Questions tagged [windows-permissions]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
71 views

How to force persistent privacy & security best practice settings on Windows

Some of you might know privacy.sexy. It gives you plenty of options regarding your Windows privacy and security settings. However, after a major Windows update, those settings will be reset by Windows....
Dr3xler's user avatar
  • 308
0 votes
0 answers
68 views

Difference between running executable from disk vs removable media

I came across a strange group policy setup once and was wondering if anyone can make sense of it. We were NOT allowed to run executables that were stored on the local disk or network drives, but we ...
user2334659's user avatar
0 votes
0 answers
62 views

Proof of concept: Services File Permissions Weakness (T1574.010)

I am trying to do a proof of concept where I use technique T1574.010. In this technique, I should rewrite the binpath of some service in Windows 10 so that when the service starts again the payload ...
P00's user avatar
  • 1
0 votes
0 answers
137 views

Secure Registry Keys

Is it possible to restrict access to the registry keys, just like Microsoft does on some of the keys(ex. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend)? I was able to get a similar ...
pepperoni's user avatar
0 votes
2 answers
1k views

Windows directory that is only accessible by SYSTEM user

I am developing a .NET Windows Service using C# that needs to download an executable file and run it. I need the Windows Service to run with SYSTEM privileges in order to allow it to install software ...
Jack's user avatar
  • 3
2 votes
1 answer
718 views

How is the use of Process Monitor a security risk?

I was trying to debug an application that was not working on specific environments and in my research I had multiple sources refer me to the tool Process Monitor found in \live.sysinternals.com\tools. ...
Mandelbrotter's user avatar
0 votes
1 answer
116 views

Permissions to set for Secure internet browsing in Windows 10 (Pro)

In the recent past I have been a victim of virus/malware attacks on my home computer running Windows 10 (Home), since I used the same account with high access rights to also browse the internet. ...
Matthew's user avatar
  • 101
0 votes
1 answer
1k views

Directory to place files on windows

on linux when we have a foothold and we want to transfer files to the victim we usually transfer it to /tmp beacuse it is writable and always there. what directory should we transfer our files if we ...
Ven Ven's user avatar
  • 27
1 vote
0 answers
116 views

Can USB-C be restricted for display only (i.e. no data transfer)?

I want to allow users to connect their company mobile phones to company tablets for display only using USB-C. These are windows tablets. Is there anyway of restricting the USB-C to only allow display?...
Architect 's user avatar
1 vote
0 answers
3k views

How I can I make VBA macro force Run As Administrator

I'm trying to perform Reflective Dll Injection via VBA macro. The main idea behind using Reflective Dll Injection is to bypass Windows Defender as dropping an dll onto the disk seems very loud. The ...
Rob D's user avatar
  • 51
0 votes
0 answers
242 views

Identifying Share Permission and File Permission on Hundreds of Servers

Objective Identify and report on Windows hosts in the network which allow file/folder access (READ/WRITE/Execute) for Everyone. Scenario: Using agent based scanner, I extracted share permissions ...
Shakir's user avatar
  • 185
1 vote
2 answers
219 views

IIS Application - service account permissions

My company is looking to install a 3rd party application on our infrastructure and this application will be installed on an IIS Server with a connection to a SQL server. They require an AD service ...
deltzy's user avatar
  • 237
2 votes
0 answers
302 views

Can a named pipe with a low integrity label have its SACL/DACL modified by a low integrity process?

If a named pipe on Windows has a Low Mandatory Level label and SYSTEM_MANDATORY_LABEL_NO_WRITE_UP in its SACL, but the DACL has WRITE_DAC and WRITE_OWNER for the current user, can a low integrity ...
Polynomial's user avatar
  • 135k
0 votes
1 answer
4k views

Run as different user VS. Run as admin

Can anyone explain what the security implications are between these options and how they should be used? In windows (10) Run as different user Run as administrator
Matt's user avatar
  • 57
0 votes
1 answer
130 views

Enter as guest into another server folder

I have a PC using Windows 7 in 192.168.0.10 where there is a folder, lets call Data, that i want to make avaliable for any computer connected to this network ( 192.168.0.X ) I have shared that folder ...
U. Busto's user avatar
  • 101
1 vote
1 answer
383 views

Is it possible to execute an executable with authenticated SMB?

Assume the following: An attacker has access to a remote Windows share on a remote host. Attacker manages to bruteforce a local Windows account on the host and can login to it via SMB. Attacker can ...
Saustin's user avatar
  • 311
2 votes
2 answers
2k views

What can someone do with (non-admin) command prompt on a network?

