Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

1
vote
0answers
21 views

Is it possible to execute an executable with authenticated SMB?

Assume the following: An attacker has access to a remote Windows share on a remote host. Attacker manages to bruteforce a local Windows account on the host and can login to it via SMB. Attacker can ...
2
votes
1answer
52 views

What are the security implications of an out-of-support Java runtime?

What are the potential security implications of leaving the January 2019 version of Oracle's Java 8 runtime installed indefinitely? For context, we have the Oracle Java 8 runtime widely deployed, but ...
2
votes
1answer
65 views

How does Malwarebytes intercept web traffic?

I use Malwarebytes and the web filter functionality puzzles me. As far as my research has found, antivirus engines typically use a proxy to intercept web requests which typically there would be ...
0
votes
2answers
63 views

Why windows 7 ulitmate can't run exe file? Facing NTVDM CPU error?

I have created a malicious .exe file with the use of msfvenom in my local environment. And I created a listener by using multi/handler in Metasploit I send it to Windows 7, but when I run this test....
2
votes
2answers
128 views

What can someone do with (non-admin) command prompt on a network?

Say that an organization has a closed network - only its own computers can access it. Each of these computers has Windows 10 Enterprise. For obvious reasons, users aren't given administrator ...
-1
votes
0answers
70 views

Break out of from a network printer (with port 9100/tcp open) onto the networks computers

My Question is referring to this article: Port 9100 printing and the introduction from this git repository: PRET - Printer Exploitation Toolkit If you are connected to a network Printer with PRET ...
1
vote
2answers
133 views

Getting access and logging into employee's laptop - Can IT get access without the employee's own credentials?

If an employee's laptop is taken back from him/her for purposes of investigation, can the IT department/team that is in charge of issuing laptops etc. log into the employee's network account on this ...
0
votes
0answers
45 views

TPM, Key attestation

I need to run .exe on client machine, which will create key pair within TPM. And then I will create CSR with public key part of key pair generated by TPM. My concerns are how do i ensure that keys ...
0
votes
0answers
39 views

How to keep data protected from unauthorized persons? [closed]

How to keep data protected from unauthorized persons without setting up a windows password. I want to setup protection on my personal files and i can't set windows password because my family members ...
0
votes
0answers
43 views

TPM, private key storage?

Can someone clarify me this… Some say that private keys can't be stored on TPM but how then Microsoft Virtual Smart card works? A virtual smart card appears to applications as a conventional smart ...
0
votes
0answers
14 views

What is the effect of the arguments in the following: conhost.exe 0xffffffff -ForceV1

I'm fairly well acquainted with the role of conhost in Windows. I am aware of conhostV1.dll and conhostV2.dll so I assume force V1 would force the legacy mode of conhost (as in Pre Win 7 mode when it ...
0
votes
0answers
26 views

Sending the data without permission to the PPTP connection server

I connected to VPN a few days ago using a PPTP connection in Windows 7 Then I realized when my system connected to vpn PPTP, a process called "system" sent data to the server PPTP without my ...
0
votes
1answer
35 views

How to protect your anti virus program or logging agent?

its a very simple question but might not be too trivial. Imagine an attacker has access to your device and gained SYSTEM privilege. Your company has installed a logging agent on your device to capture ...
-1
votes
0answers
44 views

Is PSexec still possible as of Windows 10?

so while I was playing around with Responder on my private network, I managed to find my host machine's NTLMv2 hash and even managed to crack it with the help of some custom rulesets and hashcat. I, ...
2
votes
0answers
578 views

Ransomware with .adobe extension

It is possible to decrypt file with .adobe extension ? File after encryption look like this : filename.id-5735353.[email@example.com].adobe . I did a little research and found information about "....
0
votes
0answers
26 views

what are the security risk in 6 cases of using ASA and firepower with amazon? [on hold]

Goal is to prevent access and control by hackers or see remote window by replay A. what are the security risk in 4 cases of using ASA and firepower with amazon? B. which case is the most secured? C....
-1
votes
0answers
26 views

I messed up and opened a couple .docx files, and allowed them to run. What should I do? [duplicate]

I had a couple of emails from someone in my office saying to open the .doc attachment that was an invoice. I opened them but it was just blue and it said 'enable content to see the invoice'. I very ...
0
votes
0answers
50 views

Tor browsing history - if someone has physical access to my laptop can they see my tor browsing history?

