Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

Filter by
Sorted by
Tagged with
0
votes
0answers
38 views

RDP with Kali through pivoting

I'm creating a little sandbox environment for me to play around with using VirtualBox. I am using the latest Kali machine as the 'attacker'. Right now, I have a Ubuntu machine (20.04.1) that is ...
-1
votes
0answers
90 views

Is this .bat a virus? [closed]

Is this Easy anticheat Editor.bat file a virus?? IT changes the EAC background image for games. @echo off chcp 65001 > nul title EAC-E color B mode con:cols=78 lines=29 cls echo ███████...
0
votes
0answers
52 views

Windows firewall and ports [closed]

I have some questions regarding Windows Firewall and Ports How do I best close ports in Windows? With the Outbound/Inbound firewall rules? Deleting a rule is that the same as if is not activated? Or ...
0
votes
1answer
53 views

Remove all traces of files used in Veracrypt container… is this enough?

Suppose that I have a Veracrypt container on Windows 10. I unlock it, open and edit a Text document, open an image, watch a video. Then I close all files, unmount the container. Then I run CCleaner to ...
0
votes
1answer
51 views

How can a program remove the menu in Control-Alt-Delete (Secure desktop) in Windows?

In reference to another post about the Respondus Lockdown Browser, I was wondering how can a program edit and remove parts of the "Secure Desktop" (Control-Alt-Delete) menu in Windows, as ...
0
votes
1answer
96 views

Haven't updated my Windows 10 for more than a year

Almost a year ago, I dual-booted Windows 10 and Linux Mint. And since then, I haven't booted into my Windows 10 OS. I still remember that the Wi-Fi adapter was off when I shut my Windows 10 down. Now, ...
0
votes
1answer
83 views

Is it possible for a compressed file to contain malicious code?

I recently downloaded 2 compressed files (.zip and .rar) from a really unreliable and untrusted source while using a browser integrated VPN. My antivirus didn't notice anything but I am curious if it ...
0
votes
1answer
80 views

Can a video file contain code that shares your identity? [duplicate]

Could a video file contain code that reveals and sends your ip/mac address or give access to personal files to somebody else? Would normal video players (like VLC) be able to notice that kind of ...
0
votes
1answer
99 views

RubySMB::Error::CommunicationError: Read timeout expired when reading from the Socket (timeout=30)

I've been playing around with the EternalBlue exploit recently. I've downloaded a Windows 10 iso file from 2016 and used it to set up a Windows 10 Pro VM as my sandbox. I also ran the nmap script and ...
0
votes
0answers
12 views

Strange Files in AppData Roaming (IS IT A VIRUS?) [migrated]

I am not familiar with programming or something, but I have found a strange file in AppData>Roaming called vtivhwvr.exe Is it a virus?? I am also can't delete it and having strange CPU activity, it ...
10
votes
2answers
293 views

How effective is Windows KDP for exploit mitigation in practice?

Windows Kernel Data Protection is a kernel security feature which appears to use Extended Page Tables (EPT, a hardware virtualization feature) to enforce read-only pages. How effective is this at ...
0
votes
0answers
18 views

What does a missing “Account” field mean in Windows event 4769 (A Kerberos service ticket was requested)? [migrated]

I'm working on some detections for Kerberoasting using event 4769 (A Kerberos service ticket was requested) by trying to find users requesting multiple TGS tickets for several services in a short span ...
4
votes
1answer
143 views

Is Sleep mode safe?

If a PC has rootkit, when it goes into sleep mode, can rootkit do anything to it while it’s in state of sleeping? Meaning steal data, open programs and basically do anything. Assuming it’s not BIOS ...
0
votes
1answer
91 views

Downgrade of NTLM Authentication

I have been experimenting NTLM and its different relay mitigations, including MIC and channel bindings. In my understanding: ntlm auth starts with a negotiation packet sent by the client. In this ...
0
votes
0answers
34 views

Could just downloading (not opening) .tgz file infect Windows 10? [duplicate]

Today I received some e-mail to Thunderbird. It had image attached that I clicked: Which sent me to onedrive.live.com/download?... and automatically downloaded .tgz file. I am not even sure if the ...
0
votes
1answer
90 views

Watering Hole Website NTLM Steal Attack

I'm trying to recreate a Watering hole SMB theft attack where you send a victim a link to your website containing code like "file://ip/file.gif" Causing forced authentication which passes ...
1
vote
1answer
95 views

What's the point of Empire if all payloads get flagged?

