Questions tagged [windows]

Related to security concerns specific to the Microsoft Windows operating system itself. For security of applications that happen to be running on Windows, please use [appsec]. For the X Window System, please use [x11].

Filter by
Sorted by
Tagged with
0 votes
0 answers
188 views

What are security risks of a domain user accounts with denied interactive logon?

When I create domain user account with denied interactive logon, what are real security risks when hacker gets the password? http://paulasitblog.blogspot.com/2017/01/deny-interactive-logon-for-service....
user avatar
18 votes
4 answers
5k views

What are the risks of desktop personalization on Windows?

I've worked on places where the admins have disabled desktop personalization on Windows for settings like: changing desktop background and lock screen images local themes - no high contrast for ...
user avatar
  • 291
10 votes
7 answers
6k views

Can you create a fake (malicious) Ubuntu iso

Recently I got into an exchange with someone on social media about the security of Linux versus OSX and Windows. I stated that it is possible (and probable) that someone could code a low level back ...
user avatar
4 votes
2 answers
514 views

Are buffer overflow and similar attacks still possible?

The majority of my cyber security background comes in the form of web application vulnerability testing, and whilst I do have a degree of prior experience in studying and performing application ...
user avatar
0 votes
0 answers
99 views

Secure Registry Keys

Is it possible to restrict access to the registry keys, just like Microsoft does on some of the keys(ex. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend)? I was able to get a similar ...
user avatar
1 vote
1 answer
177 views

What physical damage can a user mode windows driver do?

If a driver runs in kernel mode it obviously can manipulate everything (well everything in ring 0), so manipulating the file system or devices is a possibility. Potentially devices can be destroyed, ...
user avatar
  • 492
-1 votes
1 answer
181 views

PowerShell - privilege escalation [closed]

In the past, I have used the Sherlock PowerShell script to quickly find missing software patches for local privilege escalation vulnerabilities. However, I am looking for a similar script, but I ...
user avatar
1 vote
1 answer
206 views

Does a virus (malware) ever expire?

There's a possibility that my old USB stick (which I haven't used in over a year) got a virus-infected audio file (AAC) among other trusted files. Can I safely open the trusted files bypassing the ...
user avatar
  • 15
1 vote
0 answers
118 views

How to go about checking if Windows is running any untrusted drivers (programatically)

I want to enforce a rule that my program start only if, at the time it launches, there are no untrusted kernel drivers running. I'm aware and have already tested file signature verification using ...
user avatar
  • 111
0 votes
1 answer
446 views

Why does Windows not enable TPM 2.0 parameter encryption to protect against bus sniffing of Bitlocker key?

Comes from Bitlocker, does additional authentication at startup with TPM device provide any extra security? You can sniff the key right from the bus currently: As the decryption happens automatically,...
user avatar
0 votes
0 answers
53 views

AppCertDLLs does not work in GUI apps, why?

I was trying to automatically inject a dll to every process (including GUI) whenever it is started by a user . My DLL hooks DoDragDrop method of winapi and communicates with server to decide allow or ...
user avatar
0 votes
2 answers
292 views

Windows directory that is only accessible by SYSTEM user

I am developing a .NET Windows Service using C# that needs to download an executable file and run it. I need the Windows Service to run with SYSTEM privileges in order to allow it to install software ...
user avatar
  • 3
0 votes
1 answer
333 views

Windows/NTFS: do files have any unique, immutable properties?

I want to detect if a file on disk was edited since last access, or restored since last deletion. Let's assume this isn't on a VM. Basic scheme: Somewhere in the file is a cryptographic hash of the ...
user avatar
  • 143
0 votes
1 answer
90 views

Securing and storing Active Directory logs

If we plan to log script block logging, module logging and transcription logs in Active Directory using group policy, what/where is the best place to secure these logs so we can be assured of their ...
user avatar
0 votes
0 answers
92 views

What OS do I focus on when learning Cyber Defense?

After some time in the Cyber Defense field, I am noticing that there are different learning paths to take depending on the OS you choose (for example you can learn how to use PowerShelll and lots of ...
user avatar
9 votes
2 answers
285 views

Who is at risk from the PrintNightmare RCE?

Microsoft released an emergency patch and stated that the vulnerability is being actively exploited in the wild. All the news articles describing the RCE are implying that any internet-connected ...
user avatar
0 votes
2 answers
199 views

Shellcode not executing despite EIP being overwritten properly

Here is my exploit: junk = b'A' * 1032 ​ eip = b"\xf5\x93\x4a\x00" # some address where 'jmp esp' lives shellcode = b"" shellcode += b"\x33\xc0" # xor eax, ...
user avatar
  • 121
2 votes
1 answer
254 views

How are vulnerabilities like PrintNightmare CVE-2021-34527 discovered?

Regarding the newly discovered vulnerability PrintNightmare CVE-2021-34527 that has existed for years without being discovered, currently affecting almost all versions of Windows, server and ...
user avatar
  • 1,102
1 vote
1 answer
324 views

Error with Metasploit when attempting to exploit netapi in Windows XP [duplicate]

I am a beginner in hacking. I have been trying to hack Windows XP using the netapi exploit in metasploit, but every time, in the end, I get an error: Exploit failed [unreachable]: Rex::...
user avatar
3 votes
0 answers
148 views

Process Injection and Process Isolation by OS

If the OS is responsible for ensuring that one process cannot access another process memory space, and the point of process isolation is to keep processes separate from one another, then how can a ...
user avatar
0 votes
1 answer
126 views

Memory Forensics on exited process

I am new to memory forensics. When a process in Windows is ended are all artifacts for the process in memory gone? I ask because my EDR solution gives me the local process ID of a process I am ...
user avatar
1 vote
1 answer
398 views

Tricking a windows 10 computer into thinking a USB being plugged in is a mouse for code execution [closed]

Is it possible to "trick" a Windows 10 PC into thinking a flash drive is a mouse to execute code on the machine? If so, how? Note: I'm not trying to do anything malicious. All of this is ...
user avatar
3 votes
0 answers
337 views

How does local pass-the-hash (mimikatz's sekurlsa::pth) work?

Mimikatz's sekurlsa::pth documentation states: mimikatz can perform the well-known operation 'Pass-The-Hash' to run a process under another credentials with NTLM hash of the user's password, instead ...
user avatar
  • 95
0 votes
1 answer
112 views

Is it possible to identify a financial fraud on a Windows machine? How?

How do forensics identify a banking/financial fraud in a Windows system? Malware usually uses real-time TCP sockets to complete their deeds, infecting and compromising the PC it runs on (not the ...
user avatar
0 votes
1 answer
266 views

Remove all traces of files used in Veracrypt container... is this enough?

Suppose that I have a Veracrypt container on Windows 10. I unlock it, open and edit a Text document, open an image, watch a video. Then I close all files, unmount the container. Then I run CCleaner to ...
user avatar
0 votes
1 answer
215 views

How can a program remove the menu in Control-Alt-Delete (Secure desktop) in Windows?

In reference to another post about the Respondus Lockdown Browser, I was wondering how can a program edit and remove parts of the "Secure Desktop" Ctrl+Alt+Del menu in Windows, as well as ...
user avatar
0 votes
2 answers
216 views

Haven't updated my Windows 10 for more than a year

Almost a year ago, I dual-booted Windows 10 and Linux Mint. And since then, I haven't booted into my Windows 10 OS. I still remember that the Wi-Fi adapter was off when I shut my Windows 10 down. Now, ...
user avatar
0 votes
1 answer
146 views

Is it possible for a compressed file to contain malicious code?

I recently downloaded 2 compressed files (.zip and .rar) from a really unreliable and untrusted source while using a browser integrated VPN. My antivirus didn't notice anything but I am curious if it ...
user avatar
0 votes
1 answer
200 views

Can a video file contain code that shares your identity? [duplicate]

Could a video file contain code that reveals and sends your ip/mac address or give access to personal files to somebody else? Would normal video players (like VLC) be able to notice that kind of ...
user avatar
  • 1
0 votes
1 answer
2k views

RubySMB::Error::CommunicationError: Read timeout expired when reading from the Socket (timeout=30)

I've been playing around with the EternalBlue exploit recently. I've downloaded a Windows 10 iso file from 2016 and used it to set up a Windows 10 Pro VM as my sandbox. I also ran the nmap script and ...
user avatar
  • 15
9 votes
2 answers
502 views

How effective is Windows KDP for exploit mitigation in practice?

Windows Kernel Data Protection is a kernel security feature which appears to use Extended Page Tables (EPT, a hardware virtualization feature) to enforce read-only pages. How effective is this at ...
user avatar
  • 63.8k
4 votes
1 answer
243 views

Is Sleep mode safe?

