Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

Filter by
Sorted by
Tagged with
0
votes
1answer
31 views

How can an ELF binary call a Windows API from WSL(2) to deploy a payload?

In September 2021 Black Lotus Labs (BLL) posted a blog entry discussing a payload loader that was: written in Python compiled to an ELF exe using PyInstaller in Debian in WSL and "injected into ...
0
votes
0answers
14 views

Is it possible to prevent Kerbrute from unauthenticated user enumation Active Directory?

Currently looking for a way to prevent unauthenticated user enumeration on a Domain Controller. This is a security precaution I'd like to implement, next to the existing measures taken prevent ...
0
votes
0answers
23 views

Using msfvenom shellcodes on basic bof demonstration on syswow64 (win10 latest) leads to access violations and StackHash_2beb

I'm currently preparing a course on buffer overflows. The course takes place on the latest version of Windows 10 due to other constraints. Here is my experiment setup: I simulate a basic stack ...
0
votes
1answer
45 views

Is it secure to develop sensitive apps on WSL? [closed]

Hiii, I was wondering if developing on WSL is secure for commericial and sensitive apps? I tried to read a lot about that but I feel worried.
0
votes
2answers
135 views

How do I secure SQL passwords when distributing executables?

Environment I am creating a python application which writes to SQL. It is compiled into an .exe and distributed to other computers in the business. (Edit: The SQL server is hosted by our business, ...
0
votes
1answer
89 views

Hacked list of AD logins and passwords

An organization my friend works for was recently hacked, and the hackers published a file with over 100,000 names and passwords, including theirs. An IT person in the organization told me that the ...
2
votes
0answers
48 views

How/when does Windows link private key to imported certificate?

When creating CSR on Windows (using built-in certificate store), I found some weird behaviors: When I use enrollment policy, but then extract CSR and sign it somewhere else, on import the certificate ...
0
votes
2answers
111 views

Is it safe to give away a computer with a hard drive previously encrypted with BitLocker?

Assuming the hard drive is encrypted with BitLocker and it is on a laptop with a TPM module. Then the hard drive is formatted and Windows is completely reinstalled. Is it still possible to recover the ...
0
votes
2answers
76 views

How to securely encrypt my computer and protect it from thieves and others

I did enabled Bitlocker encryption on my Windows 10 Pro Laptop. but it has TPM 2.0 chip installed and Because of that it DOES NOT actually Protecting me as someone JUST NEED TO CRACK 1 PASSWORD (...
0
votes
1answer
51 views

Risk Assessment of Windows Cert Store

We all know that SmartCards protect private keys much better than any software-based solution. However, when it comes to the Windows Cert Store to be compared to SmartCards: how difficult is it for ...
0
votes
0answers
4 views

Windows API to track if file was opened/modified [migrated]

I am using file auditing to track if a particular file was opened/modified (4663 Event). I get more information, about which process was used to access the file eg: notepad.exe etc. Is there any other ...
0
votes
0answers
56 views

I lose the reverse shell when I run some exe files [closed]

On quite a few occasions I have found that when I gain access to a machine and try to run an exe file, such as JuicyPotato.exe or Chisel.exe, it won't run and the shell freezes: The shell is thus ...
1
vote
1answer
90 views

How is using the standard Windows account more secure than using the administrator Windows account with highest UAC settings?

If someone uses the administrator Windows account for everyday work while having the default UAC settings they will be prompted by UAC whenever an application other than certain predefined system apps ...
0
votes
1answer
147 views

Can a file extension be spoofed in windows?

For example, can an .exe file be spoofed in .txt or .mp3 in Windows and still be executed as an executable? I know some basic methods like: using right-to-left override character (U+202E) winrar 4 ...
1
vote
2answers
59 views

Is using a windows user account password necessary on a PC with bitlocker and a complex pin?

Is there a security risk to disabling the windows user account password, since my PC is already unlocked with a complex pin at boot time? I have my PC configured with sleep disabled. I'm running ...
1
vote
2answers
58 views

Multiple Established TCP Connections on Port 3389 - Is my server compromised?

