Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

Filter by
Sorted by
Tagged with
-2
votes
0answers
56 views

Am I a victim of a possible DNS poisoning or MIM attack? [closed]

I recently ran a BitDefender AV scan which picked up and cleaned the GenericKDZ trojan - a very nasty infection which includes a keystroke logger. I am adamant about security - always changing default ...
0
votes
1answer
47 views

Securing and storing Active Directory logs

If we plan to log script block logging, module logging and transcription logs in Active Directory using group policy, what/where is the best place to secure these logs so we can be assured of their ...
0
votes
0answers
51 views

What OS do I focus on when learning Cyber Defense?

After some time in the Cyber Defense field, I am noticing that there are different learning paths to take depending on the OS you choose (for example you can learn how to use PowerShelll and lots of ...
9
votes
2answers
205 views

Who is at risk from the PrintNightmare RCE?

Microsoft released an emergency patch and stated that the vulnerability is being actively exploited in the wild. All the news articles describing the RCE are implying that any internet-connected ...
0
votes
0answers
35 views

Windows Event Viewer: can't find user-started programs [migrated]

My problem is as simple as it may look from the beginning. I want to see what programs have been initialized by using the Windows Event Viewer, but the log everybody tells me to use (Security logs, ...
0
votes
1answer
70 views

Shellcode not executing despite EIP being overwritten properly

Here is my exploit: junk = b'A' * 1032 ​ eip = b"\xf5\x93\x4a\x00" # some address where 'jmp esp' lives shellcode = b"" shellcode += b"\x33\xc0" # xor eax, ...
2
votes
1answer
133 views

How are vulnerabilities like PrintNightmare CVE-2021-34527 discovered?

Regarding the newly discovered vulnerability PrintNightmare CVE-2021-34527 that has existed for years without being discovered, currently affecting almost all versions of Windows, server and ...
1
vote
1answer
51 views

Error with Metasploit when attempting to exploit netapi in Windows XP [duplicate]

I am a beginner in hacking. I have been trying to hack Windows XP using the netapi exploit in metasploit, but every time, in the end, I get an error: Exploit failed [unreachable]: Rex::...
0
votes
0answers
5 views

Implement PBEWithHmacSHA256AndAES_256 with openSSL 1.1.1 and/or Windows crypt functions [migrated]

I have an implementation of password based encryption in Java. It formerly used PBEWithMD5AndDES and was later changed to use PBEWithHmacSHA256AndAES_256. The significant code looks like this: //...
0
votes
0answers
11 views

Windows firewall: How to change existing rules using netsh [migrated]

I can create new rules using netsh advfirewall firewall add rule... and Delete them using netsh advfirewall firewall delete rule... But I am not able to find a way to change existing rules. Right ...
2
votes
0answers
70 views

Process Injection and Process Isolation by OS

If the OS is responsible for ensuring that one process cannot access another process memory space, and the point of process isolation is to keep processes separate from one another, then how can a ...
0
votes
1answer
60 views

Memory Forensics on exited process

I am new to memory forensics. When a process in Windows is ended are all artifacts for the process in memory gone? I ask because my EDR solution gives me the local process ID of a process I am ...
1
vote
1answer
90 views

Tricking a windows 10 computer into thinking a USB being plugged in is a mouse for code execution [closed]

Is it possible to "trick" a Windows 10 PC into thinking a flash drive is a mouse to execute code on the machine? If so, how? Note: I'm not trying to do anything malicious. All of this is ...
0
votes
0answers
8 views

Is there any way to remove duplicate Windows firewall rules with a script or some app [migrated]

I have a PC with a lot of firewall rules, and a lot of them are duplicates. I have like 5 of the exact same rule. Will this cause some sort of conflict? Is there any kind of script that anyone has or ...
3
votes
0answers
111 views

How does local pass-the-hash (mimikatz's sekurlsa::pth) work?

Mimikatz's sekurlsa::pth documentation states: mimikatz can perform the well-known operation 'Pass-The-Hash' to run a process under another credentials with NTLM hash of the user's password, instead ...
0
votes
1answer
69 views

Is it possible to identify a financial fraud on a Windows machine? How?

How do forensics identify a banking/financial fraud in a Windows system? Malware usually uses real-time TCP sockets to complete their deeds, infecting and compromising the PC it runs on (not the ...
0
votes
1answer
69 views

Remove all traces of files used in Veracrypt container… is this enough?

