Privilege Escalation

The previous chapters have explained the process of performing an attack to a point where the attacker can compromise a system. The previous chapter, Chapter 8, Lateral Movement, discussed how an attacker can move around in the compromised system without being identified or raising any alarms. A general trend was observable, where legitimate tools were being used to avoid alerts. A similar trend may also be observed in this phase of the attack life cycle.

In this chapter, close attention will be paid to how attackers escalate the privileges of the user accounts that they have compromised. The aim of an attacker at this stage is to have the required level of privileges to achieve a greater objective. It could be mass deletion, corruption or theft of data, disabling of computers, destroying hardware, and so many other things. An attacker requires control over access systems so that they can succeed with all of their plans. Mostly, attackers seek to acquire admin...

Infiltration

Privilege escalation normally occurs deep into an attack. This means that the attacker will have already done reconnaissance and successfully compromised a system, thereby gaining entry. After this, the attacker will have traversed the compromised system through lateral movement and identified all the systems and devices of interest.

In this phase, the attacker wants to have a strong grip on the system. The attacker may have compromised a low-level account and will, therefore, be looking for an account with higher privileges in order to study the system further or get ready to accomplish their malicious objectives. Privilege escalation is not a simple phase, as it will at times require the attacker to use a combination of skills and tools in order to heighten the privileges. There are generally two classifications of privilege escalation: horizontal and vertical privilege escalation.

Figure 9.1: Privilege escalation can be done horizontally as well as vertically...

Summary

This chapter has gone through the privilege escalation phase. It has been noted that there are two broad classifications of privilege escalation: vertical and horizontal. It has also brought to light that horizontal privilege escalation is the best luck that an attacker can hope for. This is because the methods used for horizontal privilege escalation tend not to be very complex.

This chapter has gone through most of the sophisticated vertical privilege escalation methods that attackers use against systems. It is noteworthy that most of the techniques discussed involve attempts to compromise legitimate services and processes in order to get higher privileges. This is probably the last task that the attacker will have to perform in the entire attack.

The next chapter will cover security policies, and how they can help you secure your environment.

References

• Privilege Escalation Attack 2022https://www.armosec.io/blog/privilege-escalation-vulnerability-cve-2022-0492-kubernetes/
• Kaseya VSA Breach Consequences of Security Failures: https://www.erdalozkaya.com/kaseya-vsa-breach
• GitHub Privilege Escalation Vulnerabilities: https://www.globenewswire.com/news-release/2022/04/12/2421169/0/en/Legit-Security-Discovers-GitHub-Privilege-Escalation-Vulnerabilities-and-Warns-Organizations-of-Potential-Software-Supply-Chain-Attacks.html
• Container Escape: https://capsule8.com/blog/an-introduction-to-container-escapes/
• A Compendium Of Container Escapes: https://i.blackhat.com/USA-19/Thursday/us-19-Edwards-Compendium-Of-Container-Escapes-up.pdf
• Threat Intelligence: https://verdict.valkyrie.comodo.com/
• Privilege Escalation POC Videos: https://www.youtube.com/c/erdalozkaya
• A. Gouglidis, I. Mavridis and V. C. Hu, Security policy verification for multidomains in cloud systems, International Journal...