English
Menu

Cyber Attacks and Defense in Practice

An attacker who exploited a vulnerability in a web application can now run commands with the same ordinary user privileges as the web server program. Which of the following is an example of the "privilege escalation" the attacker carries out next?

  1. ATrying to connect by SSH to another internal server with a stolen password, still with the same ordinary user privileges
  2. BGaining root privileges by exploiting an unpatched vulnerability in the OS kernel or similar
  3. CConnecting to an external server at regular intervals to receive the next instruction
Show answer and explanation

Answer: B. Gaining root privileges by exploiting an unpatched vulnerability in the OS kernel or similar

Privilege escalation means gaining higher privileges than those currently held by exploiting vulnerabilities or configuration flaws. On Linux, unpatched kernel vulnerabilities, programs that unnecessarily have the SUID bit set and sudo configured to allow running anything without a password are abused. With administrator privileges, the attacker can erase logs, stop security software and steal credentials, so the damage spreads widely. Applying fixes, the principle of least privilege and reducing the programs that run with administrator privileges are the basic controls.

  • A. Extending connections to another server with the same privileges is lateral movement.
  • B. Correct. Obtaining higher privileges by using vulnerabilities or configuration flaws is privilege escalation.
  • C. Regular communication with a command server is C2 (command and control).
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. Which of the following is the most appropriate control for making "lateral movement" difficult, that is, the spread of a compromise from one hijacked employee PC to other PCs and servers inside the company?
  2. The technique in which an intruder avoids using custom malware as far as possible and works with legitimate tools already present in the OS, such as PowerShell, WMI and the standard remote administration features, is called "living off the land". Which of the following is the most appropriate way of thinking about countermeasures to this technique?
  3. Which of the following correctly describes access control based on the idea of zero trust?
  4. The zero trust architecture of NIST SP 800-207 separates the "policy decision point (PDP)", which decides whether to allow access, from the "policy enforcement point (PEP)", which carries out the decision. Which of the following correctly describes how the two work when an employee accesses a business application?
  5. Which of the following correctly compares a traditional remote-access VPN with ZTNA (zero trust network access) as ways for remote employees to use internal systems?

Comparisons in this topic