Skip to main content

Questions tagged [windows-server]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
1 answer
48 views

Nexpose reporting ciphers not present in machine

Nexpose reports the following vulnerability: TLS/SSL Server Supports The Use of Static Key Ciphers. Negotiated with the following insecure cipher suites: TLS 1.2 ciphers: ...
Nico Nico Pizza's user avatar
1 vote
0 answers
33 views

Low level privilege assignment using Secedit failed

I, as Administrator, tried to assign Backup privileges to a sample user via secedit command... cmd> secedit /export /cfg config.inf It exported the contents of Local Security Policy (LSP) database ...
Aryan's user avatar
  • 21
1 vote
0 answers
104 views

Pass-the-hash, why do I get a shell with high integrity?

I am testing the security of a Windows Server 2019 machine and have a question about remote access to the machine. The user on the machine has the permission "SeBackupPrivilege". I can ...
EEVV's user avatar
  • 11
0 votes
0 answers
76 views

How to handle Microsoft FTP server being DDoSed

We noticed FTP service going down intermittently in the server and we found an FTP user was used to DDoS the server. Then we deleted the specific user from the server. After that the user "...
Bose's user avatar
  • 1
0 votes
1 answer
139 views

How to protect a local app that acts as a webserver from exploits?

For me building interfaces through HTML / JS frameworks is by far easier then any other framework I have tried in the past. It's also not that strange, as by far the most UIs are based on the web ...
Dirk Boer's user avatar
  • 539
0 votes
0 answers
2k views

Windows Event ID 4624 with Anonymous Logon. Is it safe?

In our SIEM, I saw the following event below. From the image above here is what I'm observing: Successful login noted via eventid 4624 Username used to login was Anonymous logon as indicated by SID ...
Nina G's user avatar
  • 133
4 votes
2 answers
620 views

How to find the process that is running PowerShell commands that appear in Windows Defender

On one of our Windows Datacenter 2016, there's an alert that a trojan is trying to install : The following PowerShell commands are trying to execute at seemingly random hours of the day (always ...
Maxime's user avatar
  • 139
0 votes
0 answers
273 views

How strong is windows firewall on Windows Server 2019?

How strong is Windows Firewall? I have no knowledge on Botnets or how to use them, so I have no way to test Windows firewall's strength. And I believe it would go against the contract I signed with my ...
Azriel Elijay's user avatar
0 votes
1 answer
218 views

Notepad.exe establishing an outbound TCP over port 1025 from Windows using server to a Teradata server, is this unusual?

We have a situation where a user logged into a Windows Server which primarily runs Tableau established an outbound TCP connection over port 1025 where the destination server is part of a Teradata ...
cln6stn's user avatar
0 votes
1 answer
931 views

Cipher Suites settings wrong order?

I'm trying to setup a custom order of TLS cipher suites according to this Microsoft list, on Windows Server 2022 but the outcome is not the one that I was expecting. After using the powershell to ...
cadobe's user avatar
  • 3
3 votes
1 answer
283 views

Remote code execution after a valid SMB (net use) password in Windows?

I am doing a capture-the-flag exercise in a Windows scenario. It uses Windows 2016 server. I was able to find the password and I can access the files with a: net use z: \\computer\C$ password /user:...
psico_disk's user avatar
2 votes
1 answer
202 views

Does only having Microsoft Office installed make you vulnerable to the CVE-2022-30190 RCE or having Windows as your OS is enough?

I was wondering whether you need to have Microsoft Office installed to be vulnerable to CVE-2022-30190 RCE. As far as I understand, MSDT is the issue here (the attack vector so to say) and as shown ...
Sir Muffington's user avatar
1 vote
1 answer
1k views

TGS Ticket in Kerberoasting

In kerberoasting , User request service ticket for any service with registered SPN then use the ticket to crack service password. But in kerberoses authentication process , KRB_TGS_REQ request is ...
user10433098's user avatar
0 votes
0 answers
8k views

security certificate does not specify Subject Alternative Names

We have a Windows Server 2016 that we use as a web server hosted on premise and we host numerous web applications under the Default Web Site in IIS. All applications are reached by using the server ...
tnk479's user avatar
  • 101
0 votes
1 answer
178 views

Exposing ADCS OCSP on the Public Internet

I am building a Certificate Authority using Windows Server ADCS as a 'Standalone' CA but my application would be greatly improved if I can utilise OCSP. Is the ADCS Online Responder Role Service ...
Vjz's user avatar
  • 11
1 vote
1 answer
370 views

How do I get my server HSM working while connected via RDP? (Win 2019)

The error I get from pkcs11-tool.exe is "No slots." My server has a hardware security module (Nitrokey HSM 2) that becomes inaccessible once I connect to my server via Windows Remote Desktop....
Jacob Bruinsma's user avatar
2 votes
0 answers
915 views

SVCHOST Executed without any arguements [closed]

Our SIEM has a Sigma rule that alerts when svchost is launched without any arguments. The logs are from a domain controller which unfortunately I don't have access to to verify. I will be reaching ...
faithsec's user avatar
1 vote
0 answers
139 views

Methodology to find exploit for Windows Servers

I am following the following walk-through for a box called Sheild on Hack the Box (HTB). https://www.aldeid.com/wiki/HackTheBox-StartingPoint-Shield For privilege escalation, the walkthrough says &...
user3580480's user avatar
1 vote
0 answers
471 views

Windows X.509 certificate private keys lost

Have the same certificates installed on several machines, but this happens on only one of them. The certificates are self-signed certificates. The certificates are used for WCF message security. ...
axk's user avatar
  • 135
3 votes
4 answers
6k views

Windows Server 2019: Add CHACHA20-POLY1305 ciphersuites for IIS

Is there a way to add/enable ECDHE-ECDSA-CHACHA20-POLY1305 and ECDHE-RSA-CHACHA20-POLY1305 ciphersuites on Windows Server 2019 (Build 1809 or later) for HTTPS configuration of IIS webserver? According ...
Pylyp Lebediev's user avatar
0 votes
2 answers
6k views

RDP Authentication with domain credentials

There's something I don't get with RDP in a domain. During an authentication, if we're using a local account of the distant machine, then the creds are in the SAM so all good. But with a domain ...
Daycopo's user avatar
1 vote
2 answers
3k views

Can connecting to a remote Windows Server infect via RDP infect my home pc?

I am connecting from my home pc to Windows Server via RDP. Theoretically speaking, if the remote server is compromised, can it somehow automatically infect my home pc? No file transfers, only ...
Mon B.'s user avatar
  • 13
0 votes
0 answers
97 views

Server to Server - secured connection from separate domains

I have a box with 2019 Windows Datacenter in one domain, and I have Windows Datacenter 2019 in a completely different domain - I am looking for the best way to connect the two and keep the data secure....
Toshi Yaoyorozu's user avatar
0 votes
2 answers
1k views

Nmap with snmp-brute script freezes at 33.33%

I'm currently undergoing a penetration testing course where I discover the basics and I have a task where I need to perform SNMP enumeration on a target. My working environment is as follows : Host : ...
DisplayNeth's user avatar
2 votes
0 answers
196 views

How to mirror user access between Windows 2016 Servers

I'm setting up an intranet web server that will handle requests coming from multiple different types of employees. One of the requests that my server will need to handle is to query data from a ...
Mandelbrotter's user avatar
0 votes
1 answer
244 views

Auditing Sysmon 10 DNS events on Windows 2008 R2

I have installed Sysmon 10 on a Windows 2008 R2 box in the hope of, amongst other things, capturing DNS requests. Sysmon appears to be capturing all other Event ID's except for 22. I have installed ...
JLPH's user avatar
  • 117
1 vote
0 answers
155 views

Abusing RDP/SSH post exploitation [closed]

I'm curious to how an attacker would enable RDP/SSH and use it to gain further access to the compromised windows server after achieving remote command/code execution on the server. (Using cmd.exe)
Jake Leroy's user avatar
0 votes
0 answers
214 views

Connect 3rd party devices to windows server domain

I'm working on radius authentication. Server for this moment and production is windows server 2016. The authenticator is a hp ProCurve 2610-pwr 24p supplicants is a windows pc running windows 10 1903 ...
Tim Clinckemalie's user avatar
0 votes
0 answers
205 views

Block access from an IP that tries too many requests to Apache server XAMPP / Windows [duplicate]

I have a VPS server with Windows 2016 Server and use XAMPP as Apache Server. Yesterday I receied too many requests from 1-2 IPs. How can I detect how many requests I get per 10 seconds and block them?
Giorgi Shonia's user avatar
4 votes
1 answer
167 views

Is it possible to take over a Windows server through Oracle?

I have a Windows Server 2008 R2 with an Oracle database running on it. Someone who knows my Oracle username and password claims that he can create a Windows system account somehow. And then he can ...
user216358's user avatar
0 votes
1 answer
326 views

Blocking mimikatz on the OS level?

I want to know under which case would Mimikatz still run despite disabling WDigest? Whether wdigest is set to 1 or 0, mimikatz still worked. (tested on Windows 7, 8, 2012) Is there a better way to ...
secdos9's user avatar
0 votes
0 answers
190 views

Remote Desktop compromised

So roughly 2 weeks ago my Remote Desktop was compromised whilst I was actively interacting with my server via Rdp I was prompted with a disconnect status equal to “ Another user has connected to ...
user213965's user avatar
1 vote
1 answer
3k views

Windows RDP logging into itself?

There is a computer system that has to have RDP on an open port(I fought against this of course). I secured this via RDPGuard which worked phenomenally. Anyway, after a few weeks I check back on those ...
Mig S.'s user avatar
  • 11
0 votes
1 answer
199 views

Failed logins on a windows server - performance impact?

