A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.

learn more… | top users | synonyms

15
votes
3answers
3k views

GitHub's Bash Shell for Windows is vulnerable to Shellshock. Can it do any harm though?

After the news of the Shellshock vulnerability broke out, I remembered I had GitHub's version of a bash shell for Windows installed. Just to see if it also had the vulnerability, I executed: env ...
1
vote
1answer
21 views

About windows services and service control Manager

I was doing some study on Windows services, when I came to know that when an account other than Local System is used to run service, the SCM automatically grants the account certain security ...
1
vote
1answer
63 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
4
votes
1answer
81 views

How do I continue pentesting with access to local station?

I started learning hobbyist penetration testing a while ago, and as far as penetrating a computer I have physical access to, all is good. Mainly using Hiren bootCD, it is easy to gain access to an ...
0
votes
2answers
88 views

Minimum access required to access LSA Secrets

I would like to know what the minimum access is to be able to dump from the lsass process on a Windows machine (any version) to try and grab LSA Secrets. The reason I am asking is because I had ...
2
votes
2answers
1k views

Git bash shellshock vulnerability [duplicate]

I have installed Git for Windows with bash shell support. Is it vulnerable to ShellShock? Refs: GitHub's Bash Shell for Windows is vulnerable to Shellshock. Can it do any harm though? ...
0
votes
0answers
209 views

Ordinary Windows desktop bash bug [duplicate]

I'm still trying to make sense of the new bash vulnerability (shellshock). I can't tell from what I've read if having a bash script work in a Command Window makes my Windows box vulnerable or not. I ...
0
votes
0answers
19 views

Tunneling Remote Desktop from DMZ Windows server to my Listening Linux Server. How to?

I have a situation in a penetration test where I got a meterpreter on an internal (DMZ) Windows box, and I want to connect via RDP to it, however the RDP port is blocked externally. The box I hacked ...
1
vote
0answers
103 views

Task Manager shows higher total CPU usage than the sum of all running processes. Keylogger? [migrated]

In Windows Task Manager and AVG Task Manager (included in TuneUp Utilities), I see that the sum of all the running processes is much lower than the total CPU usage shown in "performance" tab. Does ...
8
votes
2answers
513 views

How can Network Disconnect be implemented for RDP on a Windows system (2003/XP or later)?

From NIST SP 800-53, Rev. 3: SC-10 NETWORK DISCONNECT Control: The information system terminates the network connection associated with a communications session at the end of the session or ...
1
vote
0answers
30 views

Signed an executable; appears as unsigned on VMs?

I signed my binary with a certificate issued by GoDaddy. It seems that myself and everyone I could get to test it for me confirms that it is indeed signed (much like signtool verify) However, when I ...
-1
votes
0answers
13 views

How to use windows 2008 as router [migrated]

i have a windows 2008 server with 3 network cards and 2 internet lines. i want to separate apps traffic and usual traffic as below. i tried RRAS as bridge but can i use windows 2008 as router using ...
9
votes
2answers
735 views

Running Windows Update when abroad

Is it safer or more dangerous to run Windows Update when abroad and using a WPA2 connection to a random cafe's wi-fi? Obviously good news: you get the latest security tweaks. Possible bad news: just ...
1
vote
0answers
16 views

Using OSSEC to monitor windows services [migrated]

I'm using OSSEC to trying and monitor services on servers such as Windows Event Log. I would like to know if a service has stopped or started and get emailed accordingly. I have tried a rule that ...
1
vote
3answers
137 views

Are windows users passwords easier to crack than linux?

If i set the same password in both linux and Windows, is it easier for a hacker to break the windows password? If so why and how can i create a windows password in the same security level as Linux?
4
votes
4answers
208 views

Does Windows have a built-in password store?

What passwords are stored in Microsoft Windows? How can I know what password are saved in computer?
0
votes
1answer
56 views

User “ASP” logged in to windows server - hacking attempt?

