Attacks and Exploits · Topic 3 of 10
Host-Based Attacks
Understand privilege escalation, process injection and credential dumping on Windows and Linux hosts, with indicators, tool purposes and defences.
- 6 min
- Vertical escalation increases rights, and horizontal escalation reaches peers.
- Windows escalation often comes from service and task misconfiguration, and Linux often from sudo, SUID and writable scripts.
- WinPEAS, LinPEAS and BloodHound help enumerate weaknesses and paths.
What it is
Host-based attacks take place on a single computer after an attacker or tester has some form of access. They turn a low-privilege foothold into higher rights, hide inside legitimate processes, and gather credentials for further use.
This page covers three categories from the exam outline: privilege escalation, process injection and credential dumping. It stays at the level of concepts, indicators and defences.
How it works
Privilege escalation
Privilege escalation raises the rights of an account. Vertical escalation moves up, for example from a standard user to administrator, and horizontal escalation moves sideways to another account at the same level.
Common root causes are:
| Platform | Typical weakness |
|---|---|
| Windows | Services with weak file or registry permissions, unquoted service paths, scheduled tasks running as a high-privilege user, tokens that can be impersonated, stored credentials, missing patches |
| Linux | Misconfigured sudo rules, set-user-ID (SUID) programs that can run other commands, world-writable scripts run by root, weak file permissions, kernel vulnerabilities |
| Both | Credentials left in files, shared passwords, unpatched local flaws |
An unquoted service path is a path with spaces that is not enclosed in quotes, which can make Windows consider unintended program locations. A SUID program runs with the privileges of its owner, so an owner of root makes any flaw in the program valuable.
Testers use enumeration helpers such as WinPEAS and LinPEAS, which list configuration weaknesses on a host, and BloodHound, which maps relationships and attack paths in Active Directory, the Microsoft directory service. They only gather information, and the tester then decides whether to test a weakness.
Defences include least privilege, prompt patching, reviewing sudo and service permissions, application allow lists and removing stored credentials.
Process injection
Process injection runs code inside the memory of another, usually trusted, process. The purpose is to hide, because security tools see a legitimate process name, and sometimes to inherit the target process's privileges.
| Term | Idea |
|---|---|
| Dynamic-link library (DLL) injection | Making a process load a library chosen by the attacker |
| Process hollowing | Starting a legitimate process, then replacing its memory with other code |
| Thread hijacking | Using an existing thread to run different code |
| DLL search order hijacking | Placing a malicious library where an application looks first |
Indicators include a process that opens a handle to another process and writes to its memory, a normal program with unusual child processes or network connections, and a memory region that is both writable and executable. Endpoint detection and response (EDR) tools and the Windows Sysmon utility log these events, for example remote thread creation (event 8) and process access (event 10).
Defences are EDR with memory protection, application control that allows only approved software, patching, and limiting who can debug or inspect processes.
Credential dumping
Credential dumping extracts stored secrets from a compromised host so that they can be reused elsewhere.
| Location | What it holds |
|---|---|
| Local Security Authority Subsystem Service (LSASS) memory | Logged-on credential material, such as hashes and Kerberos tickets |
| Security Account Manager (SAM) database | Local account password hashes |
| NTDS.dit file on a domain controller | Hashes for all domain accounts |
| /etc/shadow on Linux | Password hashes for local users |
| Browser and application stores | Saved passwords and tokens |
| Configuration files, scripts and history | Passwords typed or stored in cleartext |
Mimikatz is the well known tool that popularised credential extraction from memory, and many security products detect it by name and behaviour. Reading LSASS memory from an unexpected process is a classic alert.
Key protections include Credential Guard, which isolates secrets from the normal operating system, running LSASS as a protected process, and removing cleartext passwords. Others are limiting administrator logons to servers, unique local administrator passwords, and EDR alerts on credential access.
If a question describes a normal process that suddenly shows network connections or unusual child processes, think process injection, and if it describes reading LSASS, think credential dumping.
Other host-level topics
- Living off the land: abusing built-in tools such as PowerShell or scheduled tasks, which are signed and trusted, to avoid dropping new files.
- Container and sandbox escape: breaking out of an isolated environment onto the host.
- Persistence and cleanup follow in a later chapter.
More host attack concepts
| Concept | Idea | Defence |
|---|---|---|
| Payload obfuscation | Encoding, packing or encrypting code to defeat signature detection | Behaviour-based detection, which watches what code does rather than its pattern |
| User Account Control (UAC) bypass | Gaining administrator rights without the usual consent prompt | Set UAC to its highest level, and avoid admin rights for daily accounts |
| Shell escape | Breaking out of a restricted shell through an allowed program | Allow only the minimum commands |
| Kiosk escape | Breaking out of a locked-down kiosk application to the desktop through dialogs or help links | Harden kiosk mode and remove escape routes |
Host attack tools
| Tool | Purpose |
|---|---|
| Rubeus | Requests and abuses Kerberos tickets, for example roasting and ticket reuse |
| Certify | Finds vulnerable Active Directory Certificate Services templates |
| Seatbelt | Runs security-relevant survey checks on a Windows host |
| PsExec | A Sysinternals tool that runs processes on remote Windows hosts over Server Message Block (SMB) with administrator credentials |
| Evil-WinRM | A Windows Remote Management (WinRM) shell client used with passwords or hashes |
What to remember for the exam
- Vertical escalation increases rights, and horizontal escalation reaches peers.
- Windows escalation often comes from service and task misconfiguration, and Linux often from sudo, SUID and writable scripts.
- WinPEAS, LinPEAS and BloodHound help enumerate weaknesses and paths.
- Process injection hides code inside another process, for example by DLL injection or process hollowing.
- LSASS memory, the SAM, NTDS.dit and /etc/shadow are the usual credential stores.
- Mimikatz is a well known credential extraction tool.
- Credential Guard, protected LSASS and EDR are major defences.
- Least privilege, patching and application control reduce all three attack types.
Common mistakes
Thinking escalation needs a new exploit. Misconfiguration and reused credentials are frequent causes, and they are often easier to find than software bugs.
Mixing up SAM and NTDS.dit. SAM holds local accounts, and NTDS.dit holds domain accounts on a domain controller.
Assuming antivirus alone stops injection. Process injection is designed to look normal, so behaviour-based EDR is the better control.
Forgetting Linux. SUID, sudo and cron questions are as likely as Windows ones.
Leaving test artefacts. Any tool or account added during testing must be tracked for cleanup.
Check yourself
What is the difference between vertical and horizontal privilege escalation?
Vertical raises rights to a higher level, while horizontal reaches another account at the same level.
Where does a Windows domain controller store domain account hashes?
In the NTDS.dit file.
Name one defence against credential dumping from LSASS.
Credential Guard, or running LSASS as a protected process, or EDR monitoring.
Topic 3 of 10 in Attacks and Exploits
Test yourself on Attacks and Exploits
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.