Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

294 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
11 votes
1 answer
1k views

Entropy sources used by modern Windows

A comment on a Microsoft blog from 2005 mentions over 150 sources of entropy for the Windows CryptGenRandom function. The majority of sources come from low-level system information (precise stat ...
forest's user avatar
  • 66.6k
6 votes
1 answer
1k views

Pivoting with Metasploit

I am trying to exploit a Windows VM on a different subnet behind a dual home Linux VM where I already have a shell. To keep it simple, I have a meterpreter reverse_tcp shell on the Linux VM (192.168....
B-MO's user avatar
  • 313
6 votes
1 answer
707 views

MS08-067.c fails at WNetAddConnection2()

I'm working with some exploit code for the MS08-067 vulnerability from ExploitDB. The section: WNetAddConnection2(&nr, "", "", 0)* fails with an error of 67 (ERROR_BAD_NET_NAME), but I don't ...
Synthetic Ascension's user avatar
5 votes
0 answers
799 views

What encryption type does Windows Hello use for fingerprint information on Windows 10 latest build?

I've contacted Microsoft support and they said they don't support encryption, which is why I'm posting here. Basically, what I'm wondering is, if a modern laptop has TPM 2.0 enabled and hardware ...
Magnetox's user avatar
4 votes
0 answers
951 views

Hyper-V Sockets in 2016 version and host/guest communication

In new version of Hyper-V released recently with MS Windows Server 2016 contains a new functionality Hyper-V Sockets which allows for host/guest communication. It uses WinSock API with new address ...
TimB's user avatar
  • 41
4 votes
0 answers
524 views

Will WinVerifyTrust return true for a file signed by a revoked certificate, before it was revoked?

I've seen mentions online that drivers that were signed by certificates that were later revoked are still trusted by Windows' driver integrity. Apparently if the file was signed before the revocation ...
homer321's user avatar
4 votes
0 answers
269 views

Lookaside List Injection

I've been reading a lot about Use-after-free and came across this document. It talks about a "Lookaside" injection exploit. The document says to empty the dynamic memory cache, called the Lookaside ...
dylan7's user avatar
  • 747
4 votes
0 answers
362 views

Enable FIPS 140.2 in Windows 7 (cng.sys version does not match with versions from NIST Validated list

I am currently working on an application running in Windows 7 Ultimate, and it has to be FIPS 140-2 compliance. As far as I have researched in https://technet.microsoft.com/en-us/library/security/...
Víctor DMS's user avatar
4 votes
0 answers
187 views

how to create TPM_AUTHDATA as input in tpm commands ?

I'm writing my first program which use tpm (version 1.2) services in Windows 7 using TBS, in this program I'm trying to execute the TPM_CreateWrapKey command. I noticed that many commands like the ...
amir dachbash's user avatar
4 votes
0 answers
1k views

copying roaming profile credential file of another computer

I am trying to recover login information of another computer. I have managed to copy the local/roaming profile credential files located in C:\users\%username%\APPDATA\local\Microsoft\Credentials\ and ...
Syler's user avatar
  • 151
3 votes
0 answers
193 views

Does Windows 10 read/run/care about USB devices plugged in "Lock Screen" mode?

Whenever I leave my computer for the bathroom or anything inside the living space, I press WinKey + L to enter the "Lock Screen" mode. (If I go outside, I turn it off completely.) Let's say ...
Derrol H.'s user avatar
3 votes
0 answers
2k views

C# Hello World program detected as virus

I just wrote and compiled a Hello World program in C# (I'm using Visual Studio 2022) and when I sent the file to VirusTotal, 1 antivirus program detected the exe as unsafe (VirusTotal results of C# ...
Furkan125's user avatar
3 votes
1 answer
459 views

What is the Print Nightmare threat vector?

I've researched this topic a few times and have not been able to come up with a definitive answer. It appears the threat may be multi-faceted. I ask in the context of a standard Server/Client Windows ...
Appleoddity's user avatar
3 votes
0 answers
215 views

Process Injection and Process Isolation by OS

If the OS is responsible for ensuring that one process cannot access another process memory space, and the point of process isolation is to keep processes separate from one another, then how can a ...
chephato's user avatar
3 votes
0 answers
932 views

How does local pass-the-hash (mimikatz's sekurlsa::pth) work?

Mimikatz's sekurlsa::pth documentation states: mimikatz can perform the well-known operation 'Pass-The-Hash' to run a process under another credentials with NTLM hash of the user's password, instead ...
Nico's user avatar
  • 95
3 votes
0 answers
10k views

How to send deauth packets on Windows (manually or with software)?

first of all I know how deauth packets work basically. But since my wifi adapter refuses to work on my virtual Kali, I want to use my host machine (Windows 10). So I have NPcap and Wireshark and I can ...
Cemeb's user avatar
  • 31
3 votes
1 answer
978 views

Show confirmation popup before running any downloaded program in Windows 10

I often download files either using my browser or by torrenting. Few times, I encountered an attack where the torrented file was called something like movie.mp4.lnk and the target was set to run a ...
a-n's user avatar
  • 61
3 votes
2 answers
3k views

Windows Kerberos Pre-Auth Failed (4771)

Is there an easy way to distinguish 4771 events from a real attack perspective vs. someone having a stale session with an old password? If you don't get logs from all endpoints and rely on Domain ...
Eric's user avatar
  • 426
3 votes
0 answers
122 views

Is it possible for a remote machine to "escape" from a folder mapped through RDP?

