Questions tagged [windows]
Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].
2,204
questions
0
votes
0
answers
17
views
Is hashdeep deprecated?
The other day corporate or the vendor used their cloud deployment tool to replace some of our DLLs, and it got me wondering; does anyone still use hashdeep when they initially roll out a server or ...
- 1,385
0
votes
0
answers
26
views
Can't connect to internet via ethernet cable but as soon as I use VPN internet starts to work [closed]
I am using ethernet cable to connect to internet on my laptop. However, sometimes it doesn't work I can't open any website or doing any online activity. When I use VPN, only then laptop connects to ...
1
vote
0
answers
19
views
Cannot `qwinsta` during WinRM, but it works when run under `NewCredentials` logon type
When I try to WinRM into a Windows host (with a tool like evil-winrm) into the and when I do qwinsta, it says "No sessions exists for *", however, when I do RunasCs.exe x x "qwinsta&...
- 111
0
votes
0
answers
17
views
Powershell this term is not recognized [closed]
I was using powerview on machine and it was working fine the suddenly
The term Get-DomainUser is not recognized as the name of a cmdlet, function, script file, or operable program
And all ps1 files ...
- 13
0
votes
1
answer
51
views
Port scanning but Windows firewall isn't logging the connection
We are seeing port scans coming from many of our company devices and scanning our internal network over the VPN. The events are not reproducible and are not regular.
Scans always follow the same ...
- 1
0
votes
1
answer
28
views
Which is more secure to access a VMware Windows VM : VMware Remote console or RDP+Remote Desktop Gateway
Without knowing more details, I can't suggest to our security guy that we should use RDP along with a Remote Desktop Gateway.
One person says to that VMware Remote Console is more secure than using ...
- 101
0
votes
0
answers
7
views
Vulnerable Windows DLL Not updating [migrated]
I have a Windows 2022 VM in Azure that vulnerability scanning is flagging because of an outdated Windows system DLL that has a vulnerability that was patched.
The dll in question is winmm.dll and the ...
- 1
0
votes
0
answers
5
views
Using low level keyboard windows hook to read key presses & still being 'trusted' [migrated]
I am developing software for my client.
The software is a game controller configuration and enhancement software that runs on Windows machines.
I needed a feature to map keyboard keypresses to ...
- 101
0
votes
0
answers
8
views
Strange window opens randomly and closes very quickly [migrated]
It has been some time now that in Windows 11, I experience this weird issue:
Now and then, I see a window (something bigger than a command prompt) opening and closing immediately.
It has a blue color, ...
0
votes
0
answers
4
views
How to encrypt a disk with 2 Windows OSes and 3 partitions with Vera Crypt? [migrated]
I have a disk with an MBR partition scheme and 3 partitions. On the first partition, there's a Windows 7 C: drive which I keep to play some retro games that won't run on newer Windows. The second ...
- 1
0
votes
0
answers
10
views
Finding Kernel32 Base Address [migrated]
I've been experimenting with ways to obtain the Kernel32.dll base address in C and came up with the following method. It works on my machine running Windows 11 Pro, but I'm wondering how robust this ...
- 101
0
votes
1
answer
41
views
Is DPAPI usable when only being able to read the file directory?
DPAPI: Windows Data Protection API
Say I would be able to read a Windows system file system, including all files.
Say there would be a DPAPI encrypted value somewhere in this system that I want to ...
1
vote
0
answers
47
views
How to detect/trace if a Windows Live/PE used on a system?
Is it possible to detect/trace if a Windows Live/PE is used on a system?
Like with logs or dumps etc.
0
votes
0
answers
31
views
What does an exported BitLocker key package contain?
I've learned that a key protector encrypts the VMK (volume master key), then the VMK encrypts the FVEK (full volume encryption key), and finally the FVEK encrypts the actual data blocks.
I've also ...
- 181
0
votes
0
answers
64
views
Why would Jenkins want to read the memory of lsass.exe?
Is there any legitimate reason why Jenkins would ever need to request the memory of c:\windows\system32\lsass.exe (Local Security Authority Subsystem Service)?
The endpoint protection (Carbon Black) ...
- 369
0
votes
0
answers
39
views
Unable to create scheduled task which executes as System
Whenever I create a scheduled task with administrator privs, it executes normally without any problem like:- schtasks /create /tn sample /tr C:\Windows\System32\cmd.exe /sd 08/10/2023 /st 10:23 /sc ...