If a PC has rootkit, when it goes into sleep mode, can rootkit do anything to it while it’s in state of sleeping? Meaning steal data, open programs and basically do anything. Assuming it’s not BIOS ...
user avatar
  • 41
0 votes
1 answer
440 views

Downgrade of NTLM Authentication

I have been experimenting NTLM and its different relay mitigations, including MIC and channel bindings. In my understanding: ntlm auth starts with a negotiation packet sent by the client. In this ...
user avatar
0 votes
0 answers
43 views

Could just downloading (not opening) .tgz file infect Windows 10? [duplicate]

Today I received some e-mail to Thunderbird. It had image attached that I clicked: Which sent me to onedrive.live.com/download?... and automatically downloaded .tgz file. I am not even sure if the ...
user avatar
  • 101
0 votes
1 answer
198 views

Watering Hole Website NTLM Steal Attack

I'm trying to recreate a Watering hole SMB theft attack where you send a victim a link to your website containing code like "file://ip/file.gif" Causing forced authentication which passes ...
user avatar
1 vote
1 answer
187 views

What's the point of Empire if all payloads get flagged?

I've been reading about how powerful frameworks such as Empire and Metasploit are but I'm confused about something. Say I gain access through a custom reverse-shell which I self-coded (so it bypasses ...
user avatar
  • 13
8 votes
1 answer
496 views

Is Windows+L a secure attention sequence?

Ctrl+Alt+Del is a secure attention sequence (Microsoft) (or secure attention key (Wikipedia), but it's more a Linux term). As we can read, A key sequence that begins the process of logging on or off. ...
user avatar
26 votes
5 answers
6k views

How can a non-admin program cover your entire screen with a window?

This year, since many students are online, College Board (the company that administers AP Exams in the US, along with the SAT) recently released its Digital Testing App. Once installed, and going ...
user avatar
  • 361
1 vote
1 answer
84 views

Is an outdated library in a Windows user mode desktop application an actual security risk?

I have an Windows 10 desktop application that runs in user mode only, and this application is a local tool only -- that is, it does not "talk to the internet". As an example: This ...
user avatar
  • 1,247
1 vote
0 answers
154 views

Windows X.509 certificate private keys lost

Have the same certificates installed on several machines, but this happens on only one of them. The certificates are self-signed certificates. The certificates are used for WCF message security. ...
user avatar
  • 135
2 votes
1 answer
507 views

Is docker for desktop secure for non-admins?

I manage a multi-user workstation (Windows) server for a small student organisation. One of the students asked me to install docker, as it would simplify his workflow. As this is on a shared ...
user avatar
  • 121
1 vote
1 answer
212 views

How NTLM SSO is preformed on smartcard Kerberos logon?

I have been researching kerberos and ntlm for the last couple of days and still got one thing unresolved. After an interactive logon with kerberos, you will have in the cached credentials both ...
user avatar
6 votes
2 answers
5k views

Can I use VeraCrypt with an SSD?

I recently got Windows 10, and I am not overly thrilled at Microsoft having a copy of my password on their servers. I will also be forced to make a hotmail account, instead of just using a local ...
user avatar
0 votes
0 answers
89 views

TSX xbegin in SGX enclave (Windows)

What am I doing wrong with using xbegin in the enclave? First of all, I checked tsx outside enclave - it works (I tested _xbegin() from <immintrin.h>). Then I tried to use different examples of ...
user avatar
0 votes
2 answers
366 views

Path traversal in POST request?

Does it make sense to try path traversal on the filename value during a file upload request? Should I encode special characters in the POST request? For example POST [...] ----boundary Content-...
user avatar
  • 487
1 vote
2 answers
182 views

What is a secure way to log onto the domain controller?

On a pentest we found that a kerberos ticket under account name administrator was cached on one of the SQL database servers, which allowed us to steal the ticket, pass-the-ticket and log onto the ...
user avatar
  • 475
2 votes
0 answers
4k views

How to send deauth packets on Windows (manually or with software)?

first of all I know how deauth packets work basically. But since my wifi adapter refuses to work on my virtual Kali, I want to use my host machine (Windows 10). So I have NPcap and Wireshark and I can ...
user avatar
  • 21
1 vote
0 answers
61 views

SSO - SAMLResponse security via localhost reply [duplicate]

We're currently in the process of enhancing our Windows .NET desktop application with SAML single sign-on. In order to retrieve the SAMLResponse from the IP we have the redirect/reply URL set to http:/...
user avatar
2 votes
1 answer
131 views

Risk associated with Exchange email address as username when AD authentication is enabled

In my existing setup, we have Exchange Server joined with Windows Active Directory. Both the username and email address are the same for user accounts. Our support party also recommended using this ...
user avatar
  • 25
5 votes
3 answers
967 views

Decrypt TLS 1.2 traffic between .NET Windows applications

I have attempted to decrypt traffic between two .NET applications (both on Windows platforms) using Wireshark but due to the Diffie Hellman with perfect forward secrecy, I cannot use my private key ...
user avatar
  • 161

1 2
3
4 5
43