Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

0
votes
0answers
7 views

Windows 10 still allows old password [migrated]

Desktop with Windows 10 (at home). I changed my Windows password several days ago, restarted several times, and still both old and new passwords work. How to make Windows forget the old password?
3
votes
1answer
75 views

How to enforce on the OS level to recognise only certain keyboards

I give employees AES wireless keyboards. I would like to enforce the OS to only recognise the keyboard we supply. Is that possible? Assuming my employees OS are Windows 10, Ubuntu, Mac OSX. How could ...
2
votes
0answers
52 views

How can Nmap bypass Windows Server firewall rules?

I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
3
votes
0answers
60 views

Are passwords for Windows accounts always stored in cleartext in memory, while the account is logged on?

Are passwords for Windows accounts always stored in cleartext in memory, while the account is logged on? Using Mimikatz I've seen lots of examples where passwords are stored in memory, either for ...
0
votes
2answers
77 views

Does Virus or Malware make harm to system if it is in Non Admin Mode for Windows

Let Assume, In my windows systems, I have two user one Admin user and one Non Admin User, where I install a software with vulnerability and used it in both user mode. Will that get affected in normal ...
0
votes
0answers
22 views

Both Ophcrack and ONTP&RE incorrectly show Windows 10 passwords as blank

I'm trying to crack a Windows 10 laptop that I myself set a password on a day or so ago. So far I've tried booting into Ophcrack 3.6 and ONTP&RE (Offline NT Password & Registry Editor) from ...
0
votes
0answers
3 views

Windows Server 2008r2 mass upgrade with MDT [migrated]

Does anyone know if mass Windows Server upgrade can be done with MDT? From my research I mostly see it is used for PC upgrades. Looking to upgrade about 100 2008r2 servers
0
votes
0answers
30 views

How to install a periststent EXE-File on a Windows 10 system without admin rights? [closed]

is it possible to install a persistent EXE-File (Backdoor) on a Windows 10 system without having admin rights on a non-admin account, so that the EXE-File will be executed/started every time the ...
1
vote
0answers
26 views

Is it possible for a remote machine to “escape” from a folder mapped through RDP?

Although most people seem to share entire drives with RDP, it is possible to share individual folders, by mapping them to a drive for example with subst <lettertomap>: <pathtofolder> (for ...
2
votes
1answer
75 views

How to programatically verify a file signature?

I have a dll file signed with my private key, here is the signature info in Windows Explorer: Now, using the public key found in the certificate, how can I verify the integrity of the file? I am ...
1
vote
0answers
53 views

How to determine who turned off security logging on my windows server?

We know that our windows logging was disabled on several windows servers as we started to get late log message alerts in our SIEM. We know approximately the time frame this happened. However, I don't ...
0
votes
0answers
37 views

How to run command as privileged Windows service account against Active Directory domain controller?

I've compromised a Windows machine that leaks the password of a privileged service account ("Domain Admin") in memory (legal penetration test). Since the account is a service account, it cannot be ...
0
votes
0answers
45 views

How does cryptcat work?

So I've read this article about using cryptcat to create a backdoor. But then I was wondering, how is the connection made? Like according to the tutorial you have to connect the computer's shell ...
0
votes
1answer
93 views

Does hashing a file consider its digital signature as well?

I have a signed (using Windows signtool) executable which is hashed by SHA1 algorithm and encrypted using RSA. Now I like to verify the executable to avoid security vulnerabilities. For that I have an ...
2
votes
1answer
74 views

Is it possible for a virus to be embedded in a image and can this image execute on Android Oreo by just opening the image?

I am aware that on Windows this is very much possible. But is it possible on Android (latest OS with all the security updates)? Can you install a virus/malware/spyware by just clicking on an image? ...
0
votes
0answers
8 views

Use local administrator and Domain Cached Credentials to obtain access to AD domain?

I have obtained local administrator privilege on a Windows machine connected to AD domain. Using Mimikatz I see the Domain Cached Credentials of a few Domain Admins. I know that, it is possible to ...
0
votes
1answer
48 views

Where to save the token information?