I use a remote hard drive to browse tor on a windows ten laptop. I am going overseas soon and might need to take my laptop. I am concerned that customs agents for my entry/exit countries might take my ...
3
votes
0answers
38 views

Exploit “Blind” buffer overflow in a lab

In a CTF/exploitation lab, I am aware of two separate machines. Developer machine: Windows 7 x64, as blank, as it can get (no KB patch) Service machine: UNKNOWN On Developer: I have a source code ...
0
votes
0answers
23 views

Windows Credential Guard protects credentials but not the remote access with the same credentials?

I wonder what is the real purpose of having credentials protected by Windows Credential Guard (WCG) when it is possible for malicious admin to obtain cached credentials (i.e. the ones not protected by ...
0
votes
1answer
49 views

Understanding port scanning with firewall enabled

My objective is to do a port scanner in windows and find the ports which are open. Suppose, I run an application which opens up a port 8000. Now I create a new inbound rule to block all incoming ...
0
votes
0answers
32 views

My Private certificate is installed on [Trusted Root] automatically?

I have a smart token from a security company, it holds a private & public keys. When i connect the Token to windows, the private certificate appears in the [Trusted Root] like root certificates. ...
4
votes
1answer
93 views

Why is Windows Credential Guard secure, when Windows is able to “access” credentials using RPC?

I've read some blogs that describe Windows Credential Guard: how it works and which security benefits it provides. However, some of them mention that Windows can "access" credentials using RPC calls ...
0
votes
0answers
33 views

How does the so-called skeleton key (master password) in Mimikatz work?

I've used Mimikatz to patch the domain controller with a skeleton key misc::skeleton, which makes it possible for any domain user to authenticate with the password "mimikatz", while still being able ...
0
votes
0answers
17 views

Does BloodHound include local users as part of the results?

I've read the documentation for BloodHound, but I'm still unsure, whether BloodHound includes local users (not domain users) as part of the results (or whether it is possible to make BloodHound ...
2
votes
0answers
28 views

How does TPM and BitLocker work together?

When a computer has a TPM module, BitLocker doesn't seem to require a password, which makes me really uncomfortable. Where's the key coming from? What's preventing someone from grabbing the key by ...
0
votes
2answers
113 views

What consequences could there be to the continued use of an operating system without updating?

As it is well known, the extended support of Windows 7 (Service Pack 1) ends on January 14, 2020. Due to the short time that remains, I raise this question. What consequences could an outdated ...
0
votes
0answers
29 views

Problem with exploiting 'TrackPopupMenu' Local Privilege Escalation (MS14-058)

I've just started getting into local privilege escalation and ran into a problem. I downloaded MS15-058 from exploit database ( https://www.exploit-db.com/exploits/37064/ ) and did some rewriting to ...
1
vote
1answer
68 views

Why doesn't DLL injection works on Windows 10 for native Windows binaries (e.g. calc.exe)?

Why doesn't DLL injection works on Windows 10 for native Windows binaries (e.g. calc.exe)? I've been playing around with DLL injection by reading some old articles to that use, e.g., calc.exe to ...
1
vote
1answer
34 views

Masking configuration of physical workstation

Environment: Physical workstation, HP, Dell, etc Windows 7,8,10, no matter Windows executables Our goal: For additional privacy, is it possible to wipe/change all configuration that can be read by ...
0
votes
1answer
43 views

Data Execution Prevention X vs NX

My lecturer posted this in his slides and I have no idea what he is trying to say. I quote from his slide: Windows DEP = Data Execution Prevention Old “X” idea: must allow explicitly, current ...
0
votes
1answer
81 views

Why is SYSTEM failing to grant SeTcbPrivilege?

I'm attempting to grant a Windows interactive console process the SeTcbPrivilege privilege from a non-interactive SYSTEM process using OpenProcessToken(...) with TOKEN_ADJUST_PRIVILEGES. Despite ...
1
vote
1answer
112 views

Understanding Microsoft list of disallowed certificates

Microsoft publishes their untrusted certificates as disallowedcerts.stl Warning: direct download. It is ASN.1 encoded. After decoding it there is a list of sequences like so: SEQUENCE { ...
2
votes
3answers
280 views

Is moving a file with “cut and paste” secure?

