Questions tagged [windows-server]
The windows-server tag has no usage guidance.
1
vote
1answer
40 views
Deny access to IIS Server from IP local range
I have a local IIS 10 Server, this server runs a critical application.
I want to deny access for this server from IP local network and allow only 2 or 3 IP-addresses. Additionally I want to log any ...
1
vote
0answers
25 views
Active Directory Server and Mimikatz
Is it possible to use mimikatz to dump plaintext passwords of users in network by injecting mimilsa into lsass in Active Directory server? Basically other than dumping SAM which contains all hashes of ...
0
votes
0answers
11 views
Why Does Windows Server Block ICMP By Default? [duplicate]
I am conducting a OpenVAS vulnerability scan on a Windows Server 2012 box and it came back empty. It turns out that the scanner checks to see if the host is alive by sending it a ping request--if it ...
0
votes
0answers
39 views
Failed to exploit netapi vulnerability on Windows server 2003 R2
I am trying to exploit the ms08_0067_netapi vulnerability on windows server 2003 R2 but the exploitation end with the following message:
Exploit completed, but no session was created.
Any thoughts?
...
0
votes
1answer
15 views
Relying on internal DNS server (Domain Controller) on a DMZ Server
A couple of questions regarding DNS traffic between TRUST and DMZ and best practices.
Are there any significant risks in relying on internal DNS from a web server hosted in a DMZ zone? Has the DNS ...
-2
votes
1answer
40 views
window operating system vulnerability scanner tool [closed]
I want to use window operating system vulnerability scanner tool, just like lynis tools which scans on local os i.e like misconfiguration, os version, like firewall and AV configured. please recommend ...
0
votes
1answer
91 views
SRUM (system resource usage monitor) forensics - Windows server?
Having read a couple of articles on the SRUM DB and its use in forensics, I started digging around in Server 2016. The path referenced in the articles is not found in Sever 2016 %systemroot%\System32\...
-1
votes
1answer
281 views
System Infected: Trojan.Naid Activity [closed]
We have Tomcat 6 in the production server with Symantec Endpoint Protection on windows server 2008 server datacenter.
Symantec showing following lines in logs
[SID: 27068] System Infected: Trojan....
3
votes
0answers
112 views
How can Nmap bypass Windows Server firewall rules?
I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
0
votes
0answers
23 views
Use local administrator and Domain Cached Credentials to obtain access to AD domain?
I have obtained local administrator privilege on a Windows machine connected to AD domain.
Using Mimikatz I see the Domain Cached Credentials of a few Domain Admins.
I know that, it is possible to ...
0
votes
0answers
15 views
Methods for obtaining a Windows domain account, when having no domain account already?
I know of sniffing NTLM authentication, using a tool like Responder, and then brute-force these packets to obtain AD credentials.
But what if the domain has disabled LLMNR and NetBIOS? Then Responder ...
3
votes
2answers
98 views
RDP violation without credentials
On a Windows Server 2003 machine seems like someone has logged in through RDP without using credentials: there is a logged access, but there are nor userid nor password.
I am wondering how is this ...
0
votes
1answer
44 views
How to set up a two-tier CA hierarchy in Windows 2012R2 certificate authority?
My apologies if the answer is everywhere but I can't seem to find what I'm looking for. My goal is to sign the CSR with an intermediate ca then root ca. So it looks like this.
Server_cert > ...
63
votes
2answers
11k views
Does removing a GUI from a server make it less vulnerable?
Lately, I was watching an online video about Microsoft Certified Solutions Associate (MCSA) and in one of the videos it says "removing GUI from Windows server makes it less vulnerable."
Is that true? ...
3
votes
0answers
192 views
Exploiting Environment Variables in Scheduled Tasks for UAC Bypass
I am trying to escalate privileges from an ISS user on Windows Server 2012 R2 by exploiting Environment Variables in Scheduled Tasks for UAC Bypass as the following link explains the exploit:
https://...
1
vote
0answers
64 views
Why can't I see my shellcode executing in Immunity Debugger?
I am doing an exercise on creating custom shellcode (windows). The goal is to create shellcode that will delete the firewall log file.
I successfully spawned a reverse shell with metasploit, using a ...
2
votes
5answers
312 views
What tools are available to compare a 'before' and 'after' security baseline of a Windows machine?
A vendor deals in software that provides secure-messaging software to medical practices, which integrates with popular clinical systems. To install it, they're requesting an hour of unattended remote ...
