Timeline for How to find discrepancy between exploitable and unexploitable VM
Current License: CC BY-SA 4.0
20 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 9, 2021 at 13:18 | vote | accept | Andreas Unterweger | ||
| S Sep 9, 2021 at 12:02 | history | bounty ended | Andreas Unterweger | ||
| S Sep 9, 2021 at 12:02 | history | notice removed | Andreas Unterweger | ||
| Sep 9, 2021 at 6:54 | answer | added | brynk | timeline score: 2 | |
| Sep 9, 2021 at 6:13 | comment | added | Andreas Unterweger | @brynk: I checked the running Firefox instance and all other system processes with procexp to compare their versions. All versions are the same, but in the new VM, there is one additional process "Microsoft Network Realtime Inspection Service". It is not active in the old VM. "Real-time protection" is set to "on" in both VMs, but for some reason this service is stopped in the old VM (it should start with Windows, though). I could not find anything in the event viewer or settings that would indicate why this is the case. Any additional clues are appreciated | |
| Sep 7, 2021 at 21:47 | comment | added | brynk |
agreed checking timestamps etc would be like looking for a needle in a haystack - another option might be to use the Sysinternals tools to scrutinise the running procs and then compare the hashes - i think the newer versions can show/ dump digests of binaries? (or, at least, versions?) procexp and procmon
|
|
| Sep 7, 2021 at 21:37 | comment | added | brynk | assuming you're using the vbox guest additions, i wonder if this is somehow interacting with the guest's config (beyond installing the drivers and ui tools)? to get your files onto a freshly installed/ vanilla guest, one option is to mount a custom .iso file which contains all your instals - something like WinCDEmu can do this (ie. you would do this instead of installing guest additions) | |
| Sep 7, 2021 at 12:19 | comment | added | Andreas Unterweger | @brynk: VirtualBox 6.1.26. Both VMs are running in the same hypervisor. I do not know of any further tools that could show me the differences. Metasploit (module) logging does not really show any relevant details, and comparing the two VM hard disks seems futile as all the file timestamps are different. | |
| Sep 7, 2021 at 11:53 | comment | added | brynk | (that would've been quite surprising !) the only other rational thought i had was that maybe the host hypervisor is somehow injecting updated signatures for the guest os, but this seems like really specific behaviour ... which software are you using for hosting the Windows guest vm's ?? | |
| Sep 7, 2021 at 5:16 | comment | added | Andreas Unterweger | @brynk: Interesting point. I tried it, but unfortunately it does not make any difference. | |
| Sep 7, 2021 at 0:28 | comment | added | brynk | does setting the host clock back to earlier times affect the outcome? (you may also need to do it in the bios as well) | |
| Sep 6, 2021 at 20:15 | comment | added | Andreas Unterweger | @brynk: I Installed only the specified software and changed the keyboard layout. In both VMs, I additionally enabled network discovery through the control panel. For the software (Firefox and Thunderbird), I used the exact same binaries. | |
| Sep 6, 2021 at 19:12 | comment | added | brynk | what other software was installed? ... could the updated signatures have come in via this route? | |
| S Sep 3, 2021 at 14:15 | history | bounty started | Andreas Unterweger | ||
| S Sep 3, 2021 at 14:15 | history | notice added | Andreas Unterweger | Draw attention | |
| Aug 31, 2021 at 19:19 | history | edited | Andreas Unterweger | CC BY-SA 4.0 |
Clarified that none of the VMs is connected to the Internet
|
| Aug 31, 2021 at 10:46 | comment | added | Andreas Unterweger | @nobody: There is no Internet connection (not even during the setup of Windows). | |
| Aug 31, 2021 at 8:43 | comment | added | nobody | Do you set up the VM with internet connection? If so, then the problem is probably that Windows Defender signatures get updated before you run the exploit. Workaround: Turn off Real Time Protection before running the exploit. | |
| S Aug 31, 2021 at 6:09 | review | First questions | |||
| Aug 31, 2021 at 7:08 | |||||
| S Aug 31, 2021 at 6:09 | history | asked | Andreas Unterweger | CC BY-SA 4.0 |