Hot answers tagged

34

In addition to what nobody said there's a more practical, but mostly internal, requirement here. Changing a local password in Windows without knowing the original password is called a reset. Resets cause DPAPI keys to be invalidated (because they're protected by a primary secret based on the user password). Once the reset happens those original keys are dead ...


13

Changing the password from command line requires an elevated command prompt (i.e. administrative privileges). Normal users cannot do this. This makes sense since the admin should be able to change the password of any user. If, however, you have left your computer logged in as an admin user then having your password reset by the intruder would be the least of ...


3

You're using OpenSSL incorrectly. The obsolete -k parameter specifies a password, not a key file. This password (literally "key.txt" in this case) is then run through a key derivation function (PBKDF2, per your command line). However, if you're providing a key already, (as opposed to a password), you don't need (and shouldn't use) a slow key-derivation ...


2

certutil is a built-in program in Windows used to manage certificates. The above command would be decoding the certificate present in the file and install malware. An article illustrating how this could be used.


2

Basically windows/shell/reverse_tcp will give you a reverse shell->basically command prompt. and windows/meterpreter/reverse_tcp this will will you a reverse meterpreter session.A meterpreter session contains more than just a shell such as screenshot commands/Webcam grab.Things like that cannot be done from pure command execution. Also.Instead of just ...


2

So, I've had the same problem all day and i've been trying to find out how to remove whats happening. I logged into a spare account that I previously made that had Administrator Privileges and I got into safe mode. By the looks of it, in safe mode the latest version of Malwarebytes (Version 3.8.3 Free) picked the virus up. This has allowed me to log into my ...


2

Since it's not detected by antivirus software: https://www.virustotal.com/#/file/27e26e77578466a1f93f1a33332893393e176960a5f9fd4295d4515d473a0195/detectionthe The script runs the command shutdown -s -t 0, this is the usual command to shut down the computer after 0 seconds. In order to remove, remove the following if found: User Startup: ` C:\Users\(...


2

Worst case. Strictly speaking, a machine where someone got to run something you don't know - whatever it actually did - is to be treated as "compromised", i.e., all accounts on it have to have their password changed, the data saved to backup before reformatting the machine, reinstalling the OS and restoring the documents - if you're really paranoid, the ...


1

It seems like it first deleted some visual basic scripts in the directory it was executed in, the scripts had this kind of name: YOUR_USERNAME.vbs Then it downloaded an executable from this website https://coid.xyz/ which has a name like this: icarian_[x86 OR x64].exe and saved it on you computer as: YOUR_USERNAME.exe The website had the default Apache ...


Only top voted, non community-wiki answers of a minimum length are eligible