System Hacking Flashcards
Name 3 log-related methods of covering your tracks on a system hack
Disabling auditing
Clearing logs
Manipulating logs
What technique for covering tracks on network is Target system sends a request to the remote system to act on the response.
Reverse shell
What technique for covering tracks on network is Adding data payload to the target’s DNS server to create a back channel to steal information?
DNS tunneling
What technique for covering tracks on network is Using TCP parameters for payload distribution?
TCP parameters
What fields can you use to hide data in a TCP packet?
IP identification field
TCP acknowledgement number
TCP initial sequence number
What does the Privacy.sexy tool do?
Open source tool that can cleanup logs and personal activities.
What does the Auditpol tool do?
Microsoft tool to manipulate audit policies.
What does the MRU-blaster tool do?
Find and remove 30,000 Most Recently Used(MRU) lists.
What is the activity of Recovering passwords from the transmitted or stored data on computer systems?
Password Cracking
What is the non-electronic, passive method of password attack is Collecting information from the target’s trash bins?
Dumpster diving
What is the non-electronic, passive method of password attack is Observing the target while they type in their passwords?
Shoulder surfing
What is the non-electronic, passive method of password attack is Interacting with the target to trick them into revealing their passwords?
Social engineering
What kind of password attack is Load a dictionary file into a password cracking program and The program checks the passwords against user accounts?
Dictionary attack
What kind of password attack is Running every combination of characters until the password is cracked?
Brute-force attack
What kind of password attack is Taking a dictionary and expanding it with guesses using brute-force?
Hybrid attack
What kind of password attack is when Attacker combines several other attacks to crack the password and Used when the attacker has some information about the password?
Rule-based Attack
What kind of password attack is when attacker Guess passwords either by humans or by automated tools using dictionaries and Requires the attacker to manually attempt to log into the target’s machine?
Password guessing
Installed in target machine to get the target’s passwords and usernames.
Trojan/spyware/keylogger
What kind of attack can be performed against systems that use hash functions for the user authentication?
Hash injection
What kind of attack can take place when DNS fails to resolve name queries, the host sends a UDP broadcast message to other hosts asking them to authenticate themselves which can allow an attacker can listen for a NTLM has to crack?
LLMNR/NBT-NS poisoning
LLMNR = Link Local Multicast Name Resolution
NBT-NS = NetBIOS Name Service
What kind of passive online attack is when Attackers sniff credentials by capturing packets that are being transmitted?
Wire sniffing
What kind of passive online attack is when Attacker gains access to the communication channel between the target and server and then extracts information and data they need to gain unauthorized access?
Man-in-the-middle (MITM) attack
What kind of passive online attack is when an attacker can replay information using e.g. extracted authentication token or hashed password after using a sniffer to capture packets and authentication tokens?
Replay attack
What kind of attack is when Attacker never attempts to login to the application server that can be logged and attempts Cracking efforts on a separate system?
Offline attacks
What kind of attack uses the power of machines across the network to decrypt passwords often Used for recovering passwords from hashes?
Distributed network attack (DNA)
What kind of hash attack is faster than brute-force however the trade-off is that it takes a lot of storage to hold these kind of tables?
Rainbow table attack
what kind of hash attack where attacker Tries to find two inputs resulting in same hash value?
Collision attack
What kind of attack tries every possible combination of characters to break the encryption?
Brute-force attack
What kind of attack is a brute-force attack that depends on the higher likelihood of collisions found between random attack attempts and a fixed degree of permutations?
Birthday Attack - Exploits birthday problem in probability theory
What is the countermeasure where the longer the random string, the harder it becomes to break or crack the password and Generates different hashes for the same password?
Password Salting - Hash is used with salt (collection of random bits) to obscure the hash
What is it called when attackers acquire the privileges of the same level of different users?
Horizontal privilege escalation
What is Vertical privilege escalation?
Acquiring higher privileges
What is Horizontal privilege escalation?
Acquiring the privileges of the same level
What is pivoting in system hacking?
Using a compromised system as a launching point into other systems.
E.g. in Metasploit you can add route to first compromised system to access the network beyond it.
What are some techniques on Windows to escalate privileges?
Access token manipulation
File system permissions weakness
Windows application shimming
Windows application shimming
Scheduled tasks
What are some techniques on Mac OS to escalate privileges?
OS X applications dynamic library vulnerability
Launch Daemon
Meltdown vulnerability
Spectre vulnerability
Name 5 Privilege escalation countermeasures
Apply least-privilege: Never grant more privileges than needed!
Use encryption and MFA
Run services as unprivileged accounts
Patch and update regularly
Ensure all executables are write-protected
What does User Access Control (UAC) do on Windows?
Prompts user for potentially dangerous software in Windows
Limits softwares to user privileges until an administrator authorizes an elevation.
Name 3 Privilege escalation tools
BeRoot to check common misconfigurations to find a way to escalate privileges on Linux and Windows
linpostexp: Linux post exploitation enumeration and exploit checking tools
Windows Exploit Suggester & Linux Exploit Suggester
What are 4 classes of remotely executed malicious programs designed to steal information?
Programs that attackers install include:
Backdoors are designed to collect information and gain unauthorized access to the system
Crackers are designed to crack passwords
Keyloggers are designed to record keystrokes
Spyware are designed to capture screenshots and send them to the attacker
What creates backdoor to the system to enable the attacker to access to the system? Hides itself, replaces certain system calls and does not spread by themselves
Rootkits
what are the three Rootkit levels?
Ring 0 - Kernel level
Ring 1/2 - Device Drivers
Ring 3 - Applications
