Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

248 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
9 votes
1 answer
669 views

Entropy sources used by modern Windows

A comment on a Microsoft blog from 2005 mentions over 150 sources of entropy for the Windows CryptGenRandom function. The majority of sources come from low-level system information (precise stat ...
user avatar
  • 63.8k
6 votes
1 answer
1k views

Pivoting with Metasploit

I am trying to exploit a Windows VM on a different subnet behind a dual home Linux VM where I already have a shell. To keep it simple, I have a meterpreter reverse_tcp shell on the Linux VM (192.168....
user avatar
  • 313
5 votes
1 answer
582 views

MS08-067.c fails at WNetAddConnection2()

I'm working with some exploit code for the MS08-067 vulnerability from ExploitDB. The section: WNetAddConnection2(&nr, "", "", 0)* fails with an error of 67 (ERROR_BAD_NET_NAME), but I don't ...
user avatar
4 votes
0 answers
751 views

What encryption type does Windows Hello use for fingerprint information on Windows 10 latest build?

I've contacted Microsoft support and they said they don't support encryption, which is why I'm posting here. Basically, what I'm wondering is, if a modern laptop has TPM 2.0 enabled and hardware ...
user avatar
4 votes
0 answers
917 views

Hyper-V Sockets in 2016 version and host/guest communication

In new version of Hyper-V released recently with MS Windows Server 2016 contains a new functionality Hyper-V Sockets which allows for host/guest communication. It uses WinSock API with new address ...
user avatar
  • 41
4 votes
0 answers
474 views

Will WinVerifyTrust return true for a file signed by a revoked certificate, before it was revoked?

I've seen mentions online that drivers that were signed by certificates that were later revoked are still trusted by Windows' driver integrity. Apparently if the file was signed before the revocation ...
user avatar
4 votes
0 answers
240 views

Lookaside List Injection

I've been reading a lot about Use-after-free and came across this document. It talks about a "Lookaside" injection exploit. The document says to empty the dynamic memory cache, called the Lookaside ...
user avatar
  • 737
4 votes
0 answers
340 views

Enable FIPS 140.2 in Windows 7 (cng.sys version does not match with versions from NIST Validated list

I am currently working on an application running in Windows 7 Ultimate, and it has to be FIPS 140-2 compliance. As far as I have researched in https://technet.microsoft.com/en-us/library/security/...
user avatar
4 votes
0 answers
159 views

how to create TPM_AUTHDATA as input in tpm commands ?

I'm writing my first program which use tpm (version 1.2) services in Windows 7 using TBS, in this program I'm trying to execute the TPM_CreateWrapKey command. I noticed that many commands like the ...
user avatar
4 votes
0 answers
1k views

copying roaming profile credential file of another computer

I am trying to recover login information of another computer. I have managed to copy the local/roaming profile credential files located in C:\users\%username%\APPDATA\local\Microsoft\Credentials\ and ...
user avatar
  • 151
3 votes
0 answers
148 views

Process Injection and Process Isolation by OS

If the OS is responsible for ensuring that one process cannot access another process memory space, and the point of process isolation is to keep processes separate from one another, then how can a ...
user avatar
3 votes
0 answers
337 views

How does local pass-the-hash (mimikatz's sekurlsa::pth) work?

Mimikatz's sekurlsa::pth documentation states: mimikatz can perform the well-known operation 'Pass-The-Hash' to run a process under another credentials with NTLM hash of the user's password, instead ...
user avatar
  • 95
3 votes
0 answers
96 views

Is it possible for a remote machine to "escape" from a folder mapped through RDP?

Although most people seem to share entire drives with RDP, it is possible to share individual folders, by mapping them to a drive for example with subst <lettertomap>: <pathtofolder> (for ...
user avatar
  • 260
3 votes
0 answers
1k views

Exploiting Environment Variables in Scheduled Tasks for UAC Bypass

I am trying to escalate privileges from an ISS user on Windows Server 2012 R2 by exploiting Environment Variables in Scheduled Tasks for UAC Bypass as the following link explains the exploit: https://...
user avatar
3 votes
0 answers
121 views

Is it possible to prevent rogue/unauthorised computers booting from your PXE server?

In the below scenario, is it possible to prevent a rogue/unauthorised laptop plugging into the network and installing our Windows image? What risks are we exposed to should a malicious 3rd party boot ...
user avatar
  • 131
3 votes
0 answers
189 views

Need Security advice on virtualization and windows security

I have a little doubt about the security of my virtual machine and Windows. Can anyone please point me in right direction? Below is my what, how and why I made my virtual machine. Let me tell you what ...
user avatar
3 votes
0 answers
137 views

How can I identify which SCHANNEL events are being generated by a Remote Desktop connection attempt?

