In this lesson we're going to talk
about the concepts of execution and escalation attacks.
Now, when we talk about attacks against software code
usually these attacks are going to attempt to execute some kind
of attacker's code within your system.
And the way they do that is
by exploiting some kind of a vulnerability.
Now, when we talk about this section
we're really going to focus on a couple of key areas.
We're going to talk about arbitrary code execution,
remote code execution, privilege escalation, and rootkits.
Now, when we talk about arbitrary code execution
this is a vulnerability that allows an attacker
to run their own code
or a module that exploits such a vulnerability.
Now essentially, they're able to run what they want
on your system without you stopping them.
That's what we mean by arbitrary code execution
because they're being able to run the things they want to run,
which is against what you want to run,
and therefore it's arbitrary.
Now, another thing we can look
at is what's known as remote code execution.
Now, remote code execution is like arbitrary code execution.
In fact, it's a type of that, but this is really
a vulnerability that allows an attacker to transmit code
from a remote host for execution on a target host
or a module that exploits such a vulnerability.
So if I can touch your machine
and load up my software, that's arbitrary code execution.
If I can do it over the internet
that's remote code execution.
That's the difference between these two.
Now the next thing we want to talk
about is privilege escalation.
Now we've mentioned the term privilege escalation.
earlier when we talked about threat hunting.
One of the things bad guys want to do is they want to be
able to operate at higher levels of privilege.
And that's what privilege escalation is all about.
This is going to occur when a user accesses
or modify specific resources that they're not
entitled to normally access.
So if I'm going to do a privilege escalation
what I'm trying to do is attempt to gain administrator
or root level permissions.
That's the holy grail for these folks.
In fact, if they can get a domain admin, that's even better.
Now, when we talk about privilege escalation
we can really break this down into two types of escalation.
The first is vertical privilege escalation.
This is where somebody goes
from a normal user and goes to a higher level.
So they're going to go to an admin or a root level.
When you hear privilege escalation
this is normally what most people think about.
They think about a bad guy getting you to click a link
in a spear-phishing email that then runs some kind
of arbitrary code.
That code then gives them escalated rights
to be able to be the admin of that local system.
That's a vertical privilege escalation.
Now, if we're talking about the second type,
this is known as horizontal privilege escalation.
This occurs when a user accesses or modifies resources
they're not entitled to,
but it's generally at the same level.
So for example, if I'm on the share drive
and I'm trying to access George's file
and I don't have George's permission
that would be horizontal privilege escalation.
If I ran some kind
of exploit that gave me permissions to run
as a different user, such as George,
even though he's not an admin or a route
that's why it's considered horizontal.
We both have user permissions at the same level
but he has permissions over his stuff.
I have permissions over my stuff, so I might need to break
into his account to be able to do that.
And in that case
that would would be a horizontal privilege escalation.
Now, why are privileges so important?
Well, it's because every application
or process has to have some kind of privileges to read
and write data and execute those functions.
Now, because those applications have permissions
to run their functions and be able to execute functions
and read and write data,
if we are able to break into that application
we can run things as that application as well.
So for example, some applications
and some system processes run using the system account.
And so if I can break into that particular application
and put some arbitrary code in there
my code is now being run as system
and this allows me to do some sort
of a hack or attack against that system.
So whenever you're running something
and somebody's able to put arbitrary code into it
that arbitrary code is going to take the privileges
of whoever was running that program.
So if Jason's running that program
it has Jason's permission.
If the system was running that program
it has the system permission.
If an admin was running that program
they have admin permissions.
And so again
this is another way that privilege escalation can occur.
Now the last thing we want to talk about is rootkits.
Now, rootkits should be something that you're familiar
with from your security plus studies
and this is just going to be a review for you.
A rootkit is essentially a class
of malware that modifies system files often
at the kernel level to conceal its presence.
Now when we're dealing with a rootkit
this is something that is really scary for a lot of people.
Why?
Because when a rootkit gets into that system
it can hide itself.
They are very hard to detect.
Now, a lot of times once you have a rootkit installed
this means the attacker can now hide themselves
in your system.
They can install other software like malware.
They can create persistence between your computers
even if you start rebooting it or shutting it down.
They can even maintain persistence
between user log-off events and other things like this.
Now, when you're dealing with rootkits
you have to understand what are we talking
about because there are different types of rootkits.
Now, before we can get into the different types though
we really have to talk about the idea
of rings and the way that systems are built.
When we're dealing with a computer
there are multiple rings going
from the most privileged to the least privileged.
The ring zero is the center of the computer.
This is the kernel.
This is where the heart of the operating system lies.
And this kernel can be a Windows kernel or a Linux kernel.
If you're operating something with kernel level permissions
you're at ring zero.
You have the most privileged access to this machine.
And so if I can get a rootkit that embeds itself
into the kernel, that means I have ring zero access.
Now, if I have some kind of rootkit that attaches itself
to a device driver, that might be ring one or ring two.
If it's going after an application, it might be ring three.
And the further out you are, the less privileges
you're going to have.
So let's go back and look at our rootkits.
What are the two types we have?
Well, we have kernel mode and user mode.
When we have a kernel mode rootkit, this is one that's
at that ring zero, it's at the center,
it has the most permissions.
And so a kernel mode rootkit is able to gain complete
control over your system.
Now, if somebody couldn't get a kernel mode root kit
installed, they can only get a user one installed,
this would be a user mode rootkit.
And these might have administrator level privileges
but they're using the operating system features
for persistence.
So they have to be inside the registry
they have to be inside something like Task Scheduler.
So that way when you reboot the system
they get that persistence back.
So which one's more dangerous?
A kernel mode rootkit
'cause it's all the way down in ring zero.
And therefore that's going to be more dangerous
for our systems.