1 1 00:00:00,270 --> 00:00:02,700 Execution and escalation. 2 2 00:00:02,700 --> 00:00:05,490 In this lesson, we're going to talk about the concepts 3 3 00:00:05,490 --> 00:00:08,190 of execution and escalation attacks. 4 4 00:00:08,190 --> 00:00:10,530 Now, when we talk about attacks against software code, 5 5 00:00:10,530 --> 00:00:12,480 usually these attacks are going to attempt 6 6 00:00:12,480 --> 00:00:16,740 to execute some kind of attacker's code within your system. 7 7 00:00:16,740 --> 00:00:17,670 And the way they do that 8 8 00:00:17,670 --> 00:00:20,010 is by exploiting some kind of a vulnerability. 9 9 00:00:20,010 --> 00:00:21,750 Now, when we talk about this section, 10 10 00:00:21,750 --> 00:00:24,540 we're really going to focus on a couple of key areas. 11 11 00:00:24,540 --> 00:00:26,910 We're going to talk about arbitrary code execution, 12 12 00:00:26,910 --> 00:00:28,680 remote code execution, 13 13 00:00:28,680 --> 00:00:31,500 privilege escalation and rootkits. 14 14 00:00:31,500 --> 00:00:34,350 Now, when we talk about arbitrary code execution, 15 15 00:00:34,350 --> 00:00:36,510 this is a vulnerability that allows an attacker 16 16 00:00:36,510 --> 00:00:38,550 to run their own code or a module 17 17 00:00:38,550 --> 00:00:41,040 that exploits such a vulnerability. 18 18 00:00:41,040 --> 00:00:42,780 Now, essentially, they're able to run 19 19 00:00:42,780 --> 00:00:44,250 what they want on your system 20 20 00:00:44,250 --> 00:00:45,570 without you stopping them. 21 21 00:00:45,570 --> 00:00:48,000 That's what we mean by arbitrary code execution 22 22 00:00:48,000 --> 00:00:50,370 because they're being able to run the things they want to run, 23 23 00:00:50,370 --> 00:00:51,810 which is against what you want to run, 24 24 00:00:51,810 --> 00:00:53,700 and therefore it's arbitrary. 25 25 00:00:53,700 --> 00:00:54,930 Now, another thing we can look at 26 26 00:00:54,930 --> 00:00:57,120 is what's known as remote code execution. 27 27 00:00:57,120 --> 00:01:00,300 Now, remote code execution is like arbitrary code execution. 28 28 00:01:00,300 --> 00:01:01,830 In fact, it's a type of that, 29 29 00:01:01,830 --> 00:01:04,020 but this is really a vulnerability that allows an attacker 30 30 00:01:04,020 --> 00:01:06,000 to transmit code from a remote host 31 31 00:01:06,000 --> 00:01:08,280 for execution on a target host 32 32 00:01:08,280 --> 00:01:10,950 or a module that exploits such a vulnerability. 33 33 00:01:10,950 --> 00:01:14,670 So if I can touch your machine and load up my software, 34 34 00:01:14,670 --> 00:01:16,890 that's arbitrary code execution. 35 35 00:01:16,890 --> 00:01:18,720 If I can do it over the internet, 36 36 00:01:18,720 --> 00:01:20,460 that's remote code execution. 37 37 00:01:20,460 --> 00:01:22,380 That's the difference between these two. 38 38 00:01:22,380 --> 00:01:23,640 Now the next thing we want to talk about 39 39 00:01:23,640 --> 00:01:25,140 is privilege escalation. 40 40 00:01:25,140 --> 00:01:26,940 Now, we've mentioned the term privilege escalation 41 41 00:01:26,940 --> 00:01:28,890 earlier when we talked about threat hunting. 42 42 00:01:28,890 --> 00:01:30,870 One of the things bad guys want to do 43 43 00:01:30,870 --> 00:01:32,520 is they want to be able to operate 44 44 00:01:32,520 --> 00:01:34,200 at higher levels of privilege 45 45 00:01:34,200 --> 00:01:36,450 and that's what privilege escalation is all about. 46 46 00:01:36,450 --> 00:01:38,580 This is going to occur when a user accesses 47 47 00:01:38,580 --> 00:01:40,590 or modify specific resources 48 48 00:01:40,590 --> 00:01:43,170 that they're not entitled to normally access. 