0
votes
0
answers
87
views
Is UAC an overestimated protection measure in Windows? Does Linux do it better?
Windows is an API-based operating system, whereas Linux is file-based. Hence in my opinion, any operating system API security measures alone aren't effective in Windows. One of such examples would be ...
- 1,546
0
votes
0
answers
10
views
Dump Windows 11 PIN hash [duplicate]
Can anyone tell me how to dump the Windows 11 PIN? I tried dumping SAM and SYSTEM but the PIN hash is not there. What mode we can use in hashcat to crack it?
0
votes
0
answers
43
views
Are domain admin credentials cached when entered for approving a software installation?
From what I know, it's a bad practice to login to any workstation or server except domain controllers as a domain admin. I read that mimikatz or other malware can extract the hash of the password from ...
2
votes
1
answer
485
views
Is it possible for a Virus to "leave" the Windows Sandbox (VM) and infect the host system?
Im using Windows 11 Pro. It has a feature called "Windows Sandbox", which is basically a virtual machine.
If im getting a Virus inside of this sandbox, is it possible for that Virus to ...
- 43
0
votes
0
answers
36
views
Is there a way to find the devices my SSD was plugged in?
I gave my laptop for repair to a technician now I suspect he might have copied my files to another pc by probably plugging in my SSD to other devices. I already tried checking the properties but idk ...
- 1
1
vote
1
answer
89
views
Which algorithm does CryptGenRandom use on my laptop?
I have an Ideapad Gaming laptop by Lenovo, with an Intel(R) Core(TM) i5-10300H processor. On this laptop I have Windows 10 installed. To generate random numbers, I use the CryptGenRandom function. ...
- 113
0
votes
0
answers
41
views
How to double hop pivot?
I have a networking routing problem which I am unable to find a solution for:
I have a first machine, 192.168.51.103 (Windows), which is linked to subnet 172.16.51.0/24. To access this subnet, I first ...
0
votes
0
answers
21
views
How to analyze code files (Java, PHP, Python) for malicious code? [duplicate]
How can we analyze files like .jar or .php or .py files for malicious code?
I need to automate the analysis process using machine learning. What should be the features in these cases?
0
votes
0
answers
62
views
Is it possible to disable screenshare if someone's got meterpreter shell on your PC?
If hypothetically there was a meterpreter shell installed on your pc, are there security features or ways to harden a Windows laptop to prevent the hacker from using the screen share command to spy on ...
- 1
0
votes
0
answers
16
views
OriginalFirstThunk in memory
I understand the point of IAT/IDT/ INT and dynamically loaded DLLs at runtime. The OriginalFirstThunk in the Import Directory table refers to the function names stored (in the case of an ordinal) in ...
0
votes
1
answer
47
views
Static malware analysis using machine learning
As you know, using machine learning we can detect malware.
We can use dynamic analysis based on WinAPI function calls and their arguments.
But what about static analysis using machine learning? In ...
0
votes
1
answer
79
views
What are all ways to run code at Windows startup?
I'm the attacker. What are all the options to run code at the Windows startup:
If I have administrator rights?
If I have normal user rights?
Can someone put any program (or script) in this method or ...
- 21
0
votes
0
answers
146
views
How to prevent WPAD attack
We had a pentration test in our company. One of the recommendations was to disable WPAD (Windows Proxy Auto Discovery), LLMNR, NetBIOS.
We have successfully disabled LLMNR by GPO, NetBIOS on DHCP as ...
- 1
2
votes
1
answer
251
views
Windows Update installs yandex.ru browser hijacker
I recently created a Windows 10 installation stick via the official media creation tool. Presumably, there was no malware on my host system on which I created the stick. It's a pretty fresh install as ...
1
vote
0
answers
69
views
IAT/IDT in memory PE file
Can anyone please explain me this:
First, we look at the last value of the Optional Header, Data
Directories, the Import Directory RVA value. This value gives us the
address of the Import table when ...
0
votes
0
answers
37
views
Check BadUSB or similar threats via software [duplicate]
I recently purchased a fake USB flash drive for its cool and beautiful case. I know that the seller modified the firmware so that it shows a different capacity to the operating system, but I am not ...
0
votes
0
answers
27
views
simulating a domain user logon on machine startup
I'm currently working on a lab for AD penetration testing and want some of the machines to have a logon, including the TGT, for a specific domain user cached. So far I couldn't come up with anything ...
