-: Execution and escalation. 2 2
In this lesson, we're going to talk about the concepts 3 3
of execution and escalation attacks. 4 4
Now, when we talk about attacks against software code, 5 5
usually these attacks are going to attempt 6 6
to execute some kind of attacker's code within your system. 7 7
And the way they do that 8 8
is by exploiting some kind of a vulnerability. 9 9
Now, when we talk about this section, 10 10
we're really going to focus on a couple of key areas. 11 11
We're going to talk about arbitrary code execution, 12 12
remote code execution, 13 13
privilege escalation and rootkits. 14 14
Now, when we talk about arbitrary code execution, 15 15
this is a vulnerability that allows an attacker 16 16
to run their own code or a module 17 17
that exploits such a vulnerability. 18 18
Now, essentially, they're able to run 19 19
what they want on your system 20 20
without you stopping them. 21 21
That's what we mean by arbitrary code execution 22 22
because they're being able to run the things they want to run, 23 23
which is against what you want to run, 24 24
and therefore it's arbitrary. 25 25
Now, another thing we can look at 26 26
is what's known as remote code execution. 27 27
Now, remote code execution is like arbitrary code execution. 28 28
In fact, it's a type of that, 29 29
but this is really a vulnerability that allows an attacker 30 30
to transmit code from a remote host 31 31
for execution on a target host 32 32
or a module that exploits such a vulnerability. 33 33
So if I can touch your machine and load up my software, 34 34
that's arbitrary code execution. 35 35
If I can do it over the internet, 36 36
that's remote code execution. 37 37
That's the difference between these two. 38 38
Now the next thing we want to talk about 39 39
is privilege escalation. 40 40
Now, we've mentioned the term privilege escalation 41 41
earlier when we talked about threat hunting. 42 42
One of the things bad guys want to do 43 43
is they want to be able to operate 44 44
at higher levels of privilege 45 45
and that's what privilege escalation is all about. 46 46
This is going to occur when a user accesses 47 47
or modify specific resources 48 48
that they're not entitled to normally access. 49 49
So if I'm going to do a privilege escalation, 50 50
what I'm trying to do is attempt to gain 51 51
administrator or root-level permissions. 52 52
That's the holy grail for these folks. 53 53
In fact, if they can get a domain admin, 54 54
that's even better. 55 55
Now, when we talk about privilege escalation, 56 56
we can really break this down into two types of escalation. 57 57
The first is vertical privilege escalation. 58 58
This is where somebody goes from a normal user 59 59
and goes to a higher level. 60 60
So they're going to go to an admin or a root level. 61 61
When you hear privilege escalation, 62 62
this is normally what most people think about. 63 63
They think about a bad guy getting you 64 64
to click a link in a spear phishing email 65 65
that then runs some kind of arbitrary code. 66 66
That code then gives them escalated rights 67 67
to be able to be the admin of that local system. 68 68
That's a vertical privilege escalation. 69 69
Now, if we're talking about the second type, 70 70
this is known as horizontal privilege escalation. 71 71
This occurs when a user accesses 72 72
or modifies resources they're not entitled to, 73 73
but it's generally at the same level. 74 74
So for example, if I'm on the share drive 75 75
and I'm trying to access George's file 76 76
and I don't have George's permission, 77 77
that would be horizontal privilege escalation. 78 78
If I ran some kind of exploit that gave me permissions 79 79
to run as a different user, such as George, 80 80
even though he's not an admin or a root, 81 81
that's why it's considered horizontal. 82 82
We both have user permissions at the same level, 83 83
but he has permissions over his stuff, 84 84
I have permissions over my stuff. 85 85
So I might need to break into his account 86 86
to be able to do that. 87 87
And in that case, 88 88
that would be a horizontal privilege escalation. 89 89
Now, why are privileges so important? 90 90
Well, it's because every application or process 91 91
has to have some kind of privileges 92 92
to read and write data and execute those functions. 93 93
Now, because those applications 94 94
have permissions to run their functions 95 95
