1 00:00:00,000 --> 00:00:01,650 In this lesson we're going to talk 2 00:00:01,650 --> 00:00:05,550 about the concepts of execution and escalation attacks. 3 00:00:05,550 --> 00:00:07,890 Now, when we talk about attacks against software code 4 00:00:07,890 --> 00:00:11,520 usually these attacks are going to attempt to execute some kind 5 00:00:11,520 --> 00:00:14,100 of attacker's code within your system. 6 00:00:14,100 --> 00:00:15,180 And the way they do that is 7 00:00:15,180 --> 00:00:17,340 by exploiting some kind of a vulnerability. 8 00:00:17,340 --> 00:00:19,080 Now, when we talk about this section 9 00:00:19,080 --> 00:00:21,870 we're really going to focus on a couple of key areas. 10 00:00:21,870 --> 00:00:24,270 We're going to talk about arbitrary code execution, 11 00:00:24,270 --> 00:00:28,830 remote code execution, privilege escalation, and rootkits. 12 00:00:28,830 --> 00:00:31,710 Now, when we talk about arbitrary code execution 13 00:00:31,710 --> 00:00:33,840 this is a vulnerability that allows an attacker 14 00:00:33,840 --> 00:00:35,130 to run their own code 15 00:00:35,130 --> 00:00:38,370 or a module that exploits such a vulnerability. 16 00:00:38,370 --> 00:00:40,800 Now essentially, they're able to run what they want 17 00:00:40,800 --> 00:00:42,900 on your system without you stopping them. 18 00:00:42,900 --> 00:00:45,330 That's what we mean by arbitrary code execution 19 00:00:45,330 --> 00:00:47,670 because they're being able to run the things they want to run, 20 00:00:47,670 --> 00:00:49,170 which is against what you want to run, 21 00:00:49,170 --> 00:00:51,030 and therefore it's arbitrary. 22 00:00:51,030 --> 00:00:52,080 Now, another thing we can look 23 00:00:52,080 --> 00:00:54,450 at is what's known as remote code execution. 24 00:00:54,450 --> 00:00:57,630 Now, remote code execution is like arbitrary code execution. 25 00:00:57,630 --> 00:00:59,820 In fact, it's a type of that, but this is really 26 00:00:59,820 --> 00:01:02,250 a vulnerability that allows an attacker to transmit code 27 00:01:02,250 --> 00:01:05,640 from a remote host for execution on a target host 28 00:01:05,640 --> 00:01:08,310 or a module that exploits such a vulnerability. 29 00:01:08,310 --> 00:01:10,440 So if I can touch your machine 30 00:01:10,440 --> 00:01:14,220 and load up my software, that's arbitrary code execution. 31 00:01:14,220 --> 00:01:16,080 If I can do it over the internet 32 00:01:16,080 --> 00:01:17,820 that's remote code execution. 33 00:01:17,820 --> 00:01:19,740 That's the difference between these two. 34 00:01:19,740 --> 00:01:20,700 Now the next thing we want to talk 35 00:01:20,700 --> 00:01:22,500 about is privilege escalation. 36 00:01:22,500 --> 00:01:24,300 Now we've mentioned the term privilege escalation. 37 00:01:24,300 --> 00:01:26,250 earlier when we talked about threat hunting. 38 00:01:26,250 --> 00:01:28,860 One of the things bad guys want to do is they want to be 39 00:01:28,860 --> 00:01:31,560 able to operate at higher levels of privilege. 40 00:01:31,560 --> 00:01:33,810 And that's what privilege escalation is all about. 41 00:01:33,810 --> 00:01:35,910 This is going to occur when a user accesses 42 00:01:35,910 --> 00:01:38,460 or modify specific resources that they're not 43 00:01:38,460 --> 00:01:40,500 entitled to normally access. 44 00:01:40,500 --> 00:01:42,681 So if I'm going to do a privilege escalation 45 00:01:42,681 --> 00:01:45,450 what I'm trying to do is attempt to gain administrator 46 00:01:45,450 --> 00:01:46,710 or root level permissions. 47 00:01:46,710 --> 00:01:48,660 That's the holy grail for these folks. 48 00:01:48,660 --> 00:01:51,960 In fact, if they can get a domain admin, that's even better. 49 00:01:51,960 --> 00:01:53,790 Now, when we talk about privilege escalation 50 00:01:53,790 --> 00:01:56,940 we can really break this down into two types of escalation. 51 00:01:56,940 --> 00:01:59,183 The first is vertical privilege escalation. 52 00:01:59,183 --> 00:02:00,750 This is where somebody goes 53 00:02:00,750 --> 00:02:03,390 from a normal user and goes to a higher level. 54 00:02:03,390 --> 00:02:05,640 So they're going to go to an admin or a root level. 55 00:02:05,640 --> 00:02:06,990 When you hear privilege escalation 56 00:02:06,990 --> 00:02:08,940 this is normally what most people think about. 