Which of the following is an example of privilege escalation?
|
Derrick Rountree, in
Security for Microsoft Windows System Administrators, 2011 Privilege escalation is using a vulnerability to
gain privileges other than what was originally intended for the user. There are two main types of privilege escalation: horizontal and vertical. You need to understand these types of privilege escalation and how to protect against privilege escalation in general. Horizontal privilege escalation is when a user gains the access rights of another user who has the same
access level as he or she does. That might sound a little weird. You might wonder why someone would want to gain the rights of someone at the same level as that person. Here’s an example. Let’s say Robin and Liz both have accounts with the same financial institution. They have the same account types and account profiles. Robin may attempt to gain access to what Liz has access to, meaning Liz’s account. So, although they both have the same access levels, Robin can benefit from having access to
Liz’s account. Robin can then transfer or withdraw money out of Liz’s account. Generally, when someone attempts to hack into a system, it’s because they want to perform some action on the system. This could be damaging the system or stealing information. Oftentimes, this requires a privilege level the attacker does not possess. This is where vertical privilege
escalation comes in. Vertical privilege escalation is when an attacker uses a flaw in the system to gain access above what was intended for him or her. This is what most people think of when they hear privilege escalation. There are many vulnerabilities that can lead to privilege escalation. Some of the most common are cross-site scripting,
improper cookie handling, and weak passwords. Cross-site scripting and improper cookie handling can be protected against programmatically. Weak passwords require end-user education and the setting of password requirements. You can set requirements for password complexity and password age limits. There are two other widely used methods of preventing privilege escalation. They are the principle of least privilege and the separation of privileges. When you are
dealing with software, the principle of least privilege suggests that software modules or processes only have rights to perform the actions intended to be done by that module or process. The module should not have access to any other parts of the application, operating system, or file system. This way, if there is a vulnerability in that process and it is compromised, the attacker will only have access to a very limited area of the system. Separation of
privileges goes hand in hand with the principle of least privilege. Separation of privileges is dividing a program or process into smaller parts. Each of these parts has specific duties to perform. You have to be very careful with service accounts. Remember, when you specify a particular account for a service, everything that service does runs in the context of
that user. If that service were to be compromised, the attacker would basically have the rights of the account that was used to run the service. You also need to be especially careful with services that can be used to run other commands, for example, the scheduler service. Let’s say Ileana wants to execute a command that requires administrative privileges that she doesn’t have. If your scheduler service runs with a service account that has administrative privileges, Ileana can schedule the
command prompt to run. When the scheduler starts the command prompt, it will be running with administrative privileges. Then, every command Ileana executes in the command prompt will run with administrative privileges. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597495943000041 Active Directory – Escalation of PrivilegeRob Kraus, ... Naomi J. Alpern, in Seven Deadliest Microsoft Attacks, 2010 Scenario 3: Horizontal EscalationHorizontal privilege escalation can allow an attacker to gain access to data that may not necessarily belong to him. In poorly designed applications, an attacker may have the capability of identifying flaws within a Web application that allows him access to other users' information. Once access is gained to another users' data or account via leveraging flaws, he may modify, copy, destroy, or use the data for his needs. In this scenario, the attacker works as a telemarketer for a training company that sells training to potential students who want to pass information technology (IT) certifications. The job is okay, but sometimes it feels like all our attacker does is make calls and cross his fingers whether the call will result in a sale. Part of the job is to track all of the potential sales or “leads” in a custom Web application developed by corporate application developers. All telemarketers are required to keep track of their leads and the progress made toward a sale. Our attacker is having a slow month and needs to make sure he is performing well so he can keep his job. He notices that if he changes the employee ID number displayed in the URL of the lead-tracking Web application, he can see and modify other telemarketers' leads. He decides to change the employee ID to one of the employees he