{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/exploit","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/exploit/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/exploit/"},"term":{"en":"Exploit","da":"Exploit"},"aka":{"en":["exploit code"],"da":["exploit-kode","udnyttelseskode"]},"domain":["security"],"cluster":"fundamentals","layer":"application","status":"current","summary":{"en":"A piece of code or a set of steps that turns a known weakness in a system into actual access or control for an attacker.","da":"Et stykke kode eller en række trin, der gør en kendt svaghed i et system til reel adgang eller kontrol for en angriber."},"body":{"formal":{"en":"A method, often a small program or a specially made input, that triggers a specific vulnerability so the system does something its makers never meant, such as running the attacker's own commands or handing out data.","da":"En metode, ofte et lille program eller et særligt udformet input, der udløser en bestemt sårbarhed, så systemet gør noget, dets skabere aldrig havde tænkt sig, fx kører angriberens egne kommandoer eller udleverer data."},"plain":{"en":"Like a bent piece of wire that someone has shaped to open one particular kind of cheap lock - it works every time, for anyone who copies the shape.","da":"Som et bøjet stykke ståltråd, som nogen har formet, så det åbner én bestemt slags billig lås - det virker hver gang, for alle, der kopierer formen."},"inPractice":{"en":"A week after a flaw in a widely used VPN product is made public, ready-made exploit code appears online; the Danish Resilience Agency warns Danish organisations as attackers start using it against every one that has not yet installed the patch.","da":"En uge efter at en fejl i et udbredt VPN-produkt er blevet offentliggjort, dukker der færdig exploit-kode op på nettet; SAMSIK advarer danske organisationer, mens angribere begynder at bruge den mod alle, der endnu ikke har installeret rettelsen."},"whyItMatters":{"en":"A weakness nobody can use is mostly a theory; once a working exploit exists, the clock starts and fixing the weakness becomes urgent.","da":"En svaghed, som ingen kan udnytte, er mest teori; så snart der findes et virkende exploit, begynder nedtællingen, og det haster med at lukke hullet."}},"deepDive":{"en":"An exploit is the bridge between a vulnerability, which is a property of the code or configuration, and an attacker capability such as remote code execution, privilege escalation, authentication bypass or information disclosure. The vulnerability class largely determines the technique. Injection flaws (SQL, OS command, template injection, JNDI lookups as in Log4Shell, CVE-2021-44228) are exploited with crafted input strings. Memory-safety bugs in C and C++ code, such as stack and heap buffer overflows, use-after-free and type confusion, are exploited by corrupting memory so that control flow reaches attacker-chosen code. Logic flaws and misconfigurations often need no \"payload\" at all, only a specific sequence of requests.\n\nMemory-corruption exploitation has been shaped by an arms race with mitigations. Non-executable memory (DEP/NX) stopped the injection of shellcode onto the stack, which led to return-oriented programming (ROP), chaining short instruction sequences (\"gadgets\") already present in the binary. Address space layout randomisation (ASLR) hides where those gadgets are, so modern exploits usually need a separate information-leak bug first. Stack canaries, control-flow integrity and hardware shadow stacks (Intel CET) raise the bar further. As a result, a working exploit against a hardened browser or phone is typically a chain of several bugs, for example a renderer bug plus a sandbox escape plus a kernel privilege escalation.\n\nMaturity matters. A proof of concept demonstrates the bug, often just crashing the process; a weaponised exploit is reliable across versions and delivers a payload such as a web shell, a loader or ransomware. A zero-day is exploited before the vendor has a fix; an n-day targets a disclosed, patched vulnerability on systems that are still unpatched, which is the bulk of real-world exploitation. The EternalBlue exploit for MS17-010 was patched in March 2017, yet WannaCry and NotPetya spread widely with it months later.