If i run netstat -an on my Windows Server 2019 it shows multiple connections on Port 3389 (which is RDP) The first IP Adress is mine, however i cant explain the other two connections. They both ...
0
votes
1answer
58 views

Windows Defender's MsMpEng.exe Access lsass.exe

I detected an activity last week on our SIEM system. The MsMpEng.exe which belongs to Windows Defender access lsass.exe. I search it on the net for learn is it a normal acitivty or is it anormal then ...
1
vote
2answers
134 views

Why doesn't Windows send all enabled cipher suites during TLS handshake?

I have a system with custom cipher suites specified in this registry key HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL\00010002!Functions TLS_AES_256_GCM_SHA384 ...
0
votes
0answers
34 views

No User SID in the sysmon event with id 1 (process creation)

Extend version of the question I'm trying to figure out how to detect the launch of unwanted processes based on regular logging in Windows and sysmon. Sysmon event 1 allows you to get a significant ...
0
votes
1answer
45 views

WMI commandline utility, console window host, and windows command processor all opening for a split second

Basically these 3 processes open for about 1/3 of a second and then instantly close on my task manager. I don't know what it is and I wasn't able to find anything on google about it. I am a little ...
0
votes
1answer
62 views

Private IPC between two processes

I am writing a C program in which I have a client on a process and a server on another process on the same machine. I don't know much about IPC, I would like to have a "channel" that allows ...
0
votes
3answers
120 views

USB with partition that runs .exe program. - How to remove it

I have receive a USB, but I noticed that as soon as I connected it to my computer, a video of an organization is shown. Its like an informative video, it makes me think about nothing dangerous. But... ...
5
votes
1answer
441 views

Any legitimate reason for notepad.exe to make network connections

Is there any known legitimate reason that notepad.exe would make network connections to a domain controller? I observed this behavior. The first connection was to port 135 and the second was to one of ...
1
vote
1answer
55 views

Are Credentials used in RDP cached on Client?

When I enter my domain admin user credentials into the RDP Window, does the Client also save my password hash? Example: Windows 10 Client -> Remote Desktop -> Enter Domain Admin User and ...
1
vote
1answer
272 views

Is WSL 2 secure for commercial work?

Windows Subsystem for Linux (version 2) is getting more and more traction lately with new features being added such as GUI mode over Wayland (WSLg). It seems to me Microsoft really pushes for WSL ...
0
votes
0answers
108 views

What are security risks of a domain user accounts with denied interactive logon?

When I create domain user account with denied interactive logon, what are real security risks when hacker gets the password? http://paulasitblog.blogspot.com/2017/01/deny-interactive-logon-for-service....
18
votes
4answers
5k views

What are the risks of desktop personalization on Windows?

I've worked on places where the admins have disabled desktop personalization on Windows for settings like: changing desktop background and lock screen images local themes - no high contrast for ...
10
votes
7answers
6k views

Can you create a fake (malicious) Ubuntu iso

Recently I got into an exchange with someone on social media about the security of Linux versus OSX and Windows. I stated that it is possible (and probable) that someone could code a low level back ...
4
votes
2answers
223 views

Are buffer overflow and similar attacks still possible?

The majority of my cyber security background comes in the form of web application vulnerability testing, and whilst I do have a degree of prior experience in studying and performing application ...
0
votes
0answers
50 views

Secure Registry Keys

Is it possible to restrict access to the registry keys, just like Microsoft does on some of the keys(ex. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend)? I was able to get a similar ...
1
vote
1answer
119 views

What physical damage can a user mode windows driver do?

If a driver runs in kernel mode it obviously can manipulate everything (well everything in ring 0), so manipulating the file system or devices is a possibility. Potentially devices can be destroyed, ...
-1
votes
1answer
83 views

PowerShell - privilege escalation [closed]

In the past, I have used the Sherlock PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities. However, I am looking for a similar script, but I ...
1
vote
1answer
139 views

Does a virus (malware) ever expire?

There's a possibility that my old USB stick (which I haven't used in over a year) got a virus-infected audio file (AAC) among other trusted files. Can I safely open the trusted files bypassing the ...
1
vote
0answers
59 views

How to go about checking if Windows is running any untrusted drivers (programatically)

I want to enforce a rule that my program start only if, at the time it launches, there are no untrusted kernel drivers running. I'm aware and have already tested file signature verification using ...
0
votes
0answers
187 views

Why does Windows not enable TPM 2.0 parameter encryption to protect against bus sniffing of Bitlocker key?