works with (but is not too fond of) and views the status of several of the coworker's leads. Since the attacker has successfully performed a horizontal escalation of privileges attack and can view and modify the coworker's leads, he decides to use this access to make his productivity numbers look better than they currently are. The attacker deletes a few of the coworker's leads and can now re-create the leads under the context of his own account. The attacker has now “skimmed” several of the accounts and improved his productivity numbers, keeping him well within range of another successful sales month. Attacks such as the one described in this scenario are still relevant today and pose a significant security threat to organizations. Imagine if this type of scenarios was played out against your online backing account. What dangers could you think of? What if another customer from your bank was able to access your account by using horizontal privilege escalation attacks? Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597495516000029 Organization of #operationsM. Sprengers, J. van Haaster, in Cyber Guerilla, 2016 Escalate privilegesDepending on the goal, strategy, and chosen TTPs, the guerilla band can find themselves in the position where they have limited access rights on the device (server, laptop, etc.) after first compromise. For example, if the hacker group successfully exploited a vulnerability in the web server software they have the access rights of that software on the underlying operating system. If they have infected a regular employee (eg, through spear phishing), they have the access rights of the employee on his workstation. As this is not always a sufficient form of access, the hacker group can perform so-called “vertical privilege escalation”: upgrading the access rights from the current user or process to the user or process with higher access rights on the compromised machine (such as an administrator). By doing so, the guerilla band can retrieve important system files (such as the file where the passwords of other users are stored), create backdoors more easily, and possibly login to other systems and services (so-called “lateral movement,” which will be described later). Common vertical privilege escalation paths are as follows: ■Searching for passwords of higher privileged accounts that are stored in (configuration) files on the compromised machine. ■Editing scripts or (service) executables that are launched with high privileges (eg, during boot time). ■Editing the source code of a web application that is running with high privileges. ■Exploiting a common or zero-day vulnerability in the operating system or web application that is running with high privileges. ■Misuse configuration errors, such as unquoted service paths in Windows. It is important to understand that vertical privilege escalation is optional. As discussed earlier, the guerilla band should not perform privilege escalation if it does not serve a purpose or when it is just used to show off to others. For many TTPs it is sufficient to have a compromised machine that just provides network-level access to the target network, without requiring high privileges on that specific machine. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9780128051979000036 Exploiting SQL InjectionJustin Clarke, in SQL Injection Attacks and Defense, 2009 Privilege Escalation on Unpatched ServersEven if OPENROWSET is probably the most common privilege escalation vector on SQL Server, it is not the only one: If your target database server is not fully updated with the latest security patches, it might be vulnerable to one or more well-known attacks. Sometimes network administrators do not have the resources to ensure that all the servers on their networks are constantly updated. Other times, they simply lack the awareness to do so. Yet other times, if the server is particularly critical and the security fix has not been carefully tested in an isolated environment, the update process could be kept on hold for days or even weeks, leaving the attacker with a window of opportunity. In these cases, a precise fingerprinting of the remote server is paramount in determining which flaws might be present and whether they can be safely exploited. At the time of this writing, the latest vulnerability affecting SQL Server 2000 and 2005 (but not SQL Server 2008) is a heap overflow found by Bernhard Mueller in the sp_replwritetovarbin stored procedure. Disclosed in December 2008, it enables you to run arbitrary code with administrative privileges on the affected host; exploit code was made publicly available shortly after the vulnerability was published. Also at the time of this writing, no security fix had yet been released, and the only workaround is to remove the vulnerable stored procedure. You can exploit the vulnerability through SQL injection by injecting a malicious query that calls sp_replwritetovarbin, overflowing the memory space and executing the malicious shell code. However, a failed exploitation can cause a denial of service (DoS) condition, so be careful if you attempt this attack! More information about this vulnerability is available at www.securityfocus.com/bid/32710. