[THEME MUSIC]
Overview of Windows vulnerabilities.
Now that we have an idea of what system a host based attacks are
and why they're so important, let's
get started with our first operating system, which
is going to be Windows.
And before we can get started with exploiting Windows
and taking a look at the various vulnerabilities
that we can exploit in order to exploit them, let's
get an overview of the various Windows vulnerabilities
that we can exploit and just get an idea of the overall threat
surface and how Windows is developed
and how that development philosophy leads
to the creation or the actual development of new exploits.
So first things first, a brief history of Windows
vulnerabilities.
Now, Microsoft Windows has been around for a very long time
and it is one of the most popular
and dominant operating systems worldwide with a market
share of 70% and probably even more than that as of 2021.
Now, the popularity and deployment
of the Windows operating system by individuals and companies
makes it a prime target for attackers given the threat
surface.
So the rule of thumb is that whenever
a system, service application, or device is
used by a lot of people, attackers will generally
speaking shift their attention to that platform application
operating system or device because many users are
using it.
And over the last 15 years Windows
has had its fair share of severe vulnerabilities ranging
from MS08-067, also known as Conflcker to MS17-010,
which is known as EternalBlue.
And, of course, these vulnerabilities really
had a huge part to play in the infosec or cybersecurity
industry and it actually helped us
change the way we think of vulnerabilities
and securing operating systems.
Now, given the popularity of Windows,
most of these vulnerabilities have
publicly available accessible exploit code,
which makes them relatively straightforward to exploit.
So again, given the popularity of the Windows operating system
and the sheer number of vulnerabilities as well
as the different versions of Windows,
attackers will typically find vulnerabilities
within the operating system and either keep them to themselves
as zero days or they may disclose them to Windows.
Whatever the case, most of these vulnerabilities
can be exploited relatively easily
through the use of publicly available exploit code
with various resources and proof of concepts
that explain how to exploit these vulnerabilities.
So Windows really is the prime target for attackers
and most of you should already be familiar with that.
Now, in terms of Windows vulnerabilities,
Microsoft Windows has various operating system versions
and releases.
And what this eventually leads to is
it actually leads to a fragmented threat surface
in terms of vulnerability.
So an example of this would be vulnerabilities
that exist on Windows 7 are not present in Windows 10.
And looking deeper, companies that have been around
for the last 10 years may have been using Windows XP
and may not have made the transition to Windows 7
or Windows 10 for that matter or may
have made the transition to Windows 7,
but not Windows 10 yet given the nature of organizations
and the bureaucracy involved in making a transition
or changing the versions of software that
is being used by that company.
Now, what this means is that companies are pretty much
going to be running the latest version of Windows
or an older version of Windows.
And if they are running an older version of Windows,
then they're going to be left vulnerable
because the longer an operating system or a product
is out there, the more vulnerabilities
will be detected making the company even more
vulnerable to attack.
Now, regardless of the various versions and releases
of Windows, all of the various versions of Windows
share the likeness given the development
model and the philosophy that they're built on.
So let's take a look at this a little bit more.
So Windows operating systems have
been developed in the C programming
language that's not new.
Most of the operating systems out there like Linux or any
NICs based operating system all are built in some way or form
with C or C+.
Now what this means or what this leads to is
it leads these operating systems to essentially
be vulnerable to vulnerabilities or exploits like buffer
overflows, arbitrary code, execution et cetera, et cetera.
And that is down to the vulnerabilities that
exist within the programming language itself,
and we'll get to this in a few seconds.
Secondly, by default, Windows is not
really configured to run securely
and requires a proactive implementation
of security practices in order to configure
Windows to run securely.
So when you install a fresh new version of Windows
or, for example, Windows 10, it's not
configured to be secure, and that's really
not something that we can blame Microsoft for.
That's just the nature of the operating system given
the various use cases for individuals, companies,
artists, architects, et cetera.
So what that means is that by default, Windows
is vulnerable and requires endpoint protection.
So within an organization, companies
have to configure Windows to run based on their own security
policies or in compliance with the security policies.
They also need to take a look at endpoint security.
So installing antivirus solutions
performing patch management, all of that stuff
has to be handled by a company.
And if it's not handled in a systematic methodological way,
that again leaves the door open for attackers
to exploit various vulnerabilities that
could be inherent or caused by misconfigurations.
So that is something that you really need to be--
you really need to take into consideration.
Furthermore, newly discovered vulnerabilities
are not immediately patched by Microsoft.
And given the fragmented nature of Windows,
many systems are left unpatched.
So as I said, Windows over the last 10 years
has seen three to four major releases.
So you have had XP, Vista, Windows 7, Windows 8.1,
Windows 10, and now Windows 11.
All of these versions are totally different versions
and they suffer from their own vulnerabilities,
and Microsoft is constantly shifting
the goalposts in regards to the latest version of Windows.
So whenever there's a new version of Windows,
they're trying to get as much of their customer base
onto the new version and to actually
ditch the previous version.
But of course, as we know, companies don't really
operate that way and changing the version of Windows
being used is a long process.
