Privilege Escalation Explained

Privilege Escalation Overview

• Attackers increase compromised user account privileges for greater objectives, such as data manipulation or system disruption.
• System developers employ the least privilege rule, granting users only necessary privileges.
• Attackers target low-privilege accounts and upgrade them to access files or alter systems.
• Privilege escalation requires a combination of skills and tools and is classified into horizontal and vertical types.

Horizontal Privilege Escalation

• Attackers use normal accounts to access other user accounts, commonly through software bugs or administrator accounts.
• Attacks are facilitated by stealing login credentials.
• Attackers use the same initial access privileges
• Horizontal privilege escalation involves accessing protected resources with a normal user account.
• It is often achieved through session/cookie theft, cross-site scripting, weak passwords, and keystroke logging.
• Attackers gain remote access, access multiple accounts, and evade security tools.

Vertical Privilege Escalation

• Acquires system rights, often more rewarding but difficult.
• It offers higher chances of remaining undetected on a network, with the capacity to perform administrator-level actions.
• Techniques vary by system, buffer overflows are used in Windows, jailbreaking in macOS, and exploiting backend code in web-based tools.
• Attackers can run unauthorized code, gaining high-level authority.
• It involves kernel-level operations and widely uses buffer overflows.
• "EternalBlue" vulnerability used in WannaCry is based on buffer overflow.
• Vertical escalation relies on hacking tools
• It requires avoiding alerts by disabling security systems, or using legitimate tools.

How Privilege Escalation Works

• Privilege levels range from basic to admin, with capabilities to revoke or disable lower accounts.
• The least privilege rule dictates privilege assignment based on job necessities.
• Methods to gain privileged access include credential exploitation, misconfigurations, vulnerabilities/exploits, social engineering, and malware.

Credential Exploitation

• Access requires valid credentials like usernames, passwords, and API keys.
• Attackers target admin accounts for lateral movement and extensive control.
• Compromised credentials grant unrestricted access.
• Resetting passwords temporarily blocks attackers, but identifying the root cause is crucial to prevent persistent issues.

Misconfigurations

• They bypass authentication and need mitigation over remediation.
• They stem from poor default settings like backdoors, default passwords, and insecure access routes.

Vulnerabilities and Exploits

• Vulnerabilities arise from mistakes in system development, design, or configuration affecting operating systems and applications.
• Most enable horizontal privilege escalation, while some allow vertical escalation when high-privilege accounts are compromised.
• The overall threat depends on the vulnerability's severity, resources at risk, and available exploits.

Social Engineering and Malware

• Malware includes viruses, worms, adware, spyware, and ransomware for system infiltration, control, and disruption.

Avoiding Alerts

• Hackers disable or evade security systems or use legitimate tools to prevent detection.

Performing Privilege Escalation

• Technique depends on attacker skill and desired outcome.
• Administrator access should be rare in Windows.
• Normal employees should not maintain admin access, which introduces attack vectors.
• Remote users with admin access need careful monitoring to prevent misuse.

Performing Privilege Escalation: Exploiting Unpatched Systems

• Identifying unpatched systems involves using Nessus and Nmap.
• Hackers search Kali Linux or Searchsploit database for exploits.
• Tools like PowerUp bypass Windows privilege to upgrade users to admin.
• Legitimate Windows tools check patch status using "wmic qfe get" or "get-hotfix" commands.

Performing Privilege Escalation: Access Token Manipulation

• Access tokens dictate owners of running processes.
• Admin users log in as normal users, but processes execute with admin privileges via "run as administrator".
• Metasploit is used for access token manipulation.
• Full level admin access is obtained by fooling the system into thinking processes were started by an admin.
• Exploited stolen admin credentials are leveraged in access token manipulation.

Performing Privilege Escalation: Exploiting Accessibility Features

• Windows accessibility features are exploited to create backdoors, enabling login without authentication.
• A command prompt with administrator privileges is obtained by manipulating accessibility features.
• Further tasks can be achieved via the command prompt and can even install backdoors.

Performing Privilege Escalation: Application Shimming

• Application shimming is a Windows compatibility framework.
• Most applications that used to run on Windows XP can today run on Windows 10 due to this framework.
• It creates a buffer between legacy programs and the OS, referencing a shim database via API. -Shims are designed to run in user mode to avoid direct communication with OS.

Performing Privilege Escalation: Application Shimming (2/2)

• Attackers create custom shims to bypass User Account Control, inject DLLs, and interfere with memory. -Malicious programs can run using elevated privileges and can switch off security software.

Performing Privilege Escalation: Bypassing User Account Control

• Windows User Account Control (UAC) acts as a gate between normal and admin-level users. -The UAC gives permissions to programs and elevates them to run with admin-level privileges. Windows programs are allowed to elevate privileges even without prompting the user via Component Object Model (COM) objects.
• Attackers can inject malicious processes into trusted processes gaining admin privileges.

Performing Privilege Escalation: DLL Injection

• DLLs are shared libraries for Microsoft's OS, sharing code and data without re-linking.
• Dylib is used for similar functionality in macOS.
• DLL injection runs malicious code with legitimate processes and services. Attackers' actions are masked by legitimate processes.
• DLL injection attacks modify Windows Registry, create threads, and load DLLs, requiring admin privileges.

Performing Privilege Escalation: Reflective DLL Injection

• It loads malicious code without Windows API calls, bypassing DLL load monitoring.
• Malicious code is disguised as form as raw data.
• This method is difficult to detect even on machines with adequate security
• Backdoor.Oldrea injects itself in explore.exe, BlackEnergy injects as DLL in svchost.exe, and Duqu spreads across processes to avoid detection.

Performing Privilege Escalation: DLL Search Order Hijacking

• It replaces legitimate DLLs with malicious ones, identified through program storage locations.
• Malicious DLLs are placed high in the search path. -When Windows searches for a DLL, the malicious file is found, not the intended one even from the remote locations.
• The manifest or local direction files are modified to cause programs to load different DLLs other than the intended ones.

Performing Privilege Escalation: Dylib Hijacking on macOS

• Dylib Hijacking is like DLL Hijacking on Windows, injecting unauthorized code. OS X's dynamic library search mechanism are exploited by placing malicious dylibs in prioritized search locations. -With its high privileges the program inadvertently loads hacked dylib, auto-elevating its own privileges when hacked.

Performing Privilege Escalation: Exploration of vulnerabilities

• A horizontal privilege escalation method through programming errors.
• Some systems accept phrases as passwords for all users.
• Attackers change access levels via URLs in web-based systems.
• Windows flaw: Attackers created Kerberos tickets with domain admin rights using user permissions (MS14-068).

Concluding the Mission

Exfiltration

• Attackers extract sensitive data, including credentials, secrets, and personal information
• Large amounts of data are stolen
• The data is then put up for sale of the stolen data.
• Attackers may erase or alter the files.
• Ashley Madison (2015), Yahoo (2013/2016), and LinkedIn (2016) are examples of hacks which exfiltrated data.

Sustainment

• Hackers remain silent post-exfiltration or install malware like rootkits for ongoing access. The victim's security tools become ineffective.
• The attacker has multiple access points.

Assault

• The most impactful phase involves damaging data/software or disabling hardware.
• Example = Stuxnet which targeted Iranian nuclear facility.
• The nuclear station was hit by the first recorded digital weapon which was transmitted via USB thumb drive.

Obfuscation

• Attackers conceal their tracks using confusion techniques to deter investigation.
• Targets outdated servers in smaller establishments for lateral movement.
• Unsecured Wi-Fi and dynamic code obfuscation avoid detection from signature-based antivirus and firewalls.