6 - System Hacking

Question 1

What are the goals of system hacking?

Answer 1

• Gain Access:
  
  • Bypass security controls to gain access
  • Password cracking, social engineering
• Escalating Privileges:
  
  • Acquire the rights of another user or an admin
  • Exploiting vulnerabilities
• Executing Applications:
  
  • To create and maintain remote access to the system
  • Malware
• Hiding Files:
  
  • To hide attackers malicious activities and data theft
  • Rootkits, steganography
• Covering Tracks:
  
  • Hide evidence of compromise
  • Clearing logs

Question 2

What is Password Cracking?

Answer 2

Used to recover passwords from computer systems and gain unauthorized access to vulnerable system

Question 3

What are the different types of password attacks?

Answer 3

• Non-Electronic Attacks
  
  • Does not require technical knowledge to crack password (social engineering, sholder surfing)
• Active Online Attacks
  
  • An attacker needs to communicate with target machines to gain password access (dictionary attacks)
• Passive Online Attacks
  • Attacker does not need to communicate with the system.
  • Uses observed data to break into the system (sniffing)
• Offline Attacks
  • Attackers try to recover clear text passwords from a password hash dump (rainbow table attack)

Question 4

How Hash Passwords Are Stored in Windows SAM?

Answer 4

Windows uses a Security Account Manager (SAM) database file to store user passwords.

Question 5

What is Kerberos Authentication?

Answer 5

• A network authentication protocol that provides strong authentication by using secret-key cryptography.
• Both server and user verify each other’s identity

Question 6

What is Password Salting?

Answer 6

• A technique where random string of characters are added to the password before calculating their hashes.
• Makes it more difficult to reverse the hashes and defeat pre-computed hash attacks.

Question 7

How to Defend Against Password Cracking?

Answer 7

• Enable info security audit to monitor and track password attacks
• Do not use same password during password change
• Do not share password
• Do not use passwords that can be found in a dictionary
• Do not use cleartext protocols and protocols with weak encryption
• Set the password change policy to 30 days
• Avoid storing passwords in an unsecured location
• Do noy use system’s default passwords
• Make passwords hard to guess by using 8-12 characters in combination of uppercase, lowercase, numbers and symbols
• Ensure apps neither store passwords to memory nor write them to disk in clear text
• Use a random string (salt) as prefix or suffix with the password before encrypting
• Enable SYSKEY with strong password to encrypt and protect the SAM database
• Never use passwords such as date of birth, spouse, or child’s or pet’s name
• Monitor the server’s logs for brute force attacks
• Lockout accounts with too many incorrect attempts

Question 8

What is Escalating Privileges?

Answer 8

• Attackers gain access using a non-admin user account and the next step would be to gain admin privileges
• Privilege escalation attack takes advantage of design flaws, programming errors, bugs, and config oversights in the OS and software
• These privileges allow attackers to view critical/sensitive info, delete files, or install malicious programs

Question 9

What are the Types of Privilege Escalation?

Answer 9

• Horizontal
  
  • Assuming the identity of another user with similar privileges
• Vertical
  
  • Refers to gaining higher privileges than the existing account

Question 10

What are Spectre and Meltdown Vulnerabilities?

Answer 10

• Spectre Vulnerability:
  
  • Tricks a processor to exploit speculative execution to read restricted data.
  • Processors implement speculative execution in order to predict the future to complete the execution faster
  • Attackers use this vulnerability to read adjacent memory locations of a process and access info they are not authorized for.
• Meltdown Vulnerability:
  
  • Leads to tricking a process to access out of bounds memory by exploiting CPU optimization mechanisms such as speculative execution

Question 11

What are Privilege Escalation Techniques?

