Questions tagged [windows]
Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].
2,215
questions
0
votes
1
answer
30
views
Securing access to SAC from Windows EMS
When enabling Emergency Management Services on Windows, one can access a limited terminal from a serial port, by default there's no authentication required.
To leave the limited environment, you need ...
- 121
1
vote
0
answers
218
views
Are drive-by downloads and installs a significant threat to an average modern Android or Firefox for Windows user?
Today I learned that drive-by downloads and drive-by installations are or have been a thing. Yet there's something very counterintuitive about them if considered a real threat for modern smartphone or ...
- 113
0
votes
0
answers
37
views
Is it possible to abuse the sections in which are excluded from signature check in a signed executable?
Microsoft allows you to sign an executable, and has a list of certificates to validate those signatures.
However it is possible to change the data on a file, while still passing the signature check, ...
- 171
0
votes
1
answer
212
views
DLL Injection Win32 API
I want to know which Win32 API functions a certain executable calls. The executable is a 32-bit application.
I know what steps to take to perform a DLL injection and hook an API function.
However, ...
0
votes
0
answers
60
views
Passwordless authentication using expiring hardware keys
I am looking for a solution to implement passwordless authentication using expirable hardware keys. It is for devices around the world with Windows OS, and sometimes service technicians have to do ...
- 101
0
votes
1
answer
240
views
Why does the windows firewall allow apps to communicate through so many different ports and to so many different addresses?
I looked at my default windows defender firewall on Windows 10 22H2, and most of the rules allow apps to communicate through any local port to any remote address and port. I have read other questions ...
3
votes
1
answer
636
views
How can an application, using Apple's Secure Enclave on macOS or TPM on Windows, protect itself from other applications accessing its private keys?
I'm interested in using Apple's Secure Enclave on macOS or TPM on Windows to protect cryptographic keys used by an application from being accessed by other applications running with the same or higher ...
- 56
0
votes
0
answers
268
views
Is it possible to get krbtgt hash from TGT ticket?
As you know, during a kerberoasting attack, we can intercept the TGS ticket and use brute force tools (john the ripper, hashcat) to find out the password of the service accounts that signed the TGS ...
0
votes
0
answers
88
views
Custom PsExec csharp code with plaintext credentials
I have this code for exploiting PsExec that works perfectly fine when I have a TGS for the CIFS SPN on the target, however there are situations where I only have plaintext credentials for the local ...
0
votes
0
answers
42
views
What protection does the /INTEGRITYCHECK MSVC linker option offer, if a malicious file without it can simply be substituted for the authentic file?
The /INTEGRITYCHECK linker option sets a flag that "tells the memory manager to check for a digital signature in order to load the image in Windows". So the general idea is that this ...
1
vote
0
answers
56
views
How to gain admin access on windows [closed]
I've been trying to get admin on my own pc for probably like 4 years now and I still can't find anything. I tried to do the utilman swap with cmd but then literally my av blocked it and then it ...
- 11
1
vote
1
answer
390
views
RDP logout necessary to prevent RDP session hijacking?
We recently got a strengthened security policy where people are required to log out of any RDP connections at the end of the day. So when I turn off my laptop, it is not enough to merely close the RDP ...
- 11
0
votes
0
answers
121
views
What information does the Microsoft Intelligent Security Graph use for querying files?
I'm looking into WDAC and the option to use Microsoft's ISG for files that are not explicitly allowed or denied caught my interest. Unfortunately I haven't been able to find any information on what is ...
- 11
0
votes
1
answer
268
views
How is a Windows Active Directory Machine Account Password stored in Windows/Samba Clients?
It's said that a Windows Machine Account Password is usually composed of 120 characters in UTF-16-LE format. But when looking at the value stored in the Windows Registry under HKLM\SECURITY\Policy\...
- 101
1
vote
1
answer
953
views
How to decrypt LockBit encrypted files
I've got an emergency on my PC. I remotely connected to it using Remote Desktop Connection a couple of days ago and I worked on my PC for a while and logged off. Later, when I went to log back on, I ...
0
votes
1
answer
137
views
Do viruses survive in other drive and than re infect after resetting the PC?
Backstory:
I got infected while installing some shady software and at that time I kept Windows Defender off, (I have very much faith on my shady website) by turning its features off. But when I ...
2
votes
1
answer
282
views
How to extract a .bat file with volatility
I am experimenting with the volatility2 tool.
I have created a memorydump of a windows 7 machine where i had a batch script file on the desktop of the machine.
I used the mftparser command as :
...
- 23
0
votes
1
answer
81
views
Using a program that likely has a trojan horse? [closed]
OP wants to back up his Blu-ray/4K collection to a HDD.
