Questions tagged [windows-server]
The windows-server tag has no usage guidance.
114
questions
0
votes
0answers
28 views
automate Checking vulnerabilities on Windows
i'm working on a project (vulnerabilty manager) where i have to find vulnerabilities on different OS's, for linux it's simple i have to check installed packages and match them with CVE list, but what ...
0
votes
2answers
439 views
RDP Authentication with domain credentials
There's something I don't get with RDP in a domain. During an authentication, if we're using a local account of the distant machine, then the creds are in the SAM so all good.
But with a domain ...
0
votes
2answers
140 views
Can connecting to a remote Windows Server infect via RDP infect my home pc?
I am connecting from my home pc to Windows Server via RDP.
Theoretically speaking, if the remote server is compromised, can it somehow automatically infect my home pc?
No file transfers, only ...
0
votes
0answers
27 views
Server to Server - secured connection from separate domains
I have a box with 2019 Windows Datacenter in one domain, and I have Windows Datacenter 2019 in a completely different domain - I am looking for the best way to connect the two and keep the data secure....
0
votes
2answers
215 views
Nmap with snmp-brute script freezes at 33.33%
I'm currently undergoing a penetration testing course where I discover the basics and I have a task where I need to perform SNMP enumeration on a target.
My working environment is as follows :
Host : ...
0
votes
0answers
24 views
Key Pair permission on Windows 2019
I generated a key pair on Windows Server 2019 using the native ssh-keygen located in System32\OpenSSH.
Now I think the permissions of the private key are somewhat worrying...
Is it expected to have ...
2
votes
0answers
51 views
How to mirror user access between Windows 2016 Servers
I'm setting up an intranet web server that will handle requests coming from multiple different types of employees.
One of the requests that my server will need to handle is to query data from a ...
0
votes
0answers
34 views
PCI compliance and VM server administrator
I have a situation where an application has to encrypt/decrypt some credit card data, each encryption key (it could be symmetric or private asymmetric) has to be in two separate places, managed by ...
0
votes
1answer
42 views
Auditing Sysmon 10 DNS events on Windows 2008 R2
I have installed Sysmon 10 on a Windows 2008 R2 box in the hope of, amongst other things, capturing DNS requests.
Sysmon appears to be capturing all other Event ID's except for 22. I have installed ...
1
vote
0answers
49 views
Abusing RDP/SSH post exploitation [closed]
I'm curious to how an attacker would enable RDP/SSH and use it to gain further access to the compromised windows server after achieving remote command/code execution on the server. (Using cmd.exe)
0
votes
0answers
45 views
Connect 3rd party devices to windows server domain
I'm working on radius authentication. Server for this moment and production is windows server 2016.
The authenticator is a hp ProCurve 2610-pwr 24p
supplicants is a windows pc running windows 10 1903
...
0
votes
0answers
57 views
Block access from an IP that tries too many requests to Apache server XAMPP / Windows [duplicate]
I have a VPS server with Windows 2016 Server and use XAMPP as Apache Server. Yesterday I receied too many requests from 1-2 IPs. How can I detect how many requests I get per 10 seconds and block them?
4
votes
1answer
98 views
Is it possible to take over a Windows server through Oracle?
I have a Windows Server 2008 R2 with an Oracle database running on it.
Someone who knows my Oracle username and password claims that he can create a Windows system account somehow. And then he can ...
0
votes
1answer
83 views
Blocking mimikatz on the OS level?
I want to know under which case would Mimikatz still run despite disabling WDigest?
Whether wdigest is set to 1 or 0, mimikatz still worked. (tested on Windows 7, 8, 2012)
Is there a better way to ...
0
votes
0answers
62 views
Remote Desktop compromised
So roughly 2 weeks ago my Remote Desktop was compromised whilst I was actively interacting with my server via Rdp I was prompted with a disconnect status equal to “ Another user has connected to ...
1
vote
1answer
339 views
Windows RDP logging into itself?
There is a computer system that has to have RDP on an open port(I fought against this of course). I secured this via RDPGuard which worked phenomenally. Anyway, after a few weeks I check back on those ...
0
votes
1answer
59 views
Failed logins on a windows server - performance impact?
I have recently started analysing our logs and noticed 600-700 failed login attempts per day against a windows 2016 server hosting some shared files.
I know what the cause is (another misconfigured ...