Answer 11

• Access Token Manipulation:
  
  • Windows OS uses access tokens to determine the security context of a process or thread
  • Attackers generate spooked tokens to escalate privileges
• Application Shimming:
  
  • Windows uses shim to provide compatibility between the older and newer versions of Windows OS
  • Shims can be used by attackers to escalate privileges, install backdoors, disable Windows Defender, etc.
• File System Permissions Weakness:
  
  • If file system permissions of binaries are not properly set, an attacker can replace the target binary with malicious file.
  • If executing process of binary has higher permissions, then malicious binary will also execute with higher permissions
• Path Interception:
  
  • Apps include many weaknesses and misconfiguration like unquoted paths, path environment variable misconfiguration, and search order hijacking that can lead to path interception
• Scheduled Task:
  
  • Task scheduling programs used to schedule programs at a specific time
  • Attackers can manipulate these programs to execute malicious programs at system startup, maintain persistance, etc.
• Launch Daemon:
  
  • Daemons have plists that are linked to executables that run at startup
  • Attackers can alter the launch the daemon’s executable
• Plist Modification:
  
  • Files in MacOS/OS X describe when programs should execute, file path, parameters, required permissions, etc.
  • Attackers alter these files to execute malicious code
• Setuid and Setgid:
  
  • In Linux and MacOS, if an app uses setuid or setgid then the app will execute with privileges of the owning user or group
  • An attacker can take advantage of these flags
• Web Shell:
  
  • A web based script that allows access to a web server
  • Attackers use this inject malicious code

Question 12

How to Defend Against Privilege Escalation?

Answer 12

• Restrict the interactive log privileges
• Use encryption technique to protect sensitive data
• Run users and applications on the least privileges
• Reduce the amount of code that runs with particular privilege
• Implement MFA and authorization
• Perform debugging using bounds checking and stress tests
• Run services as unprivileged accounts
• Test OS and application coding errors and bugs thoroughly
• Implement a privilege separation methodology to limit the scope of programming errors and bugs
• Path and update the kernel regularly
• Change UAC settings to “Always Notify”
• Restrict users from writing files to the search paths for apps
• Continuously monitor file system permissions using auditing tools
• Reduce the privileges of users and groups so that only legitimate admins can make service changes
• Use whitelisting tools to identify and block malicious software
• Use fully qualified paths in all Windows apps
• Ensure that all executables are placed in write-protected directories
• In Mac OS, make Plist files read-only
• Block unwanted system utilities or software that may be used to schedule tasks
• Patch and update the web servers regularly

Question 13

What type of applications do attackers execute?

Answer 13

• Keylogger:
  
  • Monitors each keystroke, logs onto a file, and sends file to remote location
• Spyware:
  
  • A stealthy program that records user’s interaction with the computer and internet without user’s knowledge and sends them to the remote attackers

Question 14

What type of files do attackers try to hide?

Answer 14

• Rootkits:
  
  • Programs that hide their presence as well as activities, granting them full access to the server.
• NTFS Data Stream:
  
  • NTFS Alternate Data Stream (ADS) is a hidden Windows stream which contains metadata about a file
• Steganography:
  
  • A technique of hiding a secret message within an ordinary message

Question 15

What techniques do attackers use to cover tracks?

Answer 15

• Disable Auditing:
• Clearing Logs
• Manipulating Logs
• Attackers also clear Online tracks by removing Most Recently Used (MRU), delete cookies, clear cache, turn off AutoComplete, and clear Toolbar data from the browsers.
• Using Reverse HTTP Shells
• External master sends commands and it will execute on target system
• Using Reverse ICMP Tunnels:
• Using ICMP Echo and reply packets as carriers of TCP payload
• Using DNS Tunneling:
• Encoding malicious content within DNS queries and replies (DNS Tunneling)
• Tunneling creates a backchannel to access a remote server
• Using TCP Parameters:
• Data can be hidden in TCP fields such as: IP, acknowledgement #, sequence #
• Windows
  
  • Use Alternate Data Streams
• Unix
  
  • Add in front of file to hide it
  • Update/modify/clear/shred history

Question 16

What is Vulnerability Exploitation?

Answer 16

Involves the execution of multiple complex steps to gain access to a remote system.:

• Identify Vulnerability
• Determine the Risk
• Determine the capability of the vulnerability
• Develop the exploit
• Select the method for delivering - local or remote
• Generate and deliver the payload
• Gain remote access

Question 17

What is are Exploit Sites?

