Contents
How do attackers escalate privileges?
Horizontal privilege escalation—an attacker expands their privileges by taking over another account and misusing the legitimate privileges granted to the other user. To learn more about horizontal privilege escalation see our guide on lateral movement.
What can hackers do if they take over an application with root privileges?
The attacker can use the newly obtained privileges to steal confidential data, run administrative commands or deploy malware – and potentially do serious damage to your operating system, server applications, organization, and reputation.
What is the difference between horizontal and vertical privilege escalation?
In a vertical privilege escalation attack, the attacker moves up the privilege ladder, so to speak, by granting himself privileges usually reserved for higher-access users. In horizontal privilege escalation, the attacker is a normal, low-end user who accesses the information of other normal users.
Can hackers access my hard drive?
Intelligence agencies have developed a number of ways to prevent hackers getting access to their systems, and one of the best ways to keep a system safe is to remove it from the network entirely. …
When do hackers use privilege escalation to gain privileges?
Privilege escalation is when hackers gain additional privileges that do not normally belong to them. They do this by abusing bugs, configuration flaws or design weak spots in an application or operating system.
How does impersonateloggedonuser enable privilege escalation?
The token can then be used with ImpersonateLoggedOnUser to allow the calling thread to impersonate a logged on user’s security context, or with SetThreadToken to assign the impersonated token to a thread. Adversaries may create a new process with a duplicated token to escalate privileges and bypass access controls.
How can adversaries use tokens to escalate privileges?
Adversaries may make and impersonate tokens to escalate privileges and bypass access controls. If an adversary has a username and password but the user is not logged onto the system, the adversary can then create a logon session for the user using the LogonUser function.
Can a process impersonate an object token?
A process may impersonate an object token that it owns, but simply has a different set of privileges. For an attacker to be able to impersonate object tokens in a compromised system, they would need the following privileges on the target. These privileges are usually associated with the services account: