Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

Filter by
Sorted by
Tagged with
9
votes
2answers
207 views

Who is at risk from the PrintNightmare RCE?

Microsoft released an emergency patch and stated that the vulnerability is being actively exploited in the wild. All the news articles describing the RCE are implying that any internet-connected ...
-2
votes
0answers
57 views

Am I a victim of a possible DNS poisoning or MIM attack? [closed]

I recently ran a BitDefender AV scan which picked up and cleaned the GenericKDZ trojan - a very nasty infection which includes a keystroke logger. I am adamant about security - always changing default ...
0
votes
1answer
47 views

Securing and storing Active Directory logs

If we plan to log script block logging, module logging and transcription logs in Active Directory using group policy, what/where is the best place to secure these logs so we can be assured of their ...
21
votes
2answers
14k views

Does Windows really still use unsalted MD4 for password storage?

I find it quite difficult to believe that the passwords in Active Directory for Windows 2008 R2 are still stored using the unsalted MD4 (aka "NT Hash") algorithm. Can it really be true? I've been ...
18
votes
6answers
22k views

How can I enumerate all the saved RSA keys in the Microsoft CSP?

I have an application that is creating several keys and storing them in various stores (in this case the Machine store). How can I enumerate all the keys on a given Windows system? ...
5
votes
1answer
7k views

What is the effect of the arguments in the following: conhost.exe 0xffffffff -ForceV1

I'm fairly well acquainted with the role of conhost in Windows. I am aware of conhostV1.dll and conhostV2.dll so I assume force V1 would force the legacy mode of conhost (as in Pre Win 7 mode when it ...
0
votes
1answer
183 views

How to set up the Tor browser on Linux Mint in a VM with a VPN on the Host

(Forgive me, I don't know whether to post this here for in the "Tor" community) I'm brand new to Tor, I understand the basics of how it works and the Do's & Don'ts. I have a Windows 10 computer (...
0
votes
1answer
82 views

public MySQL via XAMPP - security - whitelisting IP's versus VPN

I'm working on app that uses MySQL database on XAMPP Control Panel on Windows. I am concerned about security part. I received advice about connecting to MySQL through VPN so it won't be accessible so ...
0
votes
0answers
51 views

What OS do I focus on when learning Cyber Defense?

After some time in the Cyber Defense field, I am noticing that there are different learning paths to take depending on the OS you choose (for example you can learn how to use PowerShelll and lots of ...
0
votes
1answer
72 views

Is persistence via scheduled tasks possible if the user is not elevated?

As far as I can tell, scheduled tasks may only be created by those in the Administrators group by default. Does that mean that persistence can't be achieved via this method without gaining elevated ...
2
votes
1answer
10k views

How to connect to a meterpreter session opened manually on the target machine

I am trying to exploit a Windows 7 VM using metasploit. I was able to open a java meterpreter session and I want to access a native meterpreter. To do so I exported a meterpreter/reverse_tcp payload ...
0
votes
1answer
72 views

Can I recover files that I had on windows from a SSD that I converted to apfs (mac) and which method or tool to use?

I had some files that I want to recover from windows, but I formatted the ssd drive to macos (apfs)? Is there a tool or method to recover those files?
0
votes
1answer
83 views

How can a program remove the menu in Control-Alt-Delete (Secure desktop) in Windows?

In reference to another post about the Respondus Lockdown Browser, I was wondering how can a program edit and remove parts of the "Secure Desktop" Ctrl+Alt+Del menu in Windows, as well as ...
0
votes
0answers
35 views

Windows Event Viewer: can't find user-started programs [migrated]

My problem is as simple as it may look from the beginning. I want to see what programs have been initialized by using the Windows Event Viewer, but the log everybody tells me to use (Security logs, ...
0
votes
1answer
70 views

Shellcode not executing despite EIP being overwritten properly

Here is my exploit: junk = b'A' * 1032 ​ eip = b"\xf5\x93\x4a\x00" # some address where 'jmp esp' lives shellcode = b"" shellcode += b"\x33\xc0" # xor eax, ...
0
votes
2answers
168 views

Haven't updated my Windows 10 for more than a year

Almost a year ago, I dual-booted Windows 10 and Linux Mint. And since then, I haven't booted into my Windows 10 OS. I still remember that the Wi-Fi adapter was off when I shut my Windows 10 down. Now, ...
1
vote
1answer
51 views

Error with Metasploit when attempting to exploit netapi in Windows XP [duplicate]

I am a beginner in hacking. I have been trying to hack Windows XP using the netapi exploit in metasploit, but every time, in the end, I get an error: Exploit failed [unreachable]: Rex::...
2
votes
1answer
133 views

How are vulnerabilities like PrintNightmare CVE-2021-34527 discovered?