So for example, if companies are--
when Windows 10 was released, companies were still
running on Windows 7.
And Windows 7 was a very old operating system at the time
and was still being exploited and new vulnerabilities
were still being found.
And Microsoft was very slow in patching the vulnerabilities
on Windows 7, because they were primarily
focused on Windows 10, which meant that companies
were left vulnerable and had to implement patches themselves.
So this fragmented nature of Windows as well as
Microsoft's policy or the actual viewpoint on patching really,
really causes a lot of issues.
And around the world, you still have
companies running Windows 7, some are still
even running Windows XP.
And in the context of Windows Server,
many companies are still running Windows Server 2012,
which is a largely vulnerable if not patched correctly.
And also I've seen a lot of companies still running
Windows Server 2008.
So that's one of the biggest issues with Windows
is the fragmentation of the actual deployment
of the operating system and the fact that older
versions of Windows are still running out there.
Now, let's explore this a little bit more.
Given the frequent releases of the new versions of Windows,
this is also a contributing factor
to exploitation or the actual threat surface
that Windows operating systems face as many companies take
a substantial length of time to upgrade
their systems to the latest version of Windows
and opt to use older versions that
may be affected by an increasing number of vulnerabilities.
I've already mentioned this.
So companies still using older versions
and newer vulnerabilities being discovered for those older
versions, and that leaves them open to attack.
In addition to inherent vulnerabilities,
Windows is also vulnerable to cross-platform vulnerabilities,
for example, SQL injection.
So if you have a Windows system or Windows
Server running the Microsoft IIS,
a web server and you're hosting a web application on that web
server, that web server or that web application
is still vulnerable to cross-platform vulnerabilities
like SQL injection, cross-site scripting, et cetera, et
cetera.
So that also needs to be taken into consideration.
Now, systems or hosts that are running Windows
are also vulnerable to physical attacks.
And this is something that will not
be covering because of the variability
of the attacks available.
And the types of physical attacks
range from theft of the system itself,
malicious peripheral devices like USB drives
with malware on them or USB drives
that have been configured to run as key loggers.
So when it comes down to host based security or system
and host a security, you need to take
in a holistic view of the vulnerabilities
and physical security is definitely
one of the key elements of this.
And, of course, that comes into the whole aspect
of physical penetration testing, which
we'll not be touching upon, but it's still
very, very important.
As for the various types of Windows
vulnerabilities out there, they are typically
classified into the following categories and, of course,
this is not an exhaustive list of the different types
of vulnerabilities that affect Windows.
In this case, it's going to be the vulnerabilities
that we'll be focusing on.
So firstly, we have information disclosure.
Information disclosure is essentially
a vulnerability that allows an attacker
to access confidential data or data that they should not
be able to access, and that is quite frequent
and may not lead directly to exploitation,
but it is still a compromise of the company's security
or that particular system or host security.
We then have both buffer overflows, which most of you
should be familiar with.
These vulnerabilities are typically
caused by a programming error that essentially allows
an attacker to write data to a buffer
and overrun the allocated buffer consequently writing data
to allocated memory addresses.
And, of course, the data that they're going to be writing
is malicious.
And once they overrun an allocated buffer,
they are writing it to memory addresses or allocated memory
addresses for other applications.
And if executed-- if this malicious code is executed,
it could give them remote access or it
could be used to execute malicious code that
could be used to perform a plethora of functionality
like executing or downloading malware so on and so forth.
We then have remote code execution,
and this is rather simple to understand.
This is a vulnerability that allows an attacker to remotely
execute on the target system.
And of course, we'll be exploring
the various ways that this has been achieved previously
and the various protocols that have
been used to facilitate this type of vulnerability
or attack.
We then have privilege escalation vulnerabilities,
and this is essentially a vulnerability
as we already know that allows an attacker
to elevate their privileges after initial compromise.
And there are various ways that this can be done, most of which
that we'll be exploring will tie into the actual core
of the Windows operating system and misconfigurations or
inherent vulnerabilities.
We then have denial of service right or DOS attacks,
and this is, of course, different to the distributed
denial of service attacks.
In the case of a denial of service attacks,
this is essentially a vulnerability
that allows an attacker to consume
a system of hosts resources.
And the resources I'm referring to here
are CPU resources or CPU usage, RAM, network consumption
cetera.
This consequently prevents the system
from functioning normally.
So an example of this would be a simple denial of service attack
that essentially prevents a web server
or consumes all the resources on a system
and prevents a web server from essentially serving
requests or responding to requests
from legitimate customers.
And, of course, that is really not something that is good.
So we really will not be focusing
on denial of service vulnerabilities and attacks,
because we are primarily interested in gaining access,
elevating privileges, so on and so forth.
That being said, that is going to conclude this video.
In the next video, we'll take a look
at some of the frequently exploited Windows features
as well as services.
And then after we've explored that,
we'll then move on to the next section that
will cover the actual exploitation of these features
and services.
So that's going to be it for this video,
and I'll be seeing you in the next video.