Security Vulnerabilities: How Attackers Break In and Spread Through Your Network

Imagine this scenario:

You rush to the local supermarket to grab a quick sandwich and drink between meetings on a busy day. In the parking lot, you leave your wallet on the back seat, but you remember to press the key fob to lock your new car.

Now, it turns out your car model has a software glitch where the remote key fob only locks the front two doors but not the back two. So, while you’re in the store, a thief notices the wallet and tries the back door. To their pleasant surprise, the door opens, and they have access to your wallet!

That scenario is the story of a security vulnerability in miniature. The glitch was small, and on its own it did nothing at all. It became a problem the second someone noticed what it gave them access to.  

Software works the same way. A flaw earns an attacker’s time based on the outcome it delivers, and that outcome shapes every move that follows.

Attackers treat an exploit as a starting line. Behind it, they chain a set of predictable steps: find the flaw, run code they control, take over the machine, and spread from there. They now run that chain at machine speed, and automation keeps shrinking the gap between a first exploit and a network-wide problem.  

You can follow the attack chain from the attacker’s point of view, from the first weakness to the final objective, so defenders can see where to break it.

What does a successful exploit give an attacker?

Vulnerabilities come in three main types. A flaw can live in the code, in the way a system is set up, or in the identity and user layer. Whichever type it starts in, a successful exploit tends to lead to one or more outcomes.

• Arbitrary code execution (ACE). A successful exploit that results in an attacker gaining access to the normal program flow of the vulnerable application. They then redirect flow to run the attacker’s own code rather than the application’s original code. Remote Code Execution (RCE) is a subset of ACE: the same attack run over a network.
• Elevation of privilege (EoP). This enables an attacker to gain higher privileges than what they landed on. For example, attackers use EoP to move from a standard user to an administrative account. Popular tools like Mimikatz enable privilege escalation.
• Information disclosure (ID). An exploit that gives the attacker information they shouldn’t be able to see, often sensitive personal data or details about how the system is secured.
• Security feature bypass. An exploit that gets around security guardrails that would have blocked access to a sensitive part of a system or software package.

For an attacker, a vulnerability and its exploit are just a means to an end: a way to start a breach and gain a foothold.

Keep that in mind through the technical middle: every step after the exploit runs on network connections, and defenders get a say in which ones stay open.

How do threat actors use a vulnerability to start a breach?

The attacker will try to inject exploit code into memory via a vulnerable application, such as through a buffer overflow. This enables them to redirect normal program flow to the attacker’s malicious code, also known as shellcode.

Now, the threat actor’s malicious code (shellcode) takes over the machine to gain an initial foothold and set up command and control (C&C or C2). At this point, the attacker has successfully started the breach.

Each step serves a crucial purpose in the overall attack chain:

1. Vulnerability discovery. This is the process of finding a weakness in how a system or software is made or how it’s being used. This can include reverse engineering, fuzzing, code analysis (static and dynamic), or dependency analysis. ‍
2. Exploit a vulnerable program. Exploits are pieces of low-level or native code that successfully leverage a vulnerability. This can include exploits leading to arbitrary code execution (ACE), bypass, elevation of privilege (EoP), or information disclosure (ID). ‍
3. Shellcode. Shellcode is the specific low-level malicious code or specially crafted attack that attempts to hijack the normal flow of a running program and redirect that flow to an attacker's malicious code also running in memory. This can include buffer overflows, heap sprays, VTable hijacking, or return-oriented programming (ROP). ‍
4. Reverse shell. A reverse shell initiates a connection back to the attacker's listener infrastructure to gain unauthorized access to the vulnerable program or system. This can include command (cmd), bash to download additional exploits, and more capable payloads such as for privilege escalation. ‍
5. Malware payload. Malware payloads are more capable, staged malicious executables or exploits that progress the attack beyond the initial foothold. The capabilities and actions additional malware provides on a compromised system are beyond what a true often small piece of shellcode is designed to offer. This can include multistage attacks through a local privilege escalation exploit and then malware for worm-like lateral movement.