22
votes
8answers
5k views
Is local admin access a danger to a properly set-up network?
I read this question: Is it common to allow local admin access for developers in organizations?
This question makes me wonder. I can see how local admin access is a danger to the machine. But can a ...
0
votes
0answers
29 views
Fully patched Windows 2008 immediate BSOD from low privilege account
Is there any exploit/script/vulnerability where a very low privileged user can trigger a BSOD or reboot? I'm familiar with the USB exploit, but I'm wondering if its possible with some remote method?
...
114
votes
19answers
27k views
Is it common to allow local admin access for developers in organizations?
I work at a company with a staff of about 1000+. We currently have programming development staff that work on web based projects (approx 50 people).
Recently due to security concerns our IT and ...
0
votes
1answer
62 views
Is it safe to install MS17-010 unpatched OS as guest on patched host?
For example, these are unpatched old OS.
Windows 98
Windows 98 SE
Windows ME
Windows NT 4.0
Windows 2000
Given that SMBv1 is not disabled on host but already patched.
Is the unpatched guest OS ...
2
votes
0answers
54 views
Will installing WinZip 22 on a server create a security vulnerability?
I've recently requested a WinZip v22 with command line installation on a Windows POC/Dev server that we're using to pilot an application that is written in .Net.
In the application there is ...
0
votes
0answers
34 views
Is it safe to remove read-only attribute from wwwroot?
I have recently moved to a windows 2012 R2 serevr. I have problem for deleting files through HTTP even though I have granted modify,write and read permissions to IIS_ISURS. I noticed that inetpub/...
0
votes
0answers
29 views
Security of unlocked, all Protocol/Port disabled, Windows AWS server
I have a AWS hosted EC2 Windows 2016 Server instance. I need to run some GUI automation (even when user is not connected via RDP) on it.
This is what I do :
Enabled RDP|TCP Incoming/Outgoing from my ...
1
vote
0answers
26 views
Are the interactive methods of credential gathering listed here actually secure, since they dont store the credentials on disk?
I found an article about different ways to collect and pass credentials in powershell. The author states that some of these methods are 100% secure (which is obviously an exaderation) but for ...
0
votes
1answer
133 views
Windows Server more vulnerable for password extraction during shutdown?
Is a Windows Server (e.g. Windows Server 2008) more vulnerable during the shutdown process compared to the Server is up and running? Does the process of shutting down Windows introduce additional ...
0
votes
0answers
82 views
How can a Logon Type 2 be initiated with seclogon?
Looking into what turned out to be an FP, I found an event that showed a PC having failed a login (Event ID: 4624) with a local account, Logon Type: 2 and Logon Process: seclogon. Consent.exe was not ...
1
vote
1answer
60 views
Third party exchange authentication
My organization has an in-house user authentication system shared between a very large number of internal systems.
One of these systems needs to retrieve information from the logged in user's ...
1
vote
0answers
32 views
Accessing SNTP MD5 Authorized Time Sync Server through GPO
I am running a Windows Server 2008 R2 server network connected to a Hardware Time Sync Server with MD5 authentication enabled. All the servers and clients are configured through NTP as NTP clients to ...
1
vote
0answers
347 views
Windows server configured for TLS 1.1 and 1.2 but scans as 1.2 only
I've got a Windows 2008 R2 server with both TLS 1.1 and TLS 1.2 enabled (but TLS 1.0 disabled) in the registry. In other words, Enabled = 0xffffffff and DisabledByDefault = 0 under both the Client and ...
3
votes
1answer
226 views
What is the main risk of allowing services to logon as NT AUTHORITY\SYSTEM?
Many enterprises run service on production servers as SYSTEM without considering the risk that might arise from this configuration, what is the biggest risk associated with it? and how would attackers ...
1
vote
0answers
88 views
Auditing specific SAM_USER events in Windows 2012 R2 Active Directory
I'm trying to create logs in Windows Event Viewer for when a user uses "net user /domain [USER]".
So far what I've done was enable the Audit SAM event in Local Group Policy, and it appears to work. ...
0
votes
2answers
1k views
How can I track executed PowerShell commands within a network?
I wanto to track PowerShell commands which are executed by users in the intranet. How can I do this?
I need the user's information and their executed commands. Is it possible?
Edit 1: I guess I can ...
0
votes
0answers
245 views
How to the find the role of computer for Windows Enumeration?
