Exploitation

exploit: code or technique that a threat uses to take advantage of a vulnerability
why exploitation?
1. validating vulnerabilities
2. assess impact
3. prioritise fixes to vulnerabilities that can exploited
4. test incident response
5. exploited machine can work as pivot point
risks
- system downtime
- system disruption
- data loss
- general bad things
always verify exploit is allowed by Rules of Engagement
most frequent initial access vectors
1. valid account usage, e.g. obtaining valid credentials
2. phishing
3. exploiting remote vulnerabilities
4. external remote services (e.g. managed filetransfer services)

Categories

remote exploit: attack a service listening on the network
client-side exploit: attack a client application that fetches content from a server
local privilege escalation exploit: attack to gain higher privileges on machine attacker is already on
- often not patched quickly as they're not considere critical
- various types
  - race conditions
  - kernel exploits
  - local exploit of high-privileged program or service
hardware and firmware exploits
cryptographic exploits

wait for target user to access infected file on attacker-controller server
target machine opens connection with attacker
- doesn't get blocked by firewall
- requires user interaction to run client program
- usually requires privilege escalation
companies often wait too long to update software -> effective strategy
exploit kits
- sophisticated delivery method for malware
- can be rented as a SaaS
- automatically inspects host for vulnerabilities
- gate servers to only forward vulnerable hosts to infected page