Exploitation, Privilege Escalation and Maintaining Access

What it is

Exploitation uses a vulnerability to run attacker-chosen actions on a system. It is often the step that follows a vulnerability assessment.

Escalating privileges raises the rights of the account the attacker controls, and maintaining access keeps control over time. Together they turn a small foothold into lasting control.

How it works

Vulnerability exploitation

An exploit is code or a technique that takes advantage of a flaw. The payload is what runs after the flaw is triggered, such as opening a remote shell. Shellcode is small machine code used as a payload.

Exploit sources include public databases such as Exploit-DB and the National Vulnerability Database, and frameworks such as Metasploit. Metasploit organizes its content into modules.

Meterpreter is the Metasploit payload that gives an interactive session on a target.

Memory corruption flaws

Many exploits abuse the way programs handle memory.

Protections reduce the damage. Data execution prevention (DEP) marks memory as non-executable. Address space layout randomization (ASLR) changes memory locations at each start. Stack canaries detect overwritten stack data. Safe languages and input checks prevent many of these flaws.

Escalating privileges

An attacker with a normal account wants administrator, SYSTEM or root rights.

Common causes of escalation include the following.

• Unpatched operating system or kernel flaws.
• Misconfigured services, such as service paths with spaces and no quotes, or services running as high privilege with weak file permissions.
• Weak access control on files, scheduled tasks and registry keys.
• DLL hijacking, where a program loads an attacker's library from a writable location.
• Access token manipulation, where a process uses the token of a more privileged one.
• Linux: files with the SUID bit set, loose sudo rules and writable scripts run by root.
• Stored credentials and cleartext secrets in scripts or configuration files.
• Bypassing User Account Control on Windows.

Enumeration scripts such as WinPEAS, LinPEAS and PowerUp list these misconfigurations in one pass, and defenders can run similar checks to find them first.

Maintaining access

After escalation the attacker wants a way back in. The tools and artifacts are listed here to recognize them.

Hardware keyloggers sit between the keyboard and computer. Software keyloggers run as a process or driver and send captures to the attacker. Spyware may record screens, microphone and browsing.

Defenses

• Patch operating systems and applications on a schedule, and prioritize exposed hosts.
• Use least privilege so users and services run with the minimum rights needed.
• Fix service paths, file permissions and sudo rules.
• Keep DEP, ASLR and other memory protections turned on.
• Use application allow lists and endpoint detection and response.
• Remove stored credentials from scripts and use a vault.
• Inspect USB ports for hardware keyloggers and use anti-keylogging and multi-factor authentication.
• Alert on new accounts, new services and sudden privilege changes.

A worked example

A web server user account is compromised. A review finds a service that runs as SYSTEM with an unquoted path that contains spaces, in a folder that ordinary users can write to. That combination can let an unintended file run with high privilege. The cause is misconfiguration, and the fix is quoting the path and tightening folder permissions.

How the exam asks about this

• "What is the code that runs after a vulnerability is triggered?" -> The payload.
• "Moving from a standard user to an administrator is which type of escalation?" -> Vertical.
• "Which protection randomizes memory locations?" -> ASLR.