As we can see, there are multiple ways malware can achieve persistence with the privileges it obtains immediately after penetration. It comes as no surprise that malware targeting IoT first of all focuses on them. For example, the VPNFilter malware incorporated crontab to achieve persistence; Torii (Mirai's clone) tries several techniques, one of which is using the local ~/.bashrc file.
However, if at any stage the privilege escalation is required, there are several common ways of how this can be achieved:
- Exploit: Privilege escalation exploits are quite common, and there is always a chance that the owner of a particular system didn't patch it in time.
- SUID executables: As we discussed in the previous section, it is possible to execute commands with elevated privileges in the case of misconfigured SUID files.
- Loose sudo permissions: If the current user is allowed to execute any command using sudo without even a need to provide a password, it can be easily...
