Timeline for How to find discrepancy between exploitable and unexploitable VM
Current License: CC BY-SA 4.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 9, 2021 at 13:18 | vote | accept | Andreas Unterweger | ||
| Sep 9, 2021 at 12:05 | comment | added | Andreas Unterweger | For anyone encountering this in the future, I would like to add that I found the trigger, even though I was not able to find the actual reason. It turns out that my two VMs only differed in their VirtualBox setting on what OS they were emulating. In my exploitable VM, I accidentally chose Win10 64-bit instead of 32-bit. I was just able to reproduce that a completely fresh install of a Win10 1803 x86 ISO with only this setting leads to the "Network Realtime Inspection Service" being in a stopped state. Why this is the case, I have no idea, but my question is answered as I found the difference. | |
| Sep 9, 2021 at 12:02 | history | bounty ended | Andreas Unterweger | ||
| Sep 9, 2021 at 9:30 | comment | added | Andreas Unterweger | Regarding 1, I can find no settings that sound similar to these. In the Windows Defender settings, I verified that any advanced options I could find were identical between the two VMs. Regarding 2, I can say for sure that no other virus scanner(s) have been involved on any of the two machines. I also did not change any Windows Defender settings. Regarding 3, autoruns shows WdNisSvc being enabled (they are ticked). I could not find any signatures so far. Regarding 4, the accounts are identical. In both VMs, the service is set to start manually, but only in one of the VMs it is running. | |
| Sep 9, 2021 at 6:54 | history | answered | brynk | CC BY-SA 4.0 |