57 00:02:08,940 --> 00:02:11,039 They think about a bad guy getting you to click a link 58 00:02:11,039 --> 00:02:13,440 in a spear-phishing email that then runs some kind 59 00:02:13,440 --> 00:02:14,730 of arbitrary code. 60 00:02:14,730 --> 00:02:16,860 That code then gives them escalated rights 61 00:02:16,860 --> 00:02:19,440 to be able to be the admin of that local system. 62 00:02:19,440 --> 00:02:21,900 That's a vertical privilege escalation. 63 00:02:21,900 --> 00:02:23,250 Now, if we're talking about the second type, 64 00:02:23,250 --> 00:02:25,890 this is known as horizontal privilege escalation. 65 00:02:25,890 --> 00:02:28,890 This occurs when a user accesses or modifies resources 66 00:02:28,890 --> 00:02:30,090 they're not entitled to, 67 00:02:30,090 --> 00:02:32,190 but it's generally at the same level. 68 00:02:32,190 --> 00:02:34,590 So for example, if I'm on the share drive 69 00:02:34,590 --> 00:02:36,960 and I'm trying to access George's file 70 00:02:36,960 --> 00:02:38,700 and I don't have George's permission 71 00:02:38,700 --> 00:02:41,220 that would be horizontal privilege escalation. 72 00:02:41,220 --> 00:02:42,053 If I ran some kind 73 00:02:42,053 --> 00:02:43,740 of exploit that gave me permissions to run 74 00:02:43,740 --> 00:02:45,868 as a different user, such as George, 75 00:02:45,868 --> 00:02:48,240 even though he's not an admin or a route 76 00:02:48,240 --> 00:02:49,920 that's why it's considered horizontal. 77 00:02:49,920 --> 00:02:52,320 We both have user permissions at the same level 78 00:02:52,320 --> 00:02:54,150 but he has permissions over his stuff. 79 00:02:54,150 --> 00:02:56,310 I have permissions over my stuff, so I might need to break 80 00:02:56,310 --> 00:02:58,230 into his account to be able to do that. 81 00:02:58,230 --> 00:02:59,063 And in that case 82 00:02:59,063 --> 00:03:01,380 that would would be a horizontal privilege escalation. 83 00:03:01,380 --> 00:03:03,540 Now, why are privileges so important? 84 00:03:03,540 --> 00:03:05,370 Well, it's because every application 85 00:03:05,370 --> 00:03:08,550 or process has to have some kind of privileges to read 86 00:03:08,550 --> 00:03:10,860 and write data and execute those functions. 87 00:03:10,860 --> 00:03:13,080 Now, because those applications have permissions 88 00:03:13,080 --> 00:03:15,480 to run their functions and be able to execute functions 89 00:03:15,480 --> 00:03:16,800 and read and write data, 90 00:03:16,800 --> 00:03:19,080 if we are able to break into that application 91 00:03:19,080 --> 00:03:22,170 we can run things as that application as well. 92 00:03:22,170 --> 00:03:24,420 So for example, some applications 93 00:03:24,420 --> 00:03:27,870 and some system processes run using the system account. 94 00:03:27,870 --> 00:03:30,590 And so if I can break into that particular application 95 00:03:30,590 --> 00:03:32,520 and put some arbitrary code in there 96 00:03:32,520 --> 00:03:35,130 my code is now being run as system 97 00:03:35,130 --> 00:03:36,570 and this allows me to do some sort 98 00:03:36,570 --> 00:03:39,090 of a hack or attack against that system. 99 00:03:39,090 --> 00:03:40,552 So whenever you're running something 100 00:03:40,552 --> 00:03:43,380 and somebody's able to put arbitrary code into it 101 00:03:43,380 --> 00:03:45,840 that arbitrary code is going to take the privileges 102 00:03:45,840 --> 00:03:47,760 of whoever was running that program. 103 00:03:47,760 --> 00:03:49,200 So if Jason's running that program 104 00:03:49,200 --> 00:03:50,520 it has Jason's permission. 105 00:03:50,520 --> 00:03:51,810 If the system was running that program 106 00:03:51,810 --> 00:03:53,160 it has the system permission. 107 00:03:53,160 --> 00:03:54,510 If an admin was running that program 108 00:03:54,510 --> 00:03:55,740 they have admin permissions. 109 00:03:55,740 --> 00:03:56,573 And so again 110 00:03:56,573 --> 00:03:59,490 this is another way that privilege escalation can occur. 111 00:03:59,490 --> 00:04:01,950 Now the last thing we want to talk about is rootkits. 112 00:04:01,950 --> 00:04:04,819 Now, rootkits should be something that you're familiar 113 00:04:04,819 --> 00:04:05,652 with from your security plus studies 114 00:04:05,652 --> 00:04:07,380 and this is just going to be a review for you. 115 00:04:07,380 --> 00:04:08,970 A rootkit is essentially a class 116 00:04:08,970 --> 00:04:11,730 of malware that modifies system files often 117 00:04:11,730 --> 00:04:14,190 at the kernel level to conceal its presence. 