Skip to Main Content
Python for Cybersecurity
book

Python for Cybersecurity

by Howard E. Poston, III
March 2022
Intermediate to advanced content levelIntermediate to advanced
240 pages
5h 13m
English
Wiley
Content preview from Python for Cybersecurity

CHAPTER 5Performing Privilege Escalation

The previous chapter explored the use of Python to reinforce an attacker's foothold on a compromised computer using persistence mechanisms. In this chapter, we discuss how similar techniques can be used to gain elevated privileges or expanded access.

This topic is covered in the Privilege Escalation tactic of the MITRE ATT&CK framework. Figure 5.1 shows the 13 techniques in this tactic.

Snapshot of MITRE ATT&CK: Privilege Escalation

Figure 5.1: MITRE ATT&CK: Privilege Escalation

Of these techniques, this chapter will focus on Boot or Logon Initialization Scripts and Hijack Execution Flow. The first pair of examples will look at the use of logon scripts to expand privileges, while the second will demonstrate how to hijack Python's search order for imported modules.

The code sample archive for this chapter can be found at https://www.wiley.com/go/pythonforcybersecurity and contains the following sample code files:

  • LogonScript.py
  • DetectLogonScript.py
  • win32evtlog.py
  • PythonLibraryMismatch.py

Boot or Logon Initialization Scripts

In the previous chapter, we discussed the use of Boot or Logon Autostart Execution for achieving persistence on a system. This technique can also be used for privilege escalation if the script is executed with a higher privilege level than the user who created it.

However, Autorun keys in the Windows Registry are not the only way to ensure that code is ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Mastering Python for Networking and Security

Mastering Python for Networking and Security

José Manuel Ortega

Publisher Resources

ISBN: 9781119850649Purchase Link