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597494243000049 Application SecurityJason Andress, in The Basics of Information Security (Second Edition), 2014 Privilege escalationOur last category of major database security issues is that of privilege escalation. In essence, privilege escalation is a category of attack in which we make use of any of a number of methods to increase the level of access above what we are authorized to have or have managed to gain on the system or application through attack. Generally speaking, privilege escalation is aimed at gaining administrative access to the software in order to carry out other attacks without needing to worry about not having the access required. As we mentioned earlier in the chapter, SQL injection is a very common attack against databases that are accessible through a Web interface and is largely an issue of not filtering or validating inputs properly. SQL injection can be used to gain information from the database in an unauthorized manner, modify data contained in the database, and perform many other similar activities. SQL injection can also be used to gain or escalate privileges in the database. One of the more common SQL injection examples is to send the string “or” 1′=1′ as the input in a username field for an application. If the application has not filtered the input properly, this may cause it to automatically record that we have entered a legitimate username, which we have clearly not done, allowing us to potentially escalate the level of privilege to which we have access. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9780128007440000129 Privilege Escalation & PasswordsJaron Bradley, in OS X Incident Response, 2016 Privilege EscalationIn this section we will run a quick break down of privilege escalation exploits and methodologies that have given attackers root access in the past. Unix permissions are set up to be very useful and incredibly powerful if handled appropriately. Most of the functionality built into the permissions assumes that you know what you’re doing. This has always been the way of Unix. When it comes to permissions on OS X some users may be clueless. Escalation issues can arise when an untrained user begins to change permissions without knowing what they are doing. Issues can also arise when a user simply installs software without knowing what comes packaged with it. The more software you have running as root, the higher the chances are that an attacker may be able to exploit one of these packages. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B978012804456800008X Stairway to Successful Kernel ExploitationEnrico Perla, Massimiliano Oldani, in A Guide to Kernel Exploitation, 2011 Raising CredentialsRaising credentials is the most common task that almost all local privilege escalation exploits perform. Credentials are kept in one or more structures contained in the process control block and they describe what a process is allowed to do. Storing credentials can be as simple as an integer value identifying the user, as in the traditional UNIX root/generic user model, or representing a whole set of privileges or security tokens, as is usually the case when a role-based access control system and the least privilege model are in place (tokens are the typical privilege model on Windows). Different operating systems use different authentication and authorization models, but most of the time the sequence that leads to a certain user being authorized or denied a set of operations can be summarized in the following steps: 1.The user authenticates itself on the system (e.g., through the classic login/password mechanism). 2.The system gives the user a set of security credentials. 3.The authorization subsystem uses these credentials to validate any further operation that the user performs. After the user has correctly logged in (the authentication phase), the kernel dynamically builds the series of structures that holds information related to the security credentials assigned to the user. Every new process spawned by the user will inherit the aforementioned credentials, unless the user specifies differently (the operating system always provides a way to restrict the set of privileges at process creation time). Whenever a process wants to perform an operation, the kernel matches the specific request with the stored set of credentials and either executes the operation on top of the process or returns an error. The goal of the shellcode is to modify those credentials so that an extended set of privileges is granted to your user/process. Since the credential structures are stored inside the process control block, it is usually quite easy to reach them from inside your shellcode. There are two main ways to identify the correct values to change: •You can use fixed/hardcoded offsets and perform very simple safety checks before using them. For example, if you need to dereference a pointer to reach a structure, you would just check that the address you are about to dereference is within the kernel-land address space. •You can use a heuristic approach. Credential structures have a precise layout in memory, and you know what credentials you were granted. Based on that, you perform a pattern match in memory to find the correct values to change. Relative offsets inside a structure may change, and using this heuristic approach you can figure out the correct place at runtime. In general, a hybrid approach can be used against nearly all kernels, identifying the offsets that have been constant over the years and using more or less sophisticated heuristics to derive the other ones. A typical and effective heuristic is to look for specific signatures of structure members that you can predict. For example, a process-based reference counter would have an upper bound value with the number of processes (easy to check), or in a combined environment a kernel address will always have a value higher (or lower, depending on where the kernel is placed) than the split address. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597494861000036 Embedded securityJ. Rosenberg, in Rugged Embedded Systems, 2017 3.8 Code Injection AttacksCode injection is a dangerous attack that exploits a bug caused by processing invalid data. Injection is used by an attacker to introduce (or “inject”) code into a vulnerable computer program and change the course of execution. The result of successful code injection is often disastrous (for instance: code injection is used by some computer worms to propagate). Injection flaws occur when an application sends untrusted data to an interpreter. Injection flaws are very prevalent, particularly in legacy code. They are often found in SQL, LDAP, Xpath, or NoSQL queries; OS commands; XML parsers, SMTP headers, program arguments, etc. Injection flaws are easy to discover when examining code, but frequently hard to discover via testing. Scanners and fuzzers can help attackers find injection flaws. Injection can result in data loss or corruption, lack of accountability, or denial of access. Injection can sometimes lead to complete host takeover. Code injection techniques are popular in system hacking or cracking to gain information, privilege escalation or unauthorized access to a system. Code injection can be used malevolently for many purposes, including: •Arbitrarily modify values in a database through a type of code injection called SQL injection. The impact of this can range from website defacement to serious compromise of sensitive data. •Install malware or execute malevolent code on a server, by injecting server scripting code (such as PHP or ASP). •Privilege escalation to root permissions by exploiting Shell Injection vulnerabilities in a setuid root binary on UNIX, or Local System by exploiting a service on Windows. •Attacking web users with HTML/Script injection (cross-site scripting). To build embedded systems or the large computer systems that control them in such a way as to prevent code injection the important thing is to detect and isolate managed and unmanaged code injections by: •Runtime image hash validation. Capture a hash of a part or complete image of the executable loaded into memory, and compare it with stored and expected hash. •Enforce at the processor (hardware) level a rule that no data coming from outside the processor can ever be instructions to execute. On some processors such as x86, a bit such as the NX bit allows data to be stored in special memory sections that are marked as nonexecutable. The processor is made aware that no code exists in that part of memory, and refuses to execute anything found in there. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9780128024591000117 Securing Cloud Computing SystemsCem Gurkok, in Computer and Information Security Handbook (Third Edition), 2017 General RisksLet's continue by looking at the following general risks: •Network failures •Privilege escalation •Social engineering •Loss or compromise of operational and security logs or audit trails •Backup loss Unauthorized physical access and theft of equipment •Natural disasters Network FailuresThis risk is one of the highest risks since it directly affects service delivery. It exists due to network misconfiguration, system vulnerabilities, lack of resource isolation, and poor or untested business continuity (BC) and disaster recovery (DR) plans. Network traffic modification can also be a risk for a customer and cloud provider if provisioning isn't done properly or there are no traffic encryption or vulnerability assessments. Privilege EscalationAlthough there is a low probability of exploitation, privilege escalation can cause loss of customer data, and access control. A malicious entity can therefore take control of large portions of the cloud platform. The risk manifests itself due to authentication, authorization, and other access control vulnerabilities, hypervisor vulnerabilities (cloudbursting), and misconfiguration. Social EngineeringThis risk is one of the most disregarded since most technical staff focus on the nonhuman aspects of their platforms. The exploitation of this risk has caused loss of reputation for cloud service providers, such as Amazon and Apple, due to the publicity of the events. This risk can be easily be minimized by security awareness training, proper user provisioning, resource isolation, data encryption, and proper physical security procedures. Loss or Compromise of Operational and Security Logs or Audit TrailsOperational logs can be vulnerable due to lack of policy or poor procedures for logs collection. This would also include