Questions tagged [windows]
Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].
2,215
questions
0
votes
1
answer
1k
views
How to monitor a logs directory with OSSEC agent in windows
My problem is that I have some windows programs I want to monitor with the following structure in the logs filename:
Program name%Y%m%d_%timestamp.log
Where %timestamp is formed by the concatenation ...
CommunityBot
- 1
5
votes
5
answers
908
views
Confused about kiosk security: am I being overly cautious?
At the company I work at, they have a physical kiosk open to the public where customers can use it to upload their files to and have them processed. Customers can connect their phones, tablets, and ...
- 7,519
10
votes
2
answers
14k
views
Is WSL 2 secure for commercial work?
Windows Subsystem for Linux (version 2) is getting more and more traction lately with new features being added such as GUI mode over Wayland (WSLg). It seems to me Microsoft really pushes for WSL ...
- 121
12
votes
4
answers
30k
views
Can the FBI or government agencies decrypt my hardrive and/or force me to give them the password?
I have seen other TrueCrypt questions as well "Windows encryption with BitLocker" and "Mac OS` encryption with FileVault".
Does the FBI/NSA or other government agencies have ...
- 34.1k
2
votes
1
answer
291
views
How to extract a .bat file with volatility
I am experimenting with the volatility2 tool.
I have created a memorydump of a windows 7 machine where i had a batch script file on the desktop of the machine.
I used the mftparser command as :
...
CommunityBot
- 1
3
votes
1
answer
2k
views
How does actually countersignature work in authenticode?
I'm trying to understand the timestamp processing in the Microsoft Authenticode verification mechanism and it looks pretty simple, but I really do not understand how signature can be valid while both ...
- 18k
0
votes
1
answer
32
views
Securing access to SAC from Windows EMS
When enabling Emergency Management Services on Windows, one can access a limited terminal from a serial port, by default there's no authentication required.
To leave the limited environment, you need ...
- 947
6
votes
1
answer
1k
views
Pivoting with Metasploit
I am trying to exploit a Windows VM on a different subnet behind a dual home Linux VM where I already have a shell. To keep it simple, I have a meterpreter reverse_tcp shell on the Linux VM (192.168....
CommunityBot
- 1
1
vote
2
answers
932
views
Path traversal in POST request?
Does it make sense to try path traversal on the filename value during a file upload request? Should I encode special characters in the POST request?
For example
POST
[...]
----boundary
Content-...
CommunityBot
- 1
0
votes
0
answers
8
views
Local Machine certificate (certlm.msc) - choosing "Microsoft Software Key Storage Provider" on import [migrated]
When importing a device certificate/private key through CERTLM, the GUI seems to choose a deprecated Cryptography Service Provider (CSP) called "Microsoft Strong Cryptographic Provider"; I'm ...
- 128k
0
votes
1
answer
88
views
Methods to bypass Windows security policy: All Removable Storage Classes - Deny All Access
My partner recently got given work laptop and if you try and put in a USB mass storage device you get an error saying it is not allowed. Without having administrator access I assume this is via the ...
CommunityBot
- 1
-1
votes
2
answers
528
views
connecting to Windows Admin Center using port 443
I want to use Windows Admin Center, but I don't want to install a SSL certificate.
If I were to forward packets from 80 to 443 using firewall rules would they automatically be encrypted?
CommunityBot
- 1
0
votes
0
answers
42
views
Can I setup and enforce additional WiFi connection (and password) requirements on managed laptops using Windows or MacOS?
Can I setup and enforce additional WiFi connection (and password) requirements on managed laptops using Windows or MacOS?
Such as:
blocking (or entirely hiding) the option to connect to open networks
...
- 6,661
0
votes
0
answers
26
views
ZeroLogon possible false positive events 5827? (CVE-2020-1472)
ZeroLogon checklist:
August 11, 2020 updates have been deployed on all domain controllers.
February 9, 2021 updates have been deployed on all domain controllers.
All devices are running Windows 10.
...
- 128k
1
vote
3
answers
548
views
I am a member of the Administrators group on a Windows 7 box, how can I spawn a reverse shell with elevated privileges?
I am learning Windows Privilege escalation. I've managed to add a user to the Administrators group but I don't know how to execute nc.exe, present in the Temp dir, with elevated privileges.
I am ...
- 128k
1
vote
1
answer
68
views
How to tell if BlackByte NT ransomware is on my computer?
The company I work at sadly fell victim to BlackByte NT ransomware this week. It ransomed many of the Windows machines on our factory floor.
I have used my personal laptop (Windows 10 Home, version ...
- 247
0
votes
0
answers
84
views
I need help properly encrypting my computer SSD
My main laptop recently broke down and i've been forced to use an older laptop I had in storage.