Although most people seem to share entire drives with RDP, it is possible to share individual folders, by mapping them to a drive for example with subst <lettertomap>: <pathtofolder> (for ...
gbr's user avatar
  • 260
3 votes
0 answers
1k views

Exploiting Environment Variables in Scheduled Tasks for UAC Bypass

I am trying to escalate privileges from an ISS user on Windows Server 2012 R2 by exploiting Environment Variables in Scheduled Tasks for UAC Bypass as the following link explains the exploit: https://...
Lucian Nitescu's user avatar
3 votes
0 answers
138 views

Is it possible to prevent rogue/unauthorised computers booting from your PXE server?

In the below scenario, is it possible to prevent a rogue/unauthorised laptop plugging into the network and installing our Windows image? What risks are we exposed to should a malicious 3rd party boot ...
AidenWebb's user avatar
  • 131
3 votes
0 answers
554 views

SMB Session Hijacking

I've been recently studying SMB protocol for a better understanding of it while doing windows environment pentesting. Regarding SMBv1 and v2, in both cases the Session Setup Request is sent using ...
bulw4rk's user avatar
  • 71
3 votes
0 answers
218 views

Need Security advice on virtualization and windows security

I have a little doubt about the security of my virtual machine and Windows. Can anyone please point me in right direction? Below is my what, how and why I made my virtual machine. Let me tell you what ...
user3526312's user avatar
3 votes
0 answers
192 views

How can I identify which SCHANNEL events are being generated by a Remote Desktop connection attempt?

I need to check which encryption level is being used for a Windows Remote Desktop session. I found this question, which shows how to enable logging that shows the client handshake and level of ...
Craig Silver's user avatar
3 votes
0 answers
295 views

Host process for windows services network activity between other computer on same network

Wondering if this is normal? I have two PCs hooked up to a router and when the other one powers up and I check my firewall I see that there's some sporadic network activity going on (mainly upload/...
user299709's user avatar
3 votes
0 answers
149 views

What personal information, if any, can be gleaned from a Microsoft APPCRASH problem signature?

I am trying to debug an "APPCRASH" problem event for a program running on Microsoft Windows 7. When this happens a problem signature is presented, like this example from SuperUser: Problem Event ...
Lee's user avatar
  • 131
3 votes
0 answers
685 views

Windows certificate verification with timestamping

I have been trying to replicate the behaviour of the Digital Signatures tab on windows file properties. I'm using WinVerifyTrust api and X509Certificates namespace to achieve my goal. I've managed to ...
feluna's user avatar
  • 31
3 votes
0 answers
147 views

Storing Recoverable Passwords In An App

I'm working on a project where I need to store and recover a password. I can't use a salted hash for authentication because the password is used to secure an HTTP connection via HTTP Digest. I'm not ...
Stephen H. Gerstacker's user avatar
3 votes
1 answer
189 views

How to enforce on the OS level to recognise only certain keyboards

I give employees AES wireless keyboards. I would like to enforce the OS to only recognise the keyboard we supply. Is that possible? Assuming my employees OS are Windows 10, Ubuntu, Mac OSX. How could ...
2Big2BeSmall's user avatar
2 votes
0 answers
60 views

Secure API token handling in Windows app: the token is needed to authenticate the requests to a backend server

I'm currently working on a UWP app that involves validating redemption codes against a Cloudflare KV storage backend. That's all the backend server is for. I want the app to check the redemption code ...
Neox's user avatar
  • 21
2 votes
0 answers
149 views

Bitlocker on Windows 11 local account

I've recently upgraded my computer security by encrypting all the drives on in with BitLocker (I'm using Windows 11 Pro). Unfortunately, I ran into a rather fastidious bug that prevents me from ...
Alicent's user avatar
  • 21
2 votes
1 answer
1k views

Security risks in using ‘no @thankyou.com’ to bypass Microsoft account login when installing Windows 11

One of the recommended methods for bypassing Microsoft account login during the Windows 11 OOBE is to attempt to log in using a locked account (no @thankyou.com being the most commonly recommended ...
Brybeck's user avatar
  • 121
2 votes
0 answers
1k views

Responder not collecting hashes in most cases

I've recently become curious on how AD works and how hashes are shared between Windows machines. It's very interesting how there are so many ways to get Windows programs to leak hashes, for example ...
Vera Fodor's user avatar
2 votes
0 answers
1k views

Windows XP SP3 2002 is not vulnerable to MS08-067

Why is my VM not vulnerable to MS08-067? There are similar question on stack exchange, yes, but they fail to specify all relevant information and so non receive a meaningful, thoughtful nor thorough ...
HackingAndJiuJItsu's user avatar
2 votes
2 answers
8k views

What can prevent Mimikatz from accessing LSA?