and be able to execute functions and read and write data, 96 96
if we are able to break into that application, 97 97
we can run things as that application as well. 98 98
So for example, some applications and some system processes 99 99
run using the system account. 100 100
And so, if I can break into that particular application 101 101
and put some arbitrary code in there, 102 102
my code is now being run as system 103 103
and this allows me to do some sort of a hack 104 104
or attack against that system. 105 105
So whenever you're running something 106 106
and somebody's able to put arbitrary code into it, 107 107
that arbitrary code is going to take the privileges 108 108
of whoever was running that program. 109 109
So if Jason's running that program, 110 110
it has Jason's permission. 111 111
If the system was running that program, 112 112
it has the system permission. 113 113
If an admin was running that program, 114 114
they have admin permissions. 115 115
And so again, this is another way 116 116
that privilege escalation can occur. 117 117
Now the last thing we want to talk about is rootkits. 118 118
Now, rootkits should be something that you're familiar with 119 119
from your Security+ studies 120 120
and this is just going to be a review for you. 121 121
A rootkit is essentially a class of malware 122 122
that modifies system files often at the kernel level 123 123
to conceal its presence. 124 124
Now when we're dealing with a rootkit, 125 125
this is something that is really scary for a lot of people. 126 126
Why? 127 127
Because when a rootkit gets into that system, 128 128
it can hide itself. 129 129
They are very hard to detect. 130 130
Now, a lot of times once you have a rootkit installed, 131 131
this means the attacker 132 132
can now hide themself in your system. 133 133
They can install other software like malware. 134 134
They can create persistence between your computers 135 135
even if you start rebooting it or shutting it down. 136 136
They can even maintain persistence 137 137
between user log off events and other things like this. 138 138
Now, when you're dealing with rootkits, 139 139
you have to understand what are we talking about 140 140
because there are different types of rootkits. 141 141
Now, before we can get into the different types though, 142 142
we really have to talk about the idea of rings 143 143
and the way that systems are built. 144 144
When we're dealing with a computer, 145 145
there are multiple rings 146 146
going from the most privileged to the least privileged. 147 147
The ring zero is the center of the computer. 148 148
This is the kernel. 149 149
This is where the heart of the operating system lies. 150 150
And this kernel can be a Windows kernel or a Linux kernel. 151 151
If you're operating something with kernel-level permissions, 152 152
you're at ring zero, 153 153
you have the most-privileged access to this machine. 154 154
And so, if I can get a rootkit 155 155
that embeds itself into the kernel, 156 156
that means I have ring zero access. 157 157
Now, if I have some kind of a rootkit 158 158
that attaches itself to a device driver, 159 159
that might be ring one or ring two. 160 160
If it's going after an application, it might be ring three. 161 161
And the further out you are, 162 162
the less privileges you're going to have. 163 163
So let's go back and look at our rootkits. 164 164
What are the two types we have? 165 165
Well, we have kernel mode and user mode. 166 166
When we have a kernel mode rootkit, 167 167
this is one that's at that ring zero. 168 168
It's at the center, it has the most permissions. 169 169
And so, a kernel mode rootkit 170 170
is able to gain complete control over your system. 171 171
Now, if somebody couldn't get 172 172
a kernel mode rootkit installed, 173 173
they could only get a user one installed, 174 174
this would be a user mode rootkit. 175 175
And these might have administrator-level privileges, 176 176
but they're using the operating system features 177 177
for persistence. 178 178
So they have to be inside the registry. 179 179
They have to be inside something like Task Scheduler, 180 180
so that way when you reboot the system, 181 181
they get that persistence back. 182 182
So which one's more dangerous? 183 183
A kernel mode rootkit 184 184
because it's all the way down in ring zero. 185 185
And therefore, that's going to be more dangerous 186 186
for our systems.