Section 19.181 Execution and Escalation Attacks Flashcards
Objective 2.4 Given a scenario, you must be able to analyse indicators of malicious activity
Arbitrary Code Execution
Vulnerability allows an attacker to run their code without restrictions and lets attackers execute their code on the target system (Physically be on the system)
Remote Code Execution
Type of arbitrary code execution that occurs remotely, often over the internet (Dont have to be physically on the system)
Privilege Escalation
Gaining higher-level permissions than originally assigned which allows attackers to operate with elevated privileges, such as administrator or
root access
Privilege Escalation 2 types of escalation
Vertical Privilege Escalation
Going from normal user to higher privilege (e.g., admin or root)
● Commonly associated with code execution leading to admin-level permissions
Privilege Escalation 2 types of escalation
Horizontal Privilege Escalation
Accessing or modifying resources at the same level as the attacker
● Occurs when a user attempts to access resources for which they don’t
have permissions at the same level
Why are privileges so important
Understanding Privileges
Application and process privileges are required for executing functions, reading, and writing data
● Applications inherit the permissions of the user running them (e.g., system, admin, or user)
● Understanding and managing privileges is crucial for system security
● Attackers aim to gain higher privileges to perform malicious actions
Rootkits
Class of malware that conceals its presence by modifying system files, often at the kernel level
■ Can be challenging to detect and provides attackers with persistence
Ring Levels
Ring Zero
○ The kernel (center) with the highest privileges
○ Kernel mode rootkits (Ring Zero) are more dangerous due to their
extensive control
Rings1 to 3
User-level components with decreasing privileges as the ring number increases
Kernel Mode Rootkit
● Embedded in the kernel (Ring Zero)
● Has maximum control and privileges
● Highly dangerous due to the extensive system access
User Mode Rootkit
● Attached to user-level components (Rings 1 to 3)
● Has administrator-level privileges
● Utilises operating system features for persistence, e.g., registry or task
scheduler