retention, access management vulnerabilities, user deprovisioning vulnerabilities, lack of forensic readiness, and OS vulnerabilities. Backup LossThis high impact risk affects company reputation, all backed up data, and service delivery. It also occurs due to inadequate physical security procedures, access management vulnerabilities, and user deprovisioning vulnerabilities. Unauthorized Physical Access and Theft of EquipmentThe probability of malicious actors gaining access to a physical location is very low, but in the event of such occurrence, the impact to the cloud provider and its customers is very high. It can affect company reputation, and data hosted on premises and the security risk it brings is due to inadequate physical security procedures. Natural DisastersThis risk is often ignored but can have a high impact on the businesses involved in the event of its occurrence. If a business has a poor or untested continuity and DR plan or lacks one, their reputation, data, and service delivery can be severely compromised. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9780128038437000636 Securing Cloud Computing SystemsCem Gurkok, in Network and System Security (Second Edition), 2014 General RisksLet’s continue by looking at the following general risks: •Network failures •Privilege escalation •Social engineering •Loss or compromise of operational and security logs or audit trails •Backup loss •Unauthorized physical access and theft of equipment •Natural disasters Network FailuresNetwork failure is one of the highest risks since it directly affects service delivery. It exists due to network misconfiguration, system vulnerabilities, lack of resource isolation, and poor or untested business continuity and disaster recovery plans. Network traffic modification can also be a risk for a customer and cloud provider; if provisioning isn’t done properly, there is no traffic encryption or vulnerability assessment. Privilege EscalationAlthough this risk has a low probability of exploitation, it can cause loss of customer data and access control. A malicious entity can therefore take control of large portions of the cloud platform. The risk manifests itself owing to authentication, authorization, and other access control vulnerabilities, hypervisor vulnerabilities (cloud bursting), and misconfiguration. Social EngineeringThis risk is one of the most disregarded risks since most technical staff focuses on the nonhuman aspects of their platforms. The exploitation of this risk has caused loss of reputation for cloud service providers, such as Amazon and Apple due to the publicity of the events. This risk can be easily minimized by security awareness training, proper user provisioning, resource isolation, data encryption, and proper physical security procedures. Loss or Compromise of Operational and Security Logs or Audit TrailsOperational logs can be vulnerable due to lack of policy or poor procedures for log collection. This would also include retention, access management vulnerabilities, user deprovisioning vulnerabilities, lack of forensic readiness, and operating system vulnerabilities. Backup LossThis high-impact risk affects company reputation, all backed up data, and service delivery. It also occurs owing to inadequate physical security procedures, access management vulnerabilities, and user deprovisioning vulnerabilities. Unauthorized Physical Access and Theft of EquipmentThe probability of malicious actors gaining access to a physical location is very low, but in the event of such an occurrence, the impact to the cloud provider and its customers is very high. It can affect company reputation and data hosted on premises; the risk is due to inadequate physical security procedures. Natural DisastersThis risk is another ignored risk that can have a high impact on the businesses involved in the event of its occurrence. If a business has a poor or an untested business continuity and disaster recovery plan or lacks one, its reputation, data, and service delivery can be severely compromised. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9780124166899000046 Which of the following is a privilege escalation?Privilege escalation is a type of network attack used to gain unauthorized access to systems within a security perimeter. Attackers start by finding weak points in an organization's defenses and gaining access to a system.
Which of the following are examples of privilege escalation attacks?Real-world Example of Privilege Escalation Attacks
Windows sticky keys. Windows Sysinternals. Process injection. Linux Password user enumeration.
Which of the following is an example of an elevation of privilege issue?Vertical privilege escalation (aka elevation of privilege or EoP) — Here, a malicious user gains access to a lower-level account and uses it to gain higher level privileges. For example, a hacker might compromise a user's internet bank account user and then try to get access to site administrative functions.
What is privilege escalation quizlet?Definition. 1 / 16. Privilege escalation is required when you want to access system resources that you are not authorized to access. Privilege escalation takes place in two forms. They are vertical privilege escalation and horizontal privilege escalation.
|
