Target Programs with Elevated Privileges
Attack Pattern ID: 69 (Standard Attack Pattern Completeness: Complete)Typical Severity: Very HighStatus: Draft
+ Description


This attack targets programs running with elevated privileges. The attacker would try to leverage a bug in the running program and get arbitrary code to execute with elevated privileges. For instance an attacker would look for programs that write to the system directories or registry keys (such as HKLM, which stores a number of critical Windows environment variables). These programs are typically running with elevated privileges and have usually not been designed with security in mind. Such programs are excellent exploit targets because they yield lots of power when they break. The malicious user try to execute its code at the same level as a privileged system call.

Attack Execution Flow

  1. The attacker probes for programs running with elevated privileges.

  2. The attacker finds a bug in a program running with elevated privileges.

  3. The attacker exploits the bug that she has found. For instance she can try to inject and execute arbitrary code or write to OS resources.

+ Attack Prerequisites

The targeted program runs with elevated OS privileges.

The targeted program accepts input data from the user or from another program.

The targeted program does not perform input validation properly.

The targeted program does not fail safely. For instance when a program fails it may authorize restricted access to anyone.

The targeted program has a vulnerability such as buffer overflow which may be exploited if a malicious user can inject unvalidated data. For instance a buffer overflow interrupts the program as it executes, and makes it run additional code supplied by the attacker. If the program under attack has elevated privileges to the OS, the attacker can elevate its privileges (such as having root level access).

The targeted program is giving away information about itself. Before performing such attack, an eventual attacker may need to gather information about the services running on the host target. The more the host target is verbose about the services that are running (version number of application, etc.) the more information can be gather by an attacker.

This attack often requires communicating with the host target services directly. For instance Telnet may be enough to communicate with the host target.

+ Typical Likelihood of Exploit

Likelihood: Very High

+ Methods of Attack
  • Injection
  • API Abuse
  • Protocol Manipulation
  • Flooding
+ Attacker Skills or Knowledge Required

Low: An attacker can use a tool to scan and automatically launch an attack against known issues. A tool can also repeat a sequence of instructions and try to brute force the service on the host target, an example of that would be the flooding technique.

Medium to High: More advanced attack may require knowledge of the protocol spoken by the host service.

+ Probing Techniques

Probing technique include fuzzing (sending random data in order to fail the service on the host target), brute forcing (with automated tools), network scanning to determine which services are available and running on the target host.

There are freely available tools to probe and gather information from host target. For instance, the attacker can find out that a host target has not been patched by collecting such information.

+ Indicators-Warnings of Attack

The log can have a trace of abnormal activity. Also if abnormal activity is detected on the host target. For instance flooding should be seen as abnormal activity and the target host may decide to take appropriate action in order to mitigate the attack (data filtering or blocking). Resource exhaustion is also a sign of abnormal activity.

+ Obfuscation Techniques

The attacker may try to hide her attack by forging the host's logs. The attacker has interest in mimicing a legitimate call to the program or service under threat.

+ Solutions and Mitigations

Apply the principle of least privilege.

Validate all untrusted data.

Apply the latest patches.

Scan your services and disable the ones which are not needed and are exposed unnecessarily. Exposing programs increases the attack surface. Only expose the services which are needed and have security mechanisms such as authentication built around them.

Avoid revealing information about your system (e.g., version of the program) to anonymous users.

Make sure that your program or service fail safely. What happen if the communication protocol is interrupted suddenly? What happen if a parameter is missing? Does your system have resistance and resiliance to attack? Fail safely when a resource exhaustion occurs.

If possible use a sandbox model which limits the actions that programs can take. A sandbox restricts a program to a set of privileges and commands that make it difficult or impossible for the program to cause any damage.

Check your program for buffer overflow and format String vulnerabilities which can lead to execution of malicious code.

Monitor traffic and resource usage and pay attention if resource exhaustion occurs.

Protect your log file from unauthorized modification and log forging.

+ Attack Motivation-Consequences
  • Run Arbitrary Code
  • Privilege Escalation
  • Denial of Service
+ Related Weaknesses
CWE-IDWeakness NameWeakness Relationship Type
250Execution with Unnecessary PrivilegesTargeted
264Permissions, Privileges, and Access ControlsTargeted
15External Control of System or Configuration SettingSecondary
+ Related Vulnerabilities
Vulnerability IDRelationship Description

Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message to cause Utility Manager to launch winhlp32 by directly accessing the context sensitive help and bypassing the GUI, then sending another message to winhlp32 in order to open a user-selected file, a different vulnerability than CVE-2003-0908.

+ Related Attack Patterns
NatureTypeIDNameDescriptionView(s) this relationship pertains toView\(s\)
ChildOfAttack PatternAttack Pattern8Buffer Overflow in an API Call 
Mechanism of Attack1000
CanPrecedeAttack PatternAttack Pattern8Buffer Overflow in an API Call 
Mechanism of Attack1000
ChildOfAttack PatternAttack Pattern9Buffer Overflow in Local Command-Line Utilities 
Mechanism of Attack1000
CanPrecedeAttack PatternAttack Pattern9Buffer Overflow in Local Command-Line Utilities 
Mechanism of Attack1000
ChildOfAttack PatternAttack Pattern10Buffer Overflow via Environment Variables 
Mechanism of Attack1000
CanPrecedeAttack PatternAttack Pattern10Buffer Overflow via Environment Variables 
Mechanism of Attack1000
ChildOfAttack PatternAttack Pattern67String Format Overflow in syslog() 
Mechanism of Attack1000
CanPrecedeAttack PatternAttack Pattern67String Format Overflow in syslog() 
Mechanism of Attack1000
ChildOfCategoryCategory232Exploitation of Privilege/Trust 
Mechanism of Attack (primary)1000
+ Relevant Security Requirements

A user must be authenticated if she invokes a privileged program.

+ Related Security Principles
  • Reluctance to Trust

  • Least Privilege

  • Fail Securely

  • Defense in Depth

+ Related Guidelines
  • Any guideline related to the buffer overflow and format String vulnerability.

  • Patch programs with the latest patches from Vendors.

  • Ensure log integrity

  • Validate all untrusted input

+ Purposes
  • Exploitation
+ CIA Impact
Confidentiality Impact: HighIntegrity Impact: HighAvailability Impact: Low
+ Technical Context
Architectural Paradigms
+ References
G. Hoglund and G. McGraw. "Exploiting Software: How to Break Code". Addison-Wesley. February 2004.

CWE : Failure to protect stored data from modification

CWE : Setting manipulation

CWE : Often Misused: Privilege Management

CWE : Permissions, Privileges, and Access Controls

+ Content History
G. Hoglund and G. McGraw. Exploiting Software: How to Break Code. Addison-Wesley, February 2004.Cigital, Inc2007-03-01
Eric DalciCigital, Inc2007-02-13Fleshed out content to CAPEC schema from the original descriptions in "Exploiting Software"
Sean BarnumCigital, Inc2007-03-05Review and revise
Richard StruseVOXEM, Inc2007-03-26Review and feedback leading to changes in Name
Sean BarnumCigital, Inc2007-04-13Modified pattern content according to review and feedback