Say that an organization has a closed network - only its own computers can access it. Each of these computers has Windows 10 Enterprise. For obvious reasons, users aren't given administrator ...
Leo Wilson's user avatar
1 vote
0 answers
128 views

Questions regarding pass the ticket

In the blackhat talk by Gentikwiki on Mimikatz back in 2014, he mentioned that you can pass the service ticket also, but i am unable to replicate it in a lab. It throws an access denied. Passing the ...
AirSnow's user avatar
  • 51
1 vote
1 answer
159 views

Laptop camera app permissions

I have a laptop with Windows 10. If I go on settings and then privacy there is a list of apps with the information about their permission to use my camera (I'm talking about the built-in camera, not ...
caciro90's user avatar
1 vote
3 answers
2k views

Is there a way to overwrite a file being used by a service without service management permissions?

I am trying to demo an exploit and here is the scenario: A service is running with SYSTEM privileges where the executable it is running (binpath) can be modified by any user. The exploit consists of ...
trallgorm's user avatar
  • 885
312 votes
25 answers
49k views

Should I let my child's school have access to my kid's personal laptop?

My kid is starting 6th grade and the school requires him to get a laptop and bring it to school. Now the school IT department wants to install some software on the laptop and is asking for ...
Sushil's user avatar
  • 2,109
3 votes
0 answers
1k views

Exploiting Environment Variables in Scheduled Tasks for UAC Bypass

I am trying to escalate privileges from an ISS user on Windows Server 2012 R2 by exploiting Environment Variables in Scheduled Tasks for UAC Bypass as the following link explains the exploit: https://...
Lucian Nitescu's user avatar
4 votes
2 answers
8k views

How can I disable execution of programs from Downloads directory in Windows 10?

I run Windows 10 and I would like the contents of my system default "Downloads" folder to be non-executable. I want at least for a landing zone where I can scan files, run hash checks, and so on. ...
user avatar
4 votes
2 answers
2k views

What is the main risk of allowing services to logon as NT AUTHORITY\SYSTEM?

Many enterprises run service on production servers as SYSTEM without considering the risk that might arise from this configuration, what is the biggest risk associated with it? and how would attackers ...
Limpid.Security's user avatar
1 vote
1 answer
364 views

Suspicious app name in Windows 10 permission prompt

I downloaded MongoDB 3.4 from the MongoDB website here When I run the .msi file to install, I am prompted with the following screen asking me if I trust a39adfe.msi A Google search for a39adfe.msi ...
CodyBugstein's user avatar
2 votes
3 answers
6k views

Windows Defender and Windows Processes

When I open up task manager, I see windows processes(services) at the bottom. As a programmer, I want to create a windows process/service for security research(windows defender) but I have some ...
C.Unbay's user avatar
  • 207
-2 votes
1 answer
180 views

How are viruses made for windows? [closed]

I know that windows source code is proprietary so how do hackers and others know what are the available exploits in windows so that the viruses can take their advantage.
pro neon's user avatar
  • 107
2 votes
3 answers
3k views

What can I do to prevent my web browser from accessing local files?

According to http://mftbug.surge.sh [ed note: potentially dangerous link on the page], any web page can attack a user through the browser without knowledge about the user. How can we stop this default ...
Edka's user avatar
  • 21
6 votes
2 answers
764 views

Securing a process from local users

We require a method to run a process on a users machine whereby a local user cannot kill this process (from task manager or otherwise). Is there a way to make this application a system process or make ...
Sachin Aggarwal's user avatar
3 votes
2 answers
13k views

How to find who granted local admin privileges to a user?

A friend of mine works in an organisation and one fine day realised that he has local admin access on his machine. He swear to me that he didn't have the privilege initially and needed to raise ...
hax's user avatar
  • 3,951
2 votes
1 answer
4k views

How to set up a secure VirtualBox VM in Windows

What's a good way to make a Debian VM reasonably safe for online banking if running Windows as a host system? I thought of the following points: normal usage of the Windows system as a restricted ...
alsdkjasdlkja's user avatar
4 votes
1 answer
290 views

Does write permission over a windows service always imply privilege escalation?

Context: Doing a lab pentest on a windows VM, I got a shell as LocalService. I modified the binpath to execute a meterpreter. Then I changed the SERVICE_START_NAME to "LocalSystem" by doing: sc ...
bolachas's user avatar
3 votes
1 answer
1k views

Security benefits of running as standard user vs. administrator

I heard in a podcast a while back (I believe it was Steve Gibson's Security Now) that running Windows as standard user vs. administrator mitigates 99% of Windows vulnerabilities (I think that was the ...
jay-charles's user avatar
  • 1,229
0 votes
1 answer
358 views

Does the separation of the OS partition (C:) and data partition (D:) in Windows increase security?

