A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.

learn more… | top users | synonyms

1
vote
0answers
25 views

run runas in a shell [migrated]

I'm playing with a Windows 7 VM that I own. I started a reverse shell with ncat as listener. I can run commands except runas. Whenever I try to switch to another user I got prompted for the password ...
0
votes
3answers
45 views

Why is shared less secure than open when it comes to WEP?

According to this post, Jeffrey Tippet (Microsoft employee) writes: WEP can run in two modes: shared and open. Despite the names, shared is actually less secure than open. Because of this, our ...
1
vote
0answers
33 views

Anti-live forensic programs

Against dead forensics acquisition we can use disk encryption (we can use TrueCrypt for example). I was wondering do software exists against live forensic ? Can you give me a list for windows and ...
1
vote
1answer
31 views

Performing a vulnerability assessment on Windows Tablets?

How do a security auditor can perform a vulnerability assessment for Windows Tablets including Surface RT tablets deployed ones and any management application that comes pre-installed with it? Also, ...
-3
votes
1answer
23 views

Protection of information terminal running Windows OS [on hold]

I need an information computer terminal to work 24/7 in a protected public area. Operating system is Windows POSReady 7 EVAL. I need this terminal to send HTTP messages to a single IP address in the ...
0
votes
0answers
21 views

Create Incremental/complete backups from a disk encrypted using TrueCrypt? [migrated]

I have a tricky question about whole disk encryption and its backups particularly TrueCrypt for which I have never found a great answer What method do you recommend/use for create automatic backups ...
3
votes
1answer
34 views

output from CryptGenRandom [closed]

Can we capture the output of Windows CryptGenRandom function. Suppose an application is utilizing CryptGenRandom, as a user can we know what is the Random Number generated and given to the ...
4
votes
0answers
75 views

Suspicious behavior from explorer.exe [migrated]

The explorer.exe process on my computer is repeatedly trying to connect with some kind of remote host, I do not know exactly what this process is trying to do. Why do I suspect Explorer.exe ? First ...
-7
votes
0answers
25 views

Bypass User Account for permissions/priviligies [closed]

I have problem with my computer. I'm user account, not admin and the computer have not admin account and all running with admin account is disabled. I need to bypass it and install my applications. ...
-1
votes
0answers
67 views

Is This A Run32dll.exe Virus [migrated]

I have two run32dll.exe processes, one in System32 and another in SysWOW64. Is one of them a virus or is it normal? Sometimes only one is there (SysWOW64) and this one uses 60-90 Mbs Of memory. ...
1
vote
0answers
20 views

Did DKOM trigger PatchGuard on x64 Windows?

DKOM can be used to hide processes and drivers. It works well on x86 system. However, there are PatchGuard on x64 system. Can PatchGuard detect DKOM?
1
vote
1answer
28 views

Windows Certificate Store - Generating / importing personal certificates using a smartcard?

I think we all know Windows can store and handle certificates which is a nice feature as this enables many appliations to rely on this (like Putty-CAC). Now I'm having the problem, that I own a ...
1
vote
3answers
91 views

How can I scan open ports through Windows Firewall?

I use Kali Linux and VMWare for testing some penetration techniques. The problem is that when I scan ports with Nmap to my Windows IP "all ports are filtered". I know that the firewall is blocking the ...
1
vote
0answers
35 views

What is SAM Account\F as reported by chntpw? [closed]

I am working through some study material and decided to explore the chntpw tool. I have a listing for SAM Account\F and it is off (0). I am wondering what this is as I am curious why it is off and ...
1
vote
2answers
99 views

How effective is antivirus software? [duplicate]

On one hand, most antivirus websites claim their products are highly effective, and I've seen antivirus "test" videos claiming 95%+ detection rates for new malware (as in less than a day old, not old ...
1
vote
1answer
32 views

CryptoAPI to CommonCrypto with RC4

I have cryptographic code used in the Windows platform, which uses the Crypto API functions and need to convert this to using Common Crypto on OS X. Essentially the original code is this, with error ...
1
vote
0answers
26 views

How to properly deploy internal self-signed scripts (Powershell) [migrated]

