Definitions And Terms Of The Padvish Bug Hunting Award Program

This term means there is a weakness or bug in the software that lets an intruder exploit it.

Non-computer allegory: assume a military castle that aims to stop attackers from intrusion. Now assume that one of the castle’s walls has a crack that lets the attackers cross it and enters the castle. If we assume castle is the software, this crack is equal to that “vulnerability” concept in the software.

Exploiting means manipulation and seducing a “vulnerability” of software. Vulnerability is a potential scheme that enabled exploitation.

Non-computer allegory: in the example of the military castle, when attackers cross the crack of the castle, we call it exploitation.

A special kind of “vulnerability” in the software is known as “remote code execution”.

This kind of vulnerability lets the attacker so to deceive a software – its goal is not to code execution- in a way that leads to executing the desired code.

in this issue, it is very important that:

First) the software does not mean to execute the code. For example, if the duty of software is to remotely receive an order and execute it (like remote desktop) and this software is used in its normal field of duties; this is not a vulnerability and as a result, it is not RCE either.

Second) the execution was remotely executed. In this case, consider that being remote means the execution executed without the necessity of login or having other accesses.

For instance: consider a web server that must search for a phrase and display its results. If an attacker can send some values to this web server that instead of searching it, execute it as a code, it will be an RCE vulnerability.

Reverse example: an attacker accessed an admin password and executed its code by remote desktop. This is not RCE, because the attacker has logged in to the system and as a result, now he can access the system with the access level of the local admin user. Therefore, the however attacker is behind the system and remotely connected to the system, but the code that he executed is locally or with local access.

Reverse example 2: the attacker sent backdoor malware to the client and convinced the client to execute it. The attacker will remotely control the system by using a backdoor. This example essentially does not show the vulnerability of the system and is some kind of social engineering. The software acted correctly, but the system client was misguided and has given the wrong answer to the software. Also, the backdoor is executed locally and with the aforementioned definitions, it is not remote access.

Another important note: is in the Code execution definition itself. Pay attention that the code execution in the debate of vulnerability is about the place where the execution of the code is not expected. For instance, when you run an exe file, normally you expect it to be executed and this is not a vulnerability. But if opening a Word file leads to the execution of a code on your system, a very dangerous vulnerability is occurred, because it is not expected to encounter this problem by opening a simple word file. Similarly, if an attacker encourages a client in a way to execute an exe file, this will be included in the phishing and social engineering field and is not a technical bug. But it will be needed to train the client and apply restrictive policies (for instance preventing from emailing an exe or like that by some sites and software)

There is a special type of “vulnerability” in software named “local privilege escalation”. Normally, this kind of vulnerability will be used when the attacker could access the system in some way and now want to escalate its access from client to admin.

For example, an attacker could log in to the system in some way (for example stealing the client password) and now wants to change one of the system settings. For this, the attacker must have admin or root access. As a result, he uses an LPE exploit to change his limited and not admin user to admin user.

Pay attention that in this scenario it is possible that the attacker is sitting behind the system, remotely controlling the system, or even sending a Trojan to the user and the user will unintentionally execute it. In all these cases, the access of the attacker considers local, because this attacker took complete control of the system (as a normal user) before.