I'm currently working on an end user Windows 10 application using the Microsoft UWP platform. Within this application the end user will be able to authenticate themselves using an oauth2 SSO service. ...
1
vote
0answers
17 views

Google search results hijacked locally / displaying moot in all browsers [duplicate]

So, since yesterday I have quite obviously caught something that Windows Defender doesn't recognize. Symptoms: All Google services suffer from Ad injection (non-YouTube ad overlays that cannot be ...
0
votes
0answers
40 views

Local Group Administrator Account shared across network?

I am a bit confused on the local group administrator account role. I managed to obtain domain administrator on a recent pentest but looking back at my results I am somewhat confused the actual ...
1
vote
1answer
142 views

Antivirus warns about processes trying to access my webcam

For the last two weeks I am constantly getting notifications from my antivirus about attempts of using my webcam. I have always chosen "Block access", often after checking "remember for this ...
1
vote
1answer
35 views

auditd-like software for Windows?

I need to know how to log users and admins activity on Windows, like auditd does on Linux. After searching, the only thing I found was this Audit account log-on events policy option for Windows 7. ...
0
votes
1answer
84 views

CWE-234 - Snprintf Missing Parameter issues

We are scanning a third party library using a well know static analysis tool here. We keep getting: "Failure to Handle Missing Parameter CWE ID 234" I'm not a C developer but I can't see what is ...
0
votes
0answers
31 views

Which shims are used to patch memory?

Reading about Shims, I came across many suggestions that shims could be used to patch memory (for instance to inject a DLL). Unfortunately, I could not find the exact shims used to perform those ...
0
votes
0answers
4 views

Windows 7 still shows certificate as valid after deleting from cert store [migrated]

I am toying around with self-signed certificates for TLS (closed network). I temporarily added one to my Trusted Root Certification Authorities store on Windows 7, and then verified that it showed as ...
0
votes
1answer
24 views

Should binary signature checked before launching from trusted locations?

If need to launch/load binaries from trusted Windows locations like System32 or Windows or Program Files directories, should the binary signature be checked before using it? Only Admin can copy/...
0
votes
0answers
44 views

Malware makes fake USB device [duplicate]

I am running windows 10 on a X1 carbon. I think I picked up a malware while I was visiting a website. Here are symptoms I had been observing: When I opened the web site, I saw that there is usb ...
1
vote
1answer
69 views

Is it possible to block psexec without blocking regular SMB access?

I don't have much experience in protecting windows machines, so sorry if I'm missing something obvious; how would one protect from psexec without disabling SMB? One could disable the admin$ share, but ...
1
vote
0answers
17 views

Best way to back up locally stored Certificates

What is the best way to back-up all the locally stored certificates on Windows 7? An adware Trojan has installed fraudulent certificates as part of its payload. Before I alter anything, I want to ...
2
votes
1answer
61 views

Risks of letting the browser open local/network file system listing

Browsers do not generally allow web pages to interact with client-side file system as a security measure. I would like to know what can go wrong with the following scenario: Clicking a special ...
1
vote
2answers
144 views

Can malware migrate between OSes on the same machine?

Someone here at work just made an interesting claim; they stated that it's possible for malware, launched in e.g. Windows, to remain in RAM through a reboot and continue working in Linux on the ...
0
votes
2answers
119 views

Pen testing - How to use credentials without remote desktop?

I'm a junior penetration tester, working in a place that does not give much guidance and I kind of just had to dive in. I'm pretty good, in that I can normally still obtain domain admin on networks I ...
2
votes
1answer
90 views

White screen popped up. All of sudden not able to do anything. Scam or something else?