Completely new to certificate usage so be gentle. I'd like to deploy Powershell scripts that I made to other employee computers so they can use them, but I will need to sign them in order for them to ...
0
votes
0answers
85 views

Finding user who deleted files on a shared network folder [migrated]

We have windows 2008 r2 server without a domain and guest account is enabled on it. Users are accessing a shared folder from their computers and can write, modify, and delete files. One shared folder ...
2
votes
0answers
53 views

Convert RSA openSSH key/putty key to gpg key [closed]

Scenario Two work sites, site 1 and site 2. Two Linux servers, server A and server B. Server A is reachable from both sites, while server B is reachable from site 1 only. Two Windows workstations, ...
0
votes
1answer
27 views

Warning message about Git on IE 11: “a website wants to open web content using this program on your computer”

This is about something that happened while using IE 11 on Win 7 x64. Not sure if it matters but IE is running in "Protected Mode". I was posting a support request for a software that I use at that ...
0
votes
1answer
37 views

How to encrypt or store data so that only a pool of processes can share it on Windows?

I am writing an application T1 which is using SQLite database to store some sensitive data and i am trying to encrypt it securely. The issue i am facing is that i don't want my symmetric key to be ...
2
votes
1answer
139 views

Security behind “Windows Security” Feature

Within the Windows Security authentication mechanism active, there are cases the user-login popup comes up. Are this username and password sent encrypted or they are sent as plain-text as the ...
1
vote
1answer
102 views

Execute cmd commands with http directory traversal attack

Question Summary: I am trying to create a lab scenario wherein the "attacker" is intended to perform a directory transversal attack from an HTML page and move into the Windows system directories. Can ...
-2
votes
0answers
20 views

Restricting C drive access on windows by limited User but allow to install new software [migrated]

I want to restrict the user to access C drive but want to allow installation of new software. scenario is user is downloading a software and installing from a wizard but he can access to installation ...
1
vote
0answers
22 views

Protect Specific Services on Client PC

I am not sure if I am asking in the correct location for this, but will ask in the hopes you assist. I want to be able to lock certain services from being restarted/stopped/ended. I know most ...
1
vote
2answers
59 views

secure notebook options [closed]

How can I secure my notebook with highly sensitive information stored in a spreadsheet. I am keeping the following options in mind: Password protect & encrypt BIOS Full disk encryption Password ...
1
vote
1answer
94 views

Can the Windows lock screen be attacked with software? [duplicate]

As a follow-up to this question, I am wondering how much care I need to put into my Windows login password, for when I leave my computer alone in "sleep" mode. (I know that Windows passwords can be ...
0
votes
0answers
35 views

Why malicious browser extensions along with API hooking

Most malware steals financial data by hooking to browser APIs like PR_Read, PR_write etc.. Also I see some malware like Sinowal use browser extensions along with these API hooks. I believe a user ...
0
votes
0answers
25 views

Windows VPN and SSO [migrated]

I have an ipsec tunnel from Network A (my domain) to Network B (other domain). User in Network B can connect with systems in network A providing AD credentials. But the problem is that they have to ...
32
votes
4answers
3k views

Is my data safe if, with an encrypted hard disk, I put Windows in “sleep” mode

Both my boot partition and my data partition are encrypted with TrueCrypt. My password is lengthy, so I find myself avoiding a reboot of my system whenever possible. When going to lunch (for ...
1
vote
0answers
37 views

Delete certificate from user local store using script [migrated]

I manage to delete a certificate using a script with command : certutil -delstore -v -enterprise CA "Certificate CN" But unfortunately, it only works if this certificate was first added using the ...
1
vote
0answers
36 views

How does Microsoft push Windows 10 Upgrade? [migrated]

A little while ago I turned on my gaming computer and noticed the following window on my taskbar. When I click it, I get the following window. If I had my update settings turned off. Would they ...
23
votes
4answers
4k views

Is it possible to detect a honeypot? [closed]

Do techniques exists to know if a machine is a honeypot (or suspicious indicators)? What techniques can be used for a software inside the honeypot or outside it? What techniques uses malware to ...
3
votes
2answers
67 views

