Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

Filter by
Sorted by
Tagged with
0 votes
0 answers
32 views

Is CVE-2024-20666 Bitlocker vulnerability mitigated by disabling Windows RE or removing the recovery parition?

Taking Microsoft's page on CVE-2024-20666 at face value, that Bitlocker vulnerability is darn serious in an "evil maid" attack: A successful attacker could bypass the BitLocker Device ...
3 votes
1 answer
2k views

DPAPI offline attack by cracking windows password?

I'm thinking of using DPAPI to protect configuration file information in my program. After doing some reading on it, it looks like it uses the user's Windows password as part of the encryption process....
0 votes
0 answers
34 views

How to prevent absolute path traversal in EasyPHP Webserver 14.1

In the EasyPHP Webserver 14.1 software, there is an Absolute Path Traversal vulnerability in the dashboard index.php page. https://www.exploit-db.com/exploits/51430 I reviewed the source code and ...
0 votes
0 answers
52 views

Very frequent calls to same Windows API function by malware

Here I have a malware sample that calls RegQueryValueEx quite frequently, without any time interruption. And as we can see, the result is quite often "BUFFER OVERFLOW". In another topic I ...
1 vote
1 answer
38 views

Can NTLM pass-through authentication be done without NetLogon?

In any "recent" documentation regarding NTLM (Microsoft) I see it stated that the mechanism of pass-through authentication is done over a NetLogon channel, which should be secure. This ...
1 vote
1 answer
206 views

Can I recover files that I had on windows from a SSD that I converted to apfs (mac) and which method or tool to use? [closed]

I had some files that I want to recover from windows, but I formatted the ssd drive to macos (apfs)? Is there a tool or method to recover those files?
2 votes
1 answer
1k views

Security risks in using ‘no @thankyou.com’ to bypass Microsoft account login when installing Windows 11

One of the recommended methods for bypassing Microsoft account login during the Windows 11 OOBE is to attempt to log in using a locked account (no @thankyou.com being the most commonly recommended ...
5 votes
2 answers
1k views

Inject hash into sam file. Is possible?

I have a very uncommon scenario. I have a Windows 10 laptop with a specific configuration. On that configuration, there is a user (local user, not domain user) which I don't know its password. I want ...
0 votes
1 answer
38 views

SACL for shadow copies

I'm researching the topic of detecting registry dump from disk shadow copies and realize that I don't see any specific events in the Windows and Sysmon logs. I tried a simple copy with the command: ...
2 votes
2 answers
366 views

How to extract a .bat file with volatility

I am experimenting with the volatility2 tool. I have created a memorydump of a windows 7 machine where i had a batch script file on the desktop of the machine. I used the mftparser command as : ...
0 votes
2 answers
86 views

Isolating encrypted and unecnrypted Windows installations and protecting the boot loader

I want to use my PC both for gaming and for stuff like keeping cryptocurrency wallets, online banking, etc. I need to install games as admin but of course I don't want them to be able to access my ...
0 votes
1 answer
329 views

Does BloodHound include local users as part of the results?

I've read the documentation for BloodHound, but I'm still unsure, whether BloodHound includes local users (not domain users) as part of the results (or whether it is possible to make BloodHound ...
24 votes
2 answers
35k views

How secure is the Windows Credential Manager?

I'm a Lastpass user and many times I thought about switching to the Credential Manager, for auto sync and a certain comfort with the windows environment. The only thing that I'm worried about is its ...
1 vote
1 answer
550 views

Can file recovery tools recover deleted small files from SSD drive's NTFS Master File Table?

According to this page and site, small files are kept in Master File Table when filesystem is NTFS. Let's assume that computer is using Windows 10 and a SSD drive with TRIM support. If a user ...
0 votes
1 answer
141 views

Which is more secure to access a VMware Windows VM : VMware Remote console or RDP+Remote Desktop Gateway

Without knowing more details, I can't suggest to our security guy that we should use RDP along with a Remote Desktop Gateway. One person says to that VMware Remote Console is more secure than using ...
0 votes
0 answers
7 views

Trojan:Win32/Wacatac.B!ml found in C:\$Extend\$Deleted\0099000000001E1607EF0CDC [migrated]

I am really worried right now. I got the following message from Defender (Windows 11): What I tried so far: Actions to remove or even quarantine don't work. Defender offline scan and Malwarebytes ...
1 vote
1 answer
3k views

How to crack AES-based Kerberos TGS tickets (Kerberoasting)?

