01. Introduction To Host Based Attacks

1. Introduction¶

System/Host-Based Attacks are cyber attacks that specifically target an individual system (host) such as a:

Personal computer
Server
Workstation
Laptop

These attacks focus on the operating system (OS) and its internal components rather than network-level services.

Key Idea¶

A host-based attack is OS-centric, meaning the attacker tries to exploit weaknesses in:

Windows
Linux
macOS (less common in labs but still relevant)

2. When Do Host-Based Attacks Occur?¶

Host-based attacks usually occur after initial access is gained into a network.

Typical Attack Flow:¶

Attacker gains access to network (via phishing, exploitation, etc.)
Moves laterally inside network
Targets specific systems (hosts)
Exploits OS vulnerabilities

Example¶

Attacker exploits a web server vulnerability
Gains shell access
Then escalates privileges on the system using OS vulnerabilities

3. Why Not Just Network Attacks?¶

Network attacks focus on:

Open ports
Services (HTTP, FTP, SSH)

But host-based attacks focus on:

Internal OS vulnerabilities
Local misconfigurations
Privilege escalation

Difference Summary¶

Type	Focus Area	Example
Network-Based	Services & ports	Port scanning, DoS
Host-Based	OS & local system	Privilege escalation

4. Core Characteristics of Host-Based Attacks¶

4.1 Exploiting OS Vulnerabilities¶

Attackers target inherent flaws in the OS.

Example¶

Windows privilege escalation using outdated patches
Linux kernel exploit (Dirty COW vulnerability)

4.2 Requires Deep OS Knowledge¶

These attacks are more specialized and require understanding of:

File systems
Processes
Memory management
Permissions

Example¶

Knowing /etc/passwd and /etc/shadow in Linux
Understanding Windows Registry

4.3 Exploiting Misconfigurations¶

Misconfigurations are one of the biggest entry points.

Example¶

World-writable files (chmod 777)
SUID binaries in Linux
Weak permissions on Windows services

4.4 Targeting Internal Systems¶

Host-based attacks usually occur on:

Internal servers
Employee workstations
Database systems

5. Types of Host-Based Attacks¶

5.1 Privilege Escalation¶

Gaining higher-level access than intended.

Example¶

User → Root (Linux)
User → Administrator (Windows)

sudo -l

If misconfigured, attacker can run commands as root.

5.2 Password Attacks¶

Target stored credentials on a system.

Example¶

Dumping hashes from /etc/shadow
Using tools like John the Ripper

5.3 File System Exploitation¶

Manipulating files to gain access.

Example¶

Replacing binaries
Editing config files

5.4 Kernel Exploits¶

Exploiting vulnerabilities in OS kernel.

Example¶

Dirty COW (Linux)
Windows token impersonation exploits

5.5 Persistence Mechanisms¶

Maintaining access to a compromised system.

Example¶

Adding cron jobs (Linux)
Creating startup registry entries (Windows)

6. Real-World Example Scenario¶

Scenario: Linux Server Compromise¶

Attacker gains access via SSH (weak password)
Checks system:

uname -a

Finds vulnerable kernel version
Runs exploit (e.g., Dirty COW)
Gains root access

Outcome: Full system control

7. Tools Used in Host-Based Attacks¶

Common tools used during penetration testing:

LinPEAS (Linux privilege escalation)
WinPEAS (Windows privilege escalation)
Metasploit (post-exploitation modules)
Nmap (initial enumeration, not host attack but used before)

8. Detection & Prevention¶

8.1 Patch Management¶

Regular OS updates
Fix known vulnerabilities

8.2 Proper Permissions¶

Avoid 777 permissions
Use least privilege principle

8.3 Monitoring¶

Use tools like:
- Wazuh
- OSSEC
- Auditd

8.4 Hardening¶

Disable unnecessary services
Remove unused accounts

9. Key Takeaways¶

Host-based attacks target the operating system
They occur mostly after initial network access
Require deep technical knowledge
Focus on:
- Vulnerabilities
- Misconfigurations
- Privilege escalation

10. Quick Revision¶

Host-based = OS-focused attacks
Happens after gaining access
Exploits:
- Kernel
- Permissions
- Configurations
Goal:
- Gain higher privileges
- Maintain control