- 1
0
votes
0
answers
196
views
Encryption of NTDS.dit (BOOTKEY)
Looking around I found some information regarding NTDS.dit encryption and I wanted to learn a little bit more around the BOOTKEY and whether this is rotated each boot up sequence or is just held ...
- 153
3
votes
1
answer
166
views
NULL dereference - Why does it work?
I know that exploiting NULL dereferences is a thing of the past and that modern systems prohibit user processes from mapping NULL page, but I also know that back in the day, a NULL dereference in the ...
- 31
1
vote
1
answer
145
views
What does Windows do to prevent dll hijacking?
DLL hijacking (I believe) is when a dll with a name identical to a system dll is placed higher up in the search directory precedence: like placing a malicious dll named secur32.dll or winsock.dll next ...
- 35
2
votes
1
answer
213
views
How does the AV inject their own DLL in each new process?
I know that most of the AV are injecting their own DLL in order to do userland API filtering, in functions such as WriteProcessMemory or CreateRemoteThread.
But how can they do that? Because from what ...
- 171
0
votes
0
answers
13
views
Securing access to SAC from Windows EMS
When enabling Emergency Management Services on Windows, one can access a limited terminal from a serial port, by default there's no authentication required.
To leave the limited environment, you need ...
- 121
0
votes
0
answers
117
views
Are drive-by downloads and installs a significant threat to an average modern Android or Firefox for Windows user?
Today I learned that drive-by downloads and drive-by installations are or have been a thing. Yet there's something very counterintuitive about them if considered a real threat for modern smartphone or ...
- 103
0
votes
0
answers
31
views
Is it possible to abuse the sections in which are excluded from signature check in a signed executable?
Microsoft allows you to sign an executable, and has a list of certificates to validate those signatures.
However it is possible to change the data on a file, while still passing the signature check, ...
- 171
0
votes
1
answer
148
views
DLL Injection Win32 API
I want to know which Win32 API functions a certain executable calls. The executable is a 32-bit application.
I know what steps to take to perform a DLL injection and hook an API function.
However, ...
0
votes
0
answers
52
views
Passwordless authentication using expiring hardware keys
I am looking for a solution to implement passwordless authentication using expirable hardware keys. It is for devices around the world with Windows OS, and sometimes service technicians have to do ...
- 101
0
votes
1
answer
187
views
Why does the windows firewall allow apps to communicate through so many different ports and to so many different addresses?
I looked at my default windows defender firewall on Windows 10 22H2, and most of the rules allow apps to communicate through any local port to any remote address and port. I have read other questions ...
3
votes
1
answer
419
views
How can an application, using Apple's Secure Enclave on macOS or TPM on Windows, protect itself from other applications accessing its private keys?
I'm interested in using Apple's Secure Enclave on macOS or TPM on Windows to protect cryptographic keys used by an application from being accessed by other applications running with the same or higher ...
- 56
0
votes
0
answers
198
views
Is it possible to get krbtgt hash from TGT ticket?
As you know, during a kerberoasting attack, we can intercept the TGS ticket and use brute force tools (john the ripper, hashcat) to find out the password of the service accounts that signed the TGS ...
0
votes
0
answers
69
views
Custom PsExec csharp code with plaintext credentials
I have this code for exploiting PsExec that works perfectly fine when I have a TGS for the CIFS SPN on the target, however there are situations where I only have plaintext credentials for the local ...
0
votes
0
answers
32
views
What protection does the /INTEGRITYCHECK MSVC linker option offer, if a malicious file without it can simply be substituted for the authentic file?
The /INTEGRITYCHECK linker option sets a flag that "tells the memory manager to check for a digital signature in order to load the image in Windows". So the general idea is that this ...
1
vote
0
answers
49
views
How to gain admin access on windows [closed]
I've been trying to get admin on my own pc for probably like 4 years now and I still can't find anything. I tried to do the utilman swap with cmd but then literally my av blocked it and then it ...
- 11
1
vote
1
answer
245
views
RDP logout necessary to prevent RDP session hijacking?
We recently got a strengthened security policy where people are required to log out of any RDP connections at the end of the day. So when I turn off my laptop, it is not enough to merely close the RDP ...
- 11
0
votes
0
answers
105
views
What information does the Microsoft Intelligent Security Graph use for querying files?
I'm looking into WDAC and the option to use Microsoft's ISG for files that are not explicitly allowed or denied caught my interest. Unfortunately I haven't been able to find any information on what is ...
- 11