I need to check which encryption level is being used for a Windows Remote Desktop session. I found this question, which shows how to enable logging that shows the client handshake and level of ...
user avatar
3 votes
0 answers
278 views

Host process for windows services network activity between other computer on same network

Wondering if this is normal? I have two PCs hooked up to a router and when the other one powers up and I check my firewall I see that there's some sporadic network activity going on (mainly upload/...
user avatar
3 votes
0 answers
135 views

What personal information, if any, can be gleaned from a Microsoft APPCRASH problem signature?

I am trying to debug an "APPCRASH" problem event for a program running on Microsoft Windows 7. When this happens a problem signature is presented, like this example from SuperUser: Problem Event ...
user avatar
  • 131
3 votes
0 answers
566 views

Windows certificate verification with timestamping

I have been trying to replicate the behaviour of the Digital Signatures tab on windows file properties. I'm using WinVerifyTrust api and X509Certificates namespace to achieve my goal. I've managed to ...
user avatar
  • 31
3 votes
0 answers
133 views

Storing Recoverable Passwords In An App

I'm working on a project where I need to store and recover a password. I can't use a salted hash for authentication because the password is used to secure an HTTP connection via HTTP Digest. I'm not ...
user avatar
3 votes
1 answer
157 views

How to enforce on the OS level to recognise only certain keyboards

I give employees AES wireless keyboards. I would like to enforce the OS to only recognise the keyboard we supply. Is that possible? Assuming my employees OS are Windows 10, Ubuntu, Mac OSX. How could ...
user avatar
2 votes
0 answers
58 views

Does Windows 10 read/run/care about USB devices plugged in "Lock Screen" mode?

Whenever I leave my computer for the bathroom or anything inside the living space, I press WinKey + L to enter the "Lock Screen" mode. (If I go outside, I turn it off completely.) Let's say ...
user avatar
2 votes
0 answers
90 views

Use platform TPM as U2F for web applications

The Problem: Use the platform TMP of my Windows Laptop/PC (no external device or USB token) as U2F in a web application to check if it is a known device. My intended solution: I need to store/create ...
user avatar
2 votes
0 answers
118 views

Windows XP SP3 2002 is not vulnerable to MS08-067

Why is my VM not vulnerable to MS08-067? There are similar question on stack exchange, yes, but they fail to specify all relevant information and so non receive a meaningful, thoughtful nor thorough ...
user avatar
2 votes
1 answer
113 views

Does Windows use Bluetooth Authenticated pairing with encryption automatically?

Does Windows use Bluetooth Authenticated pairing with encryption automatically when you connect Bluetooth devices like earbuds to it? Is that Level 4? If it's not automatic, how do I get Windows to do ...
user avatar
2 votes
0 answers
103 views

Why doesn't Defender get suspicious if a program adds exceptions to the Defender?

One can simply add exceptions to the Windows Defender by running this command in Powershell: Add-MpPreference -ExclusionPath <your_path> Why does Windows Defender not immediately flag programs ...
user avatar
  • 53
2 votes
0 answers
252 views

How/when does Windows link private key to imported certificate?

When creating CSR on Windows (using built-in certificate store), I found some weird behaviors: When I use enrollment policy, but then extract CSR and sign it somewhere else, on import the certificate ...
user avatar
2 votes
0 answers
4k views

How to send deauth packets on Windows (manually or with software)?

first of all I know how deauth packets work basically. But since my wifi adapter refuses to work on my virtual Kali, I want to use my host machine (Windows 10). So I have NPcap and Wireshark and I can ...
user avatar
  • 21
2 votes
0 answers
546 views

What legitimate services uses SAMR queries? And how to verify?

Recently I noticed that every few days, at (almost) the same time, one host is querying the Domain Controller for group members using SAMR calls. I am trying to understand why its happening ...
user avatar
  • 21
2 votes
0 answers
95 views

Is the RSA Private Key non-exportable option protected from key extraction?

I would like to know if the non-exportable private key option, virtualized based security, selected when importing an RSA certificate guaranteed although the user will never be able to see the RSA ...
user avatar
2 votes
0 answers
130 views

Are there any wormable vulnerabilities for legacy Windows operating systems that are left unfixed?

I want to know the status of remote, code executing vulnerabilities of old Windows operating systems that are left unfixed, if they exist at all. Exploits like EternalBlue or BlueKeep wreaked havoc on ...
user avatar
2 votes
0 answers
116 views

Why do Windows AV software detect strings with case-sensitivitely?

As Windows is case-insensitive, the string mimikatz can be evaluated the same as MIMIKATZ or MimIkaTZ. A naive method of AV evasion by switching cases of some characters in suspicious string has been ...
user avatar
2 votes
0 answers
347 views

Why does the Windows Security Alert dialog default to to the "not recommended" option?