0
votes
0answers
48 views
What is possible with a non-administrative users Ticket Granting Ticket and/or NTLM hash?
During a penetration test, if a users NTLM hash or a valid Kerberos TGT is compromised, what attacks are possible if the user is not an administrator on any (in scope) workstations? For instance, it ...
1
vote
1answer
99 views
Steps to Harden Ancient Gaming Server
I am somewhat administering an old Windows Server 2008 server that is used to host a older Video Game.
It's in such a state that it has tons of custom code on it that run the server and hasn't really ...
0
votes
1answer
203 views
519 tls handshake attempts in 3 seconds, with 415 within one second, was this a DDOS attack?
This morning our webserver was unresponsive to say the least. The connection was lost, the database connection we have was sluggish to say the least.
I was forced to do a reboot via the remote hosting ...
0
votes
1answer
370 views
Windows Server: Import HSM-backed certificate into second server
Scenario:
Using Amazon CloudHSM with CloudHSM Windows Client installed and configured.
Created CSR for a Code Signing certificate with certreq.exe and provider Cavium Key Storage Provider.
Submitted ...
0
votes
1answer
119 views
How do I need to secure my Windows Shares?
I am working on an Domain Controller / File Server on Windows Server 2012.
Lets say that I am from a school and that I have 3 OU's (or security groups)
Students
Staff
IT
When I create a shared ...
1
vote
1answer
120 views
Deny access to IIS Server from IP local range
I have a local IIS 10 Server, this server runs a critical application.
I want to deny access for this server from IP local network and allow only 2 or 3 IP-addresses. Additionally I want to log any ...
3
votes
1answer
144 views
Active Directory Server and Mimikatz
Is it possible to use mimikatz to dump plaintext passwords of users in network by injecting mimilsa into lsass in Active Directory server? Basically other than dumping SAM which contains all hashes of ...
0
votes
0answers
259 views
Failed to exploit netapi vulnerability on Windows server 2003 R2
I am trying to exploit the ms08_0067_netapi vulnerability on windows server 2003 R2 but the exploitation end with the following message:
Exploit completed, but no session was created.
Any thoughts?
...
0
votes
1answer
311 views
Relying on internal DNS server (Domain Controller) on a DMZ Server
A couple of questions regarding DNS traffic between TRUST and DMZ and best practices.
Are there any significant risks in relying on internal DNS from a web server hosted in a DMZ zone? Has the DNS ...
-2
votes
1answer
47 views
window operating system vulnerability scanner tool [closed]
I want to use window operating system vulnerability scanner tool, just like lynis tools which scans on local os i.e like misconfiguration, os version, like firewall and AV configured. please recommend ...
0
votes
1answer
1k views
SRUM (system resource usage monitor) forensics - Windows server?
Having read a couple of articles on the SRUM DB and its use in forensics, I started digging around in Server 2016. The path referenced in the articles is not found in Sever 2016 %systemroot%\System32\...
-1
votes
1answer
317 views
System Infected: Trojan.Naid Activity [closed]
We have Tomcat 6 in the production server with Symantec Endpoint Protection on windows server 2008 server datacenter.
Symantec showing following lines in logs
[SID: 27068] System Infected: Trojan....
5
votes
1answer
303 views
How can Nmap bypass Windows Server firewall rules?
I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
3
votes
2answers
127 views
RDP violation without credentials
On a Windows Server 2003 machine seems like someone has logged in through RDP without using credentials: there is a logged access, but there are nor userid nor password.
I am wondering how is this ...
0
votes
1answer
248 views
How to set up a two-tier CA hierarchy in Windows 2012R2 certificate authority?
My apologies if the answer is everywhere but I can't seem to find what I'm looking for. My goal is to sign the CSR with an intermediate ca then root ca. So it looks like this.
Server_cert > ...
63
votes
2answers
12k views
Does removing a GUI from a server make it less vulnerable?
Lately, I was watching an online video about Microsoft Certified Solutions Associate (MCSA) and in one of the videos it says "removing GUI from Windows server makes it less vulnerable."
Is that true? ...
3
votes
0answers
632 views
Exploiting Environment Variables in Scheduled Tasks for UAC Bypass
I am trying to escalate privileges from an ISS user on Windows Server 2012 R2 by exploiting Environment Variables in Scheduled Tasks for UAC Bypass as the following link explains the exploit:
https://...
