (Dont have to be physically on the system)

Question 3

Privilege Escalation

Answer 3

Gaining higher-level permissions than originally assigned which allows attackers to operate with elevated privileges, such as administrator or
root access

Question 4

Privilege Escalation 2 types of escalation

Vertical Privilege Escalation

Answer 4

Going from normal user to higher privilege (e.g., admin or root)

● Commonly associated with code execution leading to admin-level permissions

Question 5

Privilege Escalation 2 types of escalation

Horizontal Privilege Escalation

Answer 5

Accessing or modifying resources at the same level as the attacker

● Occurs when a user attempts to access resources for which they don’t
have permissions at the same level

Question 6

Why are privileges so important

Understanding Privileges

Answer 6

Application and process privileges are required for executing functions, reading, and writing data

● Applications inherit the permissions of the user running them (e.g., system, admin, or user)

● Understanding and managing privileges is crucial for system security

● Attackers aim to gain higher privileges to perform malicious actions

Question 7

Rootkits

Answer 7

Class of malware that conceals its presence by modifying system files, often at the kernel level

■ Can be challenging to detect and provides attackers with persistence

Question 8

Ring Levels

Ring Zero

Answer 8

○ The kernel (center) with the highest privileges

○ Kernel mode rootkits (Ring Zero) are more dangerous due to their
extensive control

Question 9

Rings1 to 3

Answer 9

User-level components with decreasing privileges as the ring number increases

Question 10

Kernel Mode Rootkit

Answer 10

● Embedded in the kernel (Ring Zero)

● Has maximum control and privileges

● Highly dangerous due to the extensive system access

Question 11

User Mode Rootkit

Answer 11

● Attached to user-level components (Rings 1 to 3)

● Has administrator-level privileges

● Utilises operating system features for persistence, e.g., registry or task
scheduler