Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. However, there are instances where programs need to be executed in an elevated context to function properly, but the user running them may not have the specific required privileges.Īdversaries may bypass UAC mechanisms to elevate process privileges on system. Normally an application is run in the current user’s context, regardless of which user or group owns the application. On Linux or macOS, when the setuid or setgid bits are set for an application binary, the application will run with the privileges of the owning user or group respectively.
An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.Īn adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions.
0 kommentar(er)