Answer 17

Sites that are used to discover vulnerabilities and download or to develop exploits to perform remote exploitation on the target system. Sites include latest details of vulnerabilities. (Exploit Database, Security Focus, VulDB, MITRE CVE)

Question 18

What is Buffer Overflow?

Answer 18

A buffer is an area of adjacent memory locations allocated to a program or app to handle its runtime data. Buffer Overflow is where an application or program accepts more data than allocated buffer. The vulnerability allows the app to exceed the buffer while writing data to the buffer and overwrite neighboring memory locations. Attackers take advantage of this by injecting malicious code into the buffer.

Question 19

What are the types of Buffer Overflow?

Answer 19

• Stack Based: A stack is used for static memory allocation and stores the variables in “LIFO” order (PUSH and POP functions). Attacker takes control of where new return address is on the EIP pointer and therefore executes shell access, etc.
• Heap Based: Heap memory that is dynamically allocated at runtime during the execution of the program and it scores program data. Vulnerability occurs when memory is allocated to a heap and data is written without any bound checking.

Question 20

What are the steps for Windows Buffer Overflow Exploitation?

Answer 20

• Perform Spiking: Allows attackers to send crafted TCP or UDP packets to the vulnerable server to make it crash.
• Perform Fuzzing: Send a large amount of data to the target server to initiate overflow
• Identify the Offset: Identify where the EIP register is getting overwritten
• Overwrite the EIP register
• Identify Bad Characters: ID characters that may cause issues in the shellcode
• Identify the Right Module: ID module of the vulnerable server that lacks memory location.
• Generate Shellcode
• Gain Root Access

Question 21

What tools are used to identify Buffer Overflow?

Answer 21

• OllyDbg
• Veracode
• Flawfinder
• Kiuwan
• Splint
• BOVSTT

Question 22

How can you defend against Buffer Overflow?

Answer 22

• Secure Coding Practices
• Validate args and minimize code that requires root privileges.
• Implement automatic bounds checking
• Never allow execution of code outside the code space
• Up to date patching

Question 23

What is Internal Monologue Attack?

Answer 23

Usually performed in a secure enviro where Security Provider Interface Interface (SSPI) from a user-mode app, a local procedure call to the NTLM authentication package is invoked to calculate the NetNTLM (a challenge-response authentication protocol) response in the context of the logged-on user.

Question 24

What is Cracking Kerberos Password?

Answer 24

Kerberos is the most commonly used authentication protocol for network entities. Attackers target Kerberos auth protocol in two common ways: cracking the TGS and cracking the TGT

• Cracking the TGT (AS-REP Roasting): Attacker requests an auth ticket (TGT) from the KDC in the form of an AS-REQ packet. If user account exists, the KDC replies with a TGT encrypted with the account’s creds. Attacker saves encrypted ticket offline for cracking.
• Cracking the TGS (Kerberoasting): Attackers request a TGS for the service principal name (SPN) of the target service account to the DC by using a valid domain user’s authentication ticket (TGT). DC finds account in AD records and responds with encrypted Service Ticket (ST) which is stored offline to be cracked.

Question 25

What is Pass the Ticket attack?

Answer 25

Used for authenticating a user to a system that is using Kerberos tickets without providing the user's password. Attackers launch this attack by stealing the ST/TGT from either an end-user or from a compromised AS then gain access to the network services and search for additional permissions and critical data.

Question 26

What are the Combinator, Fingerprint, PRINCE, Toggle-Case, Markov-Chain attacks?

Answer 26

* **_Combinator_**: Attackers combine the entries of the first dictionary with those of the second dictionary to generate a new wordlist to crack the password of the target system. * **_Fingerprint_**: Attackers break down the passphrase into fingerprints compromising single and multi-character combinations to crack complex passwords. * **_PRINCE_**: An advanced version of combinator where instead of taking input from 2 different dictionaries, attackers a single input dictionary to build chains of combined words. * **_Toggle-Case_**: Attackers try all possible combinations of upper and lower cases of a word present in the input dictionary. * **_Markov-Chain_**: Attackers gather a password database and split each password entry into 2- and 3- character long syllables to create a new alphabet and match with existing password database.

Question 27

What are some tools to detect LLMNR/NBT-NS Poisoning?