1
vote
0answers
161 views
Why can't I see my shellcode executing in Immunity Debugger?
I am doing an exercise on creating custom shellcode (windows). The goal is to create shellcode that will delete the firewall log file.
I successfully spawned a reverse shell with metasploit, using a ...
2
votes
5answers
474 views
What tools are available to compare a 'before' and 'after' security baseline of a Windows machine?
A vendor deals in software that provides secure-messaging software to medical practices, which integrates with popular clinical systems. To install it, they're requesting an hour of unattended remote ...
22
votes
8answers
7k views
Is local admin access a danger to a properly set-up network?
I read this question: Is it common to allow local admin access for developers in organizations?
This question makes me wonder. I can see how local admin access is a danger to the machine. But can a ...
125
votes
19answers
39k views
Is it common to allow local desktop and/or active directory admin access and rights for developers in organizations?
I work at a company with a staff of about 1000+. We currently have programming development staff that work on web based projects (approx 50 people).
Recently due to security concerns our IT and ...
0
votes
1answer
80 views
Is it safe to install MS17-010 unpatched OS as guest on patched host?
For example, these are unpatched old OS.
Windows 98
Windows 98 SE
Windows ME
Windows NT 4.0
Windows 2000
Given that SMBv1 is not disabled on host but already patched.
Is the unpatched guest OS ...
2
votes
1answer
100 views
Will installing WinZip 22 on a server create a security vulnerability?
I've recently requested a WinZip v22 with command line installation on a Windows POC/Dev server that we're using to pilot an application that is written in .Net.
In the application there is ...
0
votes
1answer
87 views
Is it safe to remove read-only attribute from wwwroot?
I have recently moved to a windows 2012 R2 serevr. I have problem for deleting files through HTTP even though I have granted modify,write and read permissions to IIS_ISURS. I noticed that inetpub/...
1
vote
0answers
26 views
Are the interactive methods of credential gathering listed here actually secure, since they dont store the credentials on disk?
I found an article about different ways to collect and pass credentials in powershell. The author states that some of these methods are 100% secure (which is obviously an exaderation) but for ...
0
votes
1answer
139 views
Windows Server more vulnerable for password extraction during shutdown?
Is a Windows Server (e.g. Windows Server 2008) more vulnerable during the shutdown process compared to the Server is up and running? Does the process of shutting down Windows introduce additional ...
1
vote
1answer
96 views
Third party exchange authentication
My organization has an in-house user authentication system shared between a very large number of internal systems.
One of these systems needs to retrieve information from the logged in user's ...
1
vote
0answers
52 views
Accessing SNTP MD5 Authorized Time Sync Server through GPO
I am running a Windows Server 2008 R2 server network connected to a Hardware Time Sync Server with MD5 authentication enabled. All the servers and clients are configured through NTP as NTP clients to ...
1
vote
0answers
605 views
Windows server configured for TLS 1.1 and 1.2 but scans as 1.2 only
I've got a Windows 2008 R2 server with both TLS 1.1 and TLS 1.2 enabled (but TLS 1.0 disabled) in the registry. In other words, Enabled = 0xffffffff and DisabledByDefault = 0 under both the Client and ...
4
votes
2answers
525 views
What is the main risk of allowing services to logon as NT AUTHORITY\SYSTEM?
Many enterprises run service on production servers as SYSTEM without considering the risk that might arise from this configuration, what is the biggest risk associated with it? and how would attackers ...
1
vote
0answers
252 views
Auditing specific SAM_USER events in Windows 2012 R2 Active Directory
I'm trying to create logs in Windows Event Viewer for when a user uses "net user /domain [USER]".
So far what I've done was enable the Audit SAM event in Local Group Policy, and it appears to work. ...
0
votes
3answers
8k views
How can I track executed PowerShell commands within a network?
I wanto to track PowerShell commands which are executed by users in the intranet. How can I do this?
I need the user's information and their executed commands. Is it possible?
Edit 1: I guess I can ...
2
votes
2answers
7k views
Multiple 4625 audit failures on WS2012 R2
On our WS2012 R2, I see multiple 4625 logon audit failures. Anything between once every 5 minutes to 5 times a minute. The usernames that fail the logon attempt change frequently. But seem to be from ...
