8.3 - Maintain Access

 8.3 - Maintain access 

 

Key Terms: 

• Path interception – When a malicious file name is added to a service or path without quotation marks and includes spaces in the code. 
• Backdoor – A program that grants continued access to a previously hacked system. 
• Spyware – Malware that works by stealth to capture information and send it back to the hacker. 
• Crackers – Programs written to crack passwords and code to gain unauthorised access to a system. 
• Writeable services – A service with permissions that allows anyone to change their execution. 

 

Path Interception 

When a service is started, it looks for the path to the file containing it. This is no problem when the path is written in quotation marks and has no spaces: 

“C:\programfiles\subdirectory\programname.exe” 

However, paths like this: 

C:\program files\sub directory\program name.exe 

can be exploited. It is possible for a hacker to add a malicious file name to the path and reroute it to the malicious file. If the system is running administrator, the hacker can gain escalated privileges as soon as the system restarts. 

 

Writable Services 

Writable services are weak services which allow anyone to alter its execution on the system. Altering services could include creating new administrative accounts by using PSExec to replace the service with a custom service that runs a CMD.exe file. 

 

Unsecure File and Folder Permissions 

Older versions of Windows can allow administrators to access any non-admin user’s files and folders. This can lead to DLL hijacking and malicious file installations. 

 

Backdoor 

Backdoors can allow hackers to explore a system any time they want, much like leaving a key under a mat at the front of a real house. They do this by installing rootkits, trojan horses, and RATs. Rootkits have access to the OS level and trojans have access to the application level. These backdoors allow hackers to gather sensitive information for exploitation. 

 

Crackers 

Crackers allow hackers to crack code and passwords to gain access to a system. There are many different tools and methods available for cracking. Some include brute forcing, dictionary attacks, and rainbow tables. 

 

Spyware 

Spyware works by stealth to capture information and sends it to a hacker. From this, hackers can gain remote access to a system. Keylogging, activity tracking, screen capturing, and file operation are all examples of spyware. Users can unintentionally download spyware through normal web activity and its often highly hidden and undetectable. 

 

Windows Task Scheduler 

Windows task scheduler has a vulnerability in its file validation making it weak to attacks. It has a default configuration that allows regular users to write task files. A hacker may be able to modify the file to execute commands on the system with administrator privileges.