I have been using this laptop for the last 6 months and never had any issue, but last Friday I was watching a movie and then all of sudden my PC restarted and a white screen (see figure below) showed ...
3
votes
2answers
146 views

Configuration for Windows account mapped to IIS certificate authorization

I need to connect two servers in different locations in order for one of them (Linux stack) issues HTTP periodic requests to the other (Windows stack) using cron based jobs. On the Windows machine, I ...
0
votes
0answers
14 views

Can't fix All-Radio 4.27 Malware because the computer is freezing/unusable [duplicate]

Yesterday the program All-Radio 4.27 Portable started running automatically whenever I open my PC. I researched how to remove since it came out of nowhere and bothered me. Then I found out that it ...
1
vote
1answer
102 views

Unable to establish shell with ncat over SSL

I am attempting to get a shell open between a Linux and Windows machine. On the Windows machine, I run: ncat --exec cmd.exe -vnl 4444 --ssl Once it is listening, I run the following command on my ...
0
votes
2answers
66 views

Certificate Authentication from untrusted IP address

When I launch my Windows, certificate revocation checks are performed. These occur once when explorer.exe is launched then periodically, every 40 minutes approximately, to 5 IPs. Most of these target ...
0
votes
1answer
35 views

confirm? group policy is not a reliable way to make a program run on a user's computer

I know very little about Windows domains and Group Policy. However, if you use Group Policy to set a requirement that PCs joining your domain have to download and run a program, then by default that ...
1
vote
0answers
50 views

Empire Powershell DDE Office Exploit Help

So I'm having a BIG issue trying to get this simple exploitation technique to run properly. This is also for a job, and one of the tasks I need to complete. I have to use Empire (https://github.com/...
0
votes
0answers
49 views

Can BitLocker simply be bypassed by just “waiting long enough” till it auto suspends due an update?

When you get an automatic feature or even only cumulative Windows 10 update with an activated BitLocker (password protected) system partition BitLocker will prompt you afterwards from the system tray ...
0
votes
1answer
87 views

Any privacy reasons to not allow software to update automatically?

When installing new software and it gives the option to allow automatic updates, is there any security or privacy reason that it might be preferable not to allow this?
2
votes
2answers
63 views

Privileges needed to perform process injections

I am reading about process injection techniques on Windows machines (originally came to this from privilege escalation research). Although I used Windows for the majority of my life, I feel like I ...
1
vote
2answers
51 views

Windows Servers in DMZ - managed via AD or standalone?

From a security point of view, does it make sense to connect the Windows servers that are running within the DMZ and should be reachable from the Web to the AD (running within the core network)? Or ...
61
votes
2answers
11k views

Does removing a GUI from a server make it less vulnerable?

Lately, I was watching an online video about Microsoft Certified Solutions Associate (MCSA) and in one of the videos it says "removing GUI from Windows server makes it less vulnerable." Is that true? ...
0
votes
0answers
26 views

Mimikatz /rc4 argument for pass-the-ticket?

I'm studying how pass-the-ticket works using Mimikatz, i.e., forged Silver and Golden Kerberos tickets. The command usually takes the form (Golden tickets): kerberos::golden /sid:SID /domain:DOMAIN /...
0
votes
1answer
26 views

Excessive logons from domain controllers

I am quite new to analyzing the windows logs. I have been seeing excessive logons with 4624 and 4625 with the Subject/account name: DomainController(actual name of the domaincontroller is different) ...
2
votes
0answers
127 views

Exploiting Environment Variables in Scheduled Tasks for UAC Bypass

I am trying to escalate privileges from an ISS user on Windows Server 2012 R2 by exploiting Environment Variables in Scheduled Tasks for UAC Bypass as the following link explains the exploit: https://...
4
votes
1answer
171 views

Windows: Who is this randomname person that authored *my* LibreOffice document?

A friend of mine for which I manage the computer has presented me a problem. How is it possible that Windows shows a random name in field "Authors" for a given document ? Here is a bit of context: ...
1
vote
2answers
319 views

How can I sandbox a Wine application on Linux?

I would like to run Microsoft Office programs such as Word but do not trust them, nor should anyone. Without running a virtual machine, is there a good way to sandbox a windows application to run on ...
0
votes
0answers
47 views

Is Windows known to collect hardware information?

As part of the normal behavior of Windows, telemetry, Windows Error Reporting or any other procedures; do any version of Windows send information about the machine hardware to the vendor? Like the ...
0
votes
3answers
95 views

Security risks of exposing a VM to single IP address on the Internet

I have a small office network with about 10 workstations and a single physical domain controller. I want to move it to the cloud. For that, I deployed a Windows VM on Azure, which I'm going to promote ...