I've been reading about how powerful frameworks such as Empire and Metasploit are but I'm confused about something. Say I gain access through a custom reverse-shell which I self-coded (so it bypasses ...
8
votes
1answer
333 views

Is Windows+L a secure attention sequence?

Ctrl+Alt+Del is a secure attention sequence (Microsoft) (or secure attention key (Wikipedia), but it's more a Linux term). As we can read, A key sequence that begins the process of logging on or off. ...
27
votes
5answers
6k views

How can a non-admin program cover your entire screen with a window?

This year, since many students are online, College Board (the company that administers AP Exams in the US, along with the SAT) recently released its Digital Testing App. Once installed, and going ...
1
vote
1answer
43 views

Is an outdated library in a Windows user mode desktop application an actual security risk?

I have an Windows 10 desktop application that runs in user mode only, and this application is a local tool only -- that is, it does not "talk to the internet". As an example: This ...
0
votes
0answers
63 views

Windows X.509 certificate private keys lost

Have the same certificates installed on several machines, but this happens on only one of them. The certificates are self-signed certificates. The certificates are used for WCF message security. ...
1
vote
1answer
85 views

Is docker for desktop secure for non-admins?

I manage a multi-user workstation (Windows) server for a small student organisation. One of the students asked me to install docker, as it would simplify his workflow. As this is on a shared ...
1
vote
1answer
57 views

How NTLM SSO is preformed on smartcard Kerberos logon?

I have been researching kerberos and ntlm for the last couple of days and still got one thing unresolved. After an interactive logon with kerberos, you will have in the cached credentials both ...
5
votes
2answers
2k views

Can I use VeraCrypt with an SSD?

I recently got Windows 10, and I am not overly thrilled at Microsoft having a copy of my password on their servers. I will also be forced to make a hotmail account, instead of just using a local ...
0
votes
0answers
30 views

TSX xbegin in SGX enclave (Windows)

What am I doing wrong with using xbegin in the enclave? First of all, I checked tsx outside enclave - it works (I tested _xbegin() from <immintrin.h>). Then I tried to use different examples of ...
0
votes
2answers
94 views

Path traversal in POST request?

Does it make sense to try path traversal on the filename value during a file upload request? Should I encode special characters in the POST request? For example POST [...] ----boundary Content-...
0
votes
1answer
61 views

What is a secure way to log onto the domain controller?

On a pentest we found that a kerberos ticket under account name administrator was cached on one of the SQL database server which allowed us to steal the ticket, pass-the-ticket and log onto the domain ...
2
votes
0answers
447 views

How to send deauth packets on Windows (manually or with software)?

first of all I know how deauth packets work basically. But since my wifi adapter refuses to work on my virtual Kali, I want to use my host machine (Windows 10). So I have NPcap and Wireshark and I can ...
1
vote
0answers
21 views

SSO - SAMLResponse security via localhost reply [duplicate]

We're currently in the process of enhancing our Windows .NET desktop application with SAML single sign-on. In order to retrieve the SAMLResponse from the IP we have the redirect/reply URL set to http:/...
2
votes
1answer
84 views

Risk associated with Exchange email address as username when AD authentication is enabled

In my existing setup, we have Exchange Server joined with Windows Active Directory. Both the username and email address are the same for user accounts. Our support party also recommended using this ...
0
votes
0answers
32 views

Are there advantages to using a hardware token instead of a password on a potentially compromised system?

TLDR: Is there a security benefit to regularly accessing the admin account with a hardware token rather than with a well-protected password? Long story: I'm both a developer and the system admin of ...
3
votes
2answers
148 views

Decrypt TLS 1.2 traffic between .NET Windows applications

I have attempted to decrypt traffic between two .NET applications (both on Windows platforms) using Wireshark but due to the Diffie Hellman with perfect forward secrecy, I cannot use my private key ...
3
votes
1answer
196 views

There are many ports opened by system on a Windows 8 computer - are the system files modified?

There are many ports opened by system on one Windows 8 computer: PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows ...
2
votes
0answers
161 views

What legitimate services uses SAMR queries? And how to verify?

