Ethical Hacking System Hacking Syllabus

What is a SUID bit and why is it relevant to privilege escalation on Linux?

The SUID (Set User ID) permission bit makes an executable run with the file owner's privileges (often root) rather than the caller's. A vulnerable or misconfigured SUID-root binary can be abused to execute commands as root.

Name two common Windows privilege-escalation techniques.

Abusing unquoted service paths, weak service permissions (modifiable binaries), DLL hijacking, always-install-elevated policy, and token impersonation (e.g., SeImpersonatePrivilege / Potato attacks).

What is a rootkit?

Stealthy malware designed to gain and maintain privileged (root/administrator) access while hiding its own presence — and often other malware — from the operating system, users, and security tools.

List the major types of rootkits by the layer at which they operate.

User-mode (application), Kernel-mode (ring 0, hooks OS structures), Bootloader/bootkit (infects MBR/VBR/boot process), Hypervisor/virtualized (runs beneath the OS), Firmware/hardware (BIOS/UEFI, device firmware), and Library-level rootkits.

Why are kernel-mode rootkits harder to detect than user-mode rootkits?

They run at the same privilege level (ring 0) as the OS and security software, so they can hook or patch kernel data structures (e.g., via DKOM) to intercept and falsify the very API calls detection tools rely on.

What is DKOM in the context of rootkits?

Direct Kernel Object Manipulation — a technique where a rootkit directly modifies kernel data structures (like the process list) in memory to hide processes, drivers, or ports without altering code paths.

What is a backdoor?

A covert method of bypassing normal authentication to gain remote access to a system, planted so the attacker can return later even if the original vulnerability is patched.

How does a backdoor differ from a rootkit?

A backdoor provides a persistent hidden access channel into the system; a rootkit's primary purpose is to hide activity/presence and maintain privilege. They are often combined (a rootkit conceals a backdoor).

Contrast a bind shell with a reverse shell.

A bind shell opens a listening port on the victim that the attacker connects to (blocked by inbound firewalls/NAT). A reverse shell has the victim connect outbound to the attacker's listener, bypassing inbound filtering and NAT.

What is a Trojan horse?

Malware disguised as legitimate or desirable software that, once run by the user, executes hidden malicious functions such as installing a backdoor, stealing data, or damaging the system.

How does a Trojan differ from a virus and a worm?

A Trojan relies on the user to run it and does not self-replicate. A virus attaches to a host file and spreads when that file runs. A worm self-replicates and spreads across networks autonomously without a host file or user action.

List common categories of Trojans by function.

Remote Access Trojans (RATs), backdoor Trojans, banking/credential-stealing Trojans, downloader/dropper Trojans, keyloggers, botnet Trojans, ransomware Trojans, and DDoS Trojans.

What is a wrapper (binder) in the context of Trojans?

A tool that combines a Trojan payload with a legitimate executable into a single file, so running the seemingly benign program also silently installs the Trojan.

What is a RAT (Remote Access Trojan)?

A Trojan that gives an attacker full remote control over the infected machine — file access, keylogging, webcam/mic capture, command execution — typically through a covert command-and-control channel.

Why is clearing logs a key step after a system compromise?

It removes forensic evidence of the intrusion (logins, commands, file changes), helping the attacker evade detection and hindering incident response and attribution — part of the 'covering tracks' phase.

Which Windows event logs does an attacker typically target when covering tracks?

The Security, System, and Application event logs (viewed via Event Viewer, stored as .evtx files), often cleared with tools like wevtutil, clearev (Meterpreter), or PowerShell.

On a Linux system, which log files and artifacts are commonly cleared or manipulated to hide activity?

/var/log/auth.log (or secure), /var/log/syslog, /var/log/wtmp, /var/log/btmp, /var/log/lastlog, and the shell history file (~/.bash_history).

Why is selectively editing logs stealthier than deleting them entirely, and what defends against both?

Wholesale deletion or an empty/gapped log is itself a red flag, whereas removing only incriminating entries is less obvious. Remote/centralized log forwarding (SIEM/syslog server) and append-only/immutable logs defend against local tampering.

What is steganography?

The practice of hiding a secret message inside a non-secret carrier (image, audio, video, text) so that the very existence of the communication is concealed.

How does steganography fundamentally differ from cryptography?

Cryptography hides the meaning of a message (it is visibly encrypted); steganography hides the existence of the message (the carrier looks ordinary). They are often combined for defense in depth.

Describe the LSB (Least Significant Bit) steganography technique.

Secret data bits are embedded into the least significant bit of each pixel's color value (or audio sample). Because changing the LSB alters the value by at most 1, the visual/audible difference is imperceptible.

Define the terms cover, payload/embedded message, and stego-object in steganography.

Cover (carrier) = the original innocent file; payload/embedded message = the secret data to hide; stego-object = the resulting file containing the hidden data after embedding.

What is steganalysis?

The countermeasure to steganography: the science of detecting, and ideally extracting or destroying, hidden data within carrier files, often via statistical analysis of anomalies (e.g., LSB distribution).

State the steganographic capacity of LSB embedding for an image with $P$ pixels using $c$ color channels and 1 bit per channel.

$$C = \frac{P \times c}{8} \ \text{bytes}$$ For example, a $1000 \times 1000$ RGB image holds about $\frac{10^{6} \times 3}{8} = 375{,}000$ bytes.

What are anti-forensics techniques?

Methods used to obstruct, mislead, or defeat digital forensic investigation — by destroying, hiding, altering, or fabricating evidence, or by attacking the forensic tools/process themselves.

List the major categories of anti-forensics techniques.

Data destruction (wiping), data hiding (steganography, hidden partitions, ADS), encryption, trail obfuscation (log/timestamp manipulation), artifact wiping (secure deletion of specific traces), and attacks against forensic tools.

What is timestomping?

An anti-forensics technique that alters a file's MACE timestamps (Modified, Accessed, Created, Entry-modified) to hide when it was actually created or changed and break investigators' timelines.

What are NTFS Alternate Data Streams (ADS) and how are they abused?

ADS let an NTFS file carry additional hidden data streams besides its main content. Attackers hide malware or data in a stream (e.g., file.txt:hidden.exe) that does not appear in normal directory listings or affect the visible file size.

Why does simply deleting a file not remove its data, and what technique reliably destroys it?

Deletion only unlinks the directory entry and marks the space free; the raw data remains until overwritten and is recoverable via forensics. Secure wiping (overwriting with random/zero patterns, possibly multiple passes) or full-disk encryption is needed to truly destroy it.

How does full-disk encryption serve as an anti-forensics measure?

Without the key, the entire disk appears as unreadable ciphertext, so investigators cannot access files, metadata, or slack space. It shifts the challenge from data recovery to key recovery.