All material I can find is related to RC4-based Kerberos TGS tickets, since these are easier to crack to obtain the service account's password. However, I want to attempt to crack AES-based Kerberos ...
11 votes
1 answer
1k views

Entropy sources used by modern Windows

A comment on a Microsoft blog from 2005 mentions over 150 sources of entropy for the Windows CryptGenRandom function. The majority of sources come from low-level system information (precise stat ...
1 vote
1 answer
1k views

Windows Defender's MsMpEng.exe Access lsass.exe

I detected an activity last week on our SIEM system. The MsMpEng.exe which belongs to Windows Defender access lsass.exe. I search it on the net for learn is it a normal acitivty or is it anormal then ...
6 votes
3 answers
11k views

Bitlocker without PIN

In simple words: Does Bitlocker (without Pin) transforms the normal "Windows User login" into something secure? So if you activate Bitlocker (without a pin before booting) you are forced to use the ...
0 votes
1 answer
53 views

Is the Bitlocker encryption key used on HD same for USB?

With Bitlocker, is there only one "master key" that is used to encrypt/decrypt for both HD and USB data? I saw this article today which talks about sniffing the encryption key to get access ...
1 vote
1 answer
589 views

Excessive logons from domain controllers

I am quite new to analyzing the windows logs. I have been seeing excessive logons with 4624 and 4625 with the Subject/account name: DomainController(actual name of the domaincontroller is different) ...
0 votes
0 answers
8 views

Active Directory Account Operator Modifying Groups Which Inherit Privileged Groups [migrated]

In active directory, if an account I have access to has Account Operators group, by default, is possible to add myself to a group which is inherits Domain Admins group? For instance, I have a group ...
0 votes
0 answers
15 views

In Win10/Win11, how to block mobile phone cards with mobile data (SIM cards)? [migrated]

How do I block mobile phone cards or mobile data (SIM cards), on Windows? I know that I can take out the hardware that reads the SIM cards, the LTE card. Block the device, the LTE, in the Device ...
0 votes
0 answers
44 views

What is Virtual Secure Mode trying to achieve?

I recently learned about the feature in Windows 10 called Windows Secure Mode (https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/tlfs/vsm). I'm trying to understand what exactly it ...
1 vote
1 answer
350 views

Watering Hole Website NTLM Steal Attack

I'm trying to recreate a Watering hole SMB theft attack where you send a victim a link to your website containing code like file://ip/file.gif. Causing forced authentication which passes the NTLM hash....
0 votes
0 answers
43 views

How to embed a PE file to another PE files

So what I want to do basically is what BDFproxy does on the go, I want to modify a file (on the disk) to embed another PE in it and have both working, it does not matter if they work concurrently or ...
0 votes
1 answer
283 views

DLL Injection Win32 API

I want to know which Win32 API functions a certain executable calls. The executable is a 32-bit application. I know what steps to take to perform a DLL injection and hook an API function. However, ...
0 votes
0 answers
64 views

Is using OpenSSH Authentication Agent on Windows 11 a secure practice?

I use a passphrase on my SSH key used for git. I wanted to be able to use the same git for a few scripts I run to clone/pull a bunch of my repos. I discovered that I don't have to repeatedly enter my ...
1 vote
1 answer
268 views

File sharing with compromised Windows machine

I want to connect a known to be compromised Windows machine to the network for file sharing, it has lots of pirated software installed therefor not secure. Can it be isolated so that nothing can ...
0 votes
0 answers
35 views

domain (active directory) machines accessible via web

I recently stumbled across customer machines (windows server) that were part of the customers active directory domain and also had IIS applications accessible for the www. I only have the vague ...
1 vote
1 answer
208 views

Would my hypothetical Opsec setup with the goal of compartmentalizing sensitive areas from an insecure sandbox be sensible?

The root cause of my problem stems from the fact that I need to run untrustworthy software on a bare metal windows machine, which means that I can't just have it in a VM because of major performance ...
0 votes
1 answer
178 views

How to determine which Chrome extension is re-directing me to ad sites

Twice now, seemingly randomly, I've been redirected to an ad site. I believe it has occurred both times when I have a new tab open, type what I'm searching for (Google is my default search engine), ...
3 votes
1 answer
977 views

Show confirmation popup before running any downloaded program in Windows 10

I often download files either using my browser or by torrenting. Few times, I encountered an attack where the torrented file was called something like movie.mp4.lnk and the target was set to run a ...
22 votes
8 answers
9k views

Is local admin access a danger to a properly set-up network?

