An
exploit (from the verb to exploit, in the meaning of using something to one’s own advantage) is a piece of
software, a chunk of data, or sequence of commands that takes advantage of a
bug,
glitch or
vulnerability in order to cause unintended or unanticipated behavior to occur on computer software, hardware, or something electronic (usually computerised). This frequently includes such things as gaining control of a computer system or allowing
privilege escalation or a
denial-of-service attack
There are several methods of classifying exploits. The most common is by how the exploit contacts the vulnerable software. A 'remote exploit' works over a network and exploits the security vulnerability without any prior access to the vulnerable system. A 'local exploit' requires prior access to the vulnerable system and usually increases the privileges of the person running the exploit past those granted by the
system administrator. Exploits against
client applications also exist, usually consisting of modified servers that send an exploit if accessed with client application. Exploits against client applications may also require some interaction with the user and thus may be used in combination with
social engineering method. Another classification is by the action against vulnerable system:
unauthorized data access,
arbitrary code execution,
denial of service.
Many exploits are designed to provide
superuser-level access to a computer system. However, it is also possible to use several exploits, first to gain low-level access, then to escalate privileges repeatedly until one reaches root.
Normally a single exploit can only take advantage of a specific software vulnerability. Often, when an exploit is published, the vulnerability is fixed through a
patch and the exploit becomes obsolete for newer versions of the software. This is the reason why some
blackhat hackers do not publish their exploits but keep them private to themselves or other hackers. Such exploits are referred to as '
zero day exploits' and to obtain access to such exploits is the primary desire of unskilled attackers, often nicknamed
script kiddies
Types
Exploits are commonly categorized and named by these criteria:
- The type of vulnerability they exploit (See the article on vulnerabilities for a list)
- Whether they need to be run on the same machine as the program that has the vulnerability (local) or can be run on one machine to attack a program running on another machine (remote).
- The result of running the exploit
Pivoting
Pivoting refers to method used by
penetration testers that uses compromised system to attack other systems on the same network to avoid restrictions such as firewall configurations, which may prohibit direct access to all machines. For example, an attacker compromises a web server on a corporate network, the attacker can then use the compromised web server to attack other systems on the network. These types of attacks are often called multi-layered attacks. Pivoting is also known as island hopping.
Pivoting can further be distinguished into proxy pivoting and VPN pivoting:
- Proxy pivoting generally describes the practice channeling traffic through a compromised target using a proxy payload on the machine and launching attacks from this computer.[1] This type of pivoting is restricted to certain TCP and UDP ports that are supported by the proxy.
- VPN pivoting enables the attacker to create an encrypted layer 2 tunnel into the compromised machine to route any network traffic through that target machine, for example to run a vulnerability scan on the internal network through the compromised machine, effectively giving the attacker full network access as if they were behind the firewall.
Typically, the proxy or VPN applications enabling pivoting are executed on the target computer as the
payload (software) of an exploit
Virus Removal Techniquies offered by techbuddies
If your computer is behaving strangely, your friends are receiving e-mails from your account which you never sent, you see updates on your facebook profile which you never made, you may have a virus on your machine that has hacked into your account by learning your password and user name of your various accounts. The symptoms described above are some of the visible symptoms of the viruses that infect computers, there are viruses which take control of our machine and use this to direct other machines to attack other machines (popularly known as bots). This slows down your machine and you are not even able to perform regular tasks from your machine. This may be happening even though you have a valid Anti-Virus installed on your machine. Some viruses disable the anti-virus so that they can detect the viruses and remove them.
While complicated it is possible to remove viruses from your machine without formatting it or deleting any data from your machine. Our team of certified experts can help you to remove viruses from your machine and secure your PC, preventing future attacks on your machine.
Techbuddies have trained expert to resolve your computer problems.