Answer 27

Vindicate, got-responded, Respounder

Question 28

What is Named Pipe Impersonation?

Answer 28

Named pipes are used to provide legit communication between running processes using a file. Attackers can use this technique to communicate with accounts of higher privilege.

Question 29

What is Exploiting Misconfigured Services?

Answer 29

Attackers try escalate privileges using misconfigured services * **_Unquoted Service Paths_**: In Windows, when starting a service, the system attempts to find the location of the exe file to launch it which is enclosed in quotation marks. Attackers will exploit services without quoted paths. * **_Service Object Permissions_**: Misconfigured service permissions may allow an attacker to modify or reconfigure the attributes associated with that service. Attacker can even add new users to local admin group. * **_Unattended Installs_**: Unattended install details such as config settings used during the installation process are stored in Unattend.xml file. Attackers exploit info in this file.

Question 30

What is Pivoting and Relaying to Hack External Machines?

Answer 30

* **_Pivoting_**: Where a compromised system is used to compromise the true target of another system. Usually to bypass a FW or detection. * **_Relaying_**: Where a compromised system is used to access resources on another system.

Question 31

What are some tools used for Privilege Escalation?

Answer 31

* BeRoot * Linpostexp

Question 32

What are some tools for defending against Privilege Escalation?

Answer 32

* Dependency Walker * Dylib Hijack Scanner

Question 33

How can you defend against Spectre and Meltdown Vulnerabilities?

Answer 33

* Regular patch * Continuous monitoring of critical apps and services * Ad-blockers * Endpoint security tools * Block services/apps that allow unprivileged users to execute code * Use DLP solutions * BIOS updates * **_Tools_**: InSpectre, Spectre & Meltdown Checker

Question 34

What are some Remote Code Execution Techniques?

Answer 34

* **_Exploitation for Client Execution_**: Unsecure coding practices * **_Scheduled Task_**: Execution of malicious programs at scheduled times * **_Service Execution_**: Attackers run binary files or commands that can communicate with the Windows services to maintain access * **_Windows Management Instrumentation (WMI)_**: Exploit features in WMI to interact with remote target system * **_Windows Remote Management (WinRM)_**: WinRM is a protocol that allows users to run exe's on a remote system. Attackers can take advantage of this.

Question 35

What are some tools for executing applications remotely?

Answer 35

Remote Exec, Pupy, PDQ Deploy, Dameware Remote Support, ManageEngine Desktop Central, PsExec

Question 36

What is a keylogger?

Answer 36

Programs or hardware devices that can monitor, logs, and transmit each keystroke.Types: * **_Hardware_**: PC/BIOS, Keyboard, External, PS/2 and USB, Acoustic/CAM, Bluetooth, WiFi * **_Software_**: Application, Kernel, Hypervisor, Form Grabbing, Javascript, Memory Injection

Question 37

What are some keylogger tools?

Answer 37

* **_Hardware_**: KeyGrabber, KeyCarbon, Keyllama, KeyGhost, Keyboard logger * **_Windows_**: Spyrix, REFOG, All In One, Elite, StaffCop Standard, Spytector * **_Mac_**: Refog Mac, Spyrix, Elite, Aobo, Kidlogger for MAC, Perfect Keylogger

Question 38

What is Spyware?

Answer 38

A stealthy program that records the user's interaction with PC and Internet without the user's knowledge and sends info to the remote attackers. Spreads by: * Drive-By Download * Masquerading as Anti-Spyware * Web Browser Vulnerability * Piggybacked software installation * Browser add-ons * Cookies

Question 39

What are some Spyware tools?

Answer 39

Spytech SpyAgent, Power Spy

Question 40

How can you defend against Keylogger?

Answer 40

* Use pop-up lockers and avoid opening junk emails. * Use AV and anti-spyware * Install anti-keylogging and firewall software * Recognize phishing emails * Up to Date patching * Do not click on doubtful links * Use keystroke interference software * Scan files * Use on-screen keyboard for confidential info (click on characters with mouse) * Use form filling software * Host based IDS * Disable or lock down USB ports

Question 41

What are some Anti-Keylogger tools?

