Execution and Escalation Attacks

Question 1

What is an Arbitrary Code Execution?

Answer 1

Vulnerability that allows an attacker to run their code without restrictions and exploit the vulnerability

Question 2

What is a Remote Code Execution?

Answer 2

Type of arbitrary code execution that occurs remotely, often over the internet

Question 3

What is a Privilege Escalation?

Answer 3

Occurs when a user accesses or modifies specifiic resources that they are not entitled to normally access

Question 4

What is a Vertical Privilege Escalation?

Answer 4

Going from normal user to higher privilege (e.g., admin or root)

Question 5

What is a Horizontal Privilege Escalation?

Answer 5

Occurs when a user attempts to access resources for which they don’t have permissions at the same level

Question 6

What are Rootkits?

Answer 6

Class of malware that conceals its presence by modifying system files, often at the kernel level

Question 7

What is a Ring Zero?

Answer 7

The kernel (center) with the highest privileges

Question 8

What are Rings 1 to 3?

Answer 8

User-level components with decreasing privileges as the ring number increases

Question 9

What is a Kernel Mode Rootkit?

Answer 9

Embedded in the kernel (Ring Zero) and has maximum control and privileges

Question 10

What is a User Mode Rootkit?

Answer 10

Attached to user-level components (Rings 1 to 3) and has admin level privileges