Steps 2–4 above all happen in memory. An attacker exploits a vulnerable program, uses shellcode to take over its control flow, and delivers a reverse shell. You can analyze this using the virtual memory structure of a process (a running executable). That structure has five key parts: the stack, heap, data, BSS, and text sections.  

Of particular interest will be the stack section. We’ll dig into these memory sections in part two, with an example of one of the following exploit techniques.

Top techniques for exploiting vulnerabilities

Some of the top exploit techniques include:

• ‍Identity-based attacks targeting compromised accounts. ‍
• Logic flaw attacks that leverage disparate flaws in the programming logic to create an exploitable vulnerability. ‍
• Buffer overflow, where a buffer is overrun to overwrite the return address. ‍
• Heap spray attacks that attempt to fill (spray) the heap with executable malicious code, which increases the chances of executing that code after the exploit lands. Heap sprays attempt to overcome address space layout randomization (ASLR) memory protections.

Once a threat actor exploits a vulnerability and gains an initial foothold, they’re halfway through a predictable strategy. Now they need to use that access to pivot from machine to machine, spread the attack, and achieve their objectives.

How do threat actors use a vulnerability to spread a breach?

The spread phase of the attack lands in more familiar territory. It typically follows the second half of the tactics and techniques in the MITRE ATT&CK framework. These four steps pick up where the first five left off — nine steps in all.

• ‍Discovery. Discovery means learning more about the system they landed on and the network it connects to. This can include account discovery, network information, browser discovery, and cloud infrastructure discovery. ‍
• Lateral movement. Lateral movement means connecting to and taking over remote systems to spread through the network. This can include RDP/SSH hijacking, admin shares, SMB, pass-the-hash, software deployment tools, and living-off-the-land techniques. ‍
• Command and control. Command and control is how attackers communicate with and control infected systems through their own listener infrastructure. This can include reverse shell channels, web channels, domain generation algorithms (DGA), DNS text channels, and domain fronting (CDNs).
• ‍Objectives. Objectives are the end goals of the attack. This can include data theft or exfiltration (pyexfil or icmpexfil), ransomware, denial of service, or botnets.

Top techniques for spreading a breach

Attackers rarely need exotic tools to spread. The same paths that let admins manage systems and teams share files also carry a breach from machine to machine:

• Administrative ports and protocols. RDP, SSH, and WinRM give attackers the same remote control they give IT teams.
• File and folder shares. SMB shares move malware as easily as they move documents.
• Instrumentation. Tools like WMI let attackers run commands on remote systems without dropping a single new file.
• Web-based channels. HTTP and DNS traffic lets command and control hide in the noise of normal browsing.

Why the attack flow matters more than the flaw

New vulnerabilities show up faster than any team can patch them, and the ones that cause the most damage are rarely the ones with the highest score. What decides the damage is everything that happens after the exploit lands: how far the attacker can travel, how many systems they can reach, and how long they have to work.

That’s good news for defenders, because the spread phase is the predictable part. Discovery, lateral movement, command and control, and the final objective all depend on connections between systems that most networks allow by default.  Close those paths and a foothold stays a foothold. Segmentation, tight control over administrative ports and protocols, and clear visibility into how workloads talk to each other can turn a nine-step chain into one that stops at step five.

Remember the car in the parking lot. The thief only mattered because one door opened. Segmentation is how you keep every other door locked, even when a lock fails.

Attackers now automate this whole sequence and run it at machine speed. Detection and response still matter, and they work best when the blast radius is already small. Containing the breach at the point of entry is what buys a security team the time to act.

In part two, we'll go deeper into memory exploits, how specially crafted strings and inputs work inside an exploit, and the techniques defenders can use to thwart them.

Test drive Illumio Segmentation to see how you can close lateral movement paths and contain breaches at the point of entry.