Questions tagged [windows]
Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].
285
questions with no upvoted or accepted answers
11
votes
1
answer
963
views
Entropy sources used by modern Windows
A comment on a Microsoft blog from 2005 mentions over 150 sources of entropy for the Windows CryptGenRandom function. The majority of sources come from low-level system information (precise stat ...
- 66.5k
6
votes
1
answer
1k
views
Pivoting with Metasploit
I am trying to exploit a Windows VM on a different subnet behind a dual home Linux VM where I already have a shell. To keep it simple, I have a meterpreter reverse_tcp shell on the Linux VM (192.168....
- 313
6
votes
1
answer
675
views
MS08-067.c fails at WNetAddConnection2()
I'm working with some exploit code for the MS08-067 vulnerability from ExploitDB.
The section:
WNetAddConnection2(&nr, "", "", 0)* fails with an error of 67 (ERROR_BAD_NET_NAME), but I don't ...
5
votes
0
answers
779
views
What encryption type does Windows Hello use for fingerprint information on Windows 10 latest build?
I've contacted Microsoft support and they said they don't support encryption, which is why I'm posting here.
Basically, what I'm wondering is, if a modern laptop has TPM 2.0 enabled and hardware ...
- 51
4
votes
0
answers
937
views
Hyper-V Sockets in 2016 version and host/guest communication
In new version of Hyper-V released recently with MS Windows Server 2016 contains a new functionality Hyper-V Sockets which allows for host/guest communication.
It uses WinSock API with new address ...
- 41
4
votes
0
answers
502
views
Will WinVerifyTrust return true for a file signed by a revoked certificate, before it was revoked?
I've seen mentions online that drivers that were signed by certificates that were later revoked are still trusted by Windows' driver integrity. Apparently if the file was signed before the revocation ...
- 41
4
votes
0
answers
256
views
Lookaside List Injection
I've been reading a lot about Use-after-free and came across this document. It talks about a "Lookaside" injection exploit. The document says to empty the dynamic memory cache, called the Lookaside ...
- 737
4
votes
0
answers
346
views
Enable FIPS 140.2 in Windows 7 (cng.sys version does not match with versions from NIST Validated list
I am currently working on an application running in Windows 7 Ultimate, and it has to be FIPS 140-2 compliance.
As far as I have researched in https://technet.microsoft.com/en-us/library/security/...
- 41
4
votes
0
answers
176
views
how to create TPM_AUTHDATA as input in tpm commands ?
I'm writing my first program which use tpm (version 1.2) services in Windows 7 using TBS, in this program I'm trying to execute the TPM_CreateWrapKey command.
I noticed that many commands like the ...
4
votes
0
answers
1k
views
copying roaming profile credential file of another computer
I am trying to recover login information of another computer. I have managed to copy the local/roaming profile credential files located in C:\users\%username%\APPDATA\local\Microsoft\Credentials\ and ...
- 151
3
votes
0
answers
163
views
Does Windows 10 read/run/care about USB devices plugged in "Lock Screen" mode?
Whenever I leave my computer for the bathroom or anything inside the living space, I press WinKey + L to enter the "Lock Screen" mode. (If I go outside, I turn it off completely.)
Let's say ...
- 31
3
votes
0
answers
2k
views
C# Hello World program detected as virus
I just wrote and compiled a Hello World program in C# (I'm using Visual Studio 2022) and when I sent the file to VirusTotal, 1 antivirus program detected the exe as unsafe (VirusTotal results of C# ...
- 31
3
votes
1
answer
386
views
What is the Print Nightmare threat vector?
I've researched this topic a few times and have not been able to come up with a definitive answer. It appears the threat may be multi-faceted.
I ask in the context of a standard Server/Client Windows ...
- 493
3
votes
0
answers
198
views
Process Injection and Process Isolation by OS
If the OS is responsible for ensuring that one process cannot access another process memory space, and the point of process isolation is to keep processes separate from one another, then how can a ...
- 31
3
votes
0
answers
857
views
How does local pass-the-hash (mimikatz's sekurlsa::pth) work?
Mimikatz's sekurlsa::pth documentation states:
mimikatz can perform the well-known operation 'Pass-The-Hash' to run a
process under another credentials with NTLM hash of the user's
password, instead ...
- 95
3
votes
0
answers
9k
views
How to send deauth packets on Windows (manually or with software)?
first of all I know how deauth packets work basically. But since my wifi adapter refuses to work on my virtual Kali, I want to use my host machine (Windows 10). So I have NPcap and Wireshark and I can ...
- 31
3
votes
1
answer
897
views
Show confirmation popup before running any downloaded program in Windows 10
I often download files either using my browser or by torrenting. Few times, I encountered an attack where the torrented file was called something like movie.mp4.lnk and the target was set to run a ...
- 61
3
votes
2
answers
3k
views
Windows Kerberos Pre-Auth Failed (4771)
Is there an easy way to distinguish 4771 events from a real attack perspective vs. someone having a stale session with an old password?
If you don't get logs from all endpoints and rely on Domain ...
- 426
3
votes
0
answers
110
views
Is it possible for a remote machine to "escape" from a folder mapped through RDP?
Although most people seem to share entire drives with RDP, it is possible to share individual folders, by mapping them to a drive for example with subst <lettertomap>: <pathtofolder> (for ...
- 260
3
votes
0
answers
1k
views
Exploiting Environment Variables in Scheduled Tasks for UAC Bypass
I am trying to escalate privileges from an ISS user on Windows Server 2012 R2 by exploiting Environment Variables in Scheduled Tasks for UAC Bypass as the following link explains the exploit:
https://...
- 1,840
3
votes
0
answers
126
views
Is it possible to prevent rogue/unauthorised computers booting from your PXE server?
In the below scenario, is it possible to prevent a rogue/unauthorised laptop plugging into the network and installing our Windows image?
What risks are we exposed to should a malicious 3rd party boot ...
- 131
3
votes
0
answers
527
views
SMB Session Hijacking
I've been recently studying SMB protocol for a better understanding of it while doing windows environment pentesting.
Regarding SMBv1 and v2, in both cases the Session Setup Request is sent using ...
- 71
3
votes
0
answers
205
views
Need Security advice on virtualization and windows security
I have a little doubt about the security of my virtual machine and Windows. Can anyone please point me in right direction?
Below is my what, how and why I made my virtual machine.
Let me tell you what ...
- 31
3
votes
0
answers
170
views
How can I identify which SCHANNEL events are being generated by a Remote Desktop connection attempt?
I need to check which encryption level is being used for a Windows Remote Desktop session. I found this question, which shows how to enable logging that shows the client handshake and level of ...
- 131
3
votes
0
answers
285
views
Host process for windows services network activity between other computer on same network
Wondering if this is normal? I have two PCs hooked up to a router and when the other one powers up and I check my firewall I see that there's some sporadic network activity going on (mainly upload/...
- 133
3
votes
0
answers
139
views
What personal information, if any, can be gleaned from a Microsoft APPCRASH problem signature?
I am trying to debug an "APPCRASH" problem event for a program running on Microsoft Windows 7.
When this happens a problem signature is presented, like this example from SuperUser:
Problem Event ...
- 131
3
votes
0
answers
657
views
Windows certificate verification with timestamping
I have been trying to replicate the behaviour of the Digital Signatures tab on windows file properties. I'm using WinVerifyTrust api and X509Certificates namespace to achieve my goal. I've managed to ...
- 31
3
votes
0
answers
139
views
Storing Recoverable Passwords In An App
I'm working on a project where I need to store and recover a password. I can't use a salted hash for authentication because the password is used to secure an HTTP connection via HTTP Digest. I'm not ...
3
votes
1
answer
169
views
How to enforce on the OS level to recognise only certain keyboards
I give employees AES wireless keyboards.
I would like to enforce the OS to only recognise the keyboard we supply.
Is that possible?
Assuming my employees OS are Windows 10, Ubuntu, Mac OSX.
How could ...
- 131
2
votes
1
answer
282
views
How to extract a .bat file with volatility
I am experimenting with the volatility2 tool.
I have created a memorydump of a windows 7 machine where i had a batch script file on the desktop of the machine.
I used the mftparser command as :
...
- 23
2
votes
0
answers
939
views
Responder not collecting hashes in most cases
I've recently become curious on how AD works and how hashes are shared between Windows machines. It's very interesting how there are so many ways to get Windows programs to leak hashes, for example ...
- 21
2
votes
0
answers
868
views
Windows XP SP3 2002 is not vulnerable to MS08-067
Why is my VM not vulnerable to MS08-067?
There are similar question on stack exchange, yes, but they fail to specify all relevant information and so non receive a meaningful, thoughtful nor thorough ...
2
votes
2
answers
7k
views
What can prevent Mimikatz from accessing LSA?
I used to run Mimikatz in one of my computers. Then, I did something to block its action and I do not recall what it was. I am trying to revert it unsuccessfully.
.#####. mimikatz 2.2.0 (x64) #...
- 476
2
votes
1
answer
250
views
Does Windows use Bluetooth Authenticated pairing with encryption automatically?