I have to manage the security of thousands of laptops. Nowadays our laptops have two partitions, C:, hidden to users but accessible and D: where users store documents, images, etc. Do this separation ...
Eloy Roldán Paredes's user avatar
0 votes
1 answer
214 views

Can virtual machines access files/drives protected by host?

Say I have a windows machine with a recovery partition that is locked with system permissions and is inaccessible through the windows operating system. Is it possible that a virtual machine running ...
Verbal Kint's user avatar
2 votes
1 answer
385 views

Possible security measures to put into place before allowing screen sharing

I have someone who is having their non profit small company receive a financial audit. They are prepared for it but the financial auditors have asked to also do part of it remotely and would like to ...
kms's user avatar
  • 61
3 votes
5 answers
2k views

May be justified to use generic and shared user accounts in order to segregate and reduce risk?

Imagine I have a group of users called "support" that participates solving different kinds of problems. Each user has a nominal username like jsmith that has not much privileges but additional ...
Eloy Roldán Paredes's user avatar
0 votes
1 answer
857 views

Why does Windows 7 remove Authenticated Users from file permissions when a folder is shared?

When I try to share a folder using the share tab in file properties, if I go back and remove sharing options from the Share tab, it also affects the Security tab, removing inheritance of permissions ...
Pichu0102's user avatar
1 vote
0 answers
5k views

is it possible Windows privilege escalation using freesshd keys? [closed]

I have unprivileged shell one system.By browsing all folder i found freeSSHD folder Directory of C:\Program Files\freeSSHd 09/26/2008 02:07 PM <DIR> . 09/26/2008 02:07 PM <...
Avik's user avatar
  • 31
0 votes
0 answers
144 views

Encrypt a file before being copied

I am working on a program that will prevent data theft. I want to encrypt every file that is being copied to an external drive before it is actually copied using a symmetric encryption. Is it ...
HackinGuy's user avatar
  • 127
13 votes
2 answers
4k views

How does consent.exe know what to display?

consent.exe is responsible for showning the UAC dialog. Looking at the command line parameters with Process Explorer, I see the following: consent.exe 1316 748 000000004385BD60 I have read How ...
Thomas Weller's user avatar
0 votes
1 answer
7k views

How does driver install with an expired cert?

I'm working on making a silent installer of WinpkFilter driver. In my silent installation, I'm always getting a (not so silent) prompt that says "Windows can't verify the publisher of this driver ...
bzupnick's user avatar
  • 131
1 vote
1 answer
4k views

Exploit HTTP PUT Method in Microsoft IIS 5.0

I'm trying to test if it's possible to use the PUT method to upload content to a IIS 5.0 server. The WebDav is actualy enabled and the PUT method is allowed for public/internet users: OPTIONS /...
TMR_OS's user avatar
  • 218
4 votes
1 answer
42k views

System Account in Windows

I was thinking about SYSTEM account on windows 7 and while researching about it, I came to know that it is predefined account used by service control manager (SCM),The account is not recognised by ...
raven's user avatar
  • 251
2 votes
2 answers
621 views

Attacker able to install screen capturing software in Windows 7 guest account

I am operating in a guest account of Windows 7. Could an attacker that got onto my PC through malware I installed, install a video program that records everything I do and send the result back to his ...
Fidel Hogsed's user avatar
1 vote
1 answer
845 views

IT support and security concerns regarding local VM's

I started working at a large financial institution several weeks ago as a software engineer and despite every other aspect of this job being great, I am haunted by the constant restrictions that ...
maple_shaft's user avatar
  • 1,092
1 vote
1 answer
598 views

Bluetooth Peripheral Vulnerabilities [duplicate]

I've read some interesting Bluetooth vulnerability questions, but I didn't notice one recently. Bluetooth has long been disabled in our organization, and I'm looking to enabling it because of repeated ...
WGFinley's user avatar
0 votes
1 answer
134 views

Public folders security

If using one standard user account (for daily task) and one administrator account, then while in standard you can download some virus or whatever and put that into public folder. of course, assuming ...
codekiddy's user avatar
  • 113
0 votes
1 answer
1k views

Can local Admin on Windows be given restricted permissions?

Looking at a lot of different security software on Windows, a lot of them rely on some settings on the computer which can probably be overridden by a local administrator. For eg. some DLP software ...
user93353's user avatar
  • 2,022
3 votes
1 answer
1k views

Localhost WebSocket defense

If a malicious application has found its way onto a computer running a localhost only WebSocket server, would it help if the communications used SSL? If so, how could SSL fail if a malicious app ...
user avatar