Suppose that I have a Veracrypt container on Windows 10. I unlock it, open and edit a Text document, open an image, watch a video. Then I close all files, unmount the container. Then I run CCleaner to ...
0
votes
1answer
83 views

How can a program remove the menu in Control-Alt-Delete (Secure desktop) in Windows?

In reference to another post about the Respondus Lockdown Browser, I was wondering how can a program edit and remove parts of the "Secure Desktop" Ctrl+Alt+Del menu in Windows, as well as ...
0
votes
2answers
168 views

Haven't updated my Windows 10 for more than a year

Almost a year ago, I dual-booted Windows 10 and Linux Mint. And since then, I haven't booted into my Windows 10 OS. I still remember that the Wi-Fi adapter was off when I shut my Windows 10 down. Now, ...
0
votes
1answer
97 views

Is it possible for a compressed file to contain malicious code?

I recently downloaded 2 compressed files (.zip and .rar) from a really unreliable and untrusted source while using a browser integrated VPN. My antivirus didn't notice anything but I am curious if it ...
0
votes
1answer
83 views

Can a video file contain code that shares your identity? [duplicate]

Could a video file contain code that reveals and sends your ip/mac address or give access to personal files to somebody else? Would normal video players (like VLC) be able to notice that kind of ...
0
votes
1answer
235 views

RubySMB::Error::CommunicationError: Read timeout expired when reading from the Socket (timeout=30)

I've been playing around with the EternalBlue exploit recently. I've downloaded a Windows 10 iso file from 2016 and used it to set up a Windows 10 Pro VM as my sandbox. I also ran the nmap script and ...
10
votes
2answers
316 views

How effective is Windows KDP for exploit mitigation in practice?

Windows Kernel Data Protection is a kernel security feature which appears to use Extended Page Tables (EPT, a hardware virtualization feature) to enforce read-only pages. How effective is this at ...
4
votes
1answer
150 views

Is Sleep mode safe?

If a PC has rootkit, when it goes into sleep mode, can rootkit do anything to it while it’s in state of sleeping? Meaning steal data, open programs and basically do anything. Assuming it’s not BIOS ...
0
votes
1answer
118 views

Downgrade of NTLM Authentication

I have been experimenting NTLM and its different relay mitigations, including MIC and channel bindings. In my understanding: ntlm auth starts with a negotiation packet sent by the client. In this ...
0
votes
0answers
35 views

Could just downloading (not opening) .tgz file infect Windows 10? [duplicate]

Today I received some e-mail to Thunderbird. It had image attached that I clicked: Which sent me to onedrive.live.com/download?... and automatically downloaded .tgz file. I am not even sure if the ...
0
votes
1answer
99 views

Watering Hole Website NTLM Steal Attack

I'm trying to recreate a Watering hole SMB theft attack where you send a victim a link to your website containing code like "file://ip/file.gif" Causing forced authentication which passes ...
1
vote
1answer
99 views

What's the point of Empire if all payloads get flagged?

I've been reading about how powerful frameworks such as Empire and Metasploit are but I'm confused about something. Say I gain access through a custom reverse-shell which I self-coded (so it bypasses ...
8
votes
1answer
362 views

Is Windows+L a secure attention sequence?

Ctrl+Alt+Del is a secure attention sequence (Microsoft) (or secure attention key (Wikipedia), but it's more a Linux term). As we can read, A key sequence that begins the process of logging on or off. ...
27
votes
5answers
6k views

How can a non-admin program cover your entire screen with a window?

This year, since many students are online, College Board (the company that administers AP Exams in the US, along with the SAT) recently released its Digital Testing App. Once installed, and going ...
1
vote
1answer
44 views

Is an outdated library in a Windows user mode desktop application an actual security risk?

I have an Windows 10 desktop application that runs in user mode only, and this application is a local tool only -- that is, it does not "talk to the internet". As an example: This ...
0
votes
0answers
65 views

Windows X.509 certificate private keys lost

Have the same certificates installed on several machines, but this happens on only one of them. The certificates are self-signed certificates. The certificates are used for WCF message security. ...
1
vote
1answer
114 views

Is docker for desktop secure for non-admins?