Does Windows use Bluetooth Authenticated pairing with encryption automatically when you connect Bluetooth devices like earbuds to it? Is that Level 4? If it's not automatic, how do I get Windows to do ...
- 21
2
votes
0
answers
969
views
How/when does Windows link private key to imported certificate?
When creating CSR on Windows (using built-in certificate store), I found some weird behaviors:
When I use enrollment policy, but then extract CSR and sign it somewhere else, on import the certificate ...
- 173
2
votes
0
answers
1k
views
What legitimate services uses SAMR queries? And how to verify?
Recently I noticed that every few days, at (almost) the same time, one host is querying the Domain Controller for group members using SAMR calls. I am trying to understand why its happening ...
- 21
2
votes
0
answers
184
views
Is the RSA Private Key non-exportable option protected from key extraction?
I would like to know if the non-exportable private key option, virtualized based security, selected when importing an RSA certificate guaranteed although the user will never be able to see the RSA ...
- 59
2
votes
0
answers
137
views
Are there any wormable vulnerabilities for legacy Windows operating systems that are left unfixed?
I want to know the status of remote, code executing vulnerabilities of old Windows operating systems that are left unfixed, if they exist at all.
Exploits like EternalBlue or BlueKeep wreaked havoc on ...
- 61
2
votes
0
answers
235
views
Removing PATH from the Windows DLL Search Order
There exists a class of bugs on Windows where an unprivileged attacker can write a DLL to a location on disk, then add that location to the PATH variable. Then, when an elevated user process is trying ...
- 21
2
votes
0
answers
140
views
Why do Windows AV software detect strings with case-sensitivitely?
As Windows is case-insensitive, the string mimikatz can be evaluated the same as MIMIKATZ or MimIkaTZ. A naive method of AV evasion by switching cases of some characters in suspicious string has been ...
- 3,482
2
votes
0
answers
200
views
Windows command bypassing Sandboxie
Using Sandboxie typing net user some_user some_password, on a sandboxed cmd, actually changes the password of the real user. Is this intentional?
It is just a default Sandboxie installation running ...
- 21
2
votes
2
answers
2k
views
Bypassing Windows Defender VBA custom code
I've recently written a simple keylogger using classic DLL-injection technique. I wanted to simulate a real phishing attack where the user opens an Office document with macros and by enabling them he ...
- 51
2
votes
0
answers
606
views
Buffer overflow return address with null byte, workaround
I'm practicing Buffer Overflows using Free Float FTP Server 1.0 on Windows 7 SP 1. I have done simple jmp esp examples on Windows XP, where system DLLs are without rebase or Address Space Layout ...
- 29
2
votes
0
answers
175
views
Methods of exploiting a Windows executable protected by "Control Flow Guard" and "Return Flow Guard"?
I understand that obtaining code execution by stack buffer-overflows were mitigated by DEP, which in turn lead to SEH and ROP exploit techniques etc.
However, I don't see how to exploit an executable ...
- 1,207
2
votes
0
answers
282
views
Can a named pipe with a low integrity label have its SACL/DACL modified by a low integrity process?
If a named pipe on Windows has a Low Mandatory Level label and SYSTEM_MANDATORY_LABEL_NO_WRITE_UP in its SACL, but the DACL has WRITE_DAC and WRITE_OWNER for the current user, can a low integrity ...
- 135k
2
votes
0
answers
2k
views
Ransomware with .adobe extension
It is possible to decrypt file with .adobe extension ?
File after encryption look like this : filename.id-5735353.[[email protected]].adobe .
I did a little research and found information about "....
- 41
2
votes
0
answers
143
views
The way for not disabling the firewall in windows
I have been doing this for about a year without knowing the purposes of disabling. Whenever i tried to ping/connected to my host VM via guest VM, i have to disable my host VM's firewall, but does it ...
- 193
2
votes
0
answers
107
views
Securing communications between PoS terminals and sTunnel server
Am I correct in thinking that a PoS Terminal only needs my public key installed on the device to connect to my sTunnel server (with Private key) and that communications between client and server will ...
- 21
2
votes
0
answers
103
views
Unwanted browswer redirection
I use IE 10 on Windows 10, and when I type www.outlook.com, my Facebook page opens! I can type www.msn.com and use it to get to the email, but what is causing this and how to fix it? I tried several ...
- 175
2
votes
0
answers
158
views
hardware secret key storage in windows
It seems to me that Windows provides some level of hardware-based secret key storage, for protecting UHD streams in PlayReady 3.0 DRM.
Is it possible for third-party applications to leverage this?
- 541