OP suspects that a very popular program that makes MKVs is actually a trojan horse that infects host computer's USB drives, which can later be ...
0
votes
0
answers
452
views
Symantec Endpoint Protection "Traffic has been blocked from this application: (svchost.exe)"
I'm currently getting this notification from SEP around twice a month saying "Traffic has been blocked from this application: (svchost.exe)"
Logs:
1/3/2023 12:32 Blocked Major Incoming UDP .....
- 1
1
vote
0
answers
320
views
API hooking with Microsoft Detours
I want to hook certain API calls, e.g. CreateFile (or NtCreateFile if I hook ntdll.dll), but there are some issues.
I can use several methods to achieve this goal, e.g. DLL injection, Inline hooking ...
- 35
0
votes
1
answer
2k
views
Renewing Enterprise CA certificate
I have just renewed my Root CA certificate and having issues renewing my Enterprise CA certificate.
My setup is the Root CA is offline with online issuing CA server.
When I do the renewal nothing ...
0
votes
1
answer
143
views
Can flash drive infect Android and then the Android infect Windows PC?
I found a flash drive outside my home. Thinking one of my neighbors might have dropped it and wanting to return to them (but still wanting to be cautious), I (stupidly) plugged it into an old Android ...
- 1
0
votes
0
answers
83
views
Downloaded malicious VSCode version
I just downloaded VSCode and after running the setup, which wouldn't give any response, I noticed that the setup.exe came from an obviously fake website. The website was the first to pop up upon ...
- 1
0
votes
2
answers
175
views
How can code signing posibly be secure on Windows when signed executables act on unsigned input?
As a security measure, my Windows-based work computer has been configured to deny any application that hasn't been signed with a valid certificate; my system will run a signed executable from DropBox'...
- 101
0
votes
0
answers
54
views
WMI filter to consumer binding not working correctly
I'm working on some monitoring software for automatic dynamic malware analysis.
I'm pretty unfamiliar with WMI so I made some test MOFs. Here are the MOFs pulled directly from wbemtest.
Filter:
...
1
vote
1
answer
157
views
Would my hypothetical Opsec setup with the goal of compartmentalizing sensitive areas from an insecure sandbox be sensible?
The root cause of my problem stems from the fact that I need to run untrustworthy software on a bare metal windows machine, which means that I can't just have it in a VM because of major performance ...
1
vote
0
answers
98
views
How would I communicate with my computer from a remote server when I'm using a VPN? [closed]
I have a computer at home. It's connected to the Internet. I use OpenVPN on Windows 10 to auto-connect to a VPN at startup.
Now, I would like for a remote computer to make some sort of network ...
- 11
1
vote
1
answer
348
views
Is it still recommended to block Living Off The Land Binaries (LOLBins) in Firewall?
https://lolbas-project.github.io/
Realistically, do we still need to block cmd.exe or certutil.exe in Windows firewall, on latest version of Windows? Lolbins are for Linux too but my question is only ...
user286246
2
votes
0
answers
363
views
Why does MS Teams establishing outbound connection towards malicious IP? [closed]
I'm wondering how come an internal "Teams.exe" can make outbound connections to a malicious IP, 132.147.119[.]217 (ISP: ViewQwest Pte Ltd) that was flagged as malicious and also was involved ...
- 21
0
votes
0
answers
1k
views
ERROR kuhl_sekurlsa_acquireLSA from customized mimikatz
Tried to call sekurlsa::logonpasswords function from mimikatz main source, but I get ERROR hl_aaaurlsa_acquireLSA ; Logon list
The program is executed with Administrator cred and I'm sure there's no ...
- 1
0
votes
0
answers
75
views
Recovering the key of a lost BitLocker volume
I have a 1TB HDD encrypted with BitLocker. It was set up in a way that when I'd boot Windows it would automatically mount it using the key. (I believe it is stored in some kind of .BEK file) I no ...
- 11
1
vote
1
answer
297
views
How did hackers gain access to my Chrome and my social media accounts? [closed]
These are the things that have happened to me in the last few hours:
Weird tweets such as "Hello 91" and "Hello 87" were being tweeted from my account.
My Instagram account had ...
- 11
4
votes
1
answer
277
views
Would secure boot block GPU if it has modified vbios?
I think that AMD GPUs can be flashed with any modded VBIOS because the GPU doesn't check for firmware signature.
Shouldn't the secure boot be able to check signature of the AMD GPUs modded VBIOS and ...
- 41
2
votes
0
answers
939
views
Responder not collecting hashes in most cases
I've recently become curious on how AD works and how hashes are shared between Windows machines. It's very interesting how there are so many ways to get Windows programs to leak hashes, for example ...