How does process migration work in Meterpreter [on hold]

Did anyone try to figure out how process migration works in Meterpreter in Windows? I want to make my own script to learn that, but am failing to find a starting point for that. Well, I have an idea ...
1
vote
0answers
28 views

I used diskpart clean to format an SSD, is it possible to recover any of this data? [migrated]

My Windows 7 was not booting up on my SSD. I tried recovering it but that didn't work. In a rash decision I decided to diskpart clean my SSD as I thought I didn't have any important files on it. It ...
0
votes
0answers
24 views

Windows proxy settings updated automatically [migrated]

While trying to set proxy settings in my Windows machine registry I found an interesting thing that I hope you will be able to help me with. The proxy settings that are set on my machine are: ...
0
votes
0answers
14 views

How to correct “The associate private key cannot be found” error and “certutil -repairstore” failure with Windows certificate and key files? [migrated]

Old machine cannot boot into windows to perform a cert export. The cert file and key file have been retrieved from the file system and copied. Cert is for IE SSL access to a bank. ...
-1
votes
0answers
15 views

Would BitLocker and SysKey be a possible and good security combo? [migrated]

Is it possible to have Bitlocker and SysKey work together on a Windows machine? If so, could you have them both work on a single USB thumb drive? Would the Thumb Drive have to be partitioned? If no, ...
2
votes
3answers
50 views

Utility to build IP exclusion list? [closed]

Are there any utilities out there that can assist in building an IP exclusion list? Scenario: Recently suffered a brute force attack where 50000 failed login attempts came from a multitude of ...
0
votes
0answers
75 views

Sysinternals tool suite not working on low priv shell

Currently oscp student. I asked this on the oscp forum yesterday, but no responses so far. I am new to infosec, but have 18 years of education / work experience in IT. As far as I can tell, ...
3
votes
1answer
56 views

Hooking an *unexported* API

I want to know is there any way to hook (inline hook) an unexported API of a PE? I have this binary (PE 32 bit) which does not uses any DLL (A statically linked binary) and I would like to know what ...
0
votes
1answer
58 views

How do I audit the effect of security policy on a computer

I have developed different templates for local security policy. I have been using the program Nexpose to test the effects of those security policy but so far i am not able to detect the visible ...
0
votes
1answer
43 views

Disable a specific services in Windows 7 [closed]

I am using a Windows 7 and I want to Disable some Services, How can I do this? For my machine only? For some machines inside the Active Directory I can control? For all machines inside the Active ...
0
votes
0answers
39 views

Forensics: Any legitimate reason for code injection in artifacts?

I have two images I'm analyzing using volatility. I've found two instances where malfind found injected code in processes in which the code had well defined function prologues and returns. One was ...
-2
votes
1answer
106 views

What are the new security features in Windows 10? [closed]

Title says it all really. I realise I can Google this, but the top links don't cover all the new features I am aware of, so people will benefit from a canonical answer here.
1
vote
1answer
53 views

Is the enforcement of only allowing signed application to run in a Windows server a safe rule in a prod environment?

There are various security tools that allow an administrator to enforce only signed applications to run in a Windows operating system. is this a realistic general enforcement rule in a production ...
0
votes
1answer
86 views

Windows Passwords

What are the security concerns of the following user account setups on a normal Windows 7/8/10 desktop machine compared to: Using a non-privileged account with a password and having an admin account ...
2
votes
3answers
180 views

Completely encrypting virtual machine (for free) [closed]

I know in VMware workstation there's the option to encrypt a virtual machine. Is there a free way to do this without VMware workstation? I'm aiming for the fullest encryption and encapsulation ...
1
vote
4answers
115 views

Possible to find out the last person to open a file on Windows without specialist tools?

So I suppose this is specific to the OS you are using or the filetype or software used to open it, but my question stands open for all really but I am particularly interested in more common files such ...
2
votes
0answers
85 views

Lowercase 'w' seen in C:\windows application paths from wmic services list

In reviewing several Windows 7 computers built from the same image (using wmic services command), I'm seeing most all the Window services paths displayed as C:\windows not C:\Windows. The 'w' is ...