49 49 00:01:43,170 --> 00:01:45,750 So if I'm going to do a privilege escalation, 50 50 00:01:45,750 --> 00:01:47,430 what I'm trying to do is attempt to gain 51 51 00:01:47,430 --> 00:01:49,380 administrator or root-level permissions. 52 52 00:01:49,380 --> 00:01:51,300 That's the holy grail for these folks. 53 53 00:01:51,300 --> 00:01:53,100 In fact, if they can get a domain admin, 54 54 00:01:53,100 --> 00:01:54,600 that's even better. 55 55 00:01:54,600 --> 00:01:56,460 Now, when we talk about privilege escalation, 56 56 00:01:56,460 --> 00:01:59,580 we can really break this down into two types of escalation. 57 57 00:01:59,580 --> 00:02:02,160 The first is vertical privilege escalation. 58 58 00:02:02,160 --> 00:02:04,620 This is where somebody goes from a normal user 59 59 00:02:04,620 --> 00:02:06,030 and goes to a higher level. 60 60 00:02:06,030 --> 00:02:08,310 So they're going to go to an admin or a root level. 61 61 00:02:08,310 --> 00:02:09,660 When you hear privilege escalation, 62 62 00:02:09,660 --> 00:02:11,580 this is normally what most people think about. 63 63 00:02:11,580 --> 00:02:13,080 They think about a bad guy getting you 64 64 00:02:13,080 --> 00:02:15,120 to click a link in a spear phishing email 65 65 00:02:15,120 --> 00:02:17,400 that then runs some kind of arbitrary code. 66 66 00:02:17,400 --> 00:02:19,530 That code then gives them escalated rights 67 67 00:02:19,530 --> 00:02:22,110 to be able to be the admin of that local system. 68 68 00:02:22,110 --> 00:02:24,540 That's a vertical privilege escalation. 69 69 00:02:24,540 --> 00:02:25,890 Now, if we're talking about the second type, 70 70 00:02:25,890 --> 00:02:28,560 this is known as horizontal privilege escalation. 71 71 00:02:28,560 --> 00:02:30,390 This occurs when a user accesses 72 72 00:02:30,390 --> 00:02:32,730 or modifies resources they're not entitled to, 73 73 00:02:32,730 --> 00:02:34,860 but it's generally at the same level. 74 74 00:02:34,860 --> 00:02:37,260 So for example, if I'm on the share drive 75 75 00:02:37,260 --> 00:02:39,600 and I'm trying to access George's file 76 76 00:02:39,600 --> 00:02:41,370 and I don't have George's permission, 77 77 00:02:41,370 --> 00:02:43,860 that would be horizontal privilege escalation. 78 78 00:02:43,860 --> 00:02:46,050 If I ran some kind of exploit that gave me permissions 79 79 00:02:46,050 --> 00:02:48,870 to run as a different user, such as George, 80 80 00:02:48,870 --> 00:02:50,910 even though he's not an admin or a root, 81 81 00:02:50,910 --> 00:02:52,590 that's why it's considered horizontal. 82 82 00:02:52,590 --> 00:02:54,960 We both have user permissions at the same level, 83 83 00:02:54,960 --> 00:02:56,820 but he has permissions over his stuff, 84 84 00:02:56,820 --> 00:02:58,020 I have permissions over my stuff. 85 85 00:02:58,020 --> 00:02:59,970 So I might need to break into his account 86 86 00:02:59,970 --> 00:03:00,900 to be able to do that. 87 87 00:03:00,900 --> 00:03:01,733 And in that case, 88 88 00:03:01,733 --> 00:03:04,020 that would be a horizontal privilege escalation. 89 89 00:03:04,020 --> 00:03:06,180 Now, why are privileges so important? 90 90 00:03:06,180 --> 00:03:08,910 Well, it's because every application or process 91 91 00:03:08,910 --> 00:03:10,650 has to have some kind of privileges 92 92 00:03:10,650 --> 00:03:13,500 to read and write data and execute those functions. 