What would be some immediate giveaway to determine this? I have several choices here:
Standalone Workstation
Enterprise Manager
Domain Member Server
Domain Controller
Domain Member Workstation
...
0
votes
0answers
914 views
Alternative of etc/passwd for windows based server
I am doing Authorization test of Path traversal with Burp Suite. using payloads like below:
../(FileName)
../../(FileName)
../../../(FileName)
../../../../(FileName)
../../../../../(FileName)
../...
2
votes
1answer
2k views
Multiple 4625 audit failures on WS2012 R2
On our WS2012 R2, I see multiple 4625 logon audit failures. Anything between once every 5 minutes to 5 times a minute. The usernames that fail the logon attempt change frequently. But seem to be from ...
0
votes
1answer
348 views
pass the hash via psexec from windows server 2012 ( DC ) to client
I am trying to do some pentest training on my local labs. I created a lab has 3 Windows 2012 r2 servers and 2 Windows 7 + 8 PCS. All machines protected via passwords. I added both to the domain ...
2
votes
2answers
332 views
How safe is it for the client to open a Remote App?
I have set up Google Chrome as a Remote Application on a Windows Server 2008 R2 machine. I can then load the application on another (Windows 10) machine outside the LAN and browse as if I was doing it ...
-1
votes
1answer
33 views
Secure access to pre authorized individuals only on application server [closed]
I am building a PHP application and would like to lock the backend (even login page) to only be accessible to preauthorized people - even further be able to link activities to the authorized ...
1
vote
0answers
940 views
SSL/TLS cipher suites order for Windows 2016 hosted https sites
We are SaaS & IaaS provider that predominantly use Windows 2012 (R2) for hosting. We have started evaluating Windows 2016 OS and noticed our sites are no longer accessible via Chrome / Firefox (...
0
votes
1answer
2k views
What is the proper server-side mitigation for the Lucky13 vulnerability (CVE-2013-0169) on a Windows server?
The testssl.sh tool stated that a server I tested is vulnerable to the Lucky13 (CVE-2013-0169) vulnerability. Below the testssl.sh output:
###########################################################
...
1
vote
0answers
75 views
Windows EFS Files Spontaneously Unavailable
We are trying to secure a folder with over 1 million very small text files using Windows EFS on Windows Server 2008 R2. We already have an infrastructure in place for backing up keys and data.
We ...
1
vote
0answers
62 views
DGA scheme on local network [closed]
Reviewing DNS logs within my company I've found a lot of weird DNS requests from a machine involving what it seems a DGA scheme as shown below (real IP has been obfuscated):
04/07/2017 13:36:47 12C8 ...
1
vote
1answer
708 views
Is an updated OS, in general, more secure than its predecessor?
I'm updating the OS on several servers before they run out of support. I'd like to say the new OS (Windows Server 2008 R2 to Windows Server 2016) is more secure because it includes all security ...
0
votes
1answer
83 views
Security considerations when opening port for a service?
I would like to host a service (written in C#) on my server and allow it to be accessed from outside the network.
I know that I need to open a port in the firewall for this to work, and I managed to ...
1
vote
1answer
345 views
How can we beef the security of our Windows Server 2012 R2 against ransomware? [duplicate]
We have a MS Windows Server 2012 installed. After the attacks of last week, I was wondering how we could improve the security of the server against ransomware/cryptoware.
We did install the latest ...
5
votes
0answers
57 views
DSquery leaking personal infomation
Today I found DSquery on one of my smb shares at work. I ran it to query users and since my company uses IC numbers as the unique CN, I got to see all my colleagues' ICs.
Firstly, is this considered ...
0
votes
1answer
66 views
Changing server side certificate during ongoing connection -> is it supported ? what are the effects on the existing connections?
I was wondering (based on the TLS RFC and its current implementation by the major vendors / platforms - i.e. Microsoft's IIS): how would an existing active SSL / TLS session behave / react if the ...
0
votes
0answers
161 views
How to find out what IP is being DDoSed?
I have a Windows Server 2008 R2 and more than 10 IPs. My server is being DDoSed frequently. When it just starts I can still access it, but after some time it becomes unaccessable. How can I find out ...
1
vote
0answers
186 views
Encrypting File System Data at Rest on Windows Web Application
We have a web application (running in Apache Tomcat on a Windows Server 2008 machine) that stores most of its data in the file system. We are investigating ways to implement encryption for this data ...