\n\nDefenders use this to prioritise. A CVE identifier names the vulnerability and CVSS (currently v4.0) scores its technical severity, but neither says whether an exploit exists. FIRST's EPSS estimates the probability of exploitation in the next 30 days, and CISA's Known Exploited Vulnerabilities catalogue lists flaws with evidence of exploitation in the wild. Patch management, virtual patching in a WAF or IPS, attack-surface reduction and exploit mitigations in the OS are the controls; a vulnerability scanner finds the weakness, while the exploit is what turns it into a security incident. Malware is the payload an exploit often delivers, not the exploit itself.","da":"Et exploit er broen mellem en sårbarhed, som er en egenskab ved koden eller konfigurationen, og en konkret evne hos angriberen, fx remote code execution, rettighedseskalering, omgåelse af autentificering eller udlevering af data. Sårbarhedsklassen bestemmer i høj grad teknikken. Injektionsfejl (SQL, OS-kommandoer, template injection, JNDI-opslag som i Log4Shell, CVE-2021-44228) udnyttes med særligt udformede inputstrenge. Hukommelsesfejl i C- og C++-kode, fx buffer overflows på stakken og heapen, use-after-free og type confusion, udnyttes ved at korrumpere hukommelsen, så programmets kontrolflow ender i kode, angriberen har valgt. Logiske fejl og fejlkonfigurationer kræver ofte slet ingen \"payload\", kun en bestemt rækkefølge af forespørgsler.\n\nUdnyttelse af hukommelsesfejl er formet af et våbenkapløb med mitigeringer. Ikke-eksekverbar hukommelse (DEP/NX) stoppede indsprøjtning af shellcode på stakken, hvilket førte til return-oriented programming (ROP), hvor korte instruktionssekvenser (\"gadgets\"), der allerede findes i programmet, kædes sammen. Address space layout randomisation (ASLR) skjuler, hvor disse gadgets ligger, så moderne exploits som regel først kræver en separat fejl, der lækker adresser. Stack canaries, control-flow integrity og shadow stacks i hardware (Intel CET) hæver barren yderligere. Derfor er et virkende exploit mod en hærdet browser eller telefon typisk en kæde af flere fejl, fx en fejl i rendereren plus et sandbox escape plus en rettighedseskalering i kernen.\n\nModenheden betyder noget. Et proof of concept demonstrerer fejlen, ofte blot ved at få processen til at crashe; et våbengjort exploit virker pålideligt på tværs af versioner og leverer en payload som en web shell, en loader eller ransomware. En zero-day udnyttes, før leverandøren har en rettelse; en n-day rammer en offentliggjort og rettet sårbarhed på systemer, der stadig ikke er patchet, og det er langt størstedelen af den reelle udnyttelse. EternalBlue-exploitet til MS17-010 blev lukket med en patch i marts 2017, men WannaCry og NotPetya spredte sig alligevel bredt med det måneder senere.\n\nForsvarere bruger dette til at prioritere. Et CVE-nummer identificerer sårbarheden, og CVSS (i dag v4.0) vurderer dens tekniske alvor, men ingen af dem siger, om der findes et exploit. FIRST's EPSS estimerer sandsynligheden for udnyttelse inden for de næste 30 dage, og CISA's Known Exploited Vulnerabilities-katalog lister fejl, der beviseligt udnyttes aktivt. Patch management, virtuel patching i en WAF eller IPS, reduktion af angrebsfladen og exploit-mitigeringer i styresystemet er kontrollerne; en sårbarhedsscanner finder svagheden, mens exploitet er det, der gør den til en sikkerhedshændelse. Malware er den payload, et exploit ofte leverer, ikke selve exploitet."},"edges":[{"type":"exploits","to":"security/vulnerability","why":{"en":"An exploit exists only to trigger a specific weakness; without the weakness it does nothing.","da":"Et exploit findes kun for at udløse en bestemt svaghed; uden svagheden gør det ingenting."},"confidence":"high","strength":"primary"},{"type":"causes","to":"security/security-incident","why":{"en":"When an exploit is used against a real system, the result is an event that harms or threatens that system.","da":"Når et exploit bruges mod et rigtigt system, er resultatet en hændelse, der skader eller truer systemet."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"security/malware","confidence":"high","strength":"normal"}],"depth":0,"sources":[{"title":"NIST Glossary - Exploit","url":"https://csrc.nist.gov/glossary/term/exploit","tier":"standard","publisher":"NIST"},{"title":"MITRE ATT&CK - T1190 Exploit Public-Facing Application","url":"https://attack.mitre.org/techniques/T1190/","tier":"reference","publisher":"MITRE"}],"draft":true}