Comes from Bitlocker, does additional authentication at startup with TPM device provide any extra security? You can sniff the key right from the bus currently: As the decryption happens automatically,...
0
votes
0answers
11 views

AppCertDLLs does not work in GUI apps, why?

I was trying to automatically inject a dll to every process (including GUI) whenever it is started by a user . My DLL hooks DoDragDrop method of winapi and communicates with server to decide allow or ...
0
votes
2answers
99 views

Windows directory that is only accessible by SYSTEM user

I am developing a .NET Windows Service using C# that needs to download an executable file and run it. I need the Windows Service to run with SYSTEM privileges in order to allow it to install software ...
0
votes
1answer
109 views

Windows/NTFS: do files have any unique, immutable properties?

I want to detect if a file on disk was edited since last access, or restored since last deletion. Let's assume this isn't on a VM. Basic scheme: Somewhere in the file is a cryptographic hash of the ...
0
votes
1answer
53 views

Securing and storing Active Directory logs

If we plan to log script block logging, module logging and transcription logs in Active Directory using group policy, what/where is the best place to secure these logs so we can be assured of their ...
0
votes
0answers
54 views

What OS do I focus on when learning Cyber Defense?

After some time in the Cyber Defense field, I am noticing that there are different learning paths to take depending on the OS you choose (for example you can learn how to use PowerShelll and lots of ...
9
votes
2answers
236 views

Who is at risk from the PrintNightmare RCE?

Microsoft released an emergency patch and stated that the vulnerability is being actively exploited in the wild. All the news articles describing the RCE are implying that any internet-connected ...
0
votes
2answers
109 views

Shellcode not executing despite EIP being overwritten properly

Here is my exploit: junk = b'A' * 1032 ​ eip = b"\xf5\x93\x4a\x00" # some address where 'jmp esp' lives shellcode = b"" shellcode += b"\x33\xc0" # xor eax, ...
2
votes
1answer
150 views

How are vulnerabilities like PrintNightmare CVE-2021-34527 discovered?

Regarding the newly discovered vulnerability PrintNightmare CVE-2021-34527 that has existed for years without being discovered, currently affecting almost all versions of Windows, server and ...
1
vote
1answer
92 views

Error with Metasploit when attempting to exploit netapi in Windows XP [duplicate]

I am a beginner in hacking. I have been trying to hack Windows XP using the netapi exploit in metasploit, but every time, in the end, I get an error: Exploit failed [unreachable]: Rex::...
2
votes
0answers
79 views

Process Injection and Process Isolation by OS

If the OS is responsible for ensuring that one process cannot access another process memory space, and the point of process isolation is to keep processes separate from one another, then how can a ...
0
votes
1answer
67 views

Memory Forensics on exited process

I am new to memory forensics. When a process in Windows is ended are all artifacts for the process in memory gone? I ask because my EDR solution gives me the local process ID of a process I am ...
1
vote
1answer
125 views

Tricking a windows 10 computer into thinking a USB being plugged in is a mouse for code execution [closed]

Is it possible to "trick" a Windows 10 PC into thinking a flash drive is a mouse to execute code on the machine? If so, how? Note: I'm not trying to do anything malicious. All of this is ...
3
votes
0answers
192 views

How does local pass-the-hash (mimikatz's sekurlsa::pth) work?

Mimikatz's sekurlsa::pth documentation states: mimikatz can perform the well-known operation 'Pass-The-Hash' to run a process under another credentials with NTLM hash of the user's password, instead ...
0
votes
1answer
74 views

Is it possible to identify a financial fraud on a Windows machine? How?

How do forensics identify a banking/financial fraud in a Windows system? Malware usually uses real-time TCP sockets to complete their deeds, infecting and compromising the PC it runs on (not the ...
0
votes
1answer
78 views

Remove all traces of files used in Veracrypt container... is this enough?

Suppose that I have a Veracrypt container on Windows 10. I unlock it, open and edit a Text document, open an image, watch a video. Then I close all files, unmount the container. Then I run CCleaner to ...

1
2 3 4 5
41