If you cut and paste a file (in Windows specifically) within the same drive, are there effectively two versions of the file on the drive; one in the new location and the original file on the drive ...
1
vote
2answers
125 views

How to copy files without copying Alternate Data Streams

I want to backup my infected Windows system's files before formatting it all and reinstalling the system. I would do it from a Linux Live USB. I've heard that one should be careful in copying only the ...
1
vote
1answer
41 views

Is it possible to detect if a trojan or program sends information by sniffing the network of a VM

Explaining better, I was consulting on how I can ensure that the programs of an operating system does not perform any suspicious activity with my information, and I have been told that electronic ...
2
votes
2answers
134 views

Should a windows IT shop have concerns about enabling WSL for users?

I work in a place that only supports windows, and the folks in charge of IT are (1) very conservative, and (2) not at the bleeding edge of their profession. I want the Windows Subsystem for Linux (...
1
vote
1answer
29 views

Center for Internet Security Version 6.1 Critical Security Control 16-10

My project is implementing The CIS Critical Security Controls, Version 6.1 Can anyone please give me some advice on how we can address sub-control 16.10 which says..... "Profile each user’s typical ...
0
votes
1answer
46 views

How can I make my Windows Server accessible from another Windows PC over the internet safely, without using VPN?

First, some backrgound context as follows: I have a Windows Server 2008 running for my company. It contains an ERP, which is accessible by other computers/clients on LAN. During the client setup, the ...
1
vote
2answers
45 views

Microsoft Windows CVEs?

I know sites like cvedetails and exploit-db feature Windows 10 specific CVEs. But doesnt microsoft.com have a list (or feed) of vulnerability advisories and recently disclosed CVEs? I checked their ...
1
vote
1answer
109 views

Windows 64-bit Reverse TCP Shell not working

I am sending shellcode to a 64-bit binary running on a Windows machine. This binary, copies the shellcode to an executable region of memory and executes it. I am generating the shellcode using ...
3
votes
1answer
101 views

How to enforce on the OS level to recognise only certain keyboards

I give employees AES wireless keyboards. I would like to enforce the OS to only recognise the keyboard we supply. Is that possible? Assuming my employees OS are Windows 10, Ubuntu, Mac OSX. How could ...
3
votes
0answers
94 views

How can Nmap bypass Windows Server firewall rules?

I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
4
votes
1answer
103 views

Are passwords for Windows accounts always stored in cleartext in memory, while the account is logged on?

Are passwords for Windows accounts always stored in cleartext in memory, while the account is logged on? Using Mimikatz I've seen lots of examples where passwords are stored in memory, either for ...
0
votes
2answers
95 views

Does Virus or Malware make harm to system if it is in Non Admin Mode for Windows

Let Assume, In my windows systems, I have two user one Admin user and one Non Admin User, where I install a software with vulnerability and used it in both user mode. Will that get affected in normal ...
0
votes
1answer
72 views

Both Ophcrack and ONTP&RE incorrectly show Windows 10 passwords as blank

I'm trying to crack a Windows 10 laptop that I myself set a password on a day or so ago. So far I've tried booting into Ophcrack 3.6 and ONTP&RE (Offline NT Password & Registry Editor) from ...
2
votes
0answers
31 views

Is it possible for a remote machine to “escape” from a folder mapped through RDP?

Although most people seem to share entire drives with RDP, it is possible to share individual folders, by mapping them to a drive for example with subst <lettertomap>: <pathtofolder> (for ...
2
votes
1answer
87 views

How to programatically verify a file signature?

I have a dll file signed with my private key, here is the signature info in Windows Explorer: Now, using the public key found in the certificate, how can I verify the integrity of the file? I am ...
1
vote
0answers
55 views

How to determine who turned off security logging on my windows server?

We know that our windows logging was disabled on several windows servers as we started to get late log message alerts in our SIEM. We know approximately the time frame this happened. However, I don't ...
0
votes
0answers
43 views

How to run command as privileged Windows service account against Active Directory domain controller?

I've compromised a Windows machine that leaks the password of a privileged service account ("Domain Admin") in memory (legal penetration test). Since the account is a service account, it cannot be ...