I have recently started analysing our logs and noticed 600-700 failed login attempts per day against a windows 2016 server hosting some shared files. I know what the cause is (another misconfigured ...
Hawke's user avatar
  • 13
1 vote
0 answers
270 views

What is possible with a non-administrative users Ticket Granting Ticket and/or NTLM hash?

During a penetration test, if a users NTLM hash or a valid Kerberos TGT is compromised, what attacks are possible if the user is not an administrator on any (in scope) workstations? For instance, it ...
n00b's user avatar
  • 465
1 vote
1 answer
186 views

Steps to Harden Ancient Gaming Server

I am somewhat administering an old Windows Server 2008 server that is used to host a older Video Game. It's in such a state that it has tons of custom code on it that run the server and hasn't really ...
Verac's user avatar
  • 41
0 votes
1 answer
467 views

519 tls handshake attempts in 3 seconds, with 415 within one second, was this a DDOS attack?

This morning our webserver was unresponsive to say the least. The connection was lost, the database connection we have was sluggish to say the least. I was forced to do a reboot via the remote hosting ...
Tschallacka's user avatar
0 votes
2 answers
1k views

Windows Server: Import HSM-backed certificate into second server

Scenario: Using Amazon CloudHSM with CloudHSM Windows Client installed and configured. Created CSR for a Code Signing certificate with certreq.exe and provider Cavium Key Storage Provider. Submitted ...
MikeJansen's user avatar
0 votes
1 answer
326 views

How do I need to secure my Windows Shares?

I am working on an Domain Controller / File Server on Windows Server 2012. Lets say that I am from a school and that I have 3 OU's (or security groups) Students Staff IT When I create a shared ...
Koen Hollander's user avatar
1 vote
1 answer
664 views

Deny access to IIS Server from IP local range

I have a local IIS 10 Server, this server runs a critical application. I want to deny access for this server from IP local network and allow only 2 or 3 IP-addresses. Additionally I want to log any ...
Joseph Watever J's user avatar
4 votes
1 answer
494 views

Active Directory Server and Mimikatz

Is it possible to use mimikatz to dump plaintext passwords of users in network by injecting mimilsa into lsass in Active Directory server? Basically other than dumping SAM which contains all hashes of ...
GMX Rider's user avatar
  • 395
0 votes
0 answers
491 views

Failed to exploit netapi vulnerability on Windows server 2003 R2

I am trying to exploit the ms08_0067_netapi vulnerability on windows server 2003 R2 but the exploitation end with the following message: Exploit completed, but no session was created. Any thoughts? ...
Ahmed M. Taher's user avatar
0 votes
1 answer
1k views

Relying on internal DNS server (Domain Controller) on a DMZ Server

A couple of questions regarding DNS traffic between TRUST and DMZ and best practices. Are there any significant risks in relying on internal DNS from a web server hosted in a DMZ zone? Has the DNS ...
Florian Bidabé's user avatar
-1 votes
1 answer
118 views

window operating system vulnerability scanner tool [closed]

I want to use window operating system vulnerability scanner tool, just like lynis tools which scans on local os i.e like misconfiguration, os version, like firewall and AV configured. please recommend ...
mubee's user avatar
  • 1
0 votes
1 answer
3k views

SRUM (system resource usage monitor) forensics - Windows server?

Having read a couple of articles on the SRUM DB and its use in forensics, I started digging around in Server 2016. The path referenced in the articles is not found in Sever 2016 %systemroot%\System32\...
HamblePie's user avatar
-1 votes
1 answer
424 views

System Infected: Trojan.Naid Activity [closed]

We have Tomcat 6 in the production server with Symantec Endpoint Protection on windows server 2008 server datacenter. Symantec showing following lines in logs [SID: 27068] System Infected: Trojan....
Pawan Patil's user avatar
6 votes
1 answer
891 views

How can Nmap bypass Windows Server firewall rules?

I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
Salman Raza's user avatar
3 votes
2 answers
238 views

RDP violation without credentials

On a Windows Server 2003 machine seems like someone has logged in through RDP without using credentials: there is a logged access, but there are nor userid nor password. I am wondering how is this ...
Flash's user avatar
  • 33
0 votes
1 answer
411 views

How to set up a two-tier CA hierarchy in Windows 2012R2 certificate authority?

My apologies if the answer is everywhere but I can't seem to find what I'm looking for. My goal is to sign the CSR with an intermediate ca then root ca. So it looks like this. Server_cert > ...
Olson Sala Jr's user avatar
64 votes
2 answers
13k views

Does removing a GUI from a server make it less vulnerable?

Lately, I was watching an online video about Microsoft Certified Solutions Associate (MCSA) and in one of the videos it says "removing GUI from Windows server makes it less vulnerable." Is that true? ...
R1W's user avatar
  • 1,627