I used to run Mimikatz in one of my computers. Then, I did something to block its action and I do not recall what it was. I am trying to revert it unsuccessfully. .#####. mimikatz 2.2.0 (x64) #...
user1156544's user avatar
2 votes
1 answer
292 views

Does Windows use Bluetooth Authenticated pairing with encryption automatically?

Does Windows use Bluetooth Authenticated pairing with encryption automatically when you connect Bluetooth devices like earbuds to it? Is that Level 4? If it's not automatic, how do I get Windows to do ...
user271001's user avatar
2 votes
0 answers
1k views

How/when does Windows link private key to imported certificate?

When creating CSR on Windows (using built-in certificate store), I found some weird behaviors: When I use enrollment policy, but then extract CSR and sign it somewhere else, on import the certificate ...
StanTastic's user avatar
2 votes
0 answers
1k views

What legitimate services uses SAMR queries? And how to verify?

Recently I noticed that every few days, at (almost) the same time, one host is querying the Domain Controller for group members using SAMR calls. I am trying to understand why its happening ...
Onyx's user avatar
  • 21
2 votes
0 answers
205 views

Is the RSA Private Key non-exportable option protected from key extraction?

I would like to know if the non-exportable private key option, virtualized based security, selected when importing an RSA certificate guaranteed although the user will never be able to see the RSA ...
Marc Alves's user avatar
2 votes
0 answers
151 views

Are there any wormable vulnerabilities for legacy Windows operating systems that are left unfixed?

I want to know the status of remote, code executing vulnerabilities of old Windows operating systems that are left unfixed, if they exist at all. Exploits like EternalBlue or BlueKeep wreaked havoc on ...
manatails's user avatar
2 votes
0 answers
261 views

Removing PATH from the Windows DLL Search Order

There exists a class of bugs on Windows where an unprivileged attacker can write a DLL to a location on disk, then add that location to the PATH variable. Then, when an elevated user process is trying ...
Penderghast's user avatar
2 votes
0 answers
158 views

Why do Windows AV software detect strings with case-sensitivitely?

As Windows is case-insensitive, the string mimikatz can be evaluated the same as MIMIKATZ or MimIkaTZ. A naive method of AV evasion by switching cases of some characters in suspicious string has been ...
ChocolateOverflow's user avatar
2 votes
0 answers
217 views

Windows command bypassing Sandboxie

Using Sandboxie typing net user some_user some_password, on a sandboxed cmd, actually changes the password of the real user. Is this intentional? It is just a default Sandboxie installation running ...
JohnGRThess's user avatar
2 votes
2 answers
2k views

Bypassing Windows Defender VBA custom code

I've recently written a simple keylogger using classic DLL-injection technique. I wanted to simulate a real phishing attack where the user opens an Office document with macros and by enabling them he ...
Rob D's user avatar
  • 51
2 votes
0 answers
634 views

Buffer overflow return address with null byte, workaround

I'm practicing Buffer Overflows using Free Float FTP Server 1.0 on Windows 7 SP 1. I have done simple jmp esp examples on Windows XP, where system DLLs are without rebase or Address Space Layout ...
mirek's user avatar
  • 29
2 votes
0 answers
188 views

Methods of exploiting a Windows executable protected by "Control Flow Guard" and "Return Flow Guard"?

I understand that obtaining code execution by stack buffer-overflows were mitigated by DEP, which in turn lead to SEH and ROP exploit techniques etc. However, I don't see how to exploit an executable ...
Shuzheng's user avatar
  • 1,227
2 votes
0 answers
302 views

Can a named pipe with a low integrity label have its SACL/DACL modified by a low integrity process?

If a named pipe on Windows has a Low Mandatory Level label and SYSTEM_MANDATORY_LABEL_NO_WRITE_UP in its SACL, but the DACL has WRITE_DAC and WRITE_OWNER for the current user, can a low integrity ...
Polynomial's user avatar
  • 135k
2 votes
0 answers
2k views

Ransomware with .adobe extension

It is possible to decrypt file with .adobe extension ? File after encryption look like this : filename.id-5735353.[[email protected]].adobe . I did a little research and found information about "....
Przemon's user avatar
  • 41
2 votes
0 answers
152 views

The way for not disabling the firewall in windows

I have been doing this for about a year without knowing the purposes of disabling. Whenever i tried to ping/connected to my host VM via guest VM, i have to disable my host VM's firewall, but does it ...
gagantous's user avatar
  • 193
2 votes
0 answers
119 views

Securing communications between PoS terminals and sTunnel server

Am I correct in thinking that a PoS Terminal only needs my public key installed on the device to connect to my sTunnel server (with Private key) and that communications between client and server will ...
MarkLP's user avatar
  • 21

1
2 3 4 5 6