I read this question: Is it common to allow local admin access for developers in organizations? This question makes me wonder. I can see how local admin access is a danger to the machine. But can a ...
0 votes
1 answer
111 views

Is DPAPI usable when only being able to read the file directory?

DPAPI: Windows Data Protection API Say I would be able to read a Windows system file system, including all files. Say there would be a DPAPI encrypted value somewhere in this system that I want to ...
0 votes
1 answer
88 views

ScyllaHide DLL Injection

When I try to perform a DLL injection with ScyllaHide in x32/x64 dbg, then it crashes for some reason, is this a bug? Both with stealthy injection as with normal injection, the program crashes when I ...
0 votes
1 answer
99 views

How to protect a local app that acts as a webserver from exploits?

For me building interfaces through HTML / JS frameworks is by far easier then any other framework I have tried in the past. It's also not that strange, as by far the most UIs are based on the web ...
2 votes
1 answer
292 views

Does Windows use Bluetooth Authenticated pairing with encryption automatically?

Does Windows use Bluetooth Authenticated pairing with encryption automatically when you connect Bluetooth devices like earbuds to it? Is that Level 4? If it's not automatic, how do I get Windows to do ...
0 votes
2 answers
464 views

Accidentally downloaded a Trojan.Dropper which Malwarebytes picked up, how to ensure system is clean?

So I was trying to download an arcade game, everything seemed legit and I guess I was too excited to play it I started running it - only after clicking it I decided to run a scan on both Avira and ...
30 votes
4 answers
26k views

Checklist on building an Offline Root & Intermediate Certificate Authority (CA)

Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite. Here is an image of the default cryptography settings ...
0 votes
1 answer
430 views

How is a Windows Active Directory Machine Account Password stored in Windows/Samba Clients?

It's said that a Windows Machine Account Password is usually composed of 120 characters in UTF-16-LE format. But when looking at the value stored in the Windows Registry under HKLM\SECURITY\Policy\...
3 votes
1 answer
458 views

What is the Print Nightmare threat vector?

I've researched this topic a few times and have not been able to come up with a definitive answer. It appears the threat may be multi-faceted. I ask in the context of a standard Server/Client Windows ...
1 vote
0 answers
82 views

Suspicious new folders with chaotic jpg,sql,doc,txt and doc files

I found several new folders, each containing 10 small files with random content ( a chaotic picture, an rtf of random letters, a corrupted doc file etc...), all the files were created at the same time,...
2 votes
1 answer
105 views

Do Windows Credential Manager encrypt information stored in it?

Apologize if this is a newbie question. Say the PC hard drive with Windows installed is un-encrypted (no BitLocker, etc); and someone gets physical access to the hard drive but does not know the (...
1 vote
1 answer
447 views

How to detect malicious actor altering DNS responses?

I am trying to detect what is causing my DNS to return fake IP addresses for domains like apple, orange, etc. which obviously don't exist. If I do following on my Windows machine: ipconfig /flushdns ...
0 votes
1 answer
198 views

Windows Defender Exclusions

If a virus added itself to windows defender exclusions, it will never be scanned. However would windows defender still remove its startup registry keys and scheduled tasks? Windows defender is the ...
0 votes
1 answer
1k views

Can I elicit responses from "any remote host" on "all protocols" if I want to?

An nmap scan of my test computer returns a result of “5357 / tcp open wsdapi”. After some research, this is something that can be exploited. It is explained here that: By default, WSDAPI will listen ...
0 votes
1 answer
226 views

Which Intel CPUs do not have Management Engine (ME) [duplicate]

The Intel Management Engine (ME) is a security risk which I would prefer not to take. I do not trust it, it seems to be a backdoor, and there are reported vulnerabilities on it. I do not trust the ...
3 votes
2 answers
3k views

Windows Kerberos Pre-Auth Failed (4771)

Is there an easy way to distinguish 4771 events from a real attack perspective vs. someone having a stale session with an old password? If you don't get logs from all endpoints and rely on Domain ...

1
2 3 4 5
45