This machine was encrypted years ago with veracrypt and only has an SSD. It's around 250 GB of storage.
...
0
votes
1
answer
54
views
How to mitigate spoofing, keylogging password, stealing public key with smart card with external/internal smart card reader?
Here is my thought process:
I want to use smartcards without passwords for my setup. We don't want to use Iris or fingerprint or voice. I only want to put in the card whenever something needs to ...
- 9,284
1
vote
0
answers
233
views
Security risks in using ‘no @thankyou.com’ to bypass Microsoft account login when installing Windows 11
One of the recommended methods for bypassing Microsoft account login during the Windows 11 OOBE is to attempt to log in using a locked account (no @thankyou.com being the most commonly recommended ...
- 111
2
votes
2
answers
2k
views
Bypassing Windows Defender VBA custom code
I've recently written a simple keylogger using classic DLL-injection technique. I wanted to simulate a real phishing attack where the user opens an Office document with macros and by enabling them he ...
CommunityBot
- 1
1
vote
2
answers
693
views
RDP - access security
I have a question about protecting myself against attacks on the RDP service.
I note that I have already done the appropriate configuration:
I am using a local user (not administrator) to connect
...
- 101
2
votes
2
answers
7k
views
What can prevent Mimikatz from accessing LSA?
I used to run Mimikatz in one of my computers. Then, I did something to block its action and I do not recall what it was. I am trying to revert it unsuccessfully.
.#####. mimikatz 2.2.0 (x64) #...
CommunityBot
- 1
0
votes
0
answers
23
views
How do I check if my PowerShell is connected on SSH?
I know how to check but command line cmd or powershell can be altered to make it look clean with disguised hash codes (which they show like they are not tempered but actually commands are altered and ...
0
votes
0
answers
11
views
Feeding Bitlocker with a startup key from a network service [migrated]
I am trying to bind Bitlocker operations (specifically booting Windows) with some form of network presence. In other words, I want to set-up some form of 2FA (via the network) to allow booting Windows....
- 1
0
votes
0
answers
36
views
Can already opened event logs of PowerShell's event properties screens on Windows be hacked by hackers in milliseconds?
I am wondering some issues about event log safety of powershell. I think is it possible to alter the powershell itself. But theorically the event log should show us every attempt made in powershell ...
- 128k
0
votes
0
answers
9
views
How to restore Microsoft root certificates after moving them to untrusted list? [migrated]
I have been experimenting with security options on m my Windows 10 and moved all Microsoft root certificates from trusted into untrusted position. Not sure if that was the problem but my admin ...
1
vote
1
answer
60
views
What information is contained in the local SAM in an Active Directory network
I'm curious in an enterprise network running Windows, what information is available in the SAM of a standard user's endpoint machine?
I understand (and correct me if I'm wrong) that when logging in to ...
CommunityBot
- 1
0
votes
1
answer
294
views
Rogue login to Google account after Windows clean install
Yesterday I downloaded a sketchy .exe on my Windows desktop and executed it. A command prompt window appeared then nothing abnormal happened. I tried running MalwareBytes but it didn't display any ...
CommunityBot
- 1
0
votes
1
answer
400
views
public MySQL via XAMPP - security - whitelisting IP's versus VPN
I'm working on app that uses MySQL database on XAMPP Control Panel on Windows.
I am concerned about security part.
I received advice about connecting to MySQL through VPN so it won't be accessible so ...
CommunityBot
- 1
1
vote
1
answer
315
views
How can an ELF binary call a Windows API from WSL(2) to deploy a payload?
In September 2021 Black Lotus Labs (BLL) posted a blog entry discussing a payload loader that was:
written in Python
compiled to an ELF exe using PyInstaller in Debian in WSL
and "injected into ...
CommunityBot
- 1
0
votes
0
answers
23
views
W-Firewall blocks Port 135 if using IPsec Kerberos V5 User Authentication
i am about to implement IPsec to achive a zero trust environment, in order to do so i am using the Windows Firewall with IPsec Rules (Allow the Connection if it is secure).
Everything works fine, but ...
- 1
1
vote
1
answer
331
views
Is persistence via scheduled tasks possible if the user is not elevated?
As far as I can tell, scheduled tasks may only be created by those in the Administrators group by default. Does that mean that persistence can't be achieved via this method without gaining elevated ...
CommunityBot
- 1
1
vote
2
answers
395
views
What is a secure way to log onto the domain controller?
On a pentest we found that a kerberos ticket under account name administrator was cached on one of the SQL database servers, which allowed us to steal the ticket, pass-the-ticket and log onto the ...
