1

Which kinds of vulnerabilities or security holes a hacker would use to penetrate and take over a computer in a network, like a normal PC in a default network (Wireless-LAN).

I often hear that the computer of a person got hacked, but it was not a webserver, so the attacker could not exploit a SQL-Injection or a LFI vulnerability or something like that. Is the only option or possibility to hack a computer of a person (not a webserver) with Phishing or Social Engineering (Tronjans, Backdoors end etc.) via email attachments or something like that?

  • Social engineering with a list of people to be fired.docx.exe file, or malware on company-branded USB sticks left around everywhere (with tempting filenames on it just like in the first case). – André Borie Jul 23 '16 at 13:16
  • How would a professional hacker penetrate a computer in a network, let me count the ways... This is pretty open ended, usually it's easier to mess with a user first. – Fiasco Labs Jul 23 '16 at 17:38
5

This is an extremely broad question. When you're learning about security and penetration-testing, you're supposed to learn all these techniques. There are loads of techniques each with it's own purpose, situation,...

To give a small answer on your question, Social engineering is often used, and so are backdoors. Lastly I had to write a PoC (Proof of concept) for a webshop. They had a design-flaw and XSS-error, the point is, that I could hack the computer of each visitor (not user, just visitor); this attack was a mix of: Website exploitation (XSS & the design flaw), basic social-engineering, exploiting a browser-vulnerability using BeEF & Metasploit, triggering a backdoor (reverse_tcp_meterpreter) on the user's machine.

Like you see, this attack took four to five different things in order to succeed, but at the end, I had control of the user's machine (my own machine of course in this example, it was a PoC).

Other ways to attack a machine on your network, is by seeing if he uses a specific service which has a vulnerability using port-scanning. On your computer you have specific services running which need to listen to a specific port, most of the time, a port-number is related to that service. (e.g, 80 & 443 are HTTP(S) and thus mostly browsers). You can scan a machine on 'open' ports, if a port is open, you can look the port-number up to see if it matches a specific service. If it does, maybe the victim is using an old version of that service-software and that vulnerability can be exploited through that port.

When software has e.g a buffer overflow-vulnerability, it can be exploited. No matter if the payload is coming from an user-input or from a socket (port).

Than, you also have frameworks like e.g Metasploit who specialise in exploiting systems like Windows. In some cases you can get shell to another user's computer without none or very little user-interaction. Metasploit relies on vulnerabilities in the system's software like flaws in platforms like Adobe, Java,... Maybe you also remember that a few years ago a few people took down the Playstation & Xbox-network on Christmas? They did that with programmatically exploiting a network-vulnerability which allowed them to infect the systems on that network with a backdoor/trojan.

But if you're in the same network itself (e.g, you hacked the Wi-Fi password, or it's a public network,...) you can do things like MiTM-attacks (Man In the Middle, intercepting and manipulating packets) with almost none user interaction, or something similar like network-sniffing.

But getting access to another computersystem without any user-interaction is hard. When you e.g deploy malware to a user, and it's e.g a trojan which needs to communicate to a C&C (Command-and-control server), your trojan needs to bypass the firewall in order to be able to communicate with the outside-world. This can be done with social engineering and than user-interaction is involved (e.g tricking the user on clicking "Accept firewall exception"). If you'd do this without any user-interaction, you'd need to be able to add your firewall exception programmatically (which ain't a problem with the Windows API), but then yet you'd need to privilege escalate to get root access, to actually add the exception. Privilege escalation without user-interaction or social-engineering would be done by first finding a system-vulnerability which allows that, and than exploiting that vulnerability programmatically. With luck, you can use already found vulnerabilities and pre-made exploits with e.g Powershell-scripts, to use that as payload, in your actual payload.

As you see, tons of options; but your question is hard to answer because it's too broad, and it differs from situation to situation.

| improve this answer | |
2

Attackers employ a variety of techniques to compromise networks, however I would argue that in many (if not most cases) social engineering is involved. Spear Phishing has an overwhelming success ratio when executed properly and skilled social engineers are always going to be something to be feared.

Spear Phishing typically also relies in a weakness in the infrastructure itself in some capacity. Examples are

  • Allowing non-signed / trusted executables to run by end-users
  • Vulnerabilities in software such as Adobe Reader / Flash / Java etc
  • Allowing Macros to run in word documents
  • Letting end-users run applications with administrative privileges

To answer your question most hacks that I've read up on recently do not involve the movie plotline type "zero day was used to compromise the edge firewall and everything was pillaged after that", but rather a combination of social engineering combined with a malicious payload. Verizon releases a Data Breach Investigative Report each year with data compiled from various sources that outline common vulnerabilities and entry points. This is definitely worth a read.

In the case of Hacking Team hack however, the self-proclaimed hacker has done a fascinating write-up of how they supposedly compromised and navigated through the network. This is movie plot-line worthy and definitely worth taking the time to read but also worth noting that I think this is not as common as some may think.

| improve this answer | |
0

The most common vector for hacking user computers are probably Trojan horse programs, followed by malicious code on web pages. Although social engineering and using vulnerabilities to hack in through user routers are methods of attack, these require more work on the part of an attacker and are probably a lesser threat unless you are someone that the attacker has specifically targeted for some reason.

WiFi hacking is a real thing, but modern WiFi routers use WPA2 encryption. As long as you are not using the older WEP or (shudder) unencrypted WiFi, your risk of being cracked in this way is minimal.

This answer is the cliffnotes version. For the real answer, you'll have to do a whole lot of studying about how computers systems work and can be broken.

Definitions:

Trojan Horse: that free game you downloaded that now has infected your PC.

Malicious Web pages: That site with weak security that a hacker put malicious code on. You surfed there and the hacker's code used a security hole in your browser or OS to infect your PC.

Social engineering: "Hi! I'm from windows support. Just download this remote control program and let me rummage through your PC and fix all those viruses I see you have.

Vulnerabilities in router software: This is the Hollywood version of hacking, where the hacker hops from one system to the next until they finally reach your PC and take over. Possible, but a lot of work for the hacker.

An analogy: A hacker goes fishing. He can drop dynamite in the water (malicious web page) and grab any fish that float to the surface, or use a rod and reel and wait a couple hours (hack in Hollywood style) and get one specific fish he wants.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.