Recently I noticed that every few days, at (almost) the same time, one host is querying the Domain Controller for group members using SAMR calls. I am trying to understand why its happening ...
2
votes
0answers
38 views

Is the RSA Private Key non-exportable option protected from key extraction?

I would like to know if the non-exportable private key option, virtualized based security, selected when importing an RSA certificate guaranteed although the user will never be able to see the RSA ...
7
votes
1answer
235 views

Is this Windows local code execution bug also a security vulnerability?

I stumbled on a Windows bug leading to code execution. I believe it should be categorized as a vulnerability but Microsoft does not recognize it as such. I would like to read other opinions. ...
1
vote
0answers
91 views

How can this “Jim Browning” YouTuber have access to all these scammers' PCs? [closed]

I've been watching these videos on YouTube about some British-sounding male (with millions of views) busting Indian scammers. It is never explained how exactly he is able to do this, with him ...
2
votes
1answer
63 views

How can I protect myself from intercepting messages sent to the server?

I want to collect certain data from my application using the driver and transfer it to the server to check its integrity. And I want to sign these packages using TPM to avoid forgery. However, a user ...
1
vote
2answers
82 views

Are there any risks involved with plugging smartphones into Windows 7-10 computer's USB ports?

When you plug a smartphone into a USB port on a Windows 7-10 computer, often a small message box pops up on the Windows device indicating that drivers are being installed. This happens automatically ...
0
votes
1answer
62 views

public MySQL via XAMPP - security - whitelisting IP's versus VPN

I'm working on app that uses MySQL database on XAMPP Control Panel on Windows. I am concerned about security part. I received advice about connecting to MySQL through VPN so it won't be accessible so ...
0
votes
0answers
51 views

Non-malicious root causes for multiple failed logon in windows domain

While monitoring SIEM alerts, I saw that there was more than 200 failed logon for a user to several hosts in the domain. Obviously, it was triggered as a brute-force attempt. Assuming it was not an ...
1
vote
0answers
226 views

Purpose of SeDebugPrivilege for DLL injection

I have been recently working on a little DLL injection program in Go. While the program works and I am able to successfully inject into a remote process, Windows permissions system still seems to ...
0
votes
0answers
42 views

Why does msfvenom payload dll create the run32dll subprocess after it is injected into the explorer process memory?

I am researching payloads that msfvenom (metasploit framework) can be generated and existing methods of injection them into processes for manual incident investigation. Initial data Target: Windows ...
1
vote
1answer
99 views

How does malware avoid AV's when using a simple DLL injection technique?

As far as I understand it, a simple approach for a malware DLL injection would require 2 DLLs. The first for the DLL side loading, while the malicious DLL remains encrypted. And then this 'loader' ...
0
votes
0answers
53 views

The incoming traffic was allowed on my home network for two days. How to assess the damage?

My router's firewall was set to accept incoming traffic for about 48 hours. Misconfiguration from a user, apparently. I have few devices on the network (two Windows PC, Freenas, printer, chromecast TV)...
0
votes
0answers
49 views

Is it possible to verify that a USB adapter is not malicious? [duplicate]

I have some generic USB C-to-A and A-to-C adapters that were bought cheaply. I thought that if any of them had any advanced capabilities (other than being "dumb" adapters) such as mimicking ...
1
vote
0answers
41 views

WebApp Windows Command Injection without “||”

I've found an application that allows arbitrary file upload (client side validation on file extensions), however those files are not stored in a folder which is accessible by the webserver, so a web ...
0
votes
1answer
41 views

IPC Security on Server [duplicate]

An application is running in a customer's environment on a single server and consists of a collection of Windows Services that communicate with each other using (unencrypted) TCP messages. Although ...
1
vote
0answers
41 views

How am I supposed to trust binaries “submitted by anyone”? [duplicate]

I finally found a Chromium fork which appears to have made a serious effort to remove all the Google cancer. Sadly, I see this: https://ungoogled-software.github.io/ungoogled-chromium-binaries/ ...
2
votes
0answers
82 views

Are there any wormable vulnerabilities for legacy Windows operating systems that are left unfixed?

I want to know the status of remote, code executing vulnerabilities of old Windows operating systems that are left unfixed, if they exist at all. Exploits like EternalBlue or BlueKeep wreaked havoc on ...

1
2 3 4 5
40