CommunityBot
- 1
4
votes
1
answer
40k
views
System Account in Windows
I was thinking about SYSTEM account on windows 7 and while researching about it, I came to know that it is predefined account used by service control manager (SCM),The account is not recognised by ...
- 46.3k
1
vote
0
answers
53
views
Windows decrypting TC volume without passphrase?
I remember having read a blog post or a forum post, some years ago, about a TrueCrypt user whose Windows machine sometimes, at boot, did not ask for the TC passphrase and decrypted automatically the ...
- 5,168
0
votes
2
answers
510
views
Windows IP Helper service listening on port 1000
On a Windows 10 Home machine (21H2 19044.1741), I noticed one of my applications failed to listen on port 1000, because something was already using that port. That struck me as peculiar, because I ...
CommunityBot
- 1
1
vote
2
answers
203
views
ModSecurity Command Injection not working
I am testing web application firewall and I have installed ModSecurity 2.9 runs Core ModSecurity Rule Set ver.2.2.9 and to test on Web application I also install DVWA Platform: Windows
and trying ...
CommunityBot
- 1
0
votes
1
answer
2k
views
Renewing Enterprise CA certificate
I have just renewed my Root CA certificate and having issues renewing my Enterprise CA certificate.
My setup is the Root CA is offline with online issuing CA server.
When I do the renewal nothing ...
CommunityBot
- 1
1
vote
1
answer
191
views
Can I recover files that I had on windows from a SSD that I converted to apfs (mac) and which method or tool to use?
I had some files that I want to recover from windows, but I formatted the ssd drive to macos (apfs)? Is there a tool or method to recover those files?
CommunityBot
- 1
1
vote
0
answers
67
views
Is having no driver installed better than having old driver?
How safe are installed & genuine-vendor signed old drivers, specifically when attackers are spoofing Microsoft and other vendor certificates?
On older PCs and laptops where some components are no ...
0
votes
2
answers
182
views
Implications of enabling Developer Mode in Windows 11
Windows 11 appears to have a Developer Mode. I was playing around with Flutter and got prompted to enable it. The setting looks like this:
When I enable it, I get the following confirmation prompt:
...
- 128k
1
vote
2
answers
140
views
Does a database with pre-calculated SHA256 values exist for Windows EXEs?
Background: At my place of work, we're trying to block all unapproved browsers on all Windows machines and the IT Security guys did a search on our internal infrastructure and came up with a list of ...
- 166
0
votes
1
answer
103
views
Windows 98 hacked just by visiting a website? [duplicate]
I am wondering how this was possible. I remember my cousin used to use the family computer and it was infected with viruses just by browsing the internet. I recall a bunch of our desktop icons turned ...
- 18.7k
0
votes
1
answer
298
views
Does BloodHound include local users as part of the results?
I've read the documentation for BloodHound, but I'm still unsure, whether BloodHound includes local users (not domain users) as part of the results (or whether it is possible to make BloodHound ...
CommunityBot
- 1
1
vote
1
answer
510
views
Can file recovery tools recover deleted small files from SSD drive's NTFS Master File Table?
According to this page and site, small files are kept in Master File Table when filesystem is NTFS.
Let's assume that computer is using Windows 10 and a SSD drive with TRIM support. If a user ...
CommunityBot
- 1
0
votes
1
answer
66
views
Which is more secure to access a VMware Windows VM : VMware Remote console or RDP+Remote Desktop Gateway
Without knowing more details, I can't suggest to our security guy that we should use RDP along with a Remote Desktop Gateway.
One person says to that VMware Remote Console is more secure than using ...
CommunityBot
- 1
1
vote
1
answer
3k
views
How to crack AES-based Kerberos TGS tickets (Kerberoasting)?
All material I can find is related to RC4-based Kerberos TGS tickets, since these are easier to crack to obtain the service account's password.
However, I want to attempt to crack AES-based Kerberos ...
CommunityBot
- 1
11
votes
1
answer
966
views
Entropy sources used by modern Windows
A comment on a Microsoft blog from 2005 mentions over 150 sources of entropy for the Windows CryptGenRandom function. The majority of sources come from low-level system information (precise stat ...
CommunityBot
- 1
1
vote
1
answer
1k
views
Windows Defender's MsMpEng.exe Access lsass.exe
I detected an activity last week on our SIEM system. The MsMpEng.exe which belongs to Windows Defender access lsass.exe. I search it on the net for learn is it a normal acitivty or is it anormal then ...
CommunityBot
- 1
1
vote
1
answer
510
views
Excessive logons from domain controllers
I am quite new to analyzing the windows logs. I have been seeing excessive logons with 4624 and 4625 with the Subject/account name: DomainController(actual name of the domaincontroller is different) ...
CommunityBot
- 1