Regarding the newly discovered vulnerability PrintNightmare CVE-2021-34527 that has existed for years without being discovered, currently affecting almost all versions of Windows, server and ...
4
votes
1answer
19k views

Decrypting SAM hive after Windows 10 anniversary update?

After a lot of frustration, I've finally cracked my local Windows 10 password using mimikatz to extract the proper NTLM hash. In particular, samdump2 decrypted the SAM hive into a list of users with &...
0
votes
0answers
5 views

Implement PBEWithHmacSHA256AndAES_256 with openSSL 1.1.1 and/or Windows crypt functions [migrated]

I have an implementation of password based encryption in Java. It formerly used PBEWithMD5AndDES and was later changed to use PBEWithHmacSHA256AndAES_256. The significant code looks like this: //...
0
votes
0answers
11 views

Windows firewall: How to change existing rules using netsh [migrated]

I can create new rules using netsh advfirewall firewall add rule... and Delete them using netsh advfirewall firewall delete rule... But I am not able to find a way to change existing rules. Right ...
0
votes
1answer
83 views

Windows System Audit

As part of auditing, I have to find whether an excel file is modified by anyone after it was created in 2018 by original user in a windows 7 computer. I had verified the creation, modified and ...
0
votes
1answer
2k views

What is the purpose of the Volume Master Key in BitLocker?

From this FAQ, I understand that BitLocker uses the following keys to encrypt the hard-drive: Full Volume Encryption Key (FVEK) (used to encrypt raw data; encrypted by the volume master key and ...
2
votes
0answers
70 views

Process Injection and Process Isolation by OS

If the OS is responsible for ensuring that one process cannot access another process memory space, and the point of process isolation is to keep processes separate from one another, then how can a ...
0
votes
1answer
60 views

Memory Forensics on exited process

I am new to memory forensics. When a process in Windows is ended are all artifacts for the process in memory gone? I ask because my EDR solution gives me the local process ID of a process I am ...
1
vote
1answer
90 views

Tricking a windows 10 computer into thinking a USB being plugged in is a mouse for code execution [closed]

Is it possible to "trick" a Windows 10 PC into thinking a flash drive is a mouse to execute code on the machine? If so, how? Note: I'm not trying to do anything malicious. All of this is ...
3
votes
0answers
111 views

How does local pass-the-hash (mimikatz's sekurlsa::pth) work?

Mimikatz's sekurlsa::pth documentation states: mimikatz can perform the well-known operation 'Pass-The-Hash' to run a process under another credentials with NTLM hash of the user's password, instead ...
0
votes
1answer
88 views

Does BloodHound include local users as part of the results?

I've read the documentation for BloodHound, but I'm still unsure, whether BloodHound includes local users (not domain users) as part of the results (or whether it is possible to make BloodHound ...
2
votes
1answer
410 views

Firefox pretending to update itself, but actually not doing it, and thus being a risk for security - what am I missing?

I am a long-time Firefox user and remember that usually the UAC prompt popped up when Firefox updated itself. Some months ago (or is it years?), Firefox obviously changed the way it updates itself: I ...
0
votes
0answers
8 views

Is there any way to remove duplicate Windows firewall rules with a script or some app [migrated]

I have a PC with a lot of firewall rules, and a lot of them are duplicates. I have like 5 of the exact same rule. Will this cause some sort of conflict? Is there any kind of script that anyone has or ...
2
votes
2answers
157 views

What program can Decrypt specific a Folder/Files during Windows Boot/Loading? (Windows)

I've been looking into Encryption of my data for some time now; I've decided to move ahead with VeraCrypt for encryption all of my partitions (I have 2 disks in 1 laptop) except for the OS (C:) ...
6
votes
2answers
2k views

What's a good secure file deletion software?

I've used cipher \w which is built into Windows to overwrite free space, but I'm looking for a tool that securely deletes files which have not been deleted yet. It would be a plus (but certainly not ...
0
votes
1answer
69 views

Is it possible to identify a financial fraud on a Windows machine? How?

