Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

Filter by
Sorted by
Tagged with
0
votes
1answer
81 views

Canary token on desktop triggers when I plug in my phone

I've just found out about canary tokens and how they can be hidden in a lot of object types. So I put a canary token on my desktop as a Windows folder. Now, whenever I unplug my phone from the ...
1
vote
0answers
40 views

How unwise is it to exclude WSL from Windows Defender?

Windows Defender often takes up a significant amount of CPU time due to I/O operations in WSL. For example, if I'm working on web development and using tools like npm or yarn, downloading packages ...
-1
votes
0answers
42 views

Shellcode is jumped to and executed but runs into error

I am really at a loss trying to understand why a Metasploit Windows payload is indeed reached (see snapshot from Immunity below), executed (at least partially), but doesn't pop a calc.exe at all. The ...
0
votes
0answers
32 views

Windows shellcode not working in C

I have been trying to run a raw piece of shellcode collected on the net within a C wrapper to try it but it never works... I know the shellcode below is all right because it does work in the context ...
0
votes
0answers
54 views

What sofware to encrypt whole drives, Google drive folder, keeping access on Android and good performances? [closed]

I would like to encrypt my drives and data on Windows 10, but I need some recommendation to use the appropriate software(s). On my system drive, I have the "Backup and sync" Google software and the ...
4
votes
1answer
322 views

What are some of the benign use cases of injecting bytes into another process and creating remote thread?

Lets say, you are developing an AV, and marked any type of injecting into another process (for example openning it and writing to it) and creating remote thread malicious. If so, what will be some of ...
0
votes
0answers
33 views

openssl version -d prints non existing directory. Should I be worried?

I am a beginner with openssl but want to get rid of my ignorance. So I downloaded openssl from https://indy.fulgan.com/SSL/ for Windows. When I executed openssl version -d I get OPENSSLDIR: "/usr/...
0
votes
0answers
50 views

How can Runtime-Crypters stay FUD

A Runtime Crypter always works with the same principle: It decrypts its payload, starts up a process in suspended state, inserts the payload and resumes the suspended process under false flag. All ...
0
votes
0answers
104 views

DLL Hijacking doesn't work (DLL Proxy technique)

I found DLL Hijacking vulnerability in a program. It doesn't load VERSION.dll properly. Then I try to use DLL Proxying technique. I try to create malicious DLL with C++. This is my code: #pragma ...
0
votes
0answers
29 views

Windows SDK Security Fixes

Microsoft releases monthly (or more frequent) patches to Windows operating systems which fix security issues. They also release updates to their SDKs which are used in C++ applications, but do they ...
0
votes
0answers
36 views

How to extract cluster data for a jpeg image using autopsy

How do I find the exact partition of an image evidence in the hard drive that is being investigated? I know autopsy has a tool for it but I can't find it anywhere.
0
votes
1answer
57 views

Windows Encrypted temp directory for files at rest in Windows?

It would be nice if there was an area on my computer where I could work with temp files that may contain sensitive information that could be encrypted with bitlocker or something similar when the ...
0
votes
1answer
115 views

Downloaded a file which turned out to be a shortcut that ran the following command, not sure what it did [closed]

I downloaded a torrent which turned out to be a shortcut that did the following thing. %ComSpec% /c certutil -decode "Succession.S02E07.720p.WEB.x265-MiNX.mkv.lnk" "%APPDATA%\Microsoft\Windows\...
1
vote
1answer
85 views

Can file recovery tools recover deleted small files from SSD drive's NTFS Master File Table?

According to this page and site, small files are kept in Master File Table when filesystem is NTFS. Let's assume that computer is using Windows 10 and a SSD drive with TRIM support. If a user ...
2
votes
1answer
81 views

Best Security measures for non-IT pro to take when at risk of hackers? [closed]

I work at a WeWork and am surrounded by about 5 different IT / coding type of companies. They apparently hacked me somehow, I don't know how, whether it was bluetooth or using WeWork wifi, or maybe ...
0
votes
0answers
48 views

Does Windows CNG Keystore support exporting a key or keypair in ciphertext?