I manage a multi-user workstation (Windows) server for a small student organisation. One of the students asked me to install docker, as it would simplify his workflow. As this is on a shared ...
1
vote
1answer
75 views

How NTLM SSO is preformed on smartcard Kerberos logon?

I have been researching kerberos and ntlm for the last couple of days and still got one thing unresolved. After an interactive logon with kerberos, you will have in the cached credentials both ...
5
votes
2answers
2k views

Can I use VeraCrypt with an SSD?

I recently got Windows 10, and I am not overly thrilled at Microsoft having a copy of my password on their servers. I will also be forced to make a hotmail account, instead of just using a local ...
0
votes
0answers
33 views

TSX xbegin in SGX enclave (Windows)

What am I doing wrong with using xbegin in the enclave? First of all, I checked tsx outside enclave - it works (I tested _xbegin() from <immintrin.h>). Then I tried to use different examples of ...
0
votes
2answers
101 views

Path traversal in POST request?

Does it make sense to try path traversal on the filename value during a file upload request? Should I encode special characters in the POST request? For example POST [...] ----boundary Content-...
0
votes
1answer
62 views

What is a secure way to log onto the domain controller?

On a pentest we found that a kerberos ticket under account name administrator was cached on one of the SQL database server which allowed us to steal the ticket, pass-the-ticket and log onto the domain ...
2
votes
0answers
742 views

How to send deauth packets on Windows (manually or with software)?

first of all I know how deauth packets work basically. But since my wifi adapter refuses to work on my virtual Kali, I want to use my host machine (Windows 10). So I have NPcap and Wireshark and I can ...
1
vote
0answers
21 views

SSO - SAMLResponse security via localhost reply [duplicate]

We're currently in the process of enhancing our Windows .NET desktop application with SAML single sign-on. In order to retrieve the SAMLResponse from the IP we have the redirect/reply URL set to http:/...
2
votes
1answer
85 views

Risk associated with Exchange email address as username when AD authentication is enabled

In my existing setup, we have Exchange Server joined with Windows Active Directory. Both the username and email address are the same for user accounts. Our support party also recommended using this ...
0
votes
0answers
35 views

Are there advantages to using a hardware token instead of a password on a potentially compromised system?

TLDR: Is there a security benefit to regularly accessing the admin account with a hardware token rather than with a well-protected password? Long story: I'm both a developer and the system admin of ...
3
votes
2answers
187 views

Decrypt TLS 1.2 traffic between .NET Windows applications

I have attempted to decrypt traffic between two .NET applications (both on Windows platforms) using Wireshark but due to the Diffie Hellman with perfect forward secrecy, I cannot use my private key ...
3
votes
1answer
203 views

There are many ports opened by system on a Windows 8 computer - are the system files modified?

There are many ports opened by system on one Windows 8 computer: PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows ...
2
votes
0answers
185 views

What legitimate services uses SAMR queries? And how to verify?

Recently I noticed that every few days, at (almost) the same time, one host is querying the Domain Controller for group members using SAMR calls. I am trying to understand why its happening ...
2
votes
0answers
39 views

Is the RSA Private Key non-exportable option protected from key extraction?

I would like to know if the non-exportable private key option, virtualized based security, selected when importing an RSA certificate guaranteed although the user will never be able to see the RSA ...
7
votes
1answer
240 views

Is this Windows local code execution bug also a security vulnerability?

I stumbled on a Windows bug leading to code execution. I believe it should be categorized as a vulnerability but Microsoft does not recognize it as such. I would like to read other opinions. ...
1
vote
0answers
97 views

How can this “Jim Browning” YouTuber have access to all these scammers' PCs? [closed]

I've been watching these videos on YouTube about some British-sounding male (with millions of views) busting Indian scammers. It is never explained how exactly he is able to do this, with him ...
2
votes
1answer
65 views

How can I protect myself from intercepting messages sent to the server?

I want to collect certain data from my application using the driver and transfer it to the server to check its integrity. And I want to sign these packages using TPM to avoid forgery. However, a user ...
1
vote
2answers
83 views

Are there any risks involved with plugging smartphones into Windows 7-10 computer's USB ports?

When you plug a smartphone into a USB port on a Windows 7-10 computer, often a small message box pops up on the Windows device indicating that drivers are being installed. This happens automatically ...

1
2 3 4 5
41