Answer 41

Zemana Antikeylogger, GuardedID, Keyscrambler, Oxynger Keyshield, Ghostpress, Spyshelter Free Anti-Keylogger

Question 42

How can you defend against Spyware?

Answer 42

* Use pop-up lockers and avoid opening junk emails. * Use AV and anti-spyware * Install anti-keylogging and firewall software * Recognize phishing emails * Up to Date patching * Do not click on doubtful links * Use keystroke interference software * Scan files * Use on-screen keyboard for confidential info (click on characters with mouse) * Use form filling software * Host based IDS * Disable or lock down USB ports

Question 43

What are some Anti-Spyware tools?

Answer 43

SUPERAnti-Spyware, Kaspersky Internet Security 2019, SecureAnywhere, Adawhere, MacScan, Norton AV

Question 44

What is a Rootkit? And what are the types?

Answer 44

Programs that hide their presence granting them full access to the server/host. They replace certain OS calls and utilities with their own modified versions. They try to gain remote backdoor access, mask tracks, sniff traffic, and install other malicious programs. **_Types_**: * **_Hypervisor Level_**: Acts as a Hypervisor * **_Hardware/Firmware_**: Hides in hardware devices * **_Kernel Level_**: Modifies or replaces OS kernel * **_Boot Loader Level_**: Replaces boot loader * **_Application Level/User Mode_**: Replaces app binaries with a fake Trojan * **_Library Level_**: Replaces OS calls with fake ones to hide info

Question 45

What are some popular rootkits?

Answer 45

* **_LoJax_**: A type of UEFI rootkit that injects malware into the system and is automatically executed at start up. * **_Scranos_**: Windows Kernel rootkit * **_Horse Pill_**: Linux rootkit that resides inside the "initrd" which it uses to infect the system and deceives the system owner with the use of container primitives. * **_Necurs_**: Contains backdoor functionality allowing remote access and control of the infected computer.

Question 46

How can you detect Rootkits?

Answer 46

* Integrity Based: Compares a snapshot with a known baseline * Signature Based: compares characteristics of files with know bad signatures * Heuristic/Behavior Based: Any deviations in systems normal activity * Runtime Execution Path: Compares runtime execution paths * Cross View Based: Enumerates key elements in a system for analysis * Alternative Trusted Medium: Shut down infected system and reboot with a known alternative trusted media * Analyzing Memory Dumps: Dump the RAM of suspected system and analyze.

Question 47

How can you defend against Rootkit?

Answer 47

* Reinstall OS/apps from trusted source * Perform kernel memory dump analysis * Harden servers and workstations * Educate staff not to download from untrusted sources * Install FW's * Up to date patches * Verify integrity of system files * Avoid using admin privileges * Least privilege principle * Do not install unnecessary apps.

Question 48

What are the steps to Covering Tracks?

Answer 48

* Disable Auditing * Clearing Logs * Manipulating Logs * Covering Tracks on the Network/OS * Deleting Files * Disabling Windows Functionality

Question 49

What is Cipher.exe?

Answer 49

An in-built Windows command-line tool that can be used to securely delete data by overwriting it to avoid their recovery in the future.

Question 50

What are some methods to Disable Windows Functionality?

Answer 50

* **_Disable the Last Access Timestamp_** * **_Disable Windows Hibernation_** * **_Disable Windows Virtual Memory (Paging File)_**: A paging file is used when RAM falls short of usable space. * **_Disable System Restore Points_**: Restore Points contain info about hidden data and previously deleted files. * **_Disable Windows Thumbnail Cache_**: Thumbnail files contain info regarding files that were previously deleted or used on the system. * **_Disable Windows Prefetch Feature_**: Prefetch is a Windows feature that stores specific data about the apps that are typically used by the system users.

Question 51

What are some Track Covering tools?

Answer 51

CCleaner, DBAN, Privacy Eraser, Wipe, BleachBit, ClearProg

Question 52

How can you defend against Covering Tracks?

Answer 52

* Logging * Audit regularly * Ensure new events do not overwrite old entries * Maintain separate logging server * Up to date patching * Close unused open ports * Encrypt log files * Set logs to "append only" * Backup logs