118 00:04:14,190 --> 00:04:16,079 Now when we're dealing with a rootkit 119 00:04:16,079 --> 00:04:19,019 this is something that is really scary for a lot of people. 120 00:04:19,019 --> 00:04:19,853 Why? 121 00:04:19,853 --> 00:04:22,019 Because when a rootkit gets into that system 122 00:04:22,019 --> 00:04:23,310 it can hide itself. 123 00:04:23,310 --> 00:04:25,380 They are very hard to detect. 124 00:04:25,380 --> 00:04:27,600 Now, a lot of times once you have a rootkit installed 125 00:04:27,600 --> 00:04:29,730 this means the attacker can now hide themselves 126 00:04:29,730 --> 00:04:30,690 in your system. 127 00:04:30,690 --> 00:04:32,820 They can install other software like malware. 128 00:04:32,820 --> 00:04:35,100 They can create persistence between your computers 129 00:04:35,100 --> 00:04:37,230 even if you start rebooting it or shutting it down. 130 00:04:37,230 --> 00:04:38,520 They can even maintain persistence 131 00:04:38,520 --> 00:04:42,000 between user log-off events and other things like this. 132 00:04:42,000 --> 00:04:43,590 Now, when you're dealing with rootkits 133 00:04:43,590 --> 00:04:45,330 you have to understand what are we talking 134 00:04:45,330 --> 00:04:47,336 about because there are different types of rootkits. 135 00:04:47,336 --> 00:04:49,650 Now, before we can get into the different types though 136 00:04:49,650 --> 00:04:51,330 we really have to talk about the idea 137 00:04:51,330 --> 00:04:54,450 of rings and the way that systems are built. 138 00:04:54,450 --> 00:04:56,100 When we're dealing with a computer 139 00:04:56,100 --> 00:04:57,690 there are multiple rings going 140 00:04:57,690 --> 00:05:00,360 from the most privileged to the least privileged. 141 00:05:00,360 --> 00:05:02,700 The ring zero is the center of the computer. 142 00:05:02,700 --> 00:05:03,750 This is the kernel. 143 00:05:03,750 --> 00:05:06,210 This is where the heart of the operating system lies. 144 00:05:06,210 --> 00:05:09,480 And this kernel can be a Windows kernel or a Linux kernel. 145 00:05:09,480 --> 00:05:11,910 If you're operating something with kernel level permissions 146 00:05:11,910 --> 00:05:12,840 you're at ring zero. 147 00:05:12,840 --> 00:05:15,780 You have the most privileged access to this machine. 148 00:05:15,780 --> 00:05:17,970 And so if I can get a rootkit that embeds itself 149 00:05:17,970 --> 00:05:20,993 into the kernel, that means I have ring zero access. 150 00:05:20,993 --> 00:05:23,250 Now, if I have some kind of rootkit that attaches itself 151 00:05:23,250 --> 00:05:26,490 to a device driver, that might be ring one or ring two. 152 00:05:26,490 --> 00:05:28,824 If it's going after an application, it might be ring three. 153 00:05:28,824 --> 00:05:31,500 And the further out you are, the less privileges 154 00:05:31,500 --> 00:05:32,730 you're going to have. 155 00:05:32,730 --> 00:05:34,410 So let's go back and look at our rootkits. 156 00:05:34,410 --> 00:05:35,790 What are the two types we have? 157 00:05:35,790 --> 00:05:38,520 Well, we have kernel mode and user mode. 158 00:05:38,520 --> 00:05:41,040 When we have a kernel mode rootkit, this is one that's 159 00:05:41,040 --> 00:05:42,930 at that ring zero, it's at the center, 160 00:05:42,930 --> 00:05:44,430 it has the most permissions. 161 00:05:44,430 --> 00:05:47,160 And so a kernel mode rootkit is able to gain complete 162 00:05:47,160 --> 00:05:48,718 control over your system. 163 00:05:48,718 --> 00:05:51,060 Now, if somebody couldn't get a kernel mode root kit 164 00:05:51,060 --> 00:05:53,370 installed, they can only get a user one installed, 165 00:05:53,370 --> 00:05:54,870 this would be a user mode rootkit. 166 00:05:54,870 --> 00:05:57,480 And these might have administrator level privileges 167 00:05:57,480 --> 00:05:59,880 but they're using the operating system features 168 00:05:59,880 --> 00:06:00,960 for persistence. 169 00:06:00,960 --> 00:06:02,940 So they have to be inside the registry 170 00:06:02,940 --> 00:06:05,490 they have to be inside something like Task Scheduler. 171 00:06:05,490 --> 00:06:07,080 So that way when you reboot the system 172 00:06:07,080 --> 00:06:08,850 they get that persistence back. 173 00:06:08,850 --> 00:06:10,410 So which one's more dangerous? 174 00:06:10,410 --> 00:06:11,670 A kernel mode rootkit 175 00:06:11,670 --> 00:06:13,830 'cause it's all the way down in ring zero. 176 00:06:13,830 --> 00:06:15,720 And therefore that's going to be more dangerous 177 00:06:15,720 --> 00:06:16,683 for our systems.