Elevating Privileges: Hackers' Secret Method

Privilege escalation lurks in the shadows of our computer systems. As the popular saying goes, “Still waters run deep”—so let’s be wary of a passive hacker who transforms from a regular user into a formidable administrator with total control over the system.

Although invisible, this threat consistently ranks at the top of lists of the most feared vulnerabilities (according to a Microsoft study, it is expected to account for 55% of vulnerabilities in 2022). Understanding the techniques behind this threat is therefore essential; here are the key facts.

What is privilege escalation?

Privilege escalation refers to the exploitation of a flaw or vulnerability in a computer system to obtain access rights greater than those initially granted. There are two main types of privilege escalation: horizontal escalation and vertical escalation.

1. Horizontal privilege escalation

Horizontal privilege escalation (the most common type) occurs when a user accesses the resources or data of another user with the same access level.

Examples:

• Active Session Exploitation: An attacker steals a session token from another user to gain access to that user's data.
• Manipulation of URL Parameters: By modifying the parameters in a URL, a user could access another user's information

2. Vertical privilege escalation

Vertical privilege escalation occurs when a user obtains rights or privileges higher than those initially assigned to them. For example, a standard user who obtains administrative privileges.

Examples:

• Exploiting Kernel Vulnerabilities: Vulnerabilities in an operating system's kernel can allow a user to escalate from limited access to root access.
• SQL Injection: An SQL injection attack could allow a user to bypass access controls and grant themselves administrator privileges.

A Typical Scenario Involving Privilege Escalation

As explained earlier, privilege escalation is a powerful technique that allows hackers to turn initial, limited access into total control over a network. It is not merely an intrusion, but complete domination of your network. It is a method by which cyberattackers covertly climb the access ladder, ultimately gaining root-level control:

Step 1: The Initial Intrusion

Hackers begin by gaining initial access to a machine on the network. This access grants them limited privileges, often at the standard-user level, without administrative permissions. This can be achieved through several methods:

• Targeted phishing (spear phishing): Sending personalized emails containing malicious links or infected attachments;
• Exploitation of Zero-Day Vulnerabilities: Exploiting unpatched vulnerabilities in web applications or software;
• Exploitation of Exposed Services: Attacks on publicly accessible services, such as poorly secured web servers or open ports.

Step 2: Target Recognition and Identification

Once inside the network, attackers begin by conducting reconnaissance. They use automated tools to scan the internal network, identify other systems and services, and map the relationships between them. In particular, they look for machines and accounts that might offer higher privileges:

• Network scanning: Using tools such as Nmap to identify machines, active services, and open ports;
• List of Network Shares: Search for accessible file and folder shares;
• Account and Group Identification: Identification of users and groups, including administrators.

Step 3: Exploiting Internal Vulnerabilities

Cybercriminals discover an old, unpatched vulnerability in the operating system of an internal server. This vulnerability allows them to execute code with elevated privileges. They exploit this vulnerability to escalate from standard user access to administrator privileges on that server:

• Operating System Vulnerabilities: Exploiting vulnerabilities in the kernel or operating system services to gain elevated privileges;
• Application Exploitation: Vulnerabilities in locally installed applications that allow code to be executed with elevated privileges;
• Inappropriate configurations: Incorrectly configured files or scripts that run with elevated privileges.

Step 4: Compromising Privileged Accounts

With administrator access to a server, cybercriminals can now access privileged accounts stored on that server. They steal domain administrator credentials, which are often stored in unsecured files or scripts:

• Volatile Memory: Extraction of passwords and password hashes stored in memory;
• Configuration Files: Search for configuration files containing identifiers;
• Scripts and Scheduled Tasks: Scripts or scheduled tasks that contain credentials.

Step 5: Lateral Movement and Persistence

Using the stolen credentials, the attackers move laterally across the network, gaining access to other servers and workstations. They exploit “pass-the-hash” techniques or use legitimate administrative tools to access other systems with the same credentials.

• Pass-the-Hash: Using password hashes to authenticate on other machines without knowing the plaintext passwords;
• pass-the-Ticket: Using Kerberos tickets to access other systems;
• Remote Access: Using Remote Desktop Protocol (RDP), Secure Shell (SSH), or other protocols to remotely access other machines.

6. Privilege Escalation on New Systems

Hackers repeat the privilege escalation process on each new compromised system:

• Exploitation of New Systems: Searching for new local vulnerabilities to exploit on each compromised machine;
• Continuous Escalation: Gradually accumulating more and more privileges to gain access to domain administrator accounts or other critical privileges.

Step 7: Full Control of the Network

Cybercriminals eventually gain domain administrator privileges, giving them complete control over the network. They can now disable intrusion detection systems, alter security logs to cover their tracks, and deploy malware across the network without being detected.

The ultimate goal is often to take control of the domain, which gives hackers virtually unlimited access to the network:

• Compromising Domain Controllers: Compromising domain controllers to gain domain administrative privileges;
• Deployment of Malware and Backdoors: Installing malicious software to maintain access and monitor activities;
• Changes to Security Policies: Modify security policies to disable detection systems and facilitate future access.

Step 8: Data Exfiltration and Exploitation

With unlimited access, cybercriminals can access sensitive databases, exfiltrate confidential information, install backdoors for future access, and even encrypt the company’s data to demand a ransom.

• Data Exfiltration: Theft of sensitive data, such as customer information, trade secrets, and financial information;
• ransomware: Encryption of critical data to demand a ransom;
• Installation of backdoors: Creating backdoors to allow future access even after attempts to clean up the network.

14 behaviors known to be used by attackers and listed in MITRE ATT&CK

How can you protect yourself against "privilege escalation" attacks?

Cybersecurity Strategy Using SIEM, UEBA, and SOAR

A SIEM UEBA SOAR solution, such as our flagship product Reveelium, provides robust protection against privilege escalation attacks.

Illustration to help understand how a SIEM, UEBA, and SOAR solution works

Regular system updates

Make sure that all operating systems and software are regularly updated with the latest security patches. This reduces exploitable vulnerabilities.

Password Security

Use strong, unique passwords for each account. Implementing multi-factor authentication (MFA) is also crucial for adding an extra layer of security.

Separation of Privileges

Apply the principle of least privilege, which means granting users only the rights necessary to perform their tasks. Use separate accounts for administrative and day-to-day tasks.

Training and Awareness

Train employees to recognize the signs of potential attacks and raise their awareness of the importance of IT security. Good “digital hygiene” is essential for preventing intrusions.