As Windows CNG Keystorage offers API to export key(pair)s: SECURITY_STATUS NCryptExportKey( /* The handle of the key(pair) to export */ NCRYPT_KEY_HANDLE hKey, /* The handle of a key to encrypt ...
0
votes
0answers
36 views

ms08_067_netapi exploit & pivoting problem

I'm having troubles with ms08_067_netapi. I have a private network with a web server (10.10.2.10), windows 7 (10.10.2.8) and windows XP (10.10.2.9). I'm hacking from outside the private network with ...
1
vote
0answers
42 views

Abusing RDP/SSH post exploitation [closed]

I'm curious to how an attacker would enable RDP/SSH and use it to gain further access to the compromised windows server after achieving remote command/code execution on the server. (Using cmd.exe)
0
votes
1answer
45 views

Is there any difference between hiberfile.sys file and RAM dump made with 3rd party software for Volatility.py?

I was wondering how could I give some advice to one of my friend when attempting to analyze live Windows machine which was infected with malware. As far as I know, hibernation saves RAM memory ...
3
votes
1answer
74 views

How to enable concurrent users, one RDP and one local, in post exploitation in windows without disk modification?

I want to do this by just using memory and not using disk modification or a tool, in post exploitation of a remote system, i already know how to enable RDP but the problem is when a user is logged in ...
0
votes
0answers
13 views

Block access from an IP that tries too many requests to Apache server XAMPP / Windows [duplicate]

I have a VPS server with Windows 2016 Server and use XAMPP as Apache Server. Yesterday I receied too many requests from 1-2 IPs. How can I detect how many requests I get per 10 seconds and block them?
1
vote
2answers
118 views

Securely editing encrypted text files

My method for editing encrypted text files is to decrypt them in a RAM drive, edit them, and then encrypt them. What I'm worried about is information from my text files being transferred to non-...
5
votes
1answer
103 views

How secure are Windows logins tied to physical human fingerprints?

Some business laptops have a fingerprint reader, and Windows has the ability to use your fingerprint to log into an account in lieu of a typed password. I understand that these open up lines of ...
4
votes
1answer
97 views

Is it possible to take over a Windows server through Oracle?

I have a Windows Server 2008 R2 with an Oracle database running on it. Someone who knows my Oracle username and password claims that he can create a Windows system account somehow. And then he can ...
0
votes
1answer
54 views

Blocking mimikatz on the OS level?

I want to know under which case would Mimikatz still run despite disabling WDigest? Whether wdigest is set to 1 or 0, mimikatz still worked. (tested on Windows 7, 8, 2012) Is there a better way to ...
0
votes
4answers
217 views

Does safe removable media exist?

I have a laptop operating a vehicle with attached camera. Video is exported using removable media. Ports available are USB and Ethernet (also video and audio I suppose). The laptop is not infected (...
0
votes
0answers
15 views

Securing DB connection string and other configuration files in RCE scenario

Environment: Microsoft Windows IIS Web server MSSQL DB Let's say an application gets compromised with an RCE, what's the best scenario of protecting the database connection string file or any ...
0
votes
2answers
160 views

Linux and Windows Password Security Settings

I'm asking a client why some password parameters are not defined in the Linux OS level and he's saying that, internally, Linux and Windows complexity and timeout settings are different. If they set ...
63
votes
3answers
14k views

Why does Windows store Wi-Fi passwords in a reversible format?

Running netsh wlan export profile key=clear in PowerShell will dump your current stored Wi-Fi settings, including the password, into xml files inside of whatever directory you are currently in. Why ...
1
vote
2answers
96 views

What causes Windows security logs saying an attempt was made to reset an account's password?

This falls under the category of eliminating what might be normal activity from my attention. I'm looking at Windows 7 security event logs. I don't have context to know if the following event is a ...
-2
votes
1answer
136 views

Windows Hello Biometric Data

I have two PCs, A and B. I set Facial Recognition (Windows Hello) on A and then I took out the SSD from A and inserted it into B. I tried to sign in using Facial Recognition on B and it was successful ...
1
vote
0answers
46 views

Inbound rules for a port is configured and disabled yet an NMap scan shows that the port is opened

I am new to Windows Defender but have read about it to understand the basics of Inbound/Outbound rules. As mentioned on the app, Inbound connections that do not match a rule are simply blocked. For ...
0
votes
0answers
52 views

Determining clients connecting to IIS using CBC ciphers. (preparing for Lucky13 remediation)

I am trying to determine the impact of re-mediating a lucky 13 vulnerability; which i understand requires disabling CBC cipher modes. So far i have added custom logging to my IIS instance to capture ...
1
vote
0answers
47 views