How do forensics identify a banking/financial fraud in a Windows system? Malware usually uses real-time TCP sockets to complete their deeds, infecting and compromising the PC it runs on (not the ...
1
vote
2answers
4k views

How safe is it to disable DEP for a program?

I've been playing a game and there is a private server (with around 2k population) that asks us to turn off DEP for their game, I read about what it does but I don't understand what the consequences ...
1
vote
2answers
305 views

Linux and Windows Password Security Settings

I'm asking a client why some password parameters are not defined in the Linux OS level and he's saying that, internally, Linux and Windows complexity and timeout settings are different. If they set ...
4
votes
1answer
150 views

Is Sleep mode safe?

If a PC has rootkit, when it goes into sleep mode, can rootkit do anything to it while it’s in state of sleeping? Meaning steal data, open programs and basically do anything. Assuming it’s not BIOS ...
0
votes
1answer
69 views

Remove all traces of files used in Veracrypt container… is this enough?

Suppose that I have a Veracrypt container on Windows 10. I unlock it, open and edit a Text document, open an image, watch a video. Then I close all files, unmount the container. Then I run CCleaner to ...
1
vote
1answer
398 views

Show confirmation popup before running any downloaded program in Windows 10

I often download files either using my browser or by torrenting. Few times, I encountered an attack where the torrented file was called something like movie.mp4.lnk and the target was set to run a ...
6
votes
1answer
5k views

What is Windows Watchdog and what do we know about it?

Today I came across this term "Watchdog", and something about "DPC_WATCHDOG VIOLATION" errors in Windows. I tried googling around but I only found posts on how to fix Watchdog errors, but nothing on ...
8
votes
1answer
362 views

Is Windows+L a secure attention sequence?

Ctrl+Alt+Del is a secure attention sequence (Microsoft) (or secure attention key (Wikipedia), but it's more a Linux term). As we can read, A key sequence that begins the process of logging on or off. ...
1
vote
3answers
949 views

Where can I find a list of checksums for windows files? Why don't MS sign all their executables?

Is there anywhere I can download a list of checksums for microsoft-published OS executable files, preferably grouped by release name? I could do the same by decompressing files on a windows setup CD, ...
291
votes
7answers
78k views

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, it'...
0
votes
1answer
97 views

Is it possible for a compressed file to contain malicious code?

I recently downloaded 2 compressed files (.zip and .rar) from a really unreliable and untrusted source while using a browser integrated VPN. My antivirus didn't notice anything but I am curious if it ...
0
votes
1answer
83 views

Can a video file contain code that shares your identity? [duplicate]

Could a video file contain code that reveals and sends your ip/mac address or give access to personal files to somebody else? Would normal video players (like VLC) be able to notice that kind of ...
2
votes
2answers
262 views

I installed a windows app that stores cookies in a plain text un-encrypted database. Is this a problem?

I have recently installed an application that was developed with Electron that requires I authorize via Google to use the application. I did this at the same time as monitoring the application with ...
0
votes
1answer
111 views

Is accepting arbitrary COM pointers over a process boundary safe?

I have a legacy Windows application that needs to be looked over in terms of security. During this review something caught me eye. In the out of process COM server I'm looking at is a method that ...
2
votes
2answers
180 views

Fetching GPG private key from Linux server to decrypt files on a Win 10 computer in production

I have a need to fetch automatically the GPG private key from a Linux server to decrypt files on a Windows 10 computer in production. There are a few challenges here: How to assure SCP from the ...
0
votes
1answer
236 views

RubySMB::Error::CommunicationError: Read timeout expired when reading from the Socket (timeout=30)

I've been playing around with the EternalBlue exploit recently. I've downloaded a Windows 10 iso file from 2016 and used it to set up a Windows 10 Pro VM as my sandbox. I also ran the nmap script and ...
0
votes
1answer
363 views

Configure Windows Firewall Inbound Rule for Program Not Installed on Server

How can I configure an inbound rule on a Windows Server 2016 firewall to allow access from a program which is not installed on the server? When searching for a program browse is only offered for ...
1
vote
2answers
611 views

How to trace SMB connection to what process initiated the connection?

I have a situation where I see a bunch of SMB connections initiated from a client to a server every night and it triggers an SMB brute-force alert on my Firewall. I installed Sysmon on the server to ...

1
2 3 4 5
41