When I launch a program that wants network communication for the first time, I get this dialog: It's been a part of Windows for a while now (this is running on Windows 10, but note the Vista/7 design ...
user avatar
  • 603
2 votes
0 answers
157 views

Windows command bypassing Sandboxie

Using Sandboxie typing net user some_user some_password, on a sandboxed cmd, actually changes the password of the real user. Is this intentional? It is just a default Sandboxie installation running ...
user avatar
2 votes
2 answers
2k views

Windows Kerberos Pre-Auth Failed (4771)

Is there an easy way to distinguish 4771 events from a real attack perspective vs. someone having a stale session with an old password? If you don't get logs from all endpoints and rely on Domain ...
user avatar
  • 416
2 votes
0 answers
505 views

Buffer overflow return address with null byte, workaround

I'm practicing Buffer Overflows using Free Float FTP Server 1.0 on Windows 7 SP 1. I have done simple jmp esp examples on Windows XP, where system DLLs are without rebase or Address Space Layout ...
user avatar
  • 29
2 votes
0 answers
153 views

Methods of exploiting a Windows executable protected by "Control Flow Guard" and "Return Flow Guard"?

I understand that obtaining code execution by stack buffer-overflows were mitigated by DEP, which in turn lead to SEH and ROP exploit techniques etc. However, I don't see how to exploit an executable ...
user avatar
  • 1,087
2 votes
0 answers
234 views

Can a named pipe with a low integrity label have its SACL/DACL modified by a low integrity process?

If a named pipe on Windows has a Low Mandatory Level label and SYSTEM_MANDATORY_LABEL_NO_WRITE_UP in its SACL, but the DACL has WRITE_DAC and WRITE_OWNER for the current user, can a low integrity ...
user avatar
  • 132k
2 votes
2 answers
243 views

What program can Decrypt specific a Folder/Files during Windows Boot/Loading? (Windows)

I've been looking into Encryption of my data for some time now; I've decided to move ahead with VeraCrypt for encryption all of my partitions (I have 2 disks in 1 laptop) except for the OS (C:) ...
user avatar
2 votes
0 answers
2k views

Ransomware with .adobe extension

It is possible to decrypt file with .adobe extension ? File after encryption look like this : filename.id-5735353.[email@example.com].adobe . I did a little research and found information about "....
user avatar
  • 21
2 votes
1 answer
1k views

Antivirus warns about processes trying to access my webcam

For the last two weeks I am constantly getting notifications from my antivirus about attempts of using my webcam. I have always chosen "Block access", often after checking "remember for this ...
user avatar
  • 121
2 votes
0 answers
421 views

SMB Session Hijacking

I've been recently studying SMB protocol for a better understanding of it while doing windows environment pentesting. Regarding SMBv1 and v2, in both cases the Session Setup Request is sent using ...
user avatar
  • 61
2 votes
0 answers
139 views

The way for not disabling the firewall in windows

I have been doing this for about a year without knowing the purposes of disabling. Whenever i tried to ping/connected to my host VM via guest VM, i have to disable my host VM's firewall, but does it ...
user avatar
  • 193
2 votes
0 answers
100 views

Securing communications between PoS terminals and sTunnel server

Am I correct in thinking that a PoS Terminal only needs my public key installed on the device to connect to my sTunnel server (with Private key) and that communications between client and server will ...
user avatar
  • 21
2 votes
0 answers
99 views

Unwanted browswer redirection

I use IE 10 on Windows 10, and when I type www.outlook.com, my Facebook page opens! I can type www.msn.com and use it to get to the email, but what is causing this and how to fix it? I tried several ...
user avatar
  • 185
2 votes
0 answers
150 views

hardware secret key storage in windows

It seems to me that Windows provides some level of hardware-based secret key storage, for protecting UHD streams in PlayReady 3.0 DRM. Is it possible for third-party applications to leverage this?
user avatar
2 votes
0 answers
1k views

Is possible to prevent input emulation with SetWindowsHookEx in specific application?

The one of technique of input emulation protection with automation toools like AutoIt or ACTools used most of simple game bot programs is SetWindowsHookEx usage WH_KEYBOARD_LL flags. This solution is ...
user avatar
2 votes
0 answers
209 views

Problem using custom CryptoNG KSP on IE 11

We are currently developing a custom KSP (Key Storage Provider) for a Key Storage System. We successfully developed a CSP (CryptoAPI) and a KSP (CryptoNG) provider, and both work really fine for ...
user avatar
  • 2,532
2 votes
0 answers
629 views

Novicorp WinToFlash Lite, spyware etc

I used Novicorp WinToFlash Lite on Windows 7 to create a Windows 10 bootable USB memory stick. While creating the USB drive, I noticed that WinToFlash wrote something like adding blahblah files to ...
user avatar

1
2 3 4 5