I run a windows server 2008 which I connect to both via VNC and via remote desktop. Yesterday I noted when I connected to it via VNC that another user was logged in. See images. Notes: I have no ...
0
votes
2answers
157 views

Is possible to be hacked remotely?

I little bit afraid about remote hacking, since i'm using a windows 7.i see what a hacker can do if he exploit the Dcom vulnerability in windows XP. But is this sort of exploits exist on windows 7 or ...
0
votes
0answers
20 views

Read WMI stuff on offline system?

For forensic purposes, I want to work with WMI on an offline system (dd image disk). In particular I would like to read the WMI Event Subscriptions. How can I achieve this ? Are WMI stuff located ...
0
votes
1answer
126 views

High-Risk Intrusion Detected

I have an endpoint protection from Symantec. Recently, I have been receiving many Symantec Cloud Alert emails. wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php They ...
-1
votes
3answers
143 views

What are the differences in Linux and Windows security that cause Windows to get so many more viruses? [closed]

I am trying to gain a more detailed understanding of specific features of the Windows and Linux security models that makes Windows so much more prone to infection by viruses than Linux. As an example ...
16
votes
1answer
85k views

How do I clear cached credentials from my Windows Profile?

Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data. How can I backup and purge this data?
0
votes
1answer
86 views

How does Bitlocker only-PIN method work?

Microsoft explained USB-key and TPM based BitLocker decryption process on this article. USB-Key process: The steps in the illustrated sequence are as follows: 1- The operating system starts ...
1
vote
1answer
201 views

automatic connection from LSASS to different IPs. Is this the usual behavior?

I'm using windows 7. firefox 22. connecting through a regular residential wifi router. In the last month I've noticed that when I connect to the internet and once in a while my firewall indicates me ...
0
votes
3answers
1k views

Is there a combination of Windows permissions that allow execution of a .NET executable but not reading nor copying its content?

I suppose that if a file is executable by anyone, in other words, if a user has enough permissions to execute an executable in Windows, it will be possible to read the contents of the executable and ...
0
votes
2answers
153 views

Computer hasn't been connected to internet for 2 weeks

A computer hasn't been connected to the internet for 2 weeks but has still been used. It's running Windows 8 and various notices are complaining about virus definitions and updates not being current. ...
0
votes
1answer
145 views

Windows security policy analysis tool

I have several security policy files (INF exported from different Windows machines) which I need to audit. Is there any automatic tool you know of, that can analyse those files according to best ...
19
votes
3answers
3k views

How can I tell if I have the citadel virus without downloading an antivirus?

I recently received an e-mail from Virgin Media indicating that I might have the Citadel virus. It obviously sounds like a fake e-mail, but I am almost certain it is genuine, as they had my name and ...
3
votes
1answer
174 views

What is “Multi-Protocol Unified Hello” and what are the impacts of disabling/enabling it?

This article describes how to disable old versions of TLS, but in addition to doing so, "Multi-Protocol Unified Hello" is also disabled. # Disable Multi-Protocol Unified Hello md ...
1
vote
2answers
179 views

How to securely use Process.Start?

I am using Process.Start in a Windows Service I created to execute an exe that I have on my server that is used for audio conversion. I am passing some user input as a parameter to this exe. The ...
0
votes
0answers
13 views

How to setup a VPN server to connect windows server 2008 R2 using RDP [migrated]

recently my server has been attacked by brute force login, fortunately nothing happened... Im not a security expert, but I want secure my windows server 2008 R2. This is the scenario. Server: ...
1
vote
1answer
152 views

Cannot get access into a vulnerable Windows 2000 (MS03_026)

I'm trying to get access into a Windows 2000 server through the vulnerability MS03_026. An exploit is provided by Metasploit but I don't know why it isn't working. After filling the options (basically ...
2
votes
6answers
5k views

Hardware USB Key to Reset Any Windows Password

This tool requires physical access of course, and there are many things you can do once you have physical access, but this peaked my curiosity. The tool in question: ...
1
vote
1answer
85 views

What security risks do you face when connecting to a server via RDP? [duplicate]

What security risks do you face when connecting to an (possibly foreign) RDP server? Opening an unsigned RDP file triggers the following warning: RDP is a one way street, right?
2
votes
0answers
7 views

Viewing and listing keys in MSCAPI CSP containers [migrated]

I have a MSCAPI container created and hosted within a Windows Server 2003 environment. How do I use the command line to list keys and their details within the container onto the command line ?
3
votes
3answers
152 views

Could “system volume information” and $RmMetadata pose information leakage on a nuked HDD?