- 21
0
votes
0
answers
538
views
Block all windows system outgoing internet connections but allow LAN on Private and VPN on Public
I have several windows PC connected to my mikrotik. I use basic features: file sharing, playing games with friends on home LAN and want to connect internet only through VPN (openVPN client).
But I am ...
- 1
0
votes
0
answers
186
views
Responder still catching hashes with LLMNR and Netbios over TCP/IP disabled. Is this by design?
My responder is still catching hashes from Windows 10 box that has had Netbios over TCP/IP (DHCP scope option) and LLMNR disabled (GP).
The workstation invokes the net view \\responderip and responder ...
11
votes
3
answers
4k
views
Why create a CSR on my own server to have it signed by a 3rd party?
I am looking into our current website certificate-management process and am looking for steps that may be unnecessary and can be simplified. The current process was created by our sysadmin who now ...
- 375
1
vote
1
answer
267
views
How can I share web-platform credentials across multiple desktop apps on Windows?
I have two desktop apps, each authenticate against our server using OIDC in order to call our web api. Currently the users need to login independently in each application.
I noticed when using ...
- 113
0
votes
0
answers
122
views
Requests to malicious IP being sent by background process on Windows
Whenever an internet connection is established on my pc, I am repeatedly getting warnings from QuickHeal like this:
I am getting such warnings repeatedly with different IP addresses. In the above ...
- 1
0
votes
1
answer
462
views
How to safely run an untrusted program that needs to be run with admin privileges?
We use Hikvision cameras and with that comes LocalServiceControl.exe which needs to be running to see video streams from cameras in a web browser. This exe requires to be run as local admin which is ...
-3
votes
1
answer
91
views
Hiding a certificate [duplicate]
Is it possible to embed a TLS certificate into an application or hide it somehow so that it’s not so easy for a user to just export it from cert manager on Windows? Or does all certificates have to be ...
- 537
1
vote
0
answers
297
views
Enabling ECDH KeyExchangeAlgorithm in Windows Schannel while disabling CBC based ciphersuites
On our Windows Servers, we have disabled the following key exchange algorithms in registry
SCHANNEL\KeyExchangeAlgorithms\ECDH
SCHANNEL\KeyExchangeAlgorithms\PKCS
This leaves us with only 2 ...
- 111
1
vote
0
answers
273
views
Cracking passwords following rules with John or hashcat
I would like to crack the forgotten password of a very old archive file (rar) with JTR or hashcat.
I remember it was starting with a certain number from a set of numbers e.g.
prefix number from the ...
- 11
-1
votes
2
answers
420
views
How to backdoor windows?
Studing pentest, I was astonished by how easy it was to backdoor a Linux machine after I got root. I just needed to compile a program like this:
#define _GNU_SOURCE
#include <stdlib.h>
#include &...
- 21
2
votes
1
answer
152
views
Remote code execution after a valid SMB (net use) password in Windows?
I am doing a capture-the-flag exercise in a Windows scenario.
It uses Windows 2016 server. I was able to find the password and I can access the files with a:
net use z: \\computer\C$ password /user:...
- 21
1
vote
1
answer
100
views
Is there a way to enforce a user password challenge for a certificate every single time in Windows Security Policy?
In Local Security Policy configuration, I have set System cryptography: Force strong key protection for user keys stored on the computer to value User must enter a password each time they use a key.
...
0
votes
0
answers
480
views
Self-signed certificate chain verified by OpenSSL but Windows says leaf is invalid
Let's say I have rootCA.crt, intermediateCA.crt and leaf.crt. I used openssl to veriy leaf.crt:
cat rootCA.crt intermediate.crt > chain.crt
openssl verify -CAfile chain.crt leaf.crt
and it said ...
1
vote
0
answers
1k
views
How do I convert any arbitrary .EXE to .DLL, in order to bypass program restrictions?
On a computer that blocks third-party programs, I figured that you could use use PowerShell and C#'s DllImport() function to import a native C program as a DLL and run it, and the program would simply ...
- 137
2
votes
1
answer
48
views
Is the Windows Security Protection History shared with my employer if I'm logged in on a work laptop?
I have a laptop with an Office 365 company account. I work from home, but I obviously have some company policies running, since I get the 'Your administrator has blocked this action' messages in my ...
- 21
0
votes
1
answer
292
views
Rogue login to Google account after Windows clean install
Yesterday I downloaded a sketchy .exe on my Windows desktop and executed it. A command prompt window appeared then nothing abnormal happened. I tried running MalwareBytes but it didn't display any ...
- 11