Securing a SOCKS5 to SSH Tunnel on Windows

In order to gain web access from the perspective of a remote device, it is very common to use the SOCKS5 to SSH Tunnel capability built into OpenSSH Client and Putty (detailed here). Both clients ...
0
votes
1answer
49 views

Configure Windows Firewall Inbound Rule for Program Not Installed on Server

How can I configure an inbound rule on a Windows Server 2016 firewall to allow access from a program which is not installed on the server? When searching for a program browse is only offered for ...
1
vote
0answers
145 views

Forensics methods for obtaining WhatsApp data from Windows Desktop PCs

WhatsApp has the option to download a Windows (or Mac) Desktop version. Installation requires pairing the software with a mobile phone. I have read a similar question about Android devices, and ...
1
vote
0answers
80 views

How should you configure PowerShell logs permissions?

I'm currently trying to figure out the best way to configure Windows PowerShell logging, so that it is secure (Attackers cannot gain sensitive data out of it) it helps in DFIR (digital forensic and ...
0
votes
0answers
43 views

Windows RDS vulnerability

Further to windows thuesday patches and the 4 criticals vulnerabilities related to RDS, i want to know if i'm exposed to the risk or not. I don't have port 3389 exposed to internet, and i read in in ...
2
votes
0answers
56 views

Secure AWS instance metadata against potential SSRF

I am running a Windows instance on AWS. The instance has an IIS service running on it. The IIS service has a user associated to it and it has no need to access the AWS instance metadata. I was ...
0
votes
1answer
27 views

What does “windows_view” attribute of registry object in OVAL?

I've seen somewhere that in 32-bit and 64-bit Windows registry structure is different so you need to use flag windows_view="32_bit" in registry object behaviors tag. But i forgot about it and tested ...
1
vote
1answer
38 views

Finding applications vulnerable to dll preloading on windows

An application is vulnerable to DLL preloading attack on Windows if it loads a DLL simply by it's name. Windows then goes on to search several folders and loads the first DLL with a matching name. ...
1
vote
1answer
52 views

Secure REST API that only works for users authenticated by App with SSO (OAuth?)

I somehow need to accomplish the following: User accesses a application written in JavaScript. Application uses SSO to identify the user who is logged into Windows. Application obtains the access ...
1
vote
0answers
87 views

How to decode kerberos tickets on wireshark? [closed]

It has been two days in a row that I spend hours trying to decrypt kerberos traffic using wireshark. For learning purposes, I want to be able to read the encrypted parts of tickets and authenticators ...
1
vote
1answer
102 views

How can I detect CVE-2018-0886 vulnerable hosts in my network?

I know that the vulnerability is a bit old,but still an important one. Today, by chance I found out that a PC with Windows 7 didn't have the update applied and I'm wondering if there are more. Most ...
1
vote
0answers
99 views

RDP/VNC/Xorg over Tails/Tor - From Tails to Windows

I asked a question that was semi related to security, so I want to make it up by bringing a more focused question. Remoting from a Tails machine to a Windows one. I have been working for a couple of ...
0
votes
1answer
93 views

Analyze Windows Malware on Linux

I'm just getting started with the book 'Practical Malware Analysis', some of the exercises are using PEview and Dependency Walker however I'm slightly allergic to using Windows. Is it possible to ...
2
votes
1answer
80 views

3DES supported in application although disabled in Windows

Can users actually use the 3DES cipher to connect to a Tomcat web server, if the 3DES cipher has been disabled via registry keys in Windows: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\...
0
votes
1answer
83 views

What is the purpose of the Volume Master Key in BitLocker?

From this FAQ, I understand that BitLocker uses the following keys to encrypt the hard-drive: Full Volume Encryption Key (FVEK) (used to encrypt raw data; encrypted by the volume master key and ...
0
votes
5answers
346 views

How do keyloggers tell it's a password? (And how to fool them.)

This question also applies to clipboard monitoring. Imagine you are planning to deploy 100,000 copies of a Windows trojan with keylogger functionality. (For the record, I'm not talking about myself ...
3
votes
1answer
108 views

Is it unsafe to enter administrative Windows credentials when logged in as a regular user?

I was recently advised that when a user is logged in as a regular user and they need an administrator to do something (i.e. install an application) that entering the administrator credentials when the ...