I recently nuked my HDD(s) via a Windows program (Disk Wipe to be precise: http://www.diskwipe.org/), now everything is fine when I try to retrieve the information on that disk by any program I can ...
1
vote
1answer
878 views

Windows Firewall netsh equivalent of iptables u32 module

I have looked everywhere and I can't seem to find a netsh equivalent of the u32 module for iptables. I want to create a rule to Drop a packet that starts with a specific set of bytes. Similar to: # ...
-1
votes
1answer
100 views

PCI compliant transparent data encryption at disk/folder level on Windows?

Is there a way to achieve PCI compliant data encryption at disk/folder level in Windows in a way that is transparent to applications(they must be able to write/read to encrypted folders/disks as if ...
0
votes
1answer
86 views

Makecab.exe at boot. is it malicious?

, I am trying to find out why this process appeared during 2 boot occasions. Autoruns does not show it anywhere. It appeared when I uninstalled google chrome and malwarebytes. The prefetch file for ...
154
votes
7answers
26k views

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, ...
1
vote
3answers
127 views

How trustable is third party root certificates?

i recently tried to use fiddler2 from third party vendor telerik,while decrypting the https traffic of my network it asked me to install its own root certifcate in my windows operating system : have ...
3
votes
1answer
76 views

How to check for presence of LM hashes in local SAM

To get rid of LM hashes in local SAM databases, one can rely on the famous NoLMHash domain GPO, which instructs clients not to store password hashes with the LM algorithm locally ("Do not store LAN ...
1
vote
1answer
55 views

Multiple “rundll32.exe mhunk.dme” instances. Is my PC Infected with Something?

So, I have this strange list of rundll32.exe There are quite a lot of rows of it (see attached image) when I open the process tab in my task manager I've already read the link here: Multiple running ...
2
votes
2answers
158 views

Does a VM keylogger listen to the keyboard activities of the host?

I am running a Windows XP virtual machine on a Windows XP host machine. I use the VM for suspicious websites and software/applications. In the case a kaylogger will be installed on my VM: will this ...
11
votes
7answers
2k views

Can hackers detect my operating system?

I've seen people demonstrating the use of backtrack to attack VMs. In one of the components of backtrack, it shows the operating system of the targets. Since support for Windows XP is ending soon, i ...
1
vote
2answers
86 views

File SHA256 checksum failed, but OK on reboot

I downloaded the Windows installer (.exe) for ImageMagick via http (both http and ftp downloads are provided at http://www.imagemagick.org/script/binary-releases.php#windows). Upon executing the ...
0
votes
1answer
74 views

Getting a log of computers that have remotely accessed a Windows server

I have suspicions that someone other than people on my team have obtained the credentials to remotely access a Windows 2008 Server. I need to get some evidence before I start pointing fingers or get ...
0
votes
2answers
347 views

Recover password or password hash from locked account

I have a locked administrator account. Other accounts are unlocked, but they have no rights. I want to get a password from the locked account, or maybe password hash, if possible.
1
vote
2answers
253 views

Are KIS 2014, Malewarebytes Pro and SpyBot sufficient to prevent internet attacks?

As mentionned in the title, I have KIS 2014, Malewarebyte Pro and Spybot installaed on my windows 7 (regularly updated). I regularly scan my pc for viruses and spywares and clean it with Glary ...
2
votes
1answer
39 views

Windows Print Drivers / Security Principal

Forgive me if this question seems a little "under the hood", but I think it's important to know from a security point of view. I see SPOOLSV.EXE runs with print driver DLLs (Type 3 - User Mode, I ...