93 93 00:03:13,500 --> 00:03:14,970 Now, because those applications 94 94 00:03:14,970 --> 00:03:16,890 have permissions to run their functions 95 95 00:03:16,890 --> 00:03:19,470 and be able to execute functions and read and write data, 96 96 00:03:19,470 --> 00:03:21,750 if we are able to break into that application, 97 97 00:03:21,750 --> 00:03:24,840 we can run things as that application as well. 98 98 00:03:24,840 --> 00:03:28,410 So for example, some applications and some system processes 99 99 00:03:28,410 --> 00:03:30,540 run using the system account. 100 100 00:03:30,540 --> 00:03:33,540 And so, if I can break into that particular application 101 101 00:03:33,540 --> 00:03:35,190 and put some arbitrary code in there, 102 102 00:03:35,190 --> 00:03:37,800 my code is now being run as system 103 103 00:03:37,800 --> 00:03:39,720 and this allows me to do some sort of a hack 104 104 00:03:39,720 --> 00:03:41,760 or attack against that system. 105 105 00:03:41,760 --> 00:03:43,590 So whenever you're running something 106 106 00:03:43,590 --> 00:03:46,050 and somebody's able to put arbitrary code into it, 107 107 00:03:46,050 --> 00:03:48,480 that arbitrary code is going to take the privileges 108 108 00:03:48,480 --> 00:03:50,430 of whoever was running that program. 109 109 00:03:50,430 --> 00:03:51,840 So if Jason's running that program, 110 110 00:03:51,840 --> 00:03:53,190 it has Jason's permission. 111 111 00:03:53,190 --> 00:03:54,450 If the system was running that program, 112 112 00:03:54,450 --> 00:03:55,800 it has the system permission. 113 113 00:03:55,800 --> 00:03:57,180 If an admin was running that program, 114 114 00:03:57,180 --> 00:03:58,410 they have admin permissions. 115 115 00:03:58,410 --> 00:04:00,030 And so again, this is another way 116 116 00:04:00,030 --> 00:04:02,160 that privilege escalation can occur. 117 117 00:04:02,160 --> 00:04:04,620 Now the last thing we want to talk about is rootkits. 118 118 00:04:04,620 --> 00:04:06,810 Now, rootkits should be something that you're familiar with 119 119 00:04:06,810 --> 00:04:08,070 from your Security+ studies 120 120 00:04:08,070 --> 00:04:10,050 and this is just going to be a review for you. 121 121 00:04:10,050 --> 00:04:12,390 A rootkit is essentially a class of malware 122 122 00:04:12,390 --> 00:04:15,420 that modifies system files often at the kernel level 123 123 00:04:15,420 --> 00:04:16,860 to conceal its presence. 124 124 00:04:16,860 --> 00:04:18,750 Now when we're dealing with a rootkit, 125 125 00:04:18,750 --> 00:04:21,690 this is something that is really scary for a lot of people. 126 126 00:04:21,690 --> 00:04:22,523 Why? 127 127 00:04:22,523 --> 00:04:24,660 Because when a rootkit gets into that system, 128 128 00:04:24,660 --> 00:04:25,950 it can hide itself. 129 129 00:04:25,950 --> 00:04:28,050 They are very hard to detect. 130 130 00:04:28,050 --> 00:04:30,270 Now, a lot of times once you have a rootkit installed, 131 131 00:04:30,270 --> 00:04:31,470 this means the attacker 132 132 00:04:31,470 --> 00:04:33,360 can now hide themself in your system. 133 133 00:04:33,360 --> 00:04:35,490 They can install other software like malware. 134 134 00:04:35,490 --> 00:04:37,740 They can create persistence between your computers 135 135 00:04:37,740 --> 00:04:39,900 even if you start rebooting it or shutting it down. 136 136 00:04:39,900 --> 00:04:41,190 They can even maintain persistence 137 137 00:04:41,190 --> 00:04:44,640 between user log off events and other things like this. 138 138 00:04:44,640 --> 00:04:46,230 Now, when you're dealing with rootkits, 139 139 00:04:46,230 --> 00:04:48,210 you have to understand what are we talking about 140 140 00:04:48,210 --> 00:04:50,610 because there are different types of rootkits. 141 141 00:04:50,610 --> 00:04:52,290 Now, before we can get into the different types though, 142 142 00:04:52,290 --> 00:04:55,050 we really have to talk about the idea of rings 143 143 00:04:55,050 --> 00:04:57,120 and the way that systems are built. 144 144 00:04:57,120 --> 00:04:58,740 When we're dealing with a computer, 145 145 00:04:58,740 --> 00:05:00,090 there are multiple rings 146 146 00:05:00,090 --> 00:05:03,000 going from the most privileged to the least privileged. 147 147 00:05:03,000 --> 00:05:05,370 The ring zero is the center of the computer. 148 148 00:05:05,370 --> 00:05:06,390 This is the kernel. 149 149 00:05:06,390 --> 00:05:08,880 This is where the heart of the operating system lies. 150 150 00:05:08,880 --> 00:05:12,150 And this kernel can be a Windows kernel or a Linux kernel. 151 151 00:05:12,150 --> 00:05:14,580 If you're operating something with kernel-level permissions, 152 152 00:05:14,580 --> 00:05:15,480 you're at ring zero, 153 153 00:05:15,480 --> 00:05:18,420 you have the most-privileged access to this machine. 154 154 00:05:18,420 --> 00:05:19,680 And so, if I can get a rootkit 155 155 00:05:19,680 --> 00:05:21,660 that embeds itself into the kernel, 156 156 00:05:21,660 --> 00:05:23,940 that means I have ring zero access. 157 157 00:05:23,940 --> 00:05:25,110 Now, if I have some kind of a rootkit 158 158 00:05:25,110 --> 00:05:27,000 that attaches itself to a device driver, 159 159 00:05:27,000 --> 00:05:29,160 that might be ring one or ring two. 160 160 00:05:29,160 --> 00:05:31,860 If it's going after an application, it might be ring three. 161 161 00:05:31,860 --> 00:05:33,270 And the further out you are, 162 162 00:05:33,270 --> 00:05:35,400 the less privileges you're going to have. 163 163 00:05:35,400 --> 00:05:37,080 So let's go back and look at our rootkits. 164 164 00:05:37,080 --> 00:05:38,430 What are the two types we have? 165 165 00:05:38,430 --> 00:05:41,160 Well, we have kernel mode and user mode. 166 166 00:05:41,160 --> 00:05:42,750 When we have a kernel mode rootkit, 167 167 00:05:42,750 --> 00:05:44,850 this is one that's at that ring zero. 168 168 00:05:44,850 --> 00:05:47,070 It's at the center, it has the most permissions. 169 169 00:05:47,070 --> 00:05:48,480 And so, a kernel mode rootkit 170 170 00:05:48,480 --> 00:05:51,750 is able to gain complete control over your system. 171 171 00:05:51,750 --> 00:05:52,740 Now, if somebody couldn't get 172 172 00:05:52,740 --> 00:05:54,060 a kernel mode rootkit installed, 173 173 00:05:54,060 --> 00:05:56,040 they could only get a user one installed, 174 174 00:05:56,040 --> 00:05:57,540 this would be a user mode rootkit. 175 175 00:05:57,540 --> 00:06:00,120 And these might have administrator-level privileges, 176 176 00:06:00,120 --> 00:06:02,550 but they're using the operating system features 177 177 00:06:02,550 --> 00:06:03,630 for persistence. 178 178 00:06:03,630 --> 00:06:05,610 So they have to be inside the registry. 179 179 00:06:05,610 --> 00:06:08,160 They have to be inside something like Task Scheduler, 180 180 00:06:08,160 --> 00:06:09,750 so that way when you reboot the system, 181 181 00:06:09,750 --> 00:06:11,520 they get that persistence back. 182 182 00:06:11,520 --> 00:06:13,080 So which one's more dangerous? 183 183 00:06:13,080 --> 00:06:14,250 A kernel mode rootkit 184 184 00:06:14,250 --> 00:06:16,500 because it's all the way down in ring zero. 185 185 00:06:16,500 --> 00:06:18,390 And therefore, that's going to be more